Networks

Ask something
Question Locked

C831 site to site VPN error..

0 helpful
8 replies

by akclark 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Can't get a site to site running between me and my friends router. He has a nettopia. attached are the error messages:

00:31:12: ISAKMP:(0:0:N/A:0):deleting SA reason "P1 delete notify (in)" state ()
00:31:12: ISAKMP:(0:0:N/A:0):deleting SA reason "P1 delete notify (in)" state (
00:31:12: ISAKMP: Unlocking IKE struct 0x82329F00 for isadb_mark_sa_deleted(), 0
00:31:12: ISAKMP: Deleting peer node by peer_reap for 24.153.138.34: 82329F00
00:31:12: ISAKMP:(0:0:N/A:0):deleting node -921753638 error FALSE reason "IKE d"
00:31:12: ISAKMP:(0:0:N/A:0):deleting node -1513062886 error FALSE reason "IKE "
00:31:12: ISAKMP:(0:0:N/A:0):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
00:31:12: ISAKMP:(0:0:N/A:0):Old State = IKE_I_MM1 New State = IKE_DEST_SA

00:33:17: ISAKMP:(0:0:N/A:0): beginning Main Mode exchange
00:33:17: ISAKMP:(0:0:N/A:0): sending packet to 24.153.138.34 my_port 500 peer_E
00:33:27: ISAKMP:(0:0:N/A:0): retransmitting phase 1 MM_NO_STATE...
00:33:27: ISAKMP:(0:0:N/A:0):incrementing error counter on sa: retransmit phase1
00:33:27: ISAKMP:(0:0:N/A:0): retransmitting phase 1 MM_NO_STATE
00:33:27: ISAKMP:(0:0:N/A:0): sending packet to 24.153.138.34 my_port 500 peer_E
00:33:37: ISAKMP:(0:0:N/A:0): retransmitting phase 1 MM_NO_STATE...
00:33:37: ISAKMP:(0:0:N/A:0):incrementing error counter on sa: retransmit phase1
00:33:37: ISAKMP:(0:0:N/A:0): retransmitting phase 1 MM_NO_STATE
00:33:37: ISAKMP:(0:0:N/A:0): sending packet to 24.153.138.34 my_port 500 peer_

8 replies

by akclark

Local Tunnel Endpoint 65.103.174.121
Local Subnet 172.16.28.0
Local Mask 255.255.255.224
Remote Tunnel Endpoint 24.153.138.34
Remote Subnet 10.0.0.0
Remote Mask 255.255.255.0

IPSec Phase 1
Encryption Algorithm 3DES
Integrity Algorithm SHA1
Die-Hellman Group 2 (1024)
Key Life 28800

IPSec Phase 2
Encryption Algorithm 3DES
Integrity Algorithm SHA1
Key Life: 3600 sec.
Die-Hellman Group 2 (1024)

!
version 12.3
no service pad
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname hal
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$pd8l$l6R0Gprto9hmqmtd4UX1M.
enable password 7 121617151B1F0D08
!
username admin privilege 7 password 7 094F4A0C5A0B1D1B52
no aaa new-model
ip subnet-zero
!
!
ip dhcp excluded-address 172.16.28.30
ip dhcp excluded-address 172.16.28.1 172.16.28.9
ip dhcp excluded-address 172.16.28.28 172.16.28.29
!
ip dhcp pool CLIENT
import all
network 172.16.28.0 255.255.255.224
default-router 172.16.28.30
lease 0 2
!
!
ip domain name cryptospace.upd
ip name-server 172.16.28.1
ip ips po max-events 100
ip ssh authentication-retries 4
no ftp-server write-enable
!
!
!
!
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
lifetime 3600
crypto isakmp key -SGPr5b_TjnWkHRzGykG$*wd address 24.153.138.34 no-xauth
!
!
crypto ipsec transform-set 3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set AES-SHA esp-aes esp-sha-hmac
! Disabled because transform not supported by encryption hardware
!
crypto map VPN-Map-1 10 ipsec-isakmp
set peer 24.153.138.34
set pfs group2
match address Crypto-list
!
!
!
interface Ethernet0
ip address 172.16.28.30 255.255.255.224
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1452
hold-queue 100 out
!
interface Ethernet1
no ip address
duplex auto
pppoe enable
pppoe-client dial-pool-number 1
!
interface FastEthernet1
no ip address
duplex auto
speed auto
!
interface FastEthernet2
no ip address
duplex auto
speed auto
!
interface FastEthernet3
no ip address
duplex auto
speed auto
!
interface FastEthernet4
no ip address
duplex auto
speed auto
!
interface Dialer1
ip address negotiated
ip mtu 1492
ip nat outside
ip virtual-reassembly
encapsulation ppp
ip tcp adjust-mss 1452
dialer pool 1
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname cryptospace@qwest.net
ppp chap password 7 000B01040D4F0A0A
ppp pap sent-username cryptospace@qwest.net password 7 030B49090F1B2040
ppp ipcp dns request
ppp ipcp wins request
crypto map VPN-Map-1
!
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer1
!
no ip http server
ip http secure-server
!
ip nat inside source list 102 interface Dialer1 overload
ip nat inside source static tcp 172.16.28.5 3389 interface Dialer1 3391
ip nat inside source static tcp 172.16.28.1 3389 interface Dialer1 3390
ip nat inside source static tcp 172.16.28.3 3389 interface Dialer1 3389
ip nat inside source static tcp 172.16.28.4 80 interface Dialer1 80
ip nat inside source static tcp 172.16.28.4 25 interface Dialer1 25
!
!
ip access-list extended Crypto-list
permit ip any 10.0.0.0 0.255.255.255
ip access-list extended Internet-inbound-ACL
permit udp host 24.153.138.34 any eq isakmp
permit esp host 24.153.138.34 any
access-list 102 permit ip 172.16.28.0 0.0.0.31 any
dialer-list 1 protocol ip permit
!
!
control-plane
!
!
line con 0
password 7 130A051002180526
login
no modem enable
transport preferred all
transport output all
stopbits 1
line aux 0
transport preferred all
transport output all
line vty 0 4
exec-timeout 120 0
password 7 104D0D1C4619180255
login local
length 0
transport preferred all
transport input ssh
transport output all
!
scheduler max-task-time 5000
end

by netman1958

First, your phase 1 lifetimes don't match.

IPSec Phase 1
Encryption Algorithm 3DES
Integrity Algorithm SHA1
Die-Hellman Group 2 (1024)
these differ -- Key Life 28800

crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
these differ -- lifetime 3600

These don't match:
Remote Subnet 10.0.0.0
Remote Mask 255.255.255.0

ip access-list extended Crypto-list
permit ip any 10.0.0.0 0.255.255.255
--This should be 10.0.0.0 0.0.0.255 to match with Remote Mask 255.255.255.0

--Also, instead of "any" I would use the actual subnet like this:
ip access-list extended Crypto-list
permit ip 172.16.28.0 0.0.0.31 10.0.0.0 0.0.0.255

Last, you don't want to perform NAT on the traffic crossing the tunnel so you need to change this:
access-list 102 permit ip 172.16.28.0 0.0.0.31 any
to
access-list 102 deny ip 172.16.28.0 0.0.0.31 10.0.0.0 0.0.0.255
access-list 102 permit ip 172.16.28.0 0.0.0.31 any

Correct those items and give her another try. If it still doesn't work, post back and we will take another look.

by akclark

Made those changes, and still getting these;

17:26:21: IPSEC(sa_request): ,
(key eng. msg.) OUTBOUND local= 65.103.174.121, remote= 24.153.138.34,
local_proxy= 172.16.28.0/255.255.255.224/0/0 (type=4),
remote_proxy= 10.0.0.0/255.255.255.0/0/0 (type=4),
protocol= ESP, transform= esp-3des esp-sha-hmac (Tunnel),
lifedur= 3600s and 4608000kb,
spi= 0x67E81565(1743263077), conn_id= 0, keysize= 0, flags= 0x400B
17:26:21: ISAKMP:(0:0:N/A:0):deleting SA reason "P1 delete notify (in)" state (I) MM_NO_STATE (peer 24.1
17:26:21: ISAKMP: Unlocking IKE struct 0x8239A824 for isadb_mark_sa_deleted(), count 0
17:26:21: ISAKMP: Deleting peer node by peer_reap for 24.153.138.34: 8239A824
17:26:21: ISAKMP:(0:0:N/A:0):deleting node -1820283338 error FALSE reason "IKE deleted"
17:26:21: ISAKMP:(0:0:N/A:0):deleting node 1311546730 error FALSE reason "IKE deleted"
17:26:21: ISAKMP:(0:0:N/A:0):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
17:26:21: ISAKMP:(0:0:N/A:0):Old State = IKE_I_MM1 New State = IKE_DEST_SA

17:26:21: ISAKMP: received ke message (1/1)
17:26:21: ISAKMP:(0:0:N/A:0): SA request profile is (NULL)
17:26:21: ISAKMP: Created a peer struct for 24.153.138.34, peer port 500
17:26:21: ISAKMP: Locking peer struct 0x823C7DE8, IKE refcount 1 for isakmp_initiator
17:26:21: ISAKMP: local port 500, remote port 500
17:26:21: ISAKMP: set new node 0 to QM_IDLE
17:26:21: ISAKMP: Find a dup sa in the avl tree during calling isadb_insert sa = 82364330
17:26:21: ISAKMP:(0:0:N/A:0):Can not start Aggressive mode, trying Main mode.
17:26:21: ISAKMP: Looking for a matching key for 24.153.138.34 in default : success
17:26:21: ISAKMP:(0:0:N/A:0):found peer pre-shared key matching 24.153.138.34
17:26:21: ISAKMP:(0:0:N/A:0): constructed NAT-T vendor-07 ID
17:26:21: ISAKMP:(0:0:N/A:0): constructed NAT-T vendor-03 ID
17:26:21: ISAKMP:(0:0:N/A:0): constructed NAT-T vendor-02 ID
17:26:21: ISAKMP:(0:0:N/A:0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
17:26:21: ISAKMP:(0:0:N/A:0):Old State = IKE_READY New State = IKE_I_MM1

17:26:21: ISAKMP:(0:0:N/A:0): beginning Main Mode exchange
17:26:21: ISAKMP:(0:0:N/A:0): sending packet to 24.153.138.34 my_port 500 peer_port 500 (I) MM_NO_STATE
17:26:31: ISAKMP:(0:0:N/A:0): retransmitting phase 1 MM_NO_STATE...
17:26:31: ISAKMP:(0:0:N/A:0):incrementing error counter on sa: retransmit phase 1
17:26:31: ISAKMP:(0:0:N/A:0): retransmitting phase 1 MM_NO_STATE
17:26:31: ISAKMP:(0:0:N/A:0): sending packet to 24.153.138.34 my_port 500 peer_port 500 (I) MM_NO_STATE
17:26:41: ISAKMP:(0:0:N/A:0): retransmitting phase 1 MM_NO_STATE...
17:26:41: ISAKMP:(0:0:N/A:0):incrementing error counter on sa: retransmit phase 1
17:26:41: ISAKMP:(0:0:N/A:0): retransmitting phase 1 MM_NO_STATE
17:26:41: ISAKMP:(0:0:N/A:0): sending packet to 24.153.138.34 my_port 500 peer_port 500 (I) MM_NO_STATE

Here is my current config;

!
version 12.3
no service pad
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname hal
!
boot-start-marker
boot-end-marker
!
logging buffered 52000 debugging
enable secret 5 $1$pd8l$l6R0Gprto9hmqmtd4UX1M.
enable password 7 121617151B1F0D08
!
username admin privilege 7 password 7 094F4A0C5A0B1D1B52
no aaa new-model
ip subnet-zero
!
!
ip dhcp excluded-address 172.16.28.30
ip dhcp excluded-address 172.16.28.1 172.16.28.9
ip dhcp excluded-address 172.16.28.28 172.16.28.29
!
ip dhcp pool CLIENT
import all
network 172.16.28.0 255.255.255.224
default-router 172.16.28.30
lease 0 2
!
!
ip domain name cryptospace.upd
ip name-server 172.16.28.1
ip ips po max-events 100
ip ssh authentication-retries 4
no ftp-server write-enable
!
!
!
!
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
lifetime 28800
crypto isakmp key -SGPr5b_TjnWkHRzGykG$*wd address 24.153.138.34 no-xauth
!
!
crypto ipsec transform-set 3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set AES-SHA esp-aes esp-sha-hmac
! Disabled because transform not supported by encryption hardware
crypto ipsec transform-set SDM_TRANSFORMSET_1 esp-3des esp-sha-hmac
crypto ipsec transform-set SDM_TRANSFORMSET_2 esp-3des esp-sha-hmac
!
crypto ipsec profile GCT
description default GCT
set transform-set SDM_TRANSFORMSET_1
!
!
crypto map VPN-Map-1 10 ipsec-isakmp
set peer 24.153.138.34
set transform-set SDM_TRANSFORMSET_2
set pfs group2
match address Crypto-list
!
!
!
interface Ethernet0
ip address 172.16.28.30 255.255.255.224
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1452
hold-queue 100 out
!
interface Ethernet1
no ip address
duplex auto
pppoe enable
pppoe-client dial-pool-number 1
!
interface FastEthernet1
no ip address
duplex auto
speed auto
!
interface FastEthernet2
no ip address
duplex auto
speed auto
!
interface FastEthernet3
no ip address
duplex auto
speed auto
!
interface FastEthernet4
no ip address
duplex auto
speed auto
!
interface Dialer1
ip address negotiated
ip mtu 1492
ip nat outside
ip virtual-reassembly
encapsulation ppp
ip tcp adjust-mss 1452
dialer pool 1
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname cryptospace@qwest.net
ppp chap password 7 000B01040D4F0A0A
ppp pap sent-username cryptospace@qwest.net password 7 030B49090F1B2040
ppp ipcp dns request
ppp ipcp wins request
crypto map VPN-Map-1
!
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer1
!
no ip http server
ip http secure-server
!
ip nat inside source static tcp 172.16.28.7 3389 interface Dialer1 3393
ip nat inside source static tcp 172.16.28.6 3389 interface Dialer1 3392
ip nat inside source static tcp 172.16.28.4 22 interface Dialer1 2202
ip nat inside source static tcp 172.16.28.2 22 interface Dialer1 2201
ip nat inside source route-map SDM_RMAP_1 interface Dialer1 overload
ip nat inside source static tcp 172.16.28.5 3389 interface Dialer1 3391
ip nat inside source static tcp 172.16.28.1 3389 interface Dialer1 3390
ip nat inside source static tcp 172.16.28.3 3389 interface Dialer1 3389
ip nat inside source static tcp 172.16.28.4 80 interface Dialer1 80
ip nat inside source static tcp 172.16.28.4 25 interface Dialer1 25
!
!
ip access-list extended Crypto-list
permit ip 172.16.28.0 0.0.0.31 10.0.0.0 0.0.0.255
ip access-list extended Internet-inbound-ACL
permit udp host 24.153.138.34 any eq isakmp
permit esp host 24.153.138.34 any
access-list 102 deny ip 172.16.28.0 0.0.0.31 10.0.0.0 0.0.0.255
access-list 102 permit ip 172.16.28.0 0.0.0.31 any
dialer-list 1 protocol ip permit
!
route-map SDM_RMAP_1 permit 1
match ip address 102
!
!
control-plane
!
!
line con 0
password 7 130A051002180526
login
no modem enable
transport preferred all
transport output all
stopbits 1
line aux 0
transport preferred all
transport output all
line vty 0 4
exec-timeout 120 0
password 7 104D0D1C4619180255
login local
length 0
transport preferred all
transport input ssh
transport output all
!
scheduler max-task-time 5000
end

by netman1958

If you aren't already doing so, run:
debug crypto isakmp

and post the output. It still looks like it's failing on phase 1.

by akclark

here is the output

18:48:12: ISAKMP:(0:0:N/A:0):purging node -1295764948
18:48:12: ISAKMP:(0:0:N/A:0):purging node 1592451257
18:48:22: ISAKMP:(0:0:N/A:0):purging SA., sa=824403BC, delme=824403BC
hal#
18:48:59: IPSEC(sa_request): ,
(key eng. msg.) OUTBOUND local= 65.103.174.121, remote= 24.153.138.34,
local_proxy= 172.16.28.0/255.255.255.224/0/0 (type=4),
remote_proxy= 10.0.0.0/255.255.255.0/0/0 (type=4),
protocol= ESP, transform= esp-3des esp-sha-hmac (Tunnel),
lifedur= 28800s and 4608000kb,
spi= 0x8248C9A7(2185808295), conn_id= 0, keysize= 0, flags= 0x400B
18:48:59: ISAKMP: received ke message (1/1)
18:48:59: ISAKMP:(0:0:N/A:0): SA request profile is (NULL)
18:48:59: ISAKMP: Created a peer struct for 24.153.138.34, peer port 500
18:48:59: ISAKMP: Locking peer struct 0x8232B4D0, IKE refcount 1 for isakmp_initiator
18:48:59: ISAKMP: local port 500, remote port 500
18:48:59: ISAKMP: set new node 0 to QM_IDLE
18:48:59: insert sa successfully sa = 824355A8
18:48:59: ISAKMP:(0:0:N/A:0):Can not start Aggressive mode, trying Main mode.
18:48:59: ISAKMP: Looking for a matching key for 24.153.138.34 in default : success
18:48:59: ISAKMP:(0:0:N/A:0):found peer pre-shared key matching 24.153.138.34
18:48:59: ISAKMP:(0:0:N/A:0): constructed NAT-T vendor-07 ID
18:48:59: ISAKMP:(0:0:N/A:0): constructed NAT-T vendor-03 ID
18:48:59: ISAKMP:(0:0:N/A:0): constructed NAT-T vendor-02 ID
18:48:59: ISAKMP:(0:0:N/A:0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
18:48:59: ISAKMP:(0:0:N/A:0):Old State = IKE_READY New State = IKE_I_MM1

18:48:59: ISAKMP:(0:0:N/A:0): beginning Main Mode exchange
18:48:59: ISAKMP:(0:0:N/A:0): sending packet to 24.153.138.34 my_port 500 peer_port 500 (I) MM_NO_STATE
18:49:09: ISAKMP:(0:0:N/A:0): retransmitting phase 1 MM_NO_STATE...
18:49:09: ISAKMP:(0:0:N/A:0):incrementing error counter on sa: retransmit phase 1
18:49:09: ISAKMP:(0:0:N/A:0): retransmitting phase 1 MM_NO_STATE
18:49:09: ISAKMP:(0:0:N/A:0): sending packet to 24.153.138.34 my_port 500 peer_port 500 (I) MM_NO_STATE
18:49:19: ISAKMP:(0:0:N/A:0): retransmitting phase 1 MM_NO_STATE...
18:49:19: ISAKMP:(0:0:N/A:0):incrementing error counter on sa: retransmit phase 1
18:49:19: ISAKMP:(0:0:N/A:0): retransmitting phase 1 MM_NO_STATE
18:49:19: ISAKMP:(0:0:N/A:0): sending packet to 24.153.138.34 my_port 500 peer_port 500 (I) MM_NO_STATE
18:49:29: IPSEC(key_engine): request timer fired: count = 1,
(identity) local= 65.103.174.121, remote= 24.153.138.34,
local_proxy= 172.16.28.0/255.255.255.224/0/0 (type=4),
remote_proxy= 10.0.0.0/255.255.255.0/0/0 (type=4)
18:49:29: IPSEC(sa_request): ,
(key eng. msg.) OUTBOUND local= 65.103.174.121, remote= 24.153.138.34,
local_proxy= 172.16.28.0/255.255.255.224/0/0 (type=4),
remote_proxy= 10.0.0.0/255.255.255.0/0/0 (type=4),
protocol= ESP, transform= esp-3des esp-sha-hmac (Tunnel),
lifedur= 28800s and 4608000kb,
spi= 0xE3D023E(238879294), conn_id= 0, keysize= 0, flags= 0x400B
18:49:29: ISAKMP: received ke message (1/1)
18:49:29: ISAKMP: set new node 0 to QM_IDLE
18:49:29: ISAKMP:(0:0:N/A:0):SA is still budding. Attached new ipsec request to it. (local 65.103.174.121)
18:49:29: ISAKMP:(0:0:N/A:0): retransmitting phase 1 MM_NO_STATE...
18:49:29: ISAKMP:(0:0:N/A:0):incrementing error counter on sa: retransmit phase 1
18:49:29: ISAKMP:(0:0:N/A:0): retransmitting phase 1 MM_NO_STATE
18:49:29: ISAKMP:(0:0:N/A:0): sending packet to 24.153.138.34 my_port 500 peer_port 500 (I) MM_NO_STATE
18:49:39: ISAKMP:(0:0:N/A:0): retransmitting phase 1 MM_NO_STATE...
18:49:39: ISAKMP:(0:0:N/A:0):incrementing error counter on sa: retransmit phase 1
18:49:39: ISAKMP:(0:0:N/A:0): retransmitting phase 1 MM_NO_STATE
18:49:39: ISAKMP:(0:0:N/A:0): sending packet to 24.153.138.34 my_port 500 peer_port 500 (I) MM_NO_STATE
18:49:49: ISAKMP:(0:0:N/A:0): retransmitting phase 1 MM_NO_STATE...
18:49:49: ISAKMP:(0:0:N/A:0):incrementing error counter on sa: retransmit phase 1
18:49:49: ISAKMP:(0:0:N/A:0): retransmitting phase 1 MM_NO_STATE
18:49:49: ISAKMP:(0:0:N/A:0): sending packet to 24.153.138.34 my_port 500 peer_port 500 (I) MM_NO_STATE
18:49:59: IPSEC(key_engine): request timer fired: count = 2,
(identity) local= 65.103.174.121, remote= 24.153.138.34,
local_proxy= 172.16.28.0/255.255.255.224/0/0 (type=4),
remote_proxy= 10.0.0.0/255.255.255.0/0/0 (type=4)
18:49:59: ISAKMP: received ke message (3/1)
18:49:59: ISAKMP:(0:0:N/A:0):peer does not do paranoid keepalives.

18:49:59: ISAKMP:(0:0:N/A:0):deleting SA reason "P1 delete notify (in)" state (I) MM_NO_STATE (peer 24.15)
18:49:59: ISAKMP:(0:0:N/A:0):deleting SA reason "P1 delete notify (in)" state (I) MM_NO_STATE (peer 24.15
18:49:59: ISAKMP: Unlocking IKE struct 0x8232B4D0 for isadb_mark_sa_deleted(), count 0
18:49:59: ISAKMP: Deleting peer node by peer_reap for 24.153.138.34: 8232B4D0
18:49:59: ISAKMP:(0:0:N/A:0):deleting node 144080543 error FALSE reason "IKE deleted"
18:49:59: ISAKMP:(0:0:N/A:0):deleting node 400261366 error FALSE reason "IKE deleted"
18:49:59: ISAKMP:(0:0:N/A:0):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
18:49:59: ISAKMP:(0:0:N/A:0):Old State = IKE_I_MM1 New State = IKE_DEST_SA

I am running these;
hal#show debug
Cryptographic Subsystem:
Crypto ISAKMP debugging is on
Crypto ISAKMP Error debugging is on
Crypto ISAKMP High Availability debugging is on
Crypto IPSEC debugging is on
Crypto IPSEC Error debugging is on
hal#

by netman1958

It's not getting very far on phase 1. Either it can't contact the other end or the settings don't match. Cisco to Netopia is usually a walk in park. I would re-verify the settings on the other end and if there is someone there that can look at the log on the netopia and see if your router is even getting to it. I have several VPNs setup between a Cisco 831 and a bunch of Netopia R910s. I ran the debug while one of them cam up. Here is what it should look like:

Network-831#clear crypto sa peer 208.XX.X.XX
Network-831#
*Dec 18 16:07:39 CST: ISAKMP (0:0): received packet from 208.XX.X.XX dport 500
sport 500 Global (N) NEW SA
*Dec 18 16:07:39 CST: ISAKMP: Created a peer struct for 208.XX.X.XX, peer port
500
*Dec 18 16:07:39 CST: ISAKMP: New peer created peer = 0x81F05194 peer_handle = 0
x800000C6
*Dec 18 16:07:39 CST: ISAKMP: Locking peer struct 0x81F05194, IKE refcount 1 for
crypto_isakmp_process_block
*Dec 18 16:07:39 CST: ISAKMP: local port 500, remote port 500
*Dec 18 16:07:39 CST: insert sa successfully sa = 81EF2598
*Dec 18 16:07:
Network-831#39 CST: ISAKMP:(0:0:N/A:0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
*Dec 18 16:07:39 CST: ISAKMP:(0:0:N/A:0):Old State = IKE_READY New State = IKE_
R_MM1

*Dec 18 16:07:39 CST: ISAKMP:(0:0:N/A:0): processing SA payload. message ID = 0
*Dec 18 16:07:39 CST: ISAKMP:(0:0:N/A:0):Looking for a matching key for 208.XX.
XX.XX in default
*Dec 18 16:07:39 CST: ISAKMP:(0:0:N/A:0): : success
*Dec 18 16:07:39 CST: ISAKMP:(0:0:N/A:0):found peer pre-shared key matching 208.
XX.XX.XX
*Dec 18 16:07:39 CST: ISAKMP:(0:0:N/A:0): local preshared key found
*Dec 18 16:07:39 CST: ISAKMP : Scanning profiles for xauth ...
*Dec 18 16:07:39 CST: ISAKMP:(0:0:N/A:0):Checking ISAKMP transform 1 against pri
ority 10 policy
*Dec 18 16:07:39 CST: ISAKMP: life type in seconds
*Dec 18 16:07:39 CST: ISAKMP: life duration (basic) of 28800
*Dec 18 16:07:39 CST: ISAKMP: encryption DES-CBC
*Dec 18 16:07:39 CST: ISAKMP: auth pre-share
*Dec 18 16:07:39 CST: ISAKMP: hash MD5
*Dec 18 16:07:39 CST: ISAKMP: default group 2
*Dec 18 16:07:39 CST: ISAKMP:(0:0:
Network-831#N/A:0):atts are acceptable. Next payload is 0
*Dec 18 16:07:40 CST: ISAKMP:(0:16:HW:2):Input = IKE_MESG_INTERNAL, IKE_PROCESS_
MAIN_MODE
*Dec 18 16:07:40 CST: ISAKMP:(0:16:HW:2):Old State = IKE_R_MM1 New State = IKE_
R_MM1

*Dec 18 16:07:40 CST: ISAKMP:(0:16:HW:2): sending packet to 208.XX.X.XX my_por
t 500 peer_port 500 (R) MM_SA_SETUP
*Dec 18 16:07:40 CST: ISAKMP:(0:16:HW:2):Input = IKE_MESG_INTERNAL, IKE_PROCESS_
COMPLETE
*Dec 18 16:07:40 CST: ISAKMP:(0:16:HW:2):Old State = IKE_R_MM1 New State = IKE_
R_MM2

*Dec 18 16:
Network-831#07:40 CST: ISAKMP (0:268435472): received packet from 208.XX.X.XX
dport 500 sport 500 Global (R) MM_SA_SETUP
*Dec 18 16:07:40 CST: ISAKMP:(0:16:HW:2):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
*Dec 18 16:07:40 CST: ISAKMP:(0:16:HW:2):Old State = IKE_R_MM2 New State = IKE_
R_MM3

*Dec 18 16:07:40 CST: ISAKMP:(0:16:HW:2): processing KE payload. message ID = 0
*Dec 18 16:07:40 CST: ISAKMP:(0:16:HW:2): processing NONCE payload. message ID =
0
*Dec 18 16:07:40 CST: ISAKMP:(0:0:N/A:0):Looking for a matching key for 208.XX.
XX.XX in default
*Dec 18 16:07:40 CST: ISAKMP:(0:0:N/A:0): : success
*Dec 18 16:07:40 CST: ISAKMP:(0:16:HW:2):found peer pre-shared key matching 208.XX.XX.XX *Dec 18 16:07:40 CST: ISAKMP:(0:16:HW:2):SKEYID state generated
*Dec 18 16:07:40 CST: ISAKMP:(0:16:HW:2): processing vendor id payload
*Dec 18 16:07:40 CST: ISAKMP:(0:16:HW:2): vendor ID seems Unity/DPD but major 16
2 mismatch
*Dec 18 16:07:40 CST: ISAKMP:(0:16:HW:2):Input = IKE_MESG_INTERNAL, IKE_PROCESS_
MAIN_MODE
*Dec 18 16:07:40 CST: ISAKMP:(0:16:HW:2):Old State = IKE_R_MM
Network-831#3 New State = IKE_R_MM3

*Dec 18 16:07:40 CST: ISAKMP:(0:16:HW:2): sending packet to 208.XX.X.XX my_por
t 500 peer_port 500 (R) MM_KEY_EXCH
*Dec 18 16:07:40 CST: ISAKMP:(0:16:HW:2):Input = IKE_MESG_INTERNAL, IKE_PROCESS_
COMPLETE
*Dec 18 16:07:40 CST: ISAKMP:(0:16:HW:2):Old State = IKE_R_MM3 New State = IKE_
R_MM4

*Dec 18 16:07:41 CST: ISAKMP (0:268435472): received packet from 208.XX.X.XX d
port 500 sport 500 Global (R) MM_KEY_EXCH
*Dec 18 16:07:41 CST: ISAKMP:(0:16:HW:2):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
*Dec
Network-831#18 16:07:41 CST: ISAKMP:(0:16:HW:2):Old State = IKE_R_MM4 New State
= IKE_R_MM5

*Dec 18 16:07:41 CST: ISAKMP:(0:16:HW:2): processing ID payload. message ID = 0
*Dec 18 16:07:41 CST: ISAKMP (0:268435472): ID payload
next-payload : 8
type : 1
address : 208.XX.X.XX
protocol : 17
port : 500
length : 12
*Dec 18 16:07:41 CST: ISAKMP:(0:16:HW:2):: peer matches *none* of the profiles
*Dec 18 16:07:41 CST: ISAKMP:(0:16:HW:2): processing HASH payload. message ID =
0
*Dec 18 16:07:41 CST: ISAKMP:(0:16:HW:2):SA authentication status:
authenticated
*Dec 18 16:07:41 CST: ISAKMP:(0:16:HW:2):SA has been authenticated with 208.XX.XX.XX
*Dec 18 16:07:41 CST: ISAKMP: Trying to insert a peer 69.XX.XX.XX/208.XX.X.XX/
500/, and inserted successfully 81F05194.
*Dec 18 16:07:41 CST: ISAKMP:(0:16:HW:2):Input = IKE_MESG_INTERNAL, IKE_PROCESS_
MAIN_MODE
*Dec 18 16:07:41 CST: ISAKMP:(0:16:HW:2):Old State = IKE_R_MM5 New State = IKE_
R_MM5

*Dec 18 16:07:41 CST: ISAKMP:(0:16:HW:2):SA is doing pre-shared key authenti
Network-831#cation using id type ID_IPV4_ADDR
*Dec 18 16:07:41 CST: ISAKMP (0:268435472): ID payload
next-payload : 8
type : 1
address : 69.XX.XX.XX
protocol : 17
port : 500
length : 12
*Dec 18 16:07:41 CST: ISAKMP:(0:16:HW:2):Total payload length: 12
*Dec 18 16:07:41 CST: ISAKMP:(0:16:HW:2): sending packet to 208.XX.X.XX my_por
t 500 peer_port 500 (R) MM_KEY_EXCH
*Dec 18 16:07:41 CST: ISAKMP:(0:16:HW:2):Input = IKE_MESG_INTERNAL, IKE_PROCESS_
COMPLETE
*Dec 18 16:07:41 CST: ISAKMP:(0:16:HW:2):Old State = IKE_R_MM5 New State = IKE_
P1_COMPLETE

*Dec 18 16:07:41 CST: ISAKMP:(0:16:HW:2):Input = IKE_MESG_INTERNAL, IKE_PHASE1_C
OMPLETE
*Dec 18 16:07:41 CST: ISAKMP:(0:16:HW:2):Old State = IKE_P1_COMPLETE New State
= IKE_P1_COMPLETE

*Dec 18 16:07:41 CST: ISAKMP (0:268435472): received packet from 208.XX.X.XX d
port 500 sport 500 Global (R) QM_IDLE
*Dec 18 16:07:41 CST: ISAKMP: set new node -1507312796 to QM_IDLE
*Dec 18 16:07:41 CST: ISAKMP:(0:16:HW:2): processing HASH payload. message ID =
-1507312796
*Dec 18 16:07:41 CST: ISAKMP:(0:16:HW:2): processing NOTIFY INITIAL_CONTACT prot
ocol 1
spi 0, message ID = -1507312796, sa = 81EF2598
*Dec 18 16:07:41 CST: ISAKMP:(0:16:HW:2):SA authentication status:
authenticated
*Dec 18 16:07:41 CST: ISAKMP:(0:16:HW:2): Process initial contact,
bring down existing phase 1 and 2 SA's with local 69.XX.XX.XX remote 208.XX.XX.XX
remote port 500
*Dec 18 16:07:41 CST: ISAKMP:(0:16:HW:2):deleting node -1507312796 error FALSE r
eason "Informational (in) state 1"
*Dec 18 16:07:41 CST: ISAKM
Network-831#P:(0:16:HW:2):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY
*Dec 18 16:07:41 CST: ISAKMP:(0:16:HW:2):Old State = IKE_P1_COMPLETE New State
= IKE_P1_COMPLETE

*Dec 18 16:07:41 CST: ISAKMP (0:268435472): received packet from 208.XX.X.XX d
port 500 sport 500 Global (R) QM_IDLE
*Dec 18 16:07:41 CST: ISAKMP: set new node 1377935587 to QM_IDLE
*Dec 18 16:07:41 CST: ISAKMP:(0:16:HW:2): processing HASH payload. message ID =
1377935587
*Dec 18 16:07:41 CST: ISAKMP:(0:16:HW:2): processing SA payload. message ID = 13
77935587
*Dec 18 16:07:41 CST: ISAKMP:(0:16:HW:2):Checking IPSec proposal 1
*Dec 18 16:07:41 CST: ISAKMP: transform 1, ESP_DES
*Dec 18 16:07:41 CST: ISAKMP: attributes in transform:
*Dec 18 16:07:41 CST: ISAKMP: SA life type in seconds
*Dec 18 16:07:41 CST: ISAKMP: SA life duration (basic) of 28798
*Dec 18 16:07:41 CST: ISAKMP: encaps is 1 (Tunnel)
*Dec 18 16:07:41 CST: ISAKMP: authenticator is HMAC-MD5
*Dec 18 16:07:41 CST: ISAKMP: group is 2
*Dec 18 16:07:41 CST: ISAKMP:(0:16:HW:2):atts are acceptable.
*Dec 18 16:07:42 CST: ISAKMP:(0:16:HW:2): processing NONCE payload. message ID =
1377935587
*Dec 18 16:07:42 CST: ISAKMP:(0:16:HW:2): processing KE payload. message ID = 13
77935587
*Dec 18 16:07:42 CST: ISAKMP:(0:16:HW:2): processing ID payload. message ID = 13
77935587
*Dec 18 16:07:42 CST: ISAKMP:(0:16:HW:2): processing ID payload. message ID = 13
77935587
*Dec 18 16:07:42 CST: ISAKMP:(0:16:HW:2): asking for 1 spis from ipsec
*Dec 18 16:07:42 CST: ISAKMP:(0:16:HW:2):Node 1377935587, Input = IKE_MESG_FROM_
PEER, IKE_QM_EXCH
*Dec 18 16:07:42 CST: ISAKMP:(0:16:HW:2):Old State = IKE_QM_READY New State = I
KE_QM_SPI_STARVE
*Dec 18 16:07:42 CST: ISAKMP: received ke message (2/1)
*Dec 18 16:07:42 CST: ISAKMP: Locking peer struct 0x81F05194, IPSEC refcount 1 f
or for stuff_ke
*Dec 18 16:07:42 CST: ISAKMP:(0:16:HW:2): Creating IPSec SAs
*Dec 18 16:07:42 CST: inbound SA from 208.XX.X.XX to 69.XX.XX.XX (f/i)
0/ 0
(proxy 192.168.1.0 to 192.168.69.0)
*Dec 18 16:07:42 CST: has spi 0x21C60740 and conn_id 0 and flags 23
*Dec 18 1
Network-831#6:07:42 CST: lifetime of 28798 seconds
*Dec 18 16:07:42 CST: has client flags 0x0
*Dec 18 16:07:42 CST: outbound SA from 69.XX.XX.XX to 208.XX.X.XX (f/i
) 0/0
(proxy 192.168.69.0 to 192.168.1.0)
*Dec 18 16:07:42 CST: has spi -569533285 and conn_id 0 and flags 2B
*Dec 18 16:07:42 CST: lifetime of 28798 seconds
*Dec 18 16:07:42 CST: has client flags 0x0
*Dec 18 16:07:42 CST: ISAKMP: Locking peer struct 0x81F05194, IPSEC refcount 2 f
or from create_transforms
*Dec 18 16:07:42 CST: ISAKMP: Unlocking IPSEC struct 0x81F05194 from create_tran
sforms, count 1
*Dec 18 16:07:42 CST: ISAKMP:(0:16:HW:2): sending packet to 208.XX.X.XX my_por
t 500 peer_port 500 (R) QM_IDLE
*Dec 18 16:07:42 CST: ISAKMP:(0:16:HW:2):Node 1377935587, Input = IKE_MESG_FROM_
IPSEC, IKE_SPI_REPLY
*Dec 18 16:07:42 CST: ISAKMP:(0:16:HW:2):Old State = IKE_QM_SPI_STARVE New Stat
e = IKE_QM_R_QM2
*Dec 18 16:07:43 CST: ISAKMP (0:268435472): received packet from 208.XX.X.XX d
port 500 sport 500 Global (R) QM_IDLE
*Dec 18 16:07:43 CST: ISAKMP:(0:16:HW:2):deleting node 1377935587 error FALSE re
ason "QM done (await)"
*Dec 18 16:07:43 CST: ISAKMP:(0:16:HW:2):Node 1377935587, Input = IKE_MESG_FROM_
PEER, IKE_QM_EXCH
*Dec 18 16:07:43 CST: ISAKMP:(0:16:HW:2):Old State = IKE_QM_R_QM2 New State = I
KE_QM_PHASE2_COMPLETE
Network-831#u all
All possible debugging has been turned off
Network-831#

This discussion is closed to new replies.