I changed the IOS in GNS3 and it worked great . I can see the following result
in R3 .
Rack1R3#sh ip routeGateway of last resort is not set
136.1.0.0/24 is subnetted, 5 subnetsS 136.1.11.0 [1/0] via 0.0.0.0,
Virtual-Access2C 136.1.23.0 is directly connected, Serial0/0C
136.1.100.0 is directly connected, FastEthernet0/1R 136.1.121.0 [120/1]
via 136.1.123.12, 00:00:25, FastEthernet0/0C 136.1.123.0 is directly
connected, FastEthernet0/0 20.0.0.0/32 is subnetted, 1 subnetsS
20.0.0.1 [1/0] via 0.0.0.0, Virtual-Access2 10.0.0.0/24 is subnetted, 1
subnetsR 10.0.0.0 [120/1] via 136.1.23.2, 00:00:27, Serial0/0
150.1.0.0/24 is subnetted, 1 subnetsC 150.1.3.0 is directly connected,
Loopback0
The route through virtual-access2 tells that it is connected using DVTI . Right
?
Thanks .
From: [email protected]
To: [email protected]
Date: Tue, 11 Oct 2011 14:35:52 +0500
CC: [email protected]
Subject: Re: [OSL | CCIE_Security] EzVPN and VTI
THere is no NAT on ASA . Yes I am using GNS3 . Are you sure the config is OK ?
Date: Tue, 11 Oct 2011 15:02:38 +0530
Subject: Re: [OSL | CCIE_Security] EzVPN and VTI
From: [email protected]
To: [email protected]
CC: [email protected]
The issue is in IPSec Phase 2.
*Mar 1 07:54:30.054: ISAKMP:(1074): phase 2 SA policy not acceptable! (local
136.1.123.3 remote 136.1.121.1)
*Mar 1 07:54:30.054: ISAKMP: set new node -133501578 to QM_IDLE
Possible reasons are transform set or Proxy IDs doesn't match. But with EzVPN,
those are not relevant.
The other reason would be ISAKMP profile. If the ISAKMP profile fails to match
the identity, we could see this message.
Are you using GNS? Is the ASA doing NAT?
With regards
Kings
On Tue, Oct 11, 2011 at 1:17 PM, Hussain Arsalan Ali <[email protected]> wrote:
I tried doing it again in office and I can see the HTTP page on client machine
. When I type in the pass it times out after sometime . I am attaching a debug
file on R3 ( Server ) .
Can you tell me if the configuration done by me is correct ? I was thinking if
the crypto ipsec client ezvpn IT outside should be on the physical interface ot
the virtual-template interface I made on the CLient router .
Date: Tue, 11 Oct 2011 11:41:36 +0530
Subject: Re: [OSL | CCIE_Security] EzVPN and VTI
From: [email protected]
To: [email protected]
CC: [email protected]
What is the issue? Is the tunnel coming up?
With regards
Kings
On Mon, Oct 10, 2011 at 11:28 PM, Hussain Arsalan Ali <[email protected]> wrote:
I am configuring EzVPN using VTI . R1 is Client while R3 is Server . There is
ASA in between which has allow any any statement there . It is working fine
with Network Extension Mode ( without VTI ) but when I switched to VTI i cant
bring things up . There is no isakmp debug messages on router . Attached is
config .
ALI
_______________________________________________
For more information regarding industry leading CCIE Lab training, please visit
www.ipexpert.com
Are you a CCNP or CCIE and looking for a job? Check out
www.PlatinumPlacement.com
_______________________________________________
For more information regarding industry leading CCIE Lab training, please visit
www.ipexpert.com
Are you a CCNP or CCIE and looking for a job? Check out
www.PlatinumPlacement.com _______________________________________________
For more information regarding industry leading CCIE Lab training, please visit
www.ipexpert.com
Are you a CCNP or CCIE and looking for a job? Check out
www.PlatinumPlacement.com
