This happens when the encryption is different.check the crypto parameters.
Sent from my iPhone On Feb 27, 2008, at 2:39 PM, Peter Rathlev <[EMAIL PROTECTED]> wrote: > Hi Matthew, > > I'm not sure about the logged message, but I've seen the > "TP-self-signed" certificates when I enable "ip http secure-server" > and > IOS generates a certificate for this. If you don't use the > certificates > you can could just remove them and see if that helps. > > I couldn't figure out from your mail whether the VPN succeeds. Is that > message the only thing it says from a debug? I'm not very familiar > with > VTI, having only used IPSec/GRE, but does a "debug crypto isakmp" > gives > you any meaningful information? > > Regards, > Peter > > > On Wed, 2008-02-27 at 08:44 -0800, matthew zeier wrote: >> Trying to setup a VTI IPSEC VPN between a 3845 and an 1841. The 3845 >> has a couple vpns already up and working, one of which is a VTI to >> a 2800. >> >> The log just spits out: >> >> >> CRYPTO-3-IKMP_QUERY_KEY : Querying key pair failed. >> >> Cisco says - >> >> Explanation: A public key or private key query attempt that used a >> subject name has failed. >> >> Recommended Action: Check the subject name in the certificate. >> >> I'm not sure what cert it's talking about or how to fix that. The >> 1841 >> does have >> >> crypto pki trustpoint TP-self-signed-2501804736 >> enrollment selfsigned >> subject-name cn=IOS-Self-Signed-Certificate-2501804736 >> revocation-check none >> rsakeypair TP-self-signed-2501804736 >> >> crypto pki certificate chain TP-self-signed-2501804736 >> ... >> >> Neither of those exist on any of my other routers and I'm not >> familiar >> with them. >> >> Any clues? >> _______________________________________________ >> cisco-nsp mailing list [email protected] >> https://puck.nether.net/mailman/listinfo/cisco-nsp >> archive at http://puck.nether.net/pipermail/cisco-nsp/ > > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
