GET VPN error

GET VPN - pre-shared keys - ver. 15.1.M4
Attempting to get 1st group member connected to the key server; Receiving the following error:
%CRYPTO-6-IKMP_MODE_FAILURE: Processing of Informational mode failed with peer 10.100.1.3
Any ideas?
Configs are:
KS - 10.100.1.3
crypto isakmp policy 10
encr aes
group 2
crypto isakmp key Cisco address 192.168.252.166
crypto ipsec transform-set new-trans esp-aes esp-sha-hmac
crypto ipsec profile gdoi-profile-getvpn
set security-association lifetime seconds 900
set transform-set new-trans
crypto gdoi group getvpn
identity number 10
server local
rekey retransmit 10 number 2
rekey authentication mypubkey rsa getvpn-export-general
rekey transport unicast
sa ipsec 1
   profile gdoi-profile-getvpn
   match address ipv4 getvpn-acl
   replay time window-size 5
address ipv4 10.100.1.3
ip access-list extended getvpn-acl
deny   tcp any any eq 848
deny   tcp any eq 848 any
remark ACL policies to be pushed to GMs
deny   tcp any any eq 22
deny   tcp any eq 22 any
deny   tcp any any eq bgp
deny   tcp any eq bgp any
permit ip any any
GM - 192.168.252.166
crypto isakmp policy 10
encr aes
authentication pre-share
group 2
crypto isakmp key Cisco address 10.100.1.3
crypto gdoi group getvpn
identity number 10
server address ipv4 10.100.1.3
crypto map getvpn-map 10 gdoi
set group getvpn
interface Multilink1
ip address 192.168.252.166 255.255.255.252
no peer neighbor-route
ppp chap hostname 122344
ppp multilink
ppp multilink links minimum 1
ppp multilink group 1
ppp multilink fragment disable
no cdp enable
crypto map getvpn-map
Debugs from GM
Apr 17 11:22:11.034: %CRYPTO-5-GM_REGSTER: Start registration to KS 10.100.1.3 for group getvpn using address 152.187.252.166
Apr 17 11:22:11.034: ISAKMP:(0): SA request profile is (NULL)
Apr 17 11:22:11.034: ISAKMP: Created a peer struct for 10.100.1.3, peer port 848
Apr 17 11:22:11.034: ISAKMP: New peer created peer = 0x12F820C8 peer_handle = 0x8000000D
Apr 17 11:22:11.034: ISAKMP: Locking peer struct 0x12F820C8, refcount 1 for isakmp_initiator
Apr 17 11:22:11.034: ISAKMP: local port 848, remote port 848
Apr 17 11:22:11.034: ISAKMP: set new node 0 to QM_IDLE
Apr 17 11:22:11.034: ISAKMP:(0):insert sa successfully sa = 1024CA4
Apr 17 11:22:11.034: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
Apr 17 11:22:11.034: ISAKMP:(0):found peer pre-shared key matching 10.100.1.3
Apr 17 11:22:11.034: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID
Apr 17 11:22:11.034: ISAKMP:(0): constructed NAT-T vendor-07 ID
Apr 17 11:22:11.034: ISAKMP:(0): constructed NAT-T vendor-03 ID
Apr 17 11:22:11.034: ISAKMP:(0): constructed NAT-T vendor-02 ID
Apr 17 11:22:11.034: ISAKMP:(0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
Apr 17 11:22:11.034: ISAKMP:(0):Old State = IKE_READY New State = IKE_I_MM1
Apr 17 11:22:11.034: ISAKMP:(0): beginning Main Mode exchange
Apr 17 11:22:11.034: ISAKMP:(0): sending packet to 10.100.1.3 my_port 848 peer_port 848 (I) MM_NO_STATE
Apr 17 11:22:11.034: ISAKMP:(0):Sending an IKE IPv4 Packet.
Apr 17 11:22:11.038: ISAKMP (0): received packet from 10.100.1.3 dport 848 sport 848 Global (I) MM_NO_STATE
Apr 17 11:22:11.038: ISAKMP:(0):Notify has no hash. Rejected.
Apr 17 11:22:11.038: ISAKMP (0): Unknown Input IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY: state = IKE_I_MM1
Apr 17 11:22:11.038: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY
Apr 17 11:22:11.038: ISAKMP:(0):Old State = IKE_I_MM1 New State = IKE_I_MM1
HQ-2951-WAN#
Apr 17 11:22:11.038: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Informational mode failed with peer at 10.100.1.3
HQ-2951-WAN#
Apr 17 11:22:21.034: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
Apr 17 11:22:21.034: ISAKMP (0): incrementing error counter on sa, attempt 1 of 3: retransmit phase 1
Apr 17 11:22:21.034: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE

Are you sure that your KS uses pre-shared key for authentication ?
This is your config on the KS:
crypto isakmp policy 10
encr aes
group 2
By default it will use RSA sig for authentication.
Can you double check that one for me please?
HTH,
Mo

Similar Messages

How do i get my wifi to work again on my ipod touch . it says no wifi and wont let me turn it on .. says something bout the VPN error, please anyone help

my wifi dont work or even trys to find or turn on ... something bout the VPN error .. how do i connect to VPN? thinking that will let my wifi work?

See:
iOS: Wi-Fi or Bluetooth settings grayed out or dim
One user reported that placing the iPod in the freezer fixed the problem.
If not successful, an appointment at the Genius Bar of an Apple store is usually in order.
Apple Retail Store - Genius Bar

Why do I get an error message that says "Your Apple ID is not eligible to purchase gift certificates?"

I am trying to purchase a printable gift certificate from iTunes, and I keep getting an error message that says, "Your Apple ID is not eligible to purchase gift certificates." You can purchase gift cards from retail locations. I can't do this because I live overseas. I've tried deleting and re-adding my credit card information, and I've submitted a support ticket to ask for help. I see from my Google search that this is not an uncommon error message to have, but I can't find a solution!

No, I am a US citizen living overseas, but I am going through a VPN and I am using a US-based credit card. I have no problem purchasing apps, just purchasing gift certificates. I'm going to try gifting the app to the person I am purchasing for until Apple straightens this out for me.

Can no longer print to printer due to spooler VPN error

When trying to print, I get an error that reads: The print spooler was unable to connect to your printer. This can be caused by your printer being turned off, the cable being unplugged, or being connected to a VPN, which will block your access to your local network. I have tried resetting everything and I even uninstalled and reinstalled the print drivers without any success. None of the computers can communicate to the printer anymore. I'm desparate - please help.

There are some differences in sharing but it will work. I have a G4 that I use as a server, too.
First, tell me what printer model. There are driver differences, too.
At the heart, CUPS (the print control subsystem) uses IPP as the print sharing protocol. That part hasn't changed. So I recommend, for troubleshooting, setting up the printer on the client using IP printer > IPP protocol.
Here's a guide:
1) On the 10.5 print server, use a browser and point it at the CUPS admin web page athttp://localhost:631
Go to Printers list and find the queue name from the left side of the page next to the printer you want. Also note the IP address of the server Mac.
2) On a client, Add the printer as an IP printer > IPP protocol, and enter the IP address and queue name you noted above.
3) Select the generic postscript driver (on client Mac)
(after reading your second post, I want to remind you to set the server to use the correct driver.)
Finish and try it.

Lion Server VPN error

I am trying to use the Lion Server VPN function and have all the firewall port opens (500, 1701, 1723, 4500) and cannot get anything to connect either inside or outside of the network. I keep getting "The L2TP-VPN server did not respond. Try reconnecting. If the problem continues, verify your settings and contact your admin". I checked the log on the server and here is what I find under system log
Oct 27 21:03:56 www racoon[3529]: Connecting.
Oct 27 21:03:56 www racoon[3529]: IPSec Phase1 started (Initiated by peer).
Oct 27 21:03:56 www racoon[3529]: IKE Packet: receive success. (Responder, Main-Mode message 1).
Oct 27 21:03:56 www racoon[3529]: IKE Packet: transmit success. (Responder, Main-Mode message 2).
Oct 27 21:03:56 www racoon[3529]: IKE Packet: receive success. (Responder, Main-Mode message 3).
Oct 27 21:03:56 www racoon[3529]: IKE Packet: transmit success. (Responder, Main-Mode message 4).
Oct 27 21:03:59 www racoon[3529]: IKE Packet: transmit success. (Phase1 Retransmit).
Oct 27 21:04:29: --- last message repeated 3 times ---
Oct 27 21:04:32 www racoon[3529]: IKE Packet: transmit success. (Phase1 Retransmit).
Then I get the error on the other machine (i.e. iPhone 4S, IMac)
Have I done searches on google for everything I can think of and can not find a answer, or at least not one that helps me.
Any help would be greatly appreciated
Sodak

If you are using iCloud "Back to my mac", then disable it.
These services are incompatible.

GET VPN in a simple scenario

R1---Cloud(R4)----R2
          |
          R3(KS)
hi,
I set up 3 routers, with R3 being the KS. a very simple GET VPN. It is not working. The underlying reachibility is fine.
any idea?
thanks,
Han
=====R3, KS====
crypto isakmp policy 10
encr aes
authentication pre-share
group 2
crypto isakmp key cisco address 1.1.14.1
crypto isakmp key cisco address 1.1.24.2
crypto ipsec transform-set mygdoi-trans esp-aes esp-sha-hmac
crypto ipsec profile godi-profile-getvpn
set security-association lifetime seconds 7200
set transform-set mygdoi-trans
crypto gdoi group getvpn
identity number 1234
server local
rekey retransmit 10 number 2
sa ipsec 1
   profile godi-profile-getvpn
   match address ipv4 199
   replay counter window-size 64
interface Serial1/0
ip address 1.1.34.3 255.255.255.0
serial restart-delay 0
router ospf 1
log-adjacency-changes
network 0.0.0.0 255.255.255.255 area 0
ip forward-protocol nd
no ip http server
no ip http secure-server
access-list 199 permit ip host 1.1.1.1 host 2.2.2.2
access-list 199 permit ip host 2.2.2.2 host 1.1.1.1
============R1, GM============
crypto isakmp policy 10
encr aes
authentication pre-share
group 2
lifetime 1200
crypto isakmp key cisco address 1.1.34.3
crypto gdoi group getvpn
identity number 1234
server address ipv4 1.1.34.3
crypto map getvpn-map 10 gdoi
set group getvpn
interface Loopback0
ip address 1.1.1.1 255.255.255.0
interface FastEthernet0/0
no ip address
shutdown
duplex half
interface Serial1/0
ip address 1.1.14.1 255.255.255.0
serial restart-delay 0
crypto map getvpn-map
router ospf 1
log-adjacency-changes
network 0.0.0.0 255.255.255.255 area 0
=====R2, GM=====
crypto isakmp policy 10
encr aes
authentication pre-share
group 2
lifetime 1200
crypto isakmp key cisco address 1.1.34.3
crypto gdoi group getvpn
identity number 1234
server address ipv4 1.1.34.3
crypto map getvpn-map 10 gdoi
set group getvpn
interface Loopback0
ip address 2.2.2.2 255.255.255.0
interface Serial1/0
ip address 1.1.24.2 255.255.255.0
serial restart-delay 0
crypto map getvpn-map
router ospf 1
log-adjacency-changes
network 0.0.0.0 255.255.255.255 area 0
============
show cryto ipsec sa on R2
R2#sh cry ips sa
interface: Serial1/0
    Crypto map tag: getvpn-map, local addr 1.1.24.2
   protected vrf: (none)
   local ident (addr/mask/prot/port): (2.0.0.0/255.0.0.0/0/0)
   remote ident (addr/mask/prot/port): (1.0.0.0/255.0.0.0/0/0)
   current_peer 0.0.0.0 port 848
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0
     local crypto endpt.: 1.1.24.2, remote crypto endpt.: 0.0.0.0
     path mtu 1500, ip mtu 1500, ip mtu idb Serial1/0
     current outbound spi: 0xB4D74B58(3034008408)
     PFS (Y/N): N, DH group: none
     inbound esp sas:
      spi: 0xB4D74B58(3034008408)
        transform: esp-aes esp-sha-hmac ,
        in use settings ={Tunnel, }
        conn id: 3, flow_id: SW:3, sibling_flags 80000040, crypto map: getvpn-map
        sa timing: remaining key lifetime (sec): (4739)
        Kilobyte Volume Rekey has been disabled
        IV size: 16 bytes
        replay detection support: N
        Status: ACTIVE
     inbound ah sas:
     inbound pcp sas:
     outbound esp sas:
      spi: 0xB4D74B58(3034008408)
        transform: esp-aes esp-sha-hmac ,
        in use settings ={Tunnel, }
        conn id: 4, flow_id: SW:4, sibling_flags 80000040, crypto map: getvpn-map
        sa timing: remaining key lifetime (sec): (4739)
        Kilobyte Volume Rekey has been disabled
        IV size: 16 bytes
        replay detection support: N
        Status: ACTIVE
     outbound ah sas:
     outbound pcp sas:
   protected vrf: (none)
   local ident (addr/mask/prot/port): (1.0.0.0/255.0.0.0/0/0)
   remote ident (addr/mask/prot/port): (2.0.0.0/255.0.0.0/0/0)
   current_peer 0.0.0.0 port 848
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0
     local crypto endpt.: 1.1.24.2, remote crypto endpt.: 0.0.0.0
     path mtu 1500, ip mtu 1500, ip mtu idb Serial1/0
     current outbound spi: 0xB4D74B58(3034008408)
     PFS (Y/N): N, DH group: none
     inbound esp sas:
      spi: 0xB4D74B58(3034008408)
        transform: esp-aes esp-sha-hmac ,
        in use settings ={Tunnel, }
        conn id: 1, flow_id: SW:1, sibling_flags 80000040, crypto map: getvpn-map
        sa timing: remaining key lifetime (sec): (4739)
        Kilobyte Volume Rekey has been disabled
        IV size: 16 bytes
        replay detection support: N
        Status: ACTIVE
     inbound ah sas:
     inbound pcp sas:
     outbound esp sas:
      spi: 0xB4D74B58(3034008408)
        transform: esp-aes esp-sha-hmac ,
        in use settings ={Tunnel, }
        conn id: 2, flow_id: SW:2, sibling_flags 80000040, crypto map: getvpn-map
        sa timing: remaining key lifetime (sec): (4739)
        Kilobyte Volume Rekey has been disabled
        IV size: 16 bytes
        replay detection support: N
        Status: ACTIVE
     outbound ah sas:
     outbound pcp sas:
R2#

First, I would say the sorryserver should be the CSS2 vip and not a server behind it.
This is a feasible solution.
The only important point is that CSS1 needs to see the response from the server, so you need to nat traffic on CSS1 with an ip address part of CSS1 subnet so that the server behind CSS2 can send the response to CSS1 and not directly to the client.
You can do this with a group.
ie:
group natme
vip x.x.x.x
add destination service sorryserver1
active
Regards,
Gilles.

Cannot connect to RV110w VPN error 619

Hello,
I'm having problems logging into my RV110w using either quickvpn or a windows pptp client connection....
I've been following the guide here but I just can't connect....I can connect via remote management however....
https://supportforums.cisco.com/document/124251/remote-vpn-tunnel
So :
IPSec, PPTP and L2Tp enabled.
RV110w firewall enabled
Block WAN Request enabled
Remote Management enabled - port 443
MPEE Encryption Enabled
Netbios over VPN Enabled
2 Clients created one for quickvpn and one for pptp.
Win 7 firewall enabled at remote end with rull to allow inbound ICMP Echo.
Exported Certificate and copied to the quickvpn install folder.
Disabled all other network adapters
QuickVPN tries to connect then shows a message listing possible reasons for a failed connection....
The quickvpn log shows:
2015/02/01 12:14:58 [STATUS]OS Version: Windows 7
2015/02/01 12:14:58 [STATUS]Windows Firewall Domain Profile Settings: ON
2015/02/01 12:14:58 [STATUS]Windows Firewall Private Profile Settings: ON
2015/02/01 12:14:58 [STATUS]Windows Firewall Private Profile Settings: ON
2015/02/01 12:14:58 [STATUS]One network interface detected with IP address 192.168.1.79
2015/02/01 12:14:58 [STATUS]Connecting...
2015/02/01 12:14:58 [DEBUG]Input VPN Server Address = 90.2.30.86
2015/02/01 12:14:58 [STATUS]Connecting to remote gateway with IP address: 90.2.30.86
2015/02/01 12:14:59 [STATUS]Remote gateway was reached by https ...
2015/02/01 12:14:59 [WARNING]Remote gateway wasn't reached...
2015/02/01 12:14:59 [WARNING]Failed to connect.
2015/02/01 12:15:20 [WARNING]Remote gateway wasn't reached...
2015/02/01 12:15:20 [WARNING]Failed to connect.
2015/02/01 12:15:20 [WARNING]Failed to connect!
The RV110w doesn't seem to log anything...?
If I try to connect using a windows pptp vpn connection I get an error 619 straight away and the RV110w log shows:
1
2015-02-01 12:20:14 AM
info
pptpd[22775]: CTRL: Client 123.150.210.162 control connection finished
2
2015-02-01 12:20:14 AM
debug
pptpd[22775]: CTRL: Reaping child PPP[22780]
3
2015-02-01 12:20:14 AM
err
pptpd[22775]: CTRL: PTY read or GRE write failed (pty,gre)=(12,13)
4
2015-02-01 12:20:14 AM
err
pptpd[22775]: GRE: read(fd=12,buffer=451c4c,len=8196) from PTY failed: status = -1 error = Input/output error, usually caused by unexpected termination of pppd, check option syntax and pppd logs
5
2015-02-01 12:20:14 AM
err
pppd[22780]: but I couldn't find any suitable secret (password) for it to use to do so.
6
2015-02-01 12:20:14 AM
err
pppd[22780]: The remote system is required to authenticate itself
7
2015-02-01 12:20:14 AM
info
pptpd[22775]: CTRL: Starting call (launching pppd, opening GRE)
8
2015-02-01 12:20:14 AM
info
pptpd[22775]: CTRL: Client 123.150.210.162 control connection started
This is all behind a talktalk fibre router, they say it's transparent and doesn't block anything but they won't support me any further than that. Ports 443 and 1723 do seem to be open when I scan so as far as I can see the talktalk router is transparent.
Do I need to create any rules on the RV110w firewall to get this working? or forward any ports to the router itself?
Thanks for any help, Kevin

I believe the problem is in iOS, as I am experiencing the same issue.
I have a Yosemite Server running L2TP VPN server and my Mac connects flawless, while neither the iPhone nor the iPad (both 8.2) are able to connect.
The error is the same "The L2TP-VPN server did not respond" and by looking at the server's log it seems iOS didn't even try to connect.
I have tried changing the server address in iOS with the corresponding IP, but the results it's the same.
Maybe a network setting reset?

Im trying to set up a connection to localhost from my mac but keep getting an error message: Firefox can't establish a connection to the server at localhost.

Hi
I'm new to working with Mamp, Dreamweaver and WordPress and am trying to work using the Firefox browser. unfortunately i keep getting the error message Firefox can't establish a connection to the server at localhost. when i type the URL http://localhost/explore_ca/blog/wp-admin I cant use Dreamweaver with WP without this is there a reason for this and how do i get around it?

1- Is your MAMP working '''whithout errors'''(does it show you errors while executing or running and enabling)?
2- Have you tested other browsers? Is your problem still occuring?
3- Are you using '''proxy '''or '''VPN '''(or setted a proxy server or VPN server on your Computer)?

Cisco vpn error 51

I have recently purchased a new MacBook Pro, which came with lion installed. I changed it back to snow leopard. I then installed a vpn client. I continually get an error 51 when I try to use it. The description is as follows: 'unable to communicate with the VPN subsystem. Please make sure that you have at least one network interface that is currently active and has an IP address and start this application again.' I have made sure that I have an active address on a network which is not the vpn I am attepting to connect to.
Is there something I have forgotten in setting up my wireless or eithernet connection. Both are active and fuctioning properly. Any HELP would be appreciated.
Thank you.

Try opening a terminal window (Applications >> Utilities). At the prompt, enter:
>sudo SystemStarter restart CiscoVPN
This will ask you for the admin password and it will restart the Cisco client service. That should fix it. This seems to be a known issue that will eventually be solved with some updates.
DB

CISCO VPN ERROR 51, NNNOOOOOOOOO

I am receiving the dreaded Error 51 when ever I install and try to launch the Cisco VPN Client.
This is on a brand new Mac Book Pro, so this software was never previously installed. Ive been trying to install the Cisco VPN Client version 280, but I've tried older versions too with the same Error 51 problem.
I've uninstalled, reinstalled, uninstalled via the Terminal window, restarted, tried multiple number of Terminal commands found online, nothing has worked. The odd thing, a co worker of mine with a similar set up was able to install the client just fine, so there's something up with my machine.
One other thing I've noticed, sometimes when I restart or uninstall the client via the Terminal, I get this error
/System/Library/Extensions/CiscoVPN.kext failed to load - (libkern/kext) requested architecture/executable not found; check the system/kernel logs for errors or try kextutil(8).
I checked my '/System/Library/' directory and I dont have this Extensions folder at all.
Can anyone help with this issue? For the love of God, this is day #3 with this issue and the whole IT department at my work is stumped.
Thanks

You must have the /System/Library/Extensions/ folder or your computer wouldn't be able to boot.
I have read about problems with the Cisco software. See the following:
Fix Cisco VPN in 10.6 [Simon Heimlicher] and HDC >> Cisco VPN for Mac OS X 10.6. If neither of these is helpful then I suggest contacting Cisco tech support.

Why do I get an error message that says Firefox is inaccessible? I have MAc OS X

Firefox worked yesterday. My Mac had a Safari update & I had to Restart the pc. Now I get an error message that says "Firefox may be missing or inaccessible".

No, I am a US citizen living overseas, but I am going through a VPN and I am using a US-based credit card. I have no problem purchasing apps, just purchasing gift certificates. I'm going to try gifting the app to the person I am purchasing for until Apple straightens this out for me.

How do I avoid getting this error when using an OpenVPN?

I did a little research online and noticed that people got this same (or a very very similar) error in iOS on Safari when browsing with a proxy and they just had to reset network connections.
I'm getting it in OS X. When I turn on the VPN sometimes browsing will work fine, but then this pops up and once I get this error in one tab I get it in all of them. Firefox still works. There's plenty of memory -- RAM and ROM.
When I turn off the VPN it works again.

Thanks Carolyn!
I don't think this is the solution for me, although I do think it is a clue. It can't be a mistyped proxy field, as this happens across different VPN's (i.e. work, personal, school) and browsing is working fine for a time before it starts all the sudden giving me that message.
I am on 10.8 which I didn't think was related, but now I'm starting to think maybe it is, so I'll also post in the Dev community. However if you or anyone has any ideas PLEASE do follow up, as I find the user support community to be far, far more useful than the Dev community in general!

VPN ERROR 619 :: A connection to the remote computer could not be established, so the port used for this connection was closed

I have been searching endlessly for this issue. Every time I try to connect to a VPN connection I get the error above. Thank you for any relevant input concerning this matter. My NIC is Qualcomm Atheros and I'm in Win8.1 x64.

everything normal before?
is there any changes before this issue happen?
turn off your antivirus and firewall, update the latest VPN client software, if still not working go to security settings and change the VPN type automatic to PPTP. And also change data encryption configuration to Optional and select CHAP & MS-CHAP v2.
If still not working try with other internet connection and try to contact your VPN provider

VRF aware GET-VPN Group-member

Hi,
we want to configure following on some of our routers.
3 VRF-lite (before it has been 3 seperate routers)
For each VRF we have to use a seperate GDOI-Group , different PSKs.
The KS for the different GDOI Groups is the same adresses (central resource reachable from every VRF).
I know that I can configure per GDOI-Group a "client registartion interface ..." which can be an interface in a VRF.
to configure the same KS-address for different GDOI-groups seems to be not possible
crypto gdoi group GROUP-1
identity number 1111111
server address ipv4 22.198.255.29
server address ipv4 22.198.255.33
crypto gdoi group GROUP-2
identity number 2222222
server address ipv4 22.198.255.29
server address ipv4 22.198.255.33
As soon as I configure the KS for GROUP-2 I get an error-message that the KS is already configured.
We can configure different ISAKMP-Profiles (vrf aware), but GDOI-GROUP configuration seems not to be VRF aware.
Is there a way how to achive to use the same KS-Address for different-Groups in different VRFs.
Thx
Hubert

Hi Naman, I think there is a misunderstanding of my problem.
On the branch-routers I have two VRFs. In each VRF I have to configure GET-VPN-GM.
The KS are on central routers in each VRF but they do have the sam IP-address (we use overlapping address-space in both VRFs)
Configuration is like following
ip vrf VRF_10
rd 10:0
route-target export 10:0
route-target import 10:0
maximum routes 1000 warning-only
ip vrf VRF_12
rd 12:0
route-target export 12:0
route-target import 12:0
maximum routes 1000 warning-only
the problem is that we would have to configure to different ISAKMP-PSK for same Server-Address, and thats not possible
crypto isakmp key !$SECURE-WAN-KEY$!101010 address 22.161.255.33
crypto isakmp key !$SECURE-WAN-KEY$!101010 address 22.109.255.45
crypto isakmp key !$SECURE-WAN-KEY$!121212 address 22.161.255.33
crypto isakmp key !$SECURE-WAN-KEY$!121212 address 22.109.255.45
crypto isakmp policy 10
encr aes
authentication pre-share
group 2
lifetime 1200
crypto gdoi group GROUP-10
identity number 101010
server address ipv4 22.161.255.33
server address ipv4 22.109.255.45
client registration interface Loopback0
crypto gdoi group GROUP-12
identity number 121212
server address ipv4 22.161.255.33
server address ipv4 22.109.255.45
client registration interface Loopback1
crypto map MAP-10-SECURE-WAN local-address Loopback0
crypto map MAP-10-SECURE-WAN 10 gdoi
set group GROUP-10
crypto map MAP-12-SECURE-WAN local-address Loopback0
crypto map MAP-12-SECURE-WAN 10 gdoi
set group GROUP-12
interface Loopback1
ip vrf forwarding VRF_10
ip address 10.10.10.45 255.255.255.252
interface Loopback1
ip vrf forwarding VRF_12
ip address 12.12.12.45 255.255.255.252
interface gig0/1.10
ip vrf forwarding VRF_10
crypto map MAP-10-SECURE-WAN
interface gig0/1.12
ip vrf forwarding VRF_12
crypto map MAP-12-SECURE-WAN
So my idea was to configure the PSKs per VRF via an ISAKMP-Profile (where i can define VRFs)
ip vrf VRF_10
rd 10:0
route-target export 10:0
route-target import 10:0
maximum routes 1000 warning-only
ip vrf VRF_12
rd 12:0
route-target export 12:0
route-target import 12:0
maximum routes 1000 warning-only
crypto isakmp policy 10
encr aes
authentication pre-share
group 2
lifetime 1200
crypto keyring ISAKMP_KEY_GETVPN_10
local-address Loopback0
pre-shared-key address 22.161.255.33 key !$SECURE-WAN-KEY$!101010
pre-shared-key address 22.109.255.45 key !$SECURE-WAN-KEY$!101010
crypto keyring ISAKMP_KEY_GETVPN_12
local-address Loopback1
pre-shared-key address 22.161.255.33 key !$SECURE-WAN-KEY$!121212
pre-shared-key address 22.109.255.45 key !$SECURE-WAN-KEY$!121212
crypto isakmp profile ISAKMP_PROFILE_GETVPN_10
   vrf VRF_10
   keyring ISAKMP_KEY_GETVPN_10
   self-identity address
   match identity address 22.161.255.33 255.255.255.255
   match identity address 22.109.255.45 255.255.255.255
   keepalive 20 retry 2
   local-address Loopback0
crypto isakmp profile ISAKMP_PROFILE_GETVPN_12
   vrf VRF_12
   keyring ISAKMP_KEY_GETVPN_12
   self-identity address
   match identity address 22.161.255.33 255.255.255.255
   match identity address 22.109.255.45 255.255.255.255
   keepalive 20 retry 2
   local-address Loopback1
crypto gdoi group GROUP-10
identity number 101010
server address ipv4 22.161.255.33
server address ipv4 22.109.255.45
client registration interface Loopback0
crypto gdoi group GROUP-12
identity number 121212
server address ipv4 22.161.255.33
server address ipv4 22.109.255.45
client registration interface Loopback1
crypto map MAP-10-SECURE-WAN local-address Loopback0
crypto map MAP-10-SECURE-WAN isakmp-profile ISAKMP_PROFILE_GETVPN_10
crypto map MAP-10-SECURE-WAN 10 gdoi
set group GROUP-10
crypto map MAP-12-SECURE-WAN local-address Loopback1
crypto map MAP-12-SECURE-WAN isakmp-profile ISAKMP_PROFILE_GETVPN_12
crypto map MAP-12-SECURE-WAN 10 gdoi
set group GROUP-12
But it seems it does not work !!!
Any idea ?
Thx in Advance
Hubert

I want to Sync my iPhone 4 to iTunes however I get an error message from iTunes each time I connect the phone to the PC saying that I should restore to factory settings. Frustrating because it's already annoying enough that I can't drag and drop mp3's!!!

I have never been so frustrated before in my life with any phone. I find it obnoxious as it is that I cannot simply drag and drop files (especially MP3's) straight from my PC directly into my phone, which I have been used to doing up until now. Everyone who convinced me to get the iPhone has instructed me that my frustration can be fixed by downloading iTunes and syncing it all up via that program (which I have never used before). So, I downloaded the program successfully, however when I connect the iPhone 4 to the PC and iTunes is open, I get an error message that 'iTunes cannot read the content of the iPhone "iPhone" and that I should go to the Preferences tab of the iPhone and select 'restore' to restore this phone to factory settings. First of all, I don't understand why I need to do that. I have already downloaded apps and other important things in the 2 days that I have the phone. I am also scared that it will erase my contacts. This is such a headache. Music is very imporatant to me, but I am getting so frustrated that I don't have freedom over the phone which I thought was supposed to be one of the best out there. I would really appreciate help in this matter. I am sure the phone is great but I am on the verge of taking it back and getting something else.

Hey joshuafromisr,
If you resintall iTunes, it should fix the issue. The following document will go over how to remove iTunes fully and then reinstall. Depending on what version of Windows you're running you'll either follow the directions here:
Removing and Reinstalling iTunes, QuickTime, and other software components for Windows XP
http://support.apple.com/kb/HT1925
or here:
Removing and reinstalling iTunes, QuickTime, and other software components for Windows Vista or Windows 7
http://support.apple.com/kb/HT1923
Best,
David

GET VPN error

Similar Messages

Maybe you are looking for