We're attempting to bring up an IPSEC tunnel with a Vendor. An engineer created the crypto map and wasnt able to establish a connection. I edited the entry to change the diffie-hillman group and the lifetime. The SA table doesn't show the change in those parameters. Do I need to delete that entry in the crypto map and then recreate it?

Here's the crypto map right now:

Crypto Map IPv4 "ToVendor" 18 ipsec-isakmp
Description: To_Monitor
Peer = x.x.x.x
Extended IP access list 123
access-list 123 permit ip host
access-list 123 permit ip host
access-list 123 permit ip host
access-list 123 permit ip host
access-list 123 permit ip host
Current peer: x.x.x.x
Security association lifetime: 4608000 kilobytes/28800 seconds
Responder-Only (Y/N): N
**PFS (Y/N): Y
DH group: group5**
Mixed-mode : Disabled
Transform sets={
ESP-AES-256-SHA256: { esp-256-aes esp-sha256-hmac } ,
Interfaces using crypto map ToVendor:


Here's the shortened output for the crytpo ipsec sa:

protected vrf: (none)
local ident (addr/mask/prot/port): (
remote ident (addr/mask/prot/port): (
current_peer x.x.x.x port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0

local crypto endpt.: x.x.x.x, remote crypto endpt.: x.x.x.x
plaintext mtu 1500, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/1
current outbound spi: 0x0(0)
**PFS (Y/N): N, DH group: none**

inbound esp sas:

inbound ah sas:

inbound pcp sas:

outbound esp sas:

outbound ah sas:

outbound pcp sas:
  • What kind of device is this?
    – Ron Trunk
    Nov 11 '20 at 17:42
  • Cisco 2911. Version 15.4
    – GH312
    Nov 11 '20 at 17:53
  • 1
    Did you drop the SA and let it renegotiate?
    – Ron Trunk
    Nov 11 '20 at 18:36
  • No I havent. Thats what I'm trying to figure out. When you say drop the SA, what do you mean exactly? I'm thinking just deleting that "18" sequence in the crypto map and adding it again.
    – GH312
    Nov 11 '20 at 18:44
  • 1
    Try clear crypto ipsec sa peer <addr> or clear crypto sa peer <addr>, whichever syntax your box accepts. Nov 12 '20 at 13:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.