877 using fe as WAN (ISP provider modem/router) - VPN won't come up!

Question

Hi,
Due some changes with our ISP, the atm interface on the 877 router won't support stable connections anymore. The fix I'm having to do is to use our ISP provided modem/router, and have the 877 use an fe port as a WAN port and instigate the VPN from there.
I've had issues with getting the WAN port to work correctly that I got fixed here:
https://supportforums.cisco.com/message/4090973
Now I've got to get this bit going then I'm all good!
Basic set up is:
Remote firewall <-> internet <-> local ISP (modem/router) <-> Cisco 877 <-> laptop/switch etc
172.20.0.0/16                             192.168.1.254       192.168.1.139    172.30.99.1     172.30.99.0/24
Current config is:
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug uptime
service timestamps log uptime
service password-encryption
hostname ITTEST
boot-start-marker
boot system flash:c870-advipservicesk9-mz.124-24.T6.bin
boot-end-marker
logging message-counter syslog
logging buffered 10240
enable secret
enable password
no aaa new-model
clock timezone GMT 0
clock summer-time BST recurring last Sun Mar 1:00 last Sun Oct 2:00
dot11 syslog
no ip source-route
ip dhcp excluded-address 172.30.99.1 172.30.99.100
ip dhcp pool dhcppool
   import all
   network 172.30.99.0 255.255.255.0
   default-router 172.30.99.1
   dns-server 172.30.99.1 172.20.0.120 172.20.0.121
   domain-name gratte.com
   update arp
ip cef
ip domain name gratte.com
ip name-server 192.168.1.254
ip name-server 172.20.0.120
ip name-server 172.20.0.121
no ipv6 cef
multilink bundle-name authenticated
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key <presharedkey> address xxx.xxx.xxx.xxx no-xauth
crypto ipsec transform-set 3DESSHA esp-3des esp-sha-hmac
crypto ipsec profile IPSEC-VPN
set transform-set 3DESSHA
archive
log config
  hidekeys
interface Tunnel0
description --- IPSec Tunnel to KX ---
ip address 172.30.99.10 255.255.255.252
ip ospf mtu-ignore
load-interval 30
tunnel source Vlan1
tunnel destination xxx.xxx.xxx.xxx
tunnel mode ipsec ipv4
tunnel protection ipsec profile IPSEC-VPN
interface ATM0
no ip address
shutdown
no atm ilmi-keepalive
interface FastEthernet0
description DATA
spanning-tree portfast
interface FastEthernet1
description VOICE
switchport access vlan 100
switchport voice vlan 100
spanning-tree portfast
interface FastEthernet2
shutdown
interface FastEthernet3
switchport access vlan 666
no cdp enable
spanning-tree portfast
interface Vlan1
ip address 172.30.99.1 255.255.255.252
ip nat inside
ip virtual-reassembly
interface Vlan666
ip address 192.168.1.139 255.255.255.0
ip nat outside
ip virtual-reassembly
interface Dialer0
no ip address
ip default-gateway 192.168.1.254
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 192.168.1.254
ip route 10.20.0.0 255.255.0.0 Tunnel0
ip route 10.21.0.0 255.255.0.0 Tunnel0
ip route 64.156.192.220 255.255.255.255 Tunnel0
ip route 64.156.192.245 255.255.255.255 Tunnel0
ip route 74.50.50.16 255.255.255.255 Tunnel0
ip route 74.50.63.14 255.255.255.255 Tunnel0
ip route 172.16.0.0 255.240.0.0 Tunnel0
ip route 172.30.99.0 255.255.255.0 Vlan1
no ip http server
no ip http secure-server
ip dns server
ip nat inside source list 100 interface Vlan666 overload
access-list 100 permit ip 172.30.99.0 0.0.0.255 any
access-list 199 permit icmp any any
snmp-server community public RO
snmp-server community blobby RW
control-plane
line con 0
password
login
no modem enable
line aux 0
line vty 0 4
password
login
scheduler max-task-time 5000
ntp server 72.8.140.222
ntp server 172.20.0.120
ntp server 172.20.0.121
end
Hope someone can help!

Answer 1

And pretty much an hour to the time of when it dropped out, it's kicked back in:
02:00:40: ISAKMP (0): received packet from dport 500 sport 500 Global (N) NEW SA
02:00:40: %CRYPTO-4-IKMP_NO_SA: IKE message from has no SA and is not an initialization offer
02:00:42: ISAKMP (0): received packet from dport 500 sport 500 Global (N) NEW SA
02:00:45: ISAKMP (0): received packet from dport 500 sport 500 Global (N) NEW SA
02:00:45: ISAKMP (0): received packet from dport 500 sport 500 Global (N) NEW SA
02:00:50: ISAKMP (0): received packet from dport 500 sport 500 Global (N) NEW SA
02:00:50: ISAKMP (0): received packet from dport 500 sport 500 Global (N) NEW SA
02:00:55: ISAKMP (0): received packet from dport 500 sport 500 Global (N) NEW SA
02:00:57: IPSEC(sa_request): ,
  (key eng. msg.) OUTBOUND local= 172.30.99.1, remote= ,
    local_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4),
    remote_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4),
    protocol= ESP, transform= esp-3des esp-sha-hmac  (Tunnel),
    lifedur= 3600s and 4608000kb,
    spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x0
02:00:57: IPSEC(lifetime_expiry): SA lifetime threshold reached, expiring in 68 seconds
02:00:57: ISAKMP: set new node 0 to QM_IDLE
02:00:57: SA has outstanding requests  (local 132.76.193.228 port 500, remote 132.76.193.200 port 500)
02:00:57: ISAKMP:(2002): sitting IDLE. Starting QM immediately (QM_IDLE      )
02:00:57: ISAKMP:(2002):beginning Quick Mode exchange, M-ID of 1560671909
02:00:57: ISAKMP:(2002):QM Initiator gets spi
02:00:57: ISAKMP:(2002): sending packet to my_port 500 peer_port 500 (I) QM_IDLE
02:00:57: ISAKMP:(2002):Sending an IKE IPv4 Packet.
02:00:57: ISAKMP:(2002):Node 1560671909, Input = IKE_MESG_INTERNAL, IKE_INIT_QM
02:00:57: ISAKMP:(2002):Old State = IKE_QM_READY  New State = IKE_QM_I_QM1
02:00:58: ISAKMP (2002): received packet from dport 500 sport 500 Global (I) QM_IDLE
02:00:58: ISAKMP: set new node 1105416027 to QM_IDLE
02:00:58: ISAKMP:(2002): processing HASH payload. message ID = 1105416027
02:00:58: ISAKMP:(2002): processing SA payload. message ID = 1105416027
02:00:58: ISAKMP:(2002):Checking IPSec proposal 1
02:00:58: ISAKMP: transform 1, ESP_3DES
02:00:58: ISAKMP:   attributes in transform:
02:00:58: ISAKMP:      SA life type in seconds
02:00:58: ISAKMP:      SA life duration (basic) of 3600
02:00:58: ISAKMP:      encaps is 1 (Tunnel)
02:00:58: ISAKMP:      key length is 192
02:00:58: ISAKMP:      authenticator is HMAC-SHA
02:00:58: ISAKMP:(2002):atts are acceptable.
02:00:58: ISAKMP:(2002):Checking IPSec proposal 1
02:00:58: ISAKMP: transform 2, ESP_3DES
02:00:58: ISAKMP:   attributes in transform:
02:00:58: ISAKMP:      SA life type in seconds
02:00:58: ISAKMP:      SA life duration (basic) of 3600
02:00:58: ISAKMP:      encaps is 1 (Tunnel)
02:00:58: ISAKMP:      authenticator is HMAC-SHA
02:00:58: ISAKMP:(2002):atts are acceptable.
02:00:58: IPSEC(validate_proposal_request): proposal part #1
02:00:58: IPSEC(validate_proposal_request): proposal part #1,
  (key eng. msg.) INBOUND local= 172.30.99.1, remote= ,
    local_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4),
    remote_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4),
    protocol= ESP, transform= NONE  (Tunnel),
    lifedur= 0s and 0kb,
    spi= 0x0(0), conn_id= 0, keysize= 192, flags= 0x0
02:00:58: Crypto mapdb : proxy_match
        src addr     : 0.0.0.0
        dst addr     : 0.0.0.0
        protocol     : 0
        src port     : 0
        dst port     : 0
02:00:58: ISAKMP:(2002): processing NONCE payload. message ID = 1105416027
02:00:58: ISAKMP:(2002): processing ID payload. message ID = 1105416027
02:00:58: ISAKMP:(2002): processing ID payload. message ID = 1105416027
02:00:58: ISAKMP:(2002):QM Responder gets spi
02:00:58: ISAKMP:(2002):Node 1105416027, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
02:00:58: ISAKMP:(2002):Old State = IKE_QM_READY  New State = IKE_QM_SPI_STARVE
02:00:58: ISAKMP:(2002): Creating IPSec SAs
02:00:58:         inbound SA from to 172.30.99.1 (f/i)  0/ 0
        (proxy 0.0.0.0 to 0.0.0.0)
02:00:58:         has spi 0x48E03F51 and conn_id 0
02:00:58:         lifetime of 3600 seconds
02:00:58:         outbound SA from 172.30.99.1 to (f/i) 0/0
        (proxy 0.0.0.0 to 0.0.0.0)
02:00:58:         has spi  0xD4AF8B3C and conn_id 0
02:00:58:         lifetime of 3600 seconds
02:00:58: ISAKMP:(2002): sending packet to my_port 500 peer_port 500 (I) QM_IDLE
02:00:58: ISAKMP:(2002):Sending an IKE IPv4 Packet.
02:00:58: ISAKMP:(2002):Node 1105416027, Input = IKE_MESG_INTERNAL, IKE_GOT_SPI
02:00:58: ISAKMP:(2002):Old State = IKE_QM_SPI_STARVE  New State = IKE_QM_R_QM2
02:00:58: IPSEC(key_engine): got a queue event with 1 KMI message(s)
02:00:58: Crypto mapdb : proxy_match
        src addr     : 0.0.0.0
        dst addr     : 0.0.0.0
        protocol     : 0
        src port     : 0
        dst port     : 0
02:00:58: IPSEC(crypto_ipsec_sa_find_ident_head): reconnecting with the same proxies and peer
02:00:58: IPSEC(create_sa): sa created,
  (sa) sa_dest= 172.30.99.1, sa_proto= 50,
    sa_spi= 0x48E03F51(1222655825),
    sa_trans= esp-3des esp-sha-hmac , sa_conn_id= 5
    sa_lifetime(k/sec)= (4450631/3600)
02:00:58: IPSEC(create_sa): sa created,
  (sa) sa_dest= , sa_proto= 50,
    sa_spi= 0xD4AF8B3C(3568274236),
    sa_trans= esp-3des esp-sha-hmac , sa_conn_id= 6
    sa_lifetime(k/sec)= (4450631/3600)
02:00:58: ISAKMP (2002): received packet from dport 500 sport 500 Global (I) QM_IDLE
02:00:58: ISAKMP:(2002):deleting node 1105416027 error FALSE reason "QM done (await)"
02:00:58: ISAKMP:(2002):Node 1105416027, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
02:00:58: ISAKMP:(2002):Old State = IKE_QM_R_QM2  New State = IKE_QM_PHASE2_COMPLETE
02:00:58: IPSEC(key_engine): got a queue event with 1 KMI message(s)
02:00:58: IPSEC(key_engine_enable_outbound): rec'd enable notify from ISAKMP
02:00:58: IPSEC(key_engine_enable_outbound): enable SA with spi 3568274236/50
02:00:58: IPSEC(update_current_outbound_sa): updated peer current outbound sa to SPI D4AF8B3C
02:00:59: ISAKMP (2002): received packet from dport 500 sport 500 Global (I) QM_IDLE
02:00:59: ISAKMP: set new node -1124267365 to QM_IDLE
02:00:59: ISAKMP:(2002): processing HASH payload. message ID = -1124267365
02:00:59: ISAKMP:(2002): processing DELETE payload. message ID = -1124267365
02:00:59: ISAKMP:(2002):peer does not do paranoid keepalives.
02:00:59: ISAKMP:(2002):deleting node -1124267365 error FALSE reason "Informational (in) state 1"
02:00:59: IPSEC(key_engine): got a queue event with 1 KMI message(s)
02:00:59: IPSEC(key_engine_delete_sas): rec'd delete notify from ISAKMP
02:00:59: IPSEC(key_engine_delete_sas): delete SA with spi 0xBDD33AB1 proto 50 for
02:00:59: IPSEC(delete_sa): deleting SA,
  (sa) sa_dest= 172.30.99.1, sa_proto= 50,
    sa_spi= 0x539777E6(1402435558),
    sa_trans= esp-3des esp-sha-hmac , sa_conn_id= 3
    sa_lifetime(k/sec)= (4412467/3600),
  (identity) local= 172.30.99.1, remote= ,
    local_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4),
    remote_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4)
02:00:59: IPSEC(delete_sa): deleting SA,
  (sa) sa_dest= , sa_proto= 50,
    sa_spi= 0xBDD33AB1(3184736945),
    sa_trans= esp-3des esp-sha-hmac , sa_conn_id= 4
    sa_lifetime(k/sec)= (4412467/3600),
  (identity) local= 172.30.99.1, remote= ,
    local_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4),
    remote_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4)
02:01:00: ISAKMP (2002): received packet from dport 500 sport 500 Global (I) QM_IDLE
02:01:00: ISAKMP: set new node -2105526428 to QM_IDLE
02:01:00: ISAKMP:(2002): processing HASH payload. message ID = -2105526428
02:01:00: ISAKMP:(2002): processing NOTIFY DPD/R_U_THERE protocol 1
        spi 0, message ID = -2105526428, sa = 844CC060
02:01:00: ISAKMP:(2002):deleting node -2105526428 error FALSE reason "Informational (in) state 1"
02:01:00: ISAKMP:(2002):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY
02:01:00: ISAKMP:(2002):Old State = IKE_P1_COMPLETE  New State = IKE_P1_COMPLETE
02:01:00: ISAKMP:(2002):DPD/R_U_THERE received from peer , sequence 0x22D
02:01:00: ISAKMP: set new node 971443288 to QM_IDLE
02:01:00: ISAKMP:(2002):Sending NOTIFY DPD/R_U_THERE_ACK protocol 1
        spi 2220478360, message ID = 971443288
02:01:00: ISAKMP:(2002): seq. no 0x22D
02:01:00: ISAKMP:(2002): sending packet to my_port 500 peer_port 500 (I) QM_IDLE
02:01:00: ISAKMP:(2002):Sending an IKE IPv4 Packet.
02:01:00: ISAKMP:(2002):purging node 971443288
02:01:00: ISAKMP:(2002):Input = IKE_MESG_FROM_PEER, IKE_MESG_KEEP_ALIVE
02:01:00: ISAKMP:(2002):Old State = IKE_P1_COMPLETE  New State = IKE_P1_COMPLETE
02:01:02: ISAKMP (2002): received packet from dport 500 sport 500 Global (I) QM_IDLE
02:01:02: ISAKMP:(2002): processing HASH payload. message ID = 1560671909
02:01:02: ISAKMP:(2002): processing SA payload. message ID = 1560671909
02:01:02: ISAKMP:(2002):Checking IPSec proposal 1
02:01:02: ISAKMP: transform 1, ESP_3DES
02:01:02: ISAKMP:   attributes in transform:
02:01:02: ISAKMP:      encaps is 1 (Tunnel)
02:01:02: ISAKMP:      SA life type in seconds
02:01:02: ISAKMP:      SA life duration (basic) of 3600
02:01:02: ISAKMP:      SA life type in kilobytes
02:01:02: ISAKMP:      SA life duration (VPI) of  0x0 0x46 0x50 0x0
02:01:02: ISAKMP:      authenticator is HMAC-SHA
02:01:02: ISAKMP:(2002):atts are acceptable.
02:01:02: IPSEC(validate_proposal_request): proposal part #1
02:01:02: IPSEC(validate_proposal_request): proposal part #1,
  (key eng. msg.) INBOUND local= 172.30.99.1, remote= ,
    local_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4),
    remote_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4),
    protocol= ESP, transform= NONE  (Tunnel),
    lifedur= 0s and 0kb,
    spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x0
02:01:02: Crypto mapdb : proxy_match
        src addr     : 0.0.0.0
        dst addr     : 0.0.0.0
        protocol     : 0
        src port     : 0
        dst port     : 0
02:01:02: ISAKMP:(2002): processing NONCE payload. message ID = 1560671909
02:01:02: ISAKMP:(2002): processing ID payload. message ID = 1560671909
02:01:02: ISAKMP:(2002): processing ID payload. message ID = 1560671909
02:01:02: ISAKMP:(2002): Creating IPSec SAs
02:01:02:         inbound SA from to 172.30.99.1 (f/i)  0/ 0
        (proxy 0.0.0.0 to 0.0.0.0)
02:01:02:         has spi 0x84F77E7D and conn_id 0
02:01:02:         lifetime of 3600 seconds
02:01:02:         lifetime of 4608000 kilobytes
02:01:02:         outbound SA from 172.30.99.1 to (f/i) 0/0
        (proxy 0.0.0.0 to 0.0.0.0)
02:01:02:         has spi  0xCA486707 and conn_id 0
02:01:02:         lifetime of 3600 seconds
02:01:02:         lifetime of 4608000 kilobytes
02:01:02: ISAKMP:(2002): sending packet to my_port 500 peer_port 500 (I) QM_IDLE
02:01:02: ISAKMP:(2002):Sending an IKE IPv4 Packet.
02:01:02: ISAKMP:(2002):deleting node 1560671909 error FALSE reason "No Error"
02:01:02: ISAKMP:(2002):Node 1560671909, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
02:01:02: ISAKMP:(2002):Old State = IKE_QM_I_QM1  New State = IKE_QM_PHASE2_COMPLETE
02:01:02: IPSEC(key_engine): got a queue event with 1 KMI message(s)
02:01:02: Crypto mapdb : proxy_match
        src addr     : 0.0.0.0
        dst addr     : 0.0.0.0
        protocol     : 0
        src port     : 0
        dst port     : 0
02:01:02: IPSEC(crypto_ipsec_sa_find_ident_head): reconnecting with the same proxies and peer
02:01:02: IPSEC(create_sa): sa created,
  (sa) sa_dest= 172.30.99.1, sa_proto= 50,
    sa_spi= 0x84F77E7D(2230812285),
    sa_trans= esp-3des esp-sha-hmac , sa_conn_id= 7
    sa_lifetime(k/sec)= (4550947/3600)
02:01:02: IPSEC(create_sa): sa created,
  (sa) sa_dest= , sa_proto= 50,
    sa_spi= 0xCA486707(3393742599),
    sa_trans= esp-3des esp-sha-hmac , sa_conn_id= 8
    sa_lifetime(k/sec)= (4550947/3600)
02:01:02: IPSEC(update_current_outbound_sa): updated peer current outbound sa to SPI CA486707
02:01:02: IPSEC(check_delete_duplicate_sa_bundle): found duplicated fresh SA bundle, aging it out. min_spi=48E03F51
02:01:02: IPSEC(early_age_out_sibling): sibling outbound SPI D4AF8B3C expiring in 30 seconds due to it's a duplicate SA bundle.
02:01:03: ISAKMP (2002): received packet from dport 500 sport 500 Global (I) QM_IDLE
02:01:03: ISAKMP: set new node 2041302203 to QM_IDLE
02:01:03: ISAKMP:(2002): processing HASH payload. message ID = 2041302203
02:01:03: ISAKMP:(2002): processing DELETE payload. message ID = 2041302203
02:01:03: ISAKMP:(2002):peer does not do paranoid keepalives.
02:01:03: ISAKMP:(2002):deleting node 2041302203 error FALSE reason "Informational (in) state 1"
02:01:03: IPSEC(key_engine): got a queue event with 1 KMI message(s)
02:01:03: IPSEC(key_engine_delete_sas): rec'd delete notify from ISAKMP
02:01:03: IPSEC(key_engine_delete_sas): delete SA with spi 0xD4AF8B3C proto 50 for
02:01:03: IPSEC(delete_sa): deleting SA,
  (sa) sa_dest= 172.30.99.1, sa_proto= 50,
    sa_spi= 0x48E03F51(1222655825),
    sa_trans= esp-3des esp-sha-hmac , sa_conn_id= 5
    sa_lifetime(k/sec)= (4450631/3600),
  (identity) local= 172.30.99.1, remote= ,
    local_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4),
    remote_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4)
02:01:03: IPSEC(delete_sa): deleting SA,
  (sa) sa_dest= , sa_proto= 50,
    sa_spi= 0xD4AF8B3C(3568274236),
    sa_trans= esp-3des esp-sha-hmac , sa_conn_id= 6
    sa_lifetime(k/sec)= (4450631/3600),
  (identity) local= 172.30.99.1, remote= ,
    local_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4),
    remote_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4)
02:01:48: ISAKMP:(2002):purging node 1105416027
02:01:49: ISAKMP:(2002):purging node -1124267365
02:01:50: ISAKMP:(2002):purging node -2105526428
02:01:52: ISAKMP:(2002):purging node 1560671909
02:01:53: ISAKMP:(2002):purging node 2041302203