I am simulating a vrf-aware IPSEC VPN Concentrator with multiple dynamic peers on GNS.
I have two client profiles on the 7200 concentrator. I can have both clients working. But I noticed when doing a restart of all the session, one of the client will stop working. I'm getting an error of: *Feb 18 20:58:27.811: %CRYPTO-4-IKMP_BAD_MESSAGE: IKE message from 172.16.1.2 failed its sanity check or is malformed which means preshare keys do not match. But i am very sure they are accurate and match. I have to re-create the whole profile so it will work again (keyring, dynamic profile, dynamic-map). I am not sure if this is just a GNS problem or config itself. Below is my config for the 7200 VPN concentrator. I hope someone can share their ideas. thanks Client 1 is ABC Clilent 2 is XYZ ip vrf A rd 1:1 route-target export 1:1 route-target import 1:1 ! ip vrf B rd 2:2 route-target export 2:2 route-target import 2:2 ! ! ! crypto keyring VRF-B pre-shared-key address 0.0.0.0 0.0.0.0 key XYZ crypto keyring VRF-A pre-shared-key address 0.0.0.0 0.0.0.0 key ABC ! crypto isakmp policy 1 encr 3des authentication pre-share group 2 crypto isakmp profile XYZ vrf B keyring VRF-B match identity address 0.0.0.0 crypto isakmp profile ABC vrf A keyring VRF-A match identity address 0.0.0.0 ! ! crypto ipsec transform-set vpn esp-3des esp-sha-hmac ! crypto dynamic-map ABC 10 set transform-set vpn set isakmp-profile ABC match address ABC-remote ! crypto dynamic-map XYZ 10 set transform-set vpn set isakmp-profile XYZ match address XYZ-remote ! ! crypto map VPN 11 ipsec-isakmp dynamic XYZ crypto map VPN 12 ipsec-isakmp dynamic ABC ip access-list extended ABC-remote permit ip 10.1.0.0 0.0.255.255 10.2.0.0 0.0.255.255 ip access-list extended XYZ-remote permit ip 10.1.0.0 0.0.255.255 10.2.0.0 0.0.255.255 ip route vrf A 10.0.0.0 255.0.0.0 172.16.1.2 global ip route vrf B 10.2.0.0 255.255.0.0 172.16.1.3 global interface FastEthernet1/0 description WAN-to-Internet ip address 172.16.1.1 255.255.255.0 duplex full speed 100 crypto map VPN interface Loopback10 ip vrf forwarding A ip address 10.1.1.1 255.255.255.0 ! interface Loopback20 ip vrf forwarding B ip address 10.1.1.1 255.255.255.0 _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
