ISR2900#show running-config
Building configuration…
Current configuration : 5150 bytes ! ! Last configuration change at 10:16:27 UTC Thu Jul 18 2019 ! version 15.7 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname ISR2900 ! boot-start-marker boot system flash0:c2900-universalk9-mz.SPA.157-3.M4a.bin boot-end-marker ! ! enable password cisco ! aaa new-model ! ! aaa authentication login AUTH local aaa authorization network NET local ! ! ! ! ! ! aaa session-id common ! ! ! ! ! ! ! ! ! ! ! ! no ip domain lookup ip cef no ipv6 cef ! multilink bundle-name authenticated ! ! ! ! license udi pid CISCO2921/K9 sn FGL17101054 ! ! username cisco privilege 15 password 0 cisco ! redundancy ! crypto ikev2 proposal PROP encryption aes-cbc-128 integrity sha256 group 2 ! crypto ikev2 policy ikev2policy proposal PROP ! crypto ikev2 keyring KEYRING peer ALL address 0.0.0.0 0.0.0.0 pre-shared-key local cisco123 pre-shared-key remote cisco123 ! ! ! crypto ikev2 profile ikev2_profile] match identity remote address 192.168.1.100 255.255.255.0 identity local address 192.168.1.102 authentication remote pre-share authentication local pre-share keyring local KEYRING ! crypto ikev2 profile IKEv2_Profile match identity remote address 192.168.1.100 255.255.255.0 identity local address 192.168.1.102 authentication remote pre-share authentication local pre-share keyring local KEYRING ! ! ! ! ! crypto isakmp policy 1 encr aes hash md5 authentication pre-share group 2 ! crypto isakmp policy 5 encr 3des authentication pre-share group 5 ! crypto isakmp policy 10 lifetime 120 crypto isakmp key cisco123 address 192.168.1.210 crypto isakmp key cisco123 address 192.168.1.100 ! crypto isakmp client configuration group RA key cisco domain cisco.com pool POOL acl VPN-TRAFFIC save-password netmask 255.255.255.0 ! crypto isakmp peer address 192.168.1.210 set aggressive-mode password cisco123 set aggressive-mode client-endpoint ipv4-address 192.168.1.130 crypto isakmp profile test match identity group RA client authentication list AUTH isakmp authorization list NET client configuration address respond client configuration group RA virtual-template 1 ! ! crypto ipsec transform-set MY-SET esp-aes esp-md5-hmac mode tunnel crypto ipsec transform-set ISR esp-3des esp-sha384-hmac mode tunnel crypto ipsec transform-set myset esp-3des esp-sha-hmac mode tunnel crypto ipsec transform-set test esp-3des esp-sha-hmac mode tunnel ! ! crypto ipsec profile ipsecprof set security-association lifetime kilobytes disable set transform-set test set isakmp-profile test ! ! crypto map CM 10 ipsec-isakmp set peer 192.168.1.100 set transform-set ISR set ikev2-profile IKEv2_Profile match address VPN-TRAFFIC ! crypto map IPSEC-SITE-TO-SITE 10 ipsec-isakmp set peer 192.168.1.100 set transform-set ISR set pfs group2 match address VPN-TRAFFIC ! crypto map IPSEC-SITE-TO-SITE-VPN 10 ipsec-isakmp set peer 192.168.1.210 set transform-set MY-SET set pfs group2 match address VPN-TRAFFIC ! crypto map ISR 1 ipsec-isakmp ! Incomplete ! crypto map MC 10 ipsec-isakmp set peer 192.168.1.0 set peer 192.168.1.100 set transform-set ISR set ikev2-profile ikev2_profile] match address ISR_VPN ! ! ! ! ! interface Loopback1 ip address 11.11.11.11 255.255.255.0 ! interface Loopback2 ip address 12.12.12.12 255.255.255.0 ! interface Loopback3 ip address 13.13.13.13 255.255.255.0 ! interface Embedded-Service-Engine0/0 no ip address shutdown ! interface GigabitEthernet0/0 ip address 192.168.1.130 255.255.255.0 duplex auto speed auto ! interface GigabitEthernet0/1 ip address 172.16.1.10 255.255.255.0 duplex auto speed auto ! interface GigabitEthernet0/2 ip address 192.168.2.102 255.255.255.0 duplex auto speed auto crypto map IPSEC-SITE-TO-SITE ! interface Virtual-Template1 type tunnel ip unnumbered GigabitEthernet0/0 tunnel source GigabitEthernet0/0 tunnel mode ipsec ipv4 tunnel protection ipsec profile ipsecprof ! router rip version 2 network 0.0.0.0 no auto-summary ! ip local pool POOL 10.1.0.0 10.1.0.255 ip forward-protocol nd ! no ip http server no ip http secure-server ! ip nat inside source list 101 interface GigabitEthernet0/0 overload ip route 192.168.0.0 255.255.255.0 192.168.1.210 ip route 192.168.0.0 255.255.255.0 192.168.1.100 ip route 192.168.1.0 255.255.255.0 192.168.1.210 ! ip access-list extended ISR ip access-list extended ISR_VPN permit ip 192.168.2.0 0.0.0.255 192.168.0.0 0.0.0.255 ip access-list extended VPN-TRAFFIC permit ip 172.16.1.0 0.0.0.255 192.168.0.0 0.0.0.255 permit ip 11.11.11.0 0.0.0.255 192.168.0.0 0.0.0.255 permit ip 12.12.12.0 0.0.0.255 192.168.0.0 0.0.0.255 permit ip 13.13.13.0 0.0.0.255 192.168.0.0 0.0.0.255 permit ip 192.168.2.0 0.0.0.255 192.168.0.0 0.0.0.255 ip access-list extended split ! ! ! access-list 101 permit ip any any ! ! ! control-plane ! ! line con 0 line aux 0 line 2 no activation-character no exec transport preferred none transport output pad telnet rlogin lapb-ta mop udptn v120 ssh stopbits 1 line vty 0 4 password cisco transport input telnet ssh ! scheduler allocate 20000 1000 ! end
Crypto Engine debugging is on
*Jul 18 10:17:00.458: ISAKMP-PAK: (0):received packet from 192.168.1.210 dport 500 sport 500 Global (N) NEW SA
*Jul 18 10:17:00.458: ISAKMP: (0):Created a peer struct for 192.168.1.210, peer port 500
*Jul 18 10:17:00.458: ISAKMP: (0):New peer created peer = 0xC0F779D8 peer_handle = 0x8000001E
*Jul 18 10:17:00.458: ISAKMP: (0):Locking peer struct 0xC0F779D8, refcount 1 for crypto_isakmp_process_block
*Jul 18 10:17:00.458: ISAKMP: (0):local port 500, remote port 500
*Jul 18 10:17:00.458: ISAKMP: (0):insert sa successfully sa = 3E24764C
*Jul 18 10:17:00.458: ISAKMP: (0):processing SA payload. message ID = 0
*Jul 18 10:17:00.458: ISAKMP: (0):processing ID payload. message ID = 0
*Jul 18 10:17:00.458: ISAKMP: (0):ID payload
next-payload : 13
type : 2
*Jul 18 10:17:00.458: ISAKMP: (0): FQDN name : RA
*Jul 18 10:17:00.458: ISAKMP: (0): protocol : 0
port : 0
length : 10
*Jul 18 10:17:00.458: ISAKMP: (0):peer matches test profile
*Jul 18 10:17:00.458: ISAKMP: (0):Setting client config settings 2203DCF0
*Jul 18 10:17:00.458: ISAKMP: (0):(Re)Setting client xauth list and state
*Jul 18 10:17:00.458: ISAKMP: (0):xauth- initializing AAA request
*Jul 18 10:17:00.458: ISAKMP: (0): Profile test assigned peer the group named RA
*Jul 18 10:17:00.458: ISAKMP: (0):processing vendor id payload
*Jul 18 10:17:00.458: ISAKMP: (0):vendor ID seems Unity/DPD but major 215 mismatch
*Jul 18 10:17:00.458: ISAKMP: (0):vendor ID is XAUTH
*Jul 18 10:17:00.458: ISAKMP: (0):processing vendor id payload
*Jul 18 10:17:00.458: ISAKMP: (0):vendor ID is DPD
*Jul 18 10:17:00.458: ISAKMP: (0):processing vendor id payload
*Jul 18 10:17:00.458: ISAKMP: (0):vendor ID is Unity
*Jul 18 10:17:00.458: ISAKMP: (0):SA using tunnel password as pre-shared key.
*Jul 18 10:17:00.458: ISAKMP: (0):local preshared key found
*Jul 18 10:17:00.458: ISAKMP: (0):Authentication by xauth preshared
*Jul 18 10:17:00.458: ISAKMP: (0):Checking ISAKMP transform 1 against priority 1 policy
*Jul 18 10:17:00.458: ISAKMP: (0): encryption AES-CBC
*Jul 18 10:17:00.458: ISAKMP: (0): keylength of 128
*Jul 18 10:17:00.458: ISAKMP: (0): hash MD5
*Jul 18 10:17:00.458: ISAKMP: (0): default group 2
*Jul 18 10:17:00.458: ISAKMP: (0): auth XAUTHInitPreShared
*Jul 18 10:17:00.458: ISAKMP: (0): life type in seconds
*Jul 18 10:17:00.458: ISAKMP: (0): life duration (basic) of 10800
*Jul 18 10:17:00.458: ISAKMP: (0):atts are acceptable. Next payload is 0
*Jul 18 10:17:00.458: ISAKMP: (0):Acceptable atts:actual life: 86400
*Jul 18 10:17:00.458: ISAKMP: (0):Acceptable atts:life: 0
*Jul 18 10:17:00.458: ISAKMP: (0):Basic life_in_seconds:10800
*Jul 18 10:17:00.458: ISAKMP: (0):Returning Actual lifetime: 10800
*Jul 18 10:17:00.458: ISAKMP: (0):Started lifetime timer: 10800.
*Jul 18 10:17:00.458: ISAKMP: (0):processing KE payload. message ID = 0
*Jul 18 10:17:00.458: crypto_engine: Create DH shared secret
*Jul 18 10:17:00.482: ISAKMP: (0):processing NONCE payload. message ID = 0
*Jul 18 10:17:00.482: ISAKMP: (0):SA using tunnel password as pre-shared key.
*Jul 18 10:17:00.482: crypto_engine: Create IKE SA
*Jul 18 10:17:00.482: crypto engine: deleting DH phase 2 SW:50
*Jul 18 10:17:00.482: crypto_engine: Delete DH shared secret
*Jul 18 10:17:00.482: ISAKMP: (1026):vendor ID is NAT-T RFC 3947
*Jul 18 10:17:00.482: ISAKMP: (1026):vendor ID is NAT-T v2
*Jul 18 10:17:00.482: ISAKMP: (1026):constructed NAT-T vendor-rfc3947 ID
*Jul 18 10:17:00.482: ISAKMP: (1026):SA is doing
*Jul 18 10:17:00.482: ISAKMP: (1026):pre-shared key authentication plus XAUTH using id type ID_IPV4_ADDR
*Jul 18 10:17:00.482: ISAKMP: (1026):ID payload
next-payload : 10
type : 1
*Jul 18 10:17:00.482: ISAKMP: (1026): address : 192.168.1.130
*Jul 18 10:17:00.482: ISAKMP: (1026): protocol : 0
port : 0
length : 12
*Jul 18 10:17:00.482: ISAKMP: (1026):Total payload length: 12
*Jul 18 10:17:00.482: crypto_engine: Generate IKE hash
*Jul 18 10:17:00.482: ISAKMP-PAK: (1026):sending packet to 192.168.1.210 my_port 500 peer_port 500 (R) AG_INIT_EXCH
*Jul 18 10:17:00.482: ISAKMP: (1026):Sending an IKE IPv4 Packet.
*Jul 18 10:17:00.482: ISAKMP: (1026):Input = IKE_MESG_FROM_PEER, IKE_AM_EXCH
*Jul 18 10:17:00.482: ISAKMP: (1026):Old State = IKE_READY New State = IKE_R_AM2
*Jul 18 10:17:00.522: ISAKMP-PAK: (1026):received packet from 192.168.1.210 dport 4500 sport 4500 Global (R) AG_INIT_EXCH
*Jul 18 10:17:00.522: crypto_engine: Decrypt IKE packet
*Jul 18 10:17:00.522: ISAKMP: (1026):processing HASH payload. message ID = 0
*Jul 18 10:17:00.522: crypto_engine: Generate IKE hash
*Jul 18 10:17:00.522: ISAKMP: (1026):received payload type 20
*Jul 18 10:17:00.522: ISAKMP: (1026):His hash no match - this node outside NAT
*Jul 18 10:17:00.522: ISAKMP: (1026):received payload type 20
*Jul 18 10:17:00.522: ISAKMP: (1026):His hash no match - this node outside NAT
*Jul 18 10:17:00.522: ISAKMP: (1026):SA authentication status:
authenticated
*Jul 18 10:17:00.522: ISAKMP: (1026):SA has been authenticated with 192.168.1.210
*Jul 18 10:17:00.522: ISAKMP: (1026):Detected port,floating to port = 4500
*Jul 18 10:17:00.522: ISAKMP: (0):Trying to insert a peer 192.168.1.130/192.168.1.210/4500/,
*Jul 18 10:17:00.522: ISAKMP: (0): and inserted successfully C0F779D8.
*Jul 18 10:17:00.526: ISAKMP: (1026):Input = IKE_MESG_FROM_PEER, IKE_AM_EXCH
*Jul 18 10:17:00.526: ISAKMP: (1026):Old State = IKE_R_AM2 New State = IKE_P1_COMPLETE
*Jul 18 10:17:00.526: ISAKMP: (1026):Need XAUTH
*Jul 18 10:17:00.526: ISAKMP: (1026):set new node -1646091979 to CONF_XAUTH
*Jul 18 10:17:00.526: ISAKMP: (1026):xauth- request attribute XAUTH_USER_NAME_V2
*Jul 18 10:17:00.526: ISAKMP: (1026):xauth- request attribute XAUTH_USER_PASSWORD_V2
*Jul 18 10:17:00.526: crypto_engine: Generate IKE hash
*Jul 18 10:17:00.526: ISAKMP: (1026):initiating peer config to 192.168.1.210. ID = 2648875317
*Jul 18 10:17:00.526: crypto_engine: Encrypt IKE packet
*Jul 18 10:17:00.526: ISAKMP-PAK: (1026):sending packet to 192.168.1.210 my_port 4500 peer_port 4500 (R) CONF_XAUTH
*Jul 18 10:17:00.526: ISAKMP: (1026):Sending an IKE IPv4 Packet.
*Jul 18 10:17:00.526: ISAKMP: (1026):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
*Jul 18 10:17:00.526: ISAKMP: (1026):Old State = IKE_P1_COMPLETE New State = IKE_XAUTH_REQ_SENT
*Jul 18 10:17:00.530: ISAKMP-PAK: (1026):received packet from 192.168.1.210 dport 4500 sport 4500 Global (R) CONF_XAUTH
*Jul 18 10:17:00.530: crypto_engine: Decrypt IKE packet
*Jul 18 10:17:00.530: ISAKMP: (1026):processing transaction payload from 192.168.1.210. message ID = -1646091979
*Jul 18 10:17:00.530: crypto_engine: Generate IKE hash
*Jul 18 10:17:00.530: ISAKMP: (1026):Config payload REPLY
*Jul 18 10:17:00.530: ISAKMP: (1026):xauth-reply attribute XAUTH_USER_NAME_V2
*Jul 18 10:17:00.530: ISAKMP: (1026):xauth-reply attribute XAUTH_USER_PASSWORD_V2
*Jul 18 10:17:00.530: ISAKMP: (1026):deleting node -1646091979 error FALSE reason "Done with xauth request/reply exchange"
*Jul 18 10:17:00.530: ISAKMP: (1026):Input = IKE_MESG_FROM_PEER, IKE_CFG_REPLY
*Jul 18 10:17:00.530: ISAKMP: (1026):Old State = IKE_XAUTH_REQ_SENT New State = IKE_XAUTH_AAA_CONT_LOGIN_AWAIT
*Jul 18 10:17:00.530: ISAKMP: (1026):set new node 1104102926 to CONF_XAUTH
*Jul 18 10:17:00.530: crypto_engine: Generate IKE hash
*Jul 18 10:17:00.530: ISAKMP: (1026):initiating peer config to 192.168.1.210. ID = 1104102926
*Jul 18 10:17:00.530: crypto_engine: Encrypt IKE packet
*Jul 18 10:17:00.530: ISAKMP-PAK: (1026):sending packet to 192.168.1.210 my_port 4500 peer_port 4500 (R) CONF_XAUTH
*Jul 18 10:17:00.530: ISAKMP: (1026):Sending an IKE IPv4 Packet.
*Jul 18 10:17:00.530: ISAKMP: (1026):Input = IKE_MESG_FROM_AAA, IKE_AAA_CONT_LOGIN
*Jul 18 10:17:00.530: ISAKMP: (1026):Old State = IKE_XAUTH_AAA_CONT_LOGIN_AWAIT New State = IKE_XAUTH_SET_SENT
*Jul 18 10:17:00.534: ISAKMP-PAK: (1026):received packet from 192.168.1.210 dport 4500 sport 4500 Global (R) CONF_XAUTH
*Jul 18 10:17:00.534: crypto_engine: Decrypt IKE packet
*Jul 18 10:17:00.534: ISAKMP: (1026):processing transaction payload from 192.168.1.210. message ID = 1104102926
*Jul 18 10:17:00.534: crypto_engine: Generate IKE hash
*Jul 18 10:17:00.534: ISAKMP: (1026):Config payload ACK
*Jul 18 10:17:00.534: ISAKMP: (1026): XAUTH ACK Processed
*Jul 18 10:17:00.534: ISAKMP: (1026):deleting node 1104102926 error FALSE reason "Transaction mode done"
*Jul 18 10:17:00.534: ISAKMP: (1026):Talking to a Unity Client
*Jul 18 10:17:00.534: ISAKMP: (1026):Input = IKE_MESG_FROM_PEER, IKE_CFG_ACK
*Jul 18 10:17:00.534: ISAKMP: (1026):Old State = IKE_XAUTH_SET_SENT New State = IKE_P1_COMPLETE
*Jul 18 10:17:00.534: ISAKMP: (1026):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
*Jul 18 10:17:00.534: ISAKMP: (1026):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE
*Jul 18 10:17:00.534: IPSEC(key_engine): got a queue event with 1 KMI message(s)
*Jul 18 10:17:00.534: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access1, changed state to down
*Jul 18 10:17:00.534: ISAKMP-PAK: (1026):received packet from 192.168.1.210 dport 4500 sport 4500 Global (R) QM_IDLE
*Jul 18 10:17:00.534: ISAKMP: (1026):set new node -1920751661 to QM_IDLE
*Jul 18 10:17:00.538: crypto_engine: Decrypt IKE packet
*Jul 18 10:17:00.542: ISAKMP: (1026):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
*Jul 18 10:17:00.542: ISAKMP: (1026):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE
*Jul 18 10:17:00.542: ISAKMP: (1026):Virtual-Access1 is created
*Jul 18 10:17:00.542: ISAKMP: (1026):src 192.168.1.210 dst 192.168.1.130
*Jul 18 10:17:00.546: ISAKMP: (1026):processing saved QM.
*Jul 18 10:17:00.546: crypto_engine: Generate IKE hash
*Jul 18 10:17:00.546: ISAKMP: (1026):processing HASH payload. message ID = 2374215635
*Jul 18 10:17:00.546: ISAKMP: (1026):processing SA payload. message ID = 2374215635
*Jul 18 10:17:00.546: ISAKMP: (1026):Checking IPSec proposal 0
*Jul 18 10:17:00.546: ISAKMP: (1026):transform 1, ESP_3DES
*Jul 18 10:17:00.546: ISAKMP: (1026): attributes in transform:
*Jul 18 10:17:00.546: ISAKMP: (1026): authenticator is HMAC-SHA
*Jul 18 10:17:00.546: ISAKMP: (1026): encaps is 3 (Tunnel-UDP)
*Jul 18 10:17:00.546: ISAKMP: (1026): SA life type in seconds
*Jul 18 10:17:00.546: ISAKMP: SA life duration (VPI) of 0x0 0x1 0x51 0x80
*Jul 18 10:17:00.546: ISAKMP: (1026):atts are acceptable.
*Jul 18 10:17:00.546: IPSEC(validate_proposal_request): proposal part #1
*Jul 18 10:17:00.546: IPSEC(validate_proposal_request): proposal part #1,
(key eng. msg.) INBOUND local= 192.168.1.130:0, remote= 192.168.1.210:0,
local_proxy= 172.16.1.0/255.255.255.0/256/0,
remote_proxy= 192.168.0.0/255.255.255.0/256/0,
protocol= ESP, transform= esp-3des esp-sha-hmac (Tunnel-UDP),
lifedur= 0s and 0kb,
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x0
*Jul 18 10:17:00.546: insert of map into mapdb AVL failed, map + ace pair already exists on the mapdb
*Jul 18 10:17:00.546: Crypto mapdb : proxy_match
src addr : 172.16.1.0
dst addr : 192.168.0.0
protocol : 0
src port : 0
dst port : 0
*Jul 18 10:17:00.546: (ipsec_process_proposal)Map Accepted: Virtual-Access1-head-0, 65537
*Jul 18 10:17:00.546: ISAKMP: (1026):processing NONCE payload. message ID = 2374215635
*Jul 18 10:17:00.546: ISAKMP: (1026):processing ID payload. message ID = 2374215635
*Jul 18 10:17:00.546: ISAKMP: (1026):processing ID payload. message ID = 2374215635
*Jul 18 10:17:00.546: ISAKMP: (1026):QM Responder gets spi
*Jul 18 10:17:00.546: ISAKMP: (1026):Node 2374215635, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
*Jul 18 10:17:00.546: ISAKMP: (1026):Old State = IKE_QM_READY New State = IKE_QM_SPI_STARVE
*Jul 18 10:17:00.546: crypto_engine: Generate IKE hash
*Jul 18 10:17:00.546: ISAKMP: (1026):Node 2374215635, Input = IKE_MESG_INTERNAL, IKE_GOT_SPI
*Jul 18 10:17:00.546: ISAKMP: (1026):Old State = IKE_QM_SPI_STARVE New State = IKE_QM_IPSEC_INSTALL_AWAIT
*Jul 18 10:17:00.546: ISAKMP: (1026):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
*Jul 18 10:17:00.546: ISAKMP: (1026):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE
*Jul 18 10:17:00.546: IPSEC: Expand action denied, discard or forward packet.
*Jul 18 10:17:00.546: IPSEC: Expand action denied, notify RP
*Jul 18 10:17:00.546: IPSEC: Expand action denied, discard or forward packet.
*Jul 18 10:17:00.546: IPSEC: Expand action denied, discard or forward packet.
*Jul 18 10:17:00.546: IPSEC(key_engine): got a queue event with 1 KMI message(s)
*Jul 18 10:17:00.546: Crypto mapdb : proxy_match
src addr : 172.16.1.0
dst addr : 192.168.0.0
protocol : 256
src port : 0
dst port : 0
*Jul 18 10:17:00.546: IPSEC(crypto_ipsec_create_ipsec_sas): Map found Virtual-Access1-head-0, 65537
*Jul 18 10:17:00.546: IPSEC(recalculate_mtu): reset sadb_root C0EFEF7C mtu to 1500
*Jul 18 10:17:00.546: IPSEC(crypto_ipsec_sa_find_ident_head): reconnecting with the same proxies and peer 192.168.1.210
*Jul 18 10:17:00.546: crypto_engine: Generate IKE QM keys
*Jul 18 10:17:00.546: crypto_engine: Create IPSec SA (by keys)
*Jul 18 10:17:00.546: crypto_engine: Generate IKE QM keys
*Jul 18 10:17:00.546: crypto_engine: Create IPSec SA (by keys)
*Jul 18 10:17:00.546: IPSEC(get_old_outbound_sa_for_peer): No outbound SA found for peer C0CAA44C
*Jul 18 10:17:00.546: IPSEC(create_sa): sa created,
(sa) sa_dest= 192.168.1.130, sa_proto= 50,
sa_spi= 0x9D67B2CE(2640818894),
sa_trans= esp-3des esp-sha-hmac , sa_conn_id= 2027
sa_lifetime(k/sec)= (0/3600),
(identity) local= 192.168.1.130:0, remote= 192.168.1.210:0,
local_proxy= 172.16.1.0/255.255.255.0/256/0,
remote_proxy= 192.168.0.0/255.255.255.0/256/0
*Jul 18 10:17:00.546: IPSEC(create_sa): sa created,
(sa) sa_dest= 192.168.1.210, sa_proto= 50,
sa_spi= 0xC74254CF(3343013071),
sa_trans= esp-3des esp-sha-hmac , sa_conn_id= 2028
sa_lifetime(k/sec)= (0/3600),
(identity) local= 192.168.1.130:0, remote= 192.168.1.210:0,
local_proxy= 172.16.1.0/255.255.255.0/256/0,
remote_proxy= 192.168.0.0/255.255.255.0/256/0
*Jul 18 10:17:00.546: ISAKMP-ERROR: (0):Failed to find peer index node to update peer_info_list
*Jul 18 10:17:00.550: IPSEC(rte_mgr): VPN Route Event Install new outbound sa: Create IPV4 route from ACL for 192.168.1.210
*Jul 18 10:17:00.550: IPSEC(rte_mgr): VPN Route Refcount 1 Virtual-Access1
*Jul 18 10:17:00.550: IPSEC(rte_mgr): VPN Route Added 192.168.0.0 255.255.255.0 via Virtual-Access1 in IP DEFAULT TABLE with tag 0 distance 1
*Jul 18 10:17:00.550: ISAKMP: (1026):Received IPSec Install callback... proceeding with the negotiation
*Jul 18 10:17:00.550: ISAKMP: (1026):Successfully installed IPSEC SA (SPI:0x9D67B2CE) on Virtual-Access1
*Jul 18 10:17:00.550: crypto_engine: Encrypt IKE packet
*Jul 18 10:17:00.550: ISAKMP-PAK: (1026):sending packet to 192.168.1.210 my_port 4500 peer_port 4500 (R) QM_IDLE
*Jul 18 10:17:00.550: ISAKMP: (1026):Sending an IKE IPv4 Packet.
*Jul 18 10:17:00.550: ISAKMP: (1026):Node 2374215635, Input = IKE_MESG_FROM_IPSEC, IPSEC_INSTALL_DONE
*Jul 18 10:17:00.550: ISAKMP: (1026):Old State = IKE_QM_IPSEC_INSTALL_AWAIT New State = IKE_QM_R_QM2
*Jul 18 10:17:00.554: ISAKMP-PAK: (1026):received packet from 192.168.1.210 dport 4500 sport 4500 Global (R) QM_IDLE
*Jul 18 10:17:00.554: crypto_engine: Decrypt IKE packet
*Jul 18 10:17:00.554: crypto_engine: Generate IKE hash
*Jul 18 10:17:00.554: ISAKMP: (1026):deleting node -1920751661 error FALSE reason "QM done (await)"
*Jul 18 10:17:00.554: ISAKMP: (1026):Node 2374215635, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
*Jul 18 10:17:00.554: ISAKMP: (1026):Old State = IKE_QM_R_QM2 New State = IKE_QM_PHASE2_COMPLETE
*Jul 18 10:17:00.554: IPSEC(key_engine): got a queue event with 1 KMI message(s)
*Jul 18 10:17:00.554: IPSEC(key_engine_enable_outbound): rec'd enable notify from ISAKMP
*Jul 18 10:17:00.554: crypto engine: updating MTU size of IPSec SA Onboard VPN:28 to 1500 (overhead=62)
*Jul 18 10:17:00.554: crypto_engine: Set IPSec MTU
*Jul 18 10:17:00.554: crypto engine: updating MTU size of IPSec SA Onboard VPN:28 to 1500 (overhead=62)
*Jul 18 10:17:00.554: crypto_engine: Set IPSec MTU
*Jul 18 10:17:00.554: IPSEC: Expand action denied, notify RP
*Jul 18 10:17:00.554: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access1, changed state to up
ISR2900#u all
All possible debugging has been turned off
ISR2900#
ISR2900#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id status
192.168.1.130 192.168.1.210 QM_IDLE 1026 ACTIVE
IPv6 Crypto ISAKMP SA
ISR2900#
ISR2900#show crypto isakmp sa detail
Codes: C - IKE configuration mode, D - Dead Peer Detection
K - Keepalives, N - NAT-traversal
T - cTCP encapsulation, X - IKE Extended Authentication
psk - Preshared key, rsig - RSA signature
renc - RSA encryption
IPv4 Crypto ISAKMP SA
C-id Local Remote I-VRF Status Encr Hash Auth DH Lifetime Cap.
1026 192.168.1.130 192.168.1.210 ACTIVE aes md5 2 02:50:47 XN
Engine-id:Conn-id = SW:26
IPv6 Crypto ISAKMP SA
ISR2900#
ISR2900#show crypto engine connections active
Crypto Engine Connections
ID Type Algorithm Encrypt Decrypt LastSeqN IP-Address
1026 IKE MD5+AES 0 0 0 192.168.1.130
2027 IPsec 3DES+SHA 0 1158 1158 192.168.1.130
2028 IPsec 3DES+SHA 5790 0 0 192.168.1.130
ISR2900#
ISR2900#show crypto ipsec sa
interface: Virtual-Access1
Crypto map tag: Virtual-Access1-head-0, local addr 192.168.1.130
protected vrf: (none)
local ident (addr/mask/prot/port): (172.16.1.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.0.0/255.255.255.0/0/0)
current_peer 192.168.1.210 port 4500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 6041, #pkts encrypt: 6041, #pkts digest: 6041
#pkts decaps: 1209, #pkts decrypt: 1209, #pkts verify: 1209
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 192.168.1.130, remote crypto endpt.: 192.168.1.210
plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0
current outbound spi: 0xC74254CF(3343013071)
PFS (Y/N): N, DH group: none
inbound esp sas:
spi: 0x9D67B2CE(2640818894)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel UDP-Encaps, }
conn id: 2027, flow_id: Onboard VPN:27, sibling_flags 80000040, crypto map: Virtual-Access1-head-0
sa timing: remaining key lifetime (sec): 2994
Kilobyte Volume Rekey has been disabled
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE(ACTIVE)
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0xC74254CF(3343013071)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel UDP-Encaps, }
conn id: 2028, flow_id: Onboard VPN:28, sibling_flags 80000040, crypto map: Virtual-Access1-head-0
sa timing: remaining key lifetime (sec): 2994
Kilobyte Volume Rekey has been disabled
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE(ACTIVE)
outbound ah sas:
outbound pcp sas:
ISR2900#