The HUB is managed at a data center with external IP There are 10 remote offices.

Office 9                                    HUB - ->>  VPN   <<- -

In office 9 only, after upgrading from ADSL to EFM and replaced Cisco 887 with Cisco 1812 (both running IOS 12.4). Copied the config, replaced internet connection details.

Not sure if relevant, but there is also a router in bridge mode the EFM provider installed the 1812 connects through.

Now the ISAKMP is connected

MYCISCO#show crypto isakmp sa
dst              src              state          conn-id slot status  MM_NO_STATE       2262    0 ACTIVE (deleted)

But Phase 2 IPSEC SA will not come up. the logs produce errors:

  • transform proposal not supported for identity
  • IPSec policy invalidated proposal with error 256
  • phase 2 SA policy not acceptable!

From show log:

*Apr  2 21:44:09.198: ISAKMP:(2125):Old State = IKE_QM_READY  New State = IKE_QM_READY
*Apr  2 21:44:12.246: ISAKMP (0:2125): received packet from dport 500 sport 500 Global (I) QM_IDLE
*Apr  2 21:44:12.246: ISAKMP: set new node -505694825 to QM_IDLE
*Apr  2 21:44:12.246: crypto_engine: Decrypt IKE packet
*Apr  2 21:44:12.246: crypto_engine: Generate IKE hash
*Apr  2 21:44:12.246: ISAKMP:(2125): processing HASH payload. message ID = -505694825
*Apr  2 21:44:12.246: ISAKMP:(2125): processing SA payload. message ID = -505694825
*Apr  2 21:44:12.246: ISAKMP:(2125):Checking IPSec proposal 0
*Apr  2 21:44:12.246: ISAKMP: transform 0, ESP_AES
*Apr  2 21:44:12.246: ISAKMP:   attributes in transform:
*Apr  2 21:44:12.246: ISAKMP:      group is 5
*Apr  2 21:44:12.246: ISAKMP:      encaps is 1 (Tunnel)
*Apr  2 21:44:12.246: ISAKMP:      SA life type in seconds
*Apr  2 21:44:12.246: ISAKMP:      SA life duration (basic) of 28800
*Apr  2 21:44:12.246: ISAKMP:      authenticator is HMAC-SHA
*Apr  2 21:44:12.246: ISAKMP:      key length is 128
*Apr  2 21:44:12.246: CryptoEngine0: validate proposal
*Apr  2 21:44:12.246: ISAKMP:(2125):atts are acceptable.
*Apr  2 21:44:12.246: IPSEC(validate_proposal_request): proposal part #1
*Apr  2 21:44:12.246: IPSEC(validate_proposal_request): proposal part #1,
  (key eng. msg.) INBOUND local=, remote=,
    local_proxy= (type=4),
    remote_proxy= (type=4),
    protocol= ESP, transform= esp-aes esp-sha-hmac  (Tunnel),
    lifedur= 0s and 0kb,
    spi= 0x0(0), conn_id= 0, keysize= 128, flags= 0x0
*Apr  2 21:44:12.246: Crypto mapdb : proxy_match
        src addr     :
        dst addr     :
        protocol     : 0
        src port     : 0
        dst port     : 0
*Apr  2 21:44:12.246: IPSEC(crypto_ipsec_process_proposal): transform proposal not supported for identity:
    {esp-aes esp-sha-hmac }
*Apr  2 21:44:12.246: ISAKMP:(2125): IPSec policy invalidated proposal with error 256
*Apr  2 21:44:12.246: ISAKMP:(2125): phase 2 SA policy not acceptable! (local remote

My Configuration:

version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname MYCISCO
logging buffered 4096 debugging
no logging console
aaa new-model
aaa authentication login userauthen local
aaa authorization network groupauthor local
aaa session-id common
resource policy
clock timezone AEST 10
clock summer-time BST recurring last Sun Mar 2:00 last Sun Oct 3:00
no ip source-route
no ip gratuitous-arps
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address
ip dhcp pool VLAN1
   import all
   domain-name MYDOMAIN.COM
ip tcp path-mtu-discovery
no ip bootp server
no ip domain lookup
ip domain name MYDOMAIN.COM
ip name-server
password encryption aes
crypto pki token default removal timeout 0
no spanning-tree vlan 1
no spanning-tree vlan 2
 log config
crypto isakmp policy 3
 encr aes
 authentication pre-share
 group 5
 lifetime 3600
crypto isakmp key PRESHAREDKEY address no-xauth
crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto ipsec transform-set myset1 esp-des esp-md5-hmac
crypto ipsec transform-set myset2 esp-3des esp-md5-hmac
crypto ipsec transform-set myset3 esp-aes 256
crypto ipsec transform-set myset4 esp-aes 256 esp-md5-hmac
crypto ipsec transform-set myset5 esp-3des esp-sha-hmac
mode transport
crypto dynamic-map dynmap 10
 set transform-set myset
crypto map clientmap client authentication list userauthen
crypto map clientmap isakmp authorization list groupauthor
crypto map clientmap client configuration address respond
crypto map clientmap 1 ipsec-isakmp
 set peer
 set security-association lifetime seconds 28800
 set transform-set myset myset1 myset2 myset3 myset4 myset5
 match address 110
crypto map clientmap 10 ipsec-isakmp dynamic dynmap
bridge irb
interface FastEthernet0
 no ip address
 duplex auto
 speed auto
 pppoe enable group global
 pppoe-client dial-pool-number 1
 no shutdown
interface FastEthernet1
 no ip address
 duplex auto
 speed auto
interface BRI0
 no ip address
 encapsulation hdlc
interface FastEthernet2
interface FastEthernet3
interface FastEthernet4
interface FastEthernet5
interface FastEthernet6
interface FastEthernet7
interface FastEthernet8
interface FastEthernet9
interface Vlan1
 description Internal Network
 ip address
 ip verify unicast reverse-path
 no ip redirects
 no ip proxy-arp
 ip nat inside
 ip virtual-reassembly
 load-interval 30

 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip mtu 1492
 ip flow ingress
 ip nat outside
 ip virtual-reassembly in

interface Dialer0
no ip redirects
no ip unreachables
no ip proxy-arp

 ip address negotiated
 ip mtu 1492
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 ip tcp adjust-mss 1452
 dialer pool 1
 ppp chap hostname [email protected]
 ppp chap password 0 CHAPPASSWORD
 ppp pap sent-username [email protected] password 0 PAPPASSWORD
 ppp ipcp dns request accept
 crypto map clientmap

no ip http server
no ip http secure-server
ip nat inside source list 102 interface Dialer0 overload
ip route Dialer0
access-list 1 remark IP Addresses Permitted to login via ssh and telnet
access-list 1 permit
access-list 1 permit
access-list 1 permit
access-list 1 deny   any
access-list 3 remark NTP Server addresses
access-list 3 permit X.X.X.X
access-list 4 remark Deny All
access-list 4 deny   any
access-list 102 remark NAT
access-list 102 deny   ip
access-list 102 permit ip any

access-list 110 remark VPN 
access-list 110 permit ip
dialer-list 1 protocol ip permit
no cdp run
line con 0
line aux 0
 access-class 4 in
line vty 0 4
 access-class 1 in
 exec-timeout 500 0
 privilege level 3
 transport input telnet ssh
scheduler max-task-time 5000
scheduler interval 500
ntp access-group peer 3
ntp access-group serve 4
ntp master
ntp server X.X.X.X
webvpn context Default_context
 ssl authenticate verify all
 no inservice

I'm suspecting the Access List settings, but again this is identical to 9 other offices, and the network support team who are providing the HUB end have taken a look and the settings are all correct.

Thanks for your comments!

  • Since it's complaining about the transfer-set containing esp-aes, I'd be curious to see what happens if you change your crypto isakmp policy 3 to 'encr 3des' ?
    – VK2TDG
    Apr 3, 2014 at 7:44
  • Imho I would use the chat to solve a troubleshooting problem. Apr 3, 2014 at 7:53

1 Answer 1


Access lists aren't a problem here.

The output from show cypro isakmp sa tells you that the key negotiation is failing (MM_NO_STATE).

The log entry says that the hub wants to use a transform set (esp-aes, esp-sha-hmac) that you don't support. None of the transform sets on your router include esp-aes, esp-sha-hmac.

I suggest you add that to your list of transforms. While you're at it, unless you really need the others (myset1-5), you might as well take them out.

Your new set will be:

crypto ipsec transform-set mynewset esp-aes esp-sha-hmac

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.