I'm too stupid to make this work. :-) What I'm trying is:
- NPE-G1 running 12.4(25c) Ent. IPSec 3DES (c7200-jk9s-mz.124-25c.bin) - Configured as "standard" MPLS PE in our network - Loopback-interface to terminate GRE tunnel on "outside" VRF - Tunnel-interface in "inside" VRF - No other interfaces apart from the global MPLS enabled - (Using a SA-VAM2, but I assume this is irrelevant) - Has to use crypto map + GRE tunnel because of other end The GRE part works fine, but I can't make it encrypt the traffic. Debug crypto gives no output at all. When trying to send traffic through the tunnel interface it ends up sending GRE traffic, i.e. not encrypting it. I tried adding the crypto map both to the loopback interface in the outside VRF and to the MPLS enabled interfaces (in global). What am I doing wrong? Is it because MPLS and IPSec just doesn't mix? The hopefully relevant part of the configuration is: ip vrf OUTSIDE-VRF description Outside VRF rd 10.0.0.1:3123 route-target export 65432:3123 route-target import 65432:3123 ! ip vrf INSIDE-VRF description Inside VRF rd 10.0.0.1:3320 route-target export 65432:3320 route-target import 65432:3320 ! ip access-list extended Crypto-map-ACL-TEST permit gre host 10.10.10.1 host 172.16.0.1 ! crypto keyring Crypto-Keyring-TEST vrf OUTSIDE-VRF pre-shared-key address 172.16.0.1 key jkB8UThDDQjHSMJdFfPM ! crypto isakmp policy 10 encr aes 256 hash md5 authentication pre-share lifetime 43200 ! crypto isakmp profile Crypto-Profile-TEST vrf INSIDE-VRF keyring Crypto-Keyring-TEST match identity address 172.16.0.1 255.255.255.255 OUTSIDE-VRF initiate mode aggressive ! crypto ipsec transform-set AES256-MD5 esp-aes 256 esp-md5-hmac ! crypto map Crypto-Map-TEST local-address Loopback3123 crypto map Crypto-Map-TEST 10 ipsec-isakmp set peer 172.16.0.1 set transform-set AES256-MD5 set isakmp-profile Crypto-Profile-TEST match address Crypto-map-ACL-TEST ! interface Loopback0 description Core loopback ip address 10.0.0.1 255.255.255.255 ! interface Loopback3123 description Interface in outside VRF ip vrf forwarding OUTSIDE-VRF ip address 10.10.10.1 255.255.255.255 ! interface Tunnel3320 description GRE tunnel ip vrf forwarding INSIDE-VRF ip address 192.168.0.1 255.255.255.252 tunnel source Loopback3123 tunnel destination 172.16.0.1 tunnel vrf OUTSIDE-VRF ! interface GigabitEthernet0/1 description MPLS core-facing interface mtu 9216 ip address 10.0.5.1 255.255.255.252 mpls ip crypto map Crypto-Map-TEST ! interface GigabitEthernet0/2 description MPLS core-facing interface mtu 9216 ip address 10.0.5.5 255.255.255.252 mpls ip crypto map Crypto-Map-TEST ! -- Peter _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
