I need some help on the IPSEC…
my MT’s are wlan1-10.0.5.1 and wlan2-10.0.5.3…I read the docs and used the examples…to no avail…
when I enable them I lose the connection and can’t even ping…the other host…any ideas…
ip ipsec counters> pri
out-accept: 29308684
out-accept-isakmp: 10
out-drop: 45
out-encrypt: 0
in-accept: 29276712
in-accept-isakmp: 41
in-drop: 0
in-decrypted: 0
in-drop-encrypted-expected: 0
This is important to us to be able to do for security on the wireless can I get some help here please
Here are my config’s for one of the MT boxes I know it is disabled now but do you see why I should get what am getting in the log file…both machines are configured the same other then the addresses are reversed…the 10.0.5.1 is not a production box just setting it up without much luck w/IPSEC…
Policy:
0 X src-address=10.0.5.3/32:500 dst-address=10.0.5.1/32:any protocol=all action=encrypt
level=require ipsec-protocols=esp tunnel=no sa-src-address=10.0.5.3 sa-dst-address=10.0.5.1
proposal=default manual-sa=none dont-fragment=clear
Peer: 0 X address=10.0.5.1/32:500 secret=“gvejimezyfopmekun” generate-policy=yes exchange-mode=aggressive
send-initial-contact=no proposal-check=obey hash-algorithm=md5 enc-algorithm=3des
dh-group=modp1024 lifetime=1d lifebytes=0
Log file:
queuing SA request, phase 1 with peer 10.0.5.3 will be
established first >
sep/18/2004 10:25:48 initiating phase 1, starting mode Aggressive (local
10.0.5.1:500) (remote unknown) >
sep/18/2004 10:25:48 ipsec packet discarded: src=10.0.5.1 dst=10.0.5.3
sep/18/2004 10:25:48 received ISAKMP packet from 10.0.5.3:500, phase 1, Aggressive
sep/18/2004 10:25:48 responding phase 1, starting mode Aggressive (local
10.0.5.1:500) (remote10.0.5.3:500) >
sep/18/2004 10:25:51 ipsec packet discarded: src=10.0.5.1 dst=10.0.5.3
sep/18/2004 10:25:57 ipsec packet discarded: src=10.0.5.1 dst=10.0.5.3
sep/18/2004 10:25:58 retransmitted packet, ignoring (remote unknown)
sep/18/2004 10:26:08 retransmitted packet, ignoring (remote unknown)
sep/18/2004 10:26:18 retransmitted packet, ignoring (remote unknown)
sep/18/2004 10:26:19 dequeuing SA request to 10.0.5.3, phase 1 wait timed out
sep/18/2004 10:26:48 phase 1 negotiation timed out
sep/18/2004 10:26:48 phase 1 negotiation timed out
sep/18/2004 10:41:38 ipsec peer changed by admin
sep/18/2004 10:43:11 queuing SA request, phase 1 with peer 10.0.5.3 will be
established first >
sep/18/2004 10:43:11 initiating phase 1, starting mode Aggressive (local
10.0.5.1:500) (remote unknown) >
sep/18/2004 10:43:11 ipsec packet discarded: src=10.0.5.1 dst=10.0.5.3
sep/18/2004 10:43:12 ipsec packet discarded: src=10.0.5.1 dst=10.0.5.3
sep/18/2004 10:43:14 ipsec packet discarded: src=10.0.5.1 dst=10.0.5.3