|
||||||||
I am not sure what is going on there I would start by debugging ipsec on the router side. I know it does not help you any but my 3des works great. When I have more time tonight I will send you exactly what I have in each line of both configs. I actually wanted to write a how to on it but recently I ran in to some problems with one site all of a sudden large data would not go back and forth but ssh and telnet would work. I have upgraded the IOS on the router side, now I am going to swap the 831 with a 2600 and if that works then I will finish the how to. BUt the other 4 sites I have work great on 3des. ________________________________ From: Chris Nottingham [mailto:chris at thewebgeek dot com] Sent: Tuesday, March 08, 2005 7:49 AM To: Elijah Savage; m0n0wall at lists dot m0n0 dot ch Subject: RE: [m0n0wall] m0n0 to cisco point to point ipsec Works great with single DES/MD5, but 3DES/MD5 will not complete phase 2. ________________________________ From: Elijah Savage [mailto:esavage at digitalrage dot org] Sent: Mon 3/7/2005 6:51 PM To: Chris Nottingham; m0n0wall at lists dot m0n0 dot ch Subject: RE: [m0n0wall] m0n0 to cisco point to point ipsec Let me know if you got it working. -----Original Message----- From: Chris Nottingham Sent: Sunday, March 06, 2005 6:46 PM To: Elijah Savage; m0n0wall at lists dot m0n0 dot ch Subject: RE: [m0n0wall] m0n0 to cisco point to point ipsec Elijah, Thank you for the config. I have just a couple questions to clarify the whole config. I would set my m0n0 for 3DES/MD5 for phase 1 with pre-shared secret, and phase 2 would be ESP with 3DES/MD5? What would I use for the DH group for phase 1 with this config? Thanks, Chris ------------------------------------------------------------------------ ---- This will get you started. He will need to put in the appropriate access-list 120 to send across the tunnel if he is a cisco guy he will understand this. crypto isakmp policy 11 encr 3des hash md5 authentication pre-share crypto isakmp key XXX address X.X.X.X no-xauth crypto ipsec transform-set myset esp-3des esp-md5-hmac crypto map clientmap 1 ipsec-isakmp set peer X.X.X.X set transform-set myset match address 120 Int s0/0 crypto map clientmap |