On Mon, 2010-03-08 at 18:47 +0200, John Kougoulos wrote: > On Mon, 8 Mar 2010, Peter Rathlev wrote: > > crypto isakmp profile Crypto-Profile-TEST > > vrf INSIDE-VRF > > keyring Crypto-Keyring-TEST > > match identity address 172.16.0.1 255.255.255.255 OUTSIDE-VRF > > initiate mode aggressive > > ! > > not sure, but maybe you should put this profile in vrf OUTSIDE-VRF ?
That's a little embarrasing. I was certain that it was supposed to be the inside VRF, cf. http://www.cisco.com/en/US/docs/ios/sec_secure_connectivity/configuration/guide/sec_vrf_aware_ipsec_ps6350_TSD_Products_Configuration_Guide_Chapter.html#wp1054317 I had actually started backtracking, simplifying the configuration as much as possible. I was down to one physical interface in the outside VRF and one physical interface in the inside VRF, and it still didn't work. I the tried changing the ISAKMP profile VRF, et voila, it worked. :-) I have reloaded the box to make sure it's not just good luck that it works now. It seems to work fine after a reload, with MPLS on the core facing interfaces. In the mean time I found this article: http://blog.ioshints.info/2009/09/encrypting-p-to-p-router-traffic.html _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
