2

I'm trying to build a GRE Tunnel with IPSec encryption between two routers, but I keep getting error message saying "%CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet..." Immediately I apply the ipsec on the tunnel interface, i get the error message and the tunnel goes down. The Gre tunnel works.

R2(config-if)#tunnel protection ipsec profile myprofil

R2(config-if)#
*May 25 10:19:33.432: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON
*May 25 10:19:35.248: %IOSXE-3-PLATFORM: R0/0: cpp_cp: QFP:0.0 Thread:000 TS:00000000734849689650 %IPSEC-3-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet, dest_addr= 8.8.11.2, src_addr= 8.8.10.2, prot= 47
*May 25 10:19:39.258: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to down
*May 25 10:19:39.263: %DUAL-5-NBRCHANGE: EIGRP-IPv4 100: Neighbor 10.1.3.1 (Tunnel0) is down: interface down

R1(config)#interface tunnel0

R1(config-if)#no tunnel mode ipsec ipv4

R1(config-if)#
*May 25 10:17:33.718: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to up
*May 25 10:17:48.674: %DUAL-5-NBRCHANGE: EIGRP-IPv4 100: Neighbor 10.1.3.2 (Tunnel0) is up: new adjacency

R1(config-if)#tunnel protection ipsec profile myprofil

R1(config-if)#
*May 25 10:19:38.001: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON
*May 25 10:19:43.023: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to down
*May 25 10:19:43.029: %DUAL-5-NBRCHANGE: EIGRP-IPv4 100: Neighbor 10.1.3.2 (Tunnel0) is down: interface down

R1

!
crypto isakmp policy 1
 encr 3des
 hash md5
 authentication pre-share
 group 2
crypto isakmp key paroal1234 address 8.8.11.2
!
!
crypto ipsec transform-set myset esp-3des esp-md5-hmac
 mode transport
!
!
crypto ipsec profile myprofile
 set security-association lifetime seconds 86400
 set transform-set myset
!
!
!
interface Tunnel0
 ip address 10.1.3.1 255.255.255.0
 keepalive 10 3
 tunnel source GigabitEthernet1
 tunnel destination 8.8.11.2
 tunnel protection ipsec profile myprofile
!
interface GigabitEthernet1
 ip address 8.8.10.2 255.255.255.0
 ip nat outside
 negotiation auto
 no mop enabled
 no mop sysid
!
interface GigabitEthernet2
 ip address 10.1.1.1 255.255.255.0
 ip nat inside
 negotiation auto
 no mop enabled
 no mop sysid
!
!
router eigrp 100
 network 10.0.0.0
 network 10.1.3.0 0.0.0.255
!
ip nat inside source list 1 interface GigabitEthernet1 overload
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
ip route 0.0.0.0 0.0.0.0 8.8.10.1
!

R2

!
!
crypto isakmp policy 1
 encr 3des
 hash md5
 authentication pre-share
 group 2
crypto isakmp key paroal1234 address 8.8.10.2
!
!
crypto ipsec transform-set myset esp-3des esp-md5-hmac
 mode transport
!
!
crypto ipsec profile myprofile
 set security-association lifetime seconds 86400
 set transform-set myset
!
!
!
interface Tunnel0
 ip address 10.1.3.2 255.255.255.0
 keepalive 10 3
 tunnel source GigabitEthernet1
 tunnel destination 8.8.10.2
 tunnel protection ipsec profile myprofile
!
interface GigabitEthernet1
 ip address 8.8.11.2 255.255.255.0
 ip nat outside
 negotiation auto
 no mop enabled
 no mop sysid
!
interface GigabitEthernet2
 ip address 10.1.2.1 255.255.255.0
 ip nat inside
 negotiation auto
 no mop enabled
 no mop sysid
!
!
router eigrp 100
 network 10.0.0.0
 network 10.1.3.0 0.0.0.255
!
ip nat inside source list 1 interface GigabitEthernet1 overload
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
ip route 0.0.0.0 0.0.0.0 8.8.11.1
!
  • 1
    Welcome to Network engineering! You've obviously misconfigured your routers, but unless you post the configurations (sanitized), we have no idea what that might be. – Ron Trunk May 25 '19 at 12:28
  • Hi! I edited my post and i added my routers configurations. – Lucian May 25 '19 at 12:59
  • The CRYPTO-4-RECVD_PKT_NOT_IPSEC is normal because at 10:19:35 ipsec was not yet enabled on R1, so R2 received an unencrypted GRE packet. – hertitu May 28 '19 at 21:59
  • Try removing the keepalives. See cisco.com/c/en/us/support/docs/ip/… – hertitu May 28 '19 at 21:59
  • I tried, don't work. Thanks! I resolved this problem with crypto map on physical interface. This routers are CSR 1000v, on c7200 for exemple works fine. – Lucian May 29 '19 at 7:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.