3

I have just configured the IPSEC tunnel between my router and the Access point.I could see that the Tunnel has came up and Active in both sides.

However,When I checked the "Show cyrpto ipsec sa" ,I Could see that decaps packet counters are getting incremented but the encaps packets are always showed as 0.

I think the router is able to decrypt the packets in it's ingress path but it is not encrypting the outbound packets or the packets are not getting routed through the tunnel.

Can someone guide me to fix this?

Router#show crypto ipsec sa

interface: FastEthernet4
    Crypto map tag: SG_LAB_MAP, local addr 10.140.134.50

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (10.140.134.50/255.255.255.255/0/0)
   remote ident (addr/mask/prot/port): (192.168.1.10/255.255.255.255/0/0)
   current_peer 192.168.1.10 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
    #pkts decaps: 177, #pkts decrypt: 177, #pkts verify: 177
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 10.140.134.50, remote crypto endpt.: 192.168.1.10
     path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet4
     current outbound spi: 0x290F(10511)

     inbound esp sas:
      spi: 0x2527(9511)
        transform: esp-aes esp-sha-hmac ,
        in use settings ={Transport, }
        conn id: 3, flow_id: Motorola SEC 1.0:3, crypto map: SG_LAB_MAP
        no sa timing
        IV size: 16 bytes
        replay detection support: N
        Status: ACTIVE

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0x290F(10511)
        transform: esp-aes esp-sha-hmac ,
        in use settings ={Transport, }
        conn id: 4, flow_id: Motorola SEC 1.0:4, crypto map: SG_LAB_MAP
        no sa timing
        IV size: 16 bytes
        replay detection support: N
        Status: ACTIVE

     outbound ah sas:

     outbound pcp sas:

Router Config

Router#sh run
Building configuration...

Current configuration : 3333 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
logging buffered 51200 warnings
enable secret 5 <Intentionally Trimmed>
enable password <Intentionally Trimmed>
!
no aaa new-model
!
!
dot11 syslog
ip source-route
!
!
ip dhcp excluded-address 192.168.1.1
!
ip dhcp pool test
   network 192.168.1.0 255.255.255.0
   default-router 192.168.1.1
   lease 0 1 2
!
!
ip cef
no ip domain lookup
ip domain name yourdomain.com
!
ipv6 unicast-routing
no ipv6 cef
multilink bundle-name authenticated
!
!
!
username <Intentionally Trimmed> privilege 15 secret 5 <Intentionally Trimmed>
!
!
!
crypto ipsec transform-set MANUAL_TRANSFORM_SET01 esp-aes esp-sha-hmac
 mode transport
!
crypto map SG_LAB_MAP 100 ipsec-manual
 description "<Intentionally Trimmed> (APREL) MAC <Intentionally Trimmed>"
 set peer 192.168.1.10 default
 set session-key inbound esp 9511 cipher <Intentionally Trimmed> authenticator <Intentionally Trimmed>
 set session-key outbound esp 10511 cipher <Intentionally Trimmed> authenticator <Intentionally Trimmed>
 set transform-set MANUAL_TRANSFORM_SET01
 match address <Intentionally Trimmed>
!
archive
 log config
  hidekeys
!
!
!
!
!
interface Tunnel100
 description "<Intentionally Trimmed>"
 no ip address
 ipv6 address FDC9:CCBE:10C0:A6:BF22:7825:C8F6:7257/64
 ipv6 enable
 tunnel source 10.140.134.50
 tunnel destination 192.168.1.10
 tunnel mode ipv6ip
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
 ip address dhcp
 speed auto
 full-duplex
 crypto map SG_LAB_MAP
!
interface Vlan1
 ip address 192.168.1.1 255.255.255.0
 ip tcp adjust-mss 1452
 ipv6 enable
!
ip forward-protocol nd
ip route 10.140.134.0 255.255.255.0 10.140.134.1
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
!
!
ip access-list extended AP_001350FFFE11B666_ACL
 permit ip host 10.140.134.50 host 192.168.1.10
 permit ip host 10.140.134.50 host 192.168.1.1
!
no cdp run

ipv6 route FDC9:CCBE:1DC7:A6::/64 Tunnel100
!
!
!
!
!
control-plane
!
banner login ^C
-----------------------------------------------------------------------
Cisco Router and Security Device Manager (SDM) is installed on this device.
This feature requires the one-time use of the username "cisco"
with the password "cisco". The default username and password have a privilege level of 15.

Please change these publicly known initial credentials using SDM or the IOS CLI.
Here are the Cisco IOS commands.

username <myuser>  privilege 15 secret 0 <mypassword>
no username cisco

Replace <myuser> and <mypassword> with the username and password you want to use.

For more information about SDM please follow the instructions in the QUICK START
GUIDE for your router or go to http://www.cisco.com/go/sdm
-----------------------------------------------------------------------
^C
!
line con 0
 login local
 no modem enable
line aux 0
line vty 0 4
 access-class 23 in
 privilege level 15
 password <Intentionally Trimmed>
 login local
 transport input telnet ssh
!
scheduler max-task-time 5000
end

Router#

enter image description here

  • Please update your question with a simple network diagram and IPSec configuration on Router. – Hung Tran Mar 1 '18 at 7:37
  • Paging for @Ron Maupin and Can you guys have a quick look? – Maverick Mar 1 '18 at 12:46
  • Are you able to resolve this issue as I am also seeing exactly same issue. Kindly let me know , how did you fix this issue. Thanks! – Rati Oct 15 '18 at 11:45
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 25 '18 at 8:03
3

Your show crypto ipsec sa output looks strange as I do not see Encryption Domains (Local and Remote subnets) at both end. Indeed, your Encryption Domains are also your VPN IP peers (10.140.134.50 and 192.168.1.10), that is incorrect!

When see only encaps/decaps packets at one end, it is likely an issue with routing, thus return traffic cannot hit Firewalls/Routers for being encrypted.

You can try initiating traffic from Router end and see whether the traffic is encrypted (encaps packets counters).

  • Thanks,I didn't quiet understand what exactly you meant by encryption domain.Excuse my ignorance,This is like only the 4th or 5th time I'm configuring a IPsec Tunnel. I did tried to initiate traffic from the router and only the decaps were getting incremented.Earlier,I used to observe both encaps and decaps packet counters will get incremented even if the ping is originated from one peer( Echo request & Replies). As you rightly mentioned,I also feel like the outbound packets aren't getting routed properly from the Router.I will update a diagram and configuration soon – Maverick Mar 1 '18 at 9:29
  • @Maverick You can check a simple configuration on Cisco page. Pay attention to local ident and remote ident they are your encryption domains, not your VPN peer IPs like in your output. – Hung Tran Mar 1 '18 at 9:52
  • I have a 6in4 Tunnel between AP and Router.I need to enable IPv6 connectivity between AP and router. Connectivity between fdc9:ccbe:1dc7:a6:213:50ff:fe11:b666 and FDC9:CCBE:10C0:A6:BF22:7825:C8F6:7257. Did you find anything wrong in the ACL or other router configurations? – Maverick Mar 1 '18 at 10:44
  • @Maverick Sorry, I was out last 10 hours. What IP address at router end would you like to reach? You need to ensure that IP address is covered in your crypto-map ACL match address <Intentionally Trimmed> – Hung Tran Mar 1 '18 at 20:48
  • Its Okay,I'm still stuck with the same issue. From the IPsec peer perspective,I would like to reach the 10.140.134.50 IP configured at the Fe4 port of the router. The AP is directly connected to the Fe0 SVI Port at the Router. As you can see,I have also configured a 6in4 tunnel.The IPv6 IP at AP is fdc9:ccbe:1dc7:a6:213:50ff:fe11:b666 and router is FDC9:CCBE:10C0:A6:BF22:7825:C8F6:7257. I have enable connectivity between there two peer IP as well. – Maverick Mar 2 '18 at 1:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.