Hello community,
I have configured Site-to-Site IPsec VPN as per the topology shown here but for some reason my routers are not negotiating Phase1 or Phase2. I have checked my configs multiple times and still do not know what can be wrong so I was hoping someone could take a quick look and point out any erros I might have made to make this work please. Thank you very much in advance and here are the configurations:
R1
interface Loopback0
ip address 1.1.1.1 255.255.255.0
end
interface Serial0/0
ip address 12.0.0.1 255.255.255.252
clock rate 2000000
crypto map R1-R3
end
router bgp 1
no synchronization
bgp log-neighbor-changes
network 12.0.0.0 mask 255.255.255.252
neighbor 12.0.0.2 remote-as 2
no auto-summary
crypto isakmp policy 5
encr aes
authentication pre-share
group 5
lifetime 50000
crypto isakmp key cisco123 address 23.0.0.1 255.255.255.252
crypto ipsec security-association lifetime seconds 50000
crypto ipsec transform-set VPN esp-aes 192 esp-sha-hmac
crypto map R1-R3 5 ipsec-isakmp
set peer 23.0.0.1
set transform-set VPN
match address 150
access-list 150 permit ip 1.1.1.0 0.0.0.255 3.3.3.0 0.0.0.255
R2
interface Serial0/0
ip address 12.0.0.2 255.255.255.252
clock rate 2000000
end
interface Serial0/1
ip address 23.0.0.2 255.255.255.252
clock rate 2000000
end
router bgp 2
no synchronization
bgp log-neighbor-changes
neighbor 12.0.0.1 remote-as 1
neighbor 23.0.0.1 remote-as 3
no auto-summary
R3
interface Loopback0
ip address 3.3.3.3 255.255.255.0
end
interface Serial0/0
ip address 23.0.0.1 255.255.255.252
clock rate 2000000
crypto map R1-R3
end
router bgp 3
no synchronization
bgp log-neighbor-changes
network 23.0.0.0 mask 255.255.255.252
neighbor 23.0.0.2 remote-as 2
no auto-summary
crypto isakmp policy 5
encr aes
authentication pre-share
group 5
lifetime 50000
crypto isakmp key cisco123 address 12.0.0.1 255.255.255.252
crypto ipsec security-association lifetime seconds 50000
crypto ipsec transform-set VPN esp-aes 192 esp-sha-hmac
crypto map R1-R3 5 ipsec-isakmp
set peer 12.0.0.1
set transform-set VPN
match address 150
access-list 150 permit ip 3.3.3.0 0.0.0.255 1.1.1.0 0.0.0.255
Verification Commands:
R1(config)#do show crypto isakmp sa
dst src state conn-id slot status
R1(config)#do show crypto ipsec sa
interface: Serial0/0
Crypto map tag: R1-R3, local addr 12.0.0.1
protected vrf: (none)
local ident (addr/mask/prot/port): (1.1.1.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (3.3.3.0/255.255.255.0/0/0)
current_peer 23.0.0.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 12.0.0.1, remote crypto endpt.: 23.0.0.1
path mtu 1500, ip mtu 1500, ip mtu idb Serial0/0
current outbound spi: 0x0(0)
inbound esp sas:
inbound ah sas:
inbound pcp sas:
outbound esp sas:
outbound ah sas:
outbound pcp sas:
R1(config)#do ping 23.0.0.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 23.0.0.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/22/36 ms