3

I am trying to create a GRE/IPsec tunnel between Cisco router and a Linux Router. The tunnel is UP and active, but when I do a "show crypto session" on the Cisco router the Active SA's keep on increasing and reach a limit of 2800 and then restarts again. The IPsec SPI is rekey and keeps on increasing on both the sides. The Phase1(86400 sec) and Phase2(3600 sec) lifetimes, policies are also the same on both the sides. Is there any rekeying parameter I am missing in terms of configuration. What am I missing ? Seems like a small parameter change to me ? Please find below the configurations on Cisco & Linux router:

Cisco 2901

crypto isakmp policy 20  
 encr aes 256  
 authentication pre-share  
 group 2  
crypto isakmp key PASS address 192.168.12.192  
crypto isakmp invalid-spi-recovery  
crypto isakmp keepalive 10 4 periodic  
!  
!  
crypto ipsec transform-set AES esp-aes 256 esp-sha-hmac  
 mode transport  
!  
!
!  
crypto map remote-sites 20 ipsec-isakmp  
 set peer 192.168.12.192  
 set transform-set AES  
 match address 100  
!  
!
!
!
!  
interface Loopback120  
 ip address 12.12.12.12 255.255.255.0  
!  
interface Tunnel0  
 ip address 10.10.10.1 255.255.255.252  
 tunnel source 192.168.12.10  
 tunnel destination 192.168.12.192  
!  
interface Embedded-Service-Engine0/0  
 no ip address  
!  
interface GigabitEthernet0/0  
 ip address 192.168.12.10 255.255.255.0  
 duplex auto  
 speed auto  
 crypto map remote-sites  
!  
!
!  
ip forward-protocol nd  
!  
!  
ip route 0.0.0.0 0.0.0.0 192.168.12.1  
!  
access-list 100 permit gre host 192.168.12.10 host 192.168.12.192

Linux Router

en01  
ipaddress 192.168.12.192/24  
interface up  

gre12  
ipaddress 10.10.10.2 peer 10.10.10.1  
tunnel 192.168.12.192 192.168.12.10  
key disable  
checksum disable  
interface up  
exit  

loopback12  
ipaddress 14.14.14.14/24  

sec  
ipsec enable  
psk 192.168.12.10 PASS  
vpn-template VZN 1 main aes256 sha1 24 hour 2 pre-shared-key address aes256 hmac-sha1 1 hour none  
vpn TESTVPN VZN 192.168.12.192 192.168.12.10  
ipsec-rule TESTVPN-rule 192.168.12.192 192.168.12.10 47 esp transport TESTVPN

Please let me know if I have missed to share something important.

Improve this question
5
  • 1
    Please edit your question to include both router's configurations. Otherwise, we're just guessing.
    – Ron Trunk
    Jul 18, 2018 at 18:38
  • 1
    Enable debug crypto isakmp and debug crypto ipsec on the cisco and see what that tells you.
    – hertitu
    Jul 19, 2018 at 0:01
  • I have the outputs from the above commands, and I am trying to see if I can find something but I am not having any luck. What would be the best way to share the output here ???
    – jani
    Jul 19, 2018 at 15:13
  • Just so we know, what linux IPSec implementation are you using? Strongswan?
    – Mike Pennington
    Jul 23, 2018 at 16:30
  • It is a 6wind Turbo IPsec router based on StrongSwan.
    – jani
    Jul 27, 2018 at 22:01

2 Answers 2

Reset to default
1

We had to change the lifetime durations for IKE Phase1 & Phase 2 on the Linux Box to get the result. It was more of a bug/tweaking required on the Linux Router. Thank you for all your help!!!

Improve this answer
2
  • You should accept your answer so that the question doesn't keep popping up forever, looking for an answer.
    – Ron Maupin ♦
    Jul 23, 2018 at 15:42
  • Sorry about this. I will remember it in the future.
    – jani
    Jul 23, 2018 at 15:46
0

You aren't actually routing anything through the tunnels, so maybe the SA is disconnecting as there is no traffic matching the crypto-map. Try creating the following route on the Cisco side:

ip route 14.14.14.0 255.255.255.0 10.10.10.2

Also, create something similar on the Linux box:

route add -net 12.12.12.0/24 gw 10.10.10.1

This would force any traffic destined for the loopback on the other side over the tunnel. The tunnel traffic then matches the crypto-map and is encrypted. You would need to sent traffic regularly between the loopbacks to keep the SA up.

I can see this is likely a test setup, but you would benefit from some other interfaces on each device, to route traffic from/to, i.e. some additional LAN networks that host clients that would route between the devices over the IPsec tunnel.

Improve this answer
4
  • Thank you for the response Karl. I added the routes on both the sides, but still when the tunnel comes up, it continously starts producing the Active SA's and stops at 2800. Then it starts again. And Yes, This is a test setup, with these 2 devices connected to a Switch. I have also tried to connect them to each other (Cisco Router and Linux Router) and form a tunnel but it still builds Active SA's continuously.
    – jani
    Jul 19, 2018 at 14:11
  • Have you tried generating traffic across the tunnel? Does the counter reset if you ping 10.10.10.2 from 10.10.10.1?
    – user27899
    Jul 19, 2018 at 14:31
  • The counter doesnt reset by I ping 10.10.10.2 from 10.10.10.1
    – jani
    Jul 19, 2018 at 14:40
  • OK, must be something else causing the issue
    – user27899
    Jul 19, 2018 at 14:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.