IPSEC Only starting from one side (Spoke side)

Hi,
I have a hub and spoke setup with IPSEC.
If interesting traffic comes from the spoke, the IPSEC SA starts and works perfectly. However, once the link idles out and there is no more traffic, the hub shows this with the sh crypto isa sa command
196.47.133.38   185.20.242.61   QM_IDLE           1017 ACTIVE
sh cryp ips sa peer 196.47.133.38 shows nothing at all.
I have checked my routing and NAT deny's to make sure that is not the issue.
I then checked the crypto ACL's when i send traffic, i see the crypto ACL's are incrementing correctly but still the SA wont activate. If i look at the ipsec debug i also see nothing.
I am using a dynamic map with each spoke end on its own ACL, as follows;
crypto dynamic-map dynmap 5
set peer 111.116.206.92
set transform-set des-transform
match address 171
crypto dynamic-map dynmap 10
set peer 111.47.132.38
set transform-set des-transform
match address 172
crypto dynamic-map dynmap 15
set peer 111.174.150.47
set transform-set des-transform
match address 173
crypto dynamic-map dynmap 20
set peer 111.166.108.250
set transform-set des-transform
match address 174
crypto dynamic-map dynmap 100
set transform-set des-transform
match address 170
c2800nm-adventerprisek9_ivs_li-mz.151-4.m6.bin on a 2811
Any ideas?
Thanks
Alan

Here you go Sachin
Edge routers are 1801's
Hub is a 2811
Edge ACL's are a mirror of what is in the ACL's associated to each map line
As far as I can see the default route is correct and that all the crypo traffic should not be NAT'd or go elsewhere but hit po1.100 on the way out.
Symptoms are that a person pinging from say 10.192.112.5 (spoke) to the dest 10.192.40.10 (hub) will work perfectly, but the same user 10.192.112.5 wont be able to ping 10.192.73.10 (spoke) or 10.192.113.5 (spoke)
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
hostname c2811-test
boot-start-marker
boot system flash:/c2800nm-adventerprisek9_ivs_li-mz.151-4.m6.bin
boot-end-marker
no logging console
aaa session-id common
dot11 syslog
no ip source-route
ip cef
no ipv6 cef
multilink bundle-name authenticated
voice-card 0
crypto pki token default removal timeout 0
crypto pki trustpoint TP-self-signed-1226746475
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-1226746475
revocation-check none
rsakeypair TP-self-signed-1226746475
crypto pki certificate chain TP-self-signed-1226746475
certificate self-signed 01
        quit
license udi pid CISCO2811 sn FCZ1047729M
archive
log config
  hidekeys
redundancy
crypto isakmp policy 10
hash md5
authentication pre-share
crypto isakmp key address 196.47.132.38
crypto isakmp key address 0.0.0.0 0.0.0.0
crypto isakmp keepalive 10 10
crypto isakmp nat keepalive 360
crypto ipsec transform-set des-transform esp-des esp-md5-hmac
crypto dynamic-map dynmap 100
set transform-set des-transform
match address 170
crypto map dyntrans 10 ipsec-isakmp
set peer 81.174.150.47
set transform-set des-transform
match address 173
crypto map dyntrans 20 ipsec-isakmp
set peer 196.47.132.38
set transform-set des-transform
set reverse-route tag 1
match address 172
crypto map dyntrans 30 ipsec-isakmp
set peer 62.116.206.92
set transform-set des-transform
match address 171
crypto map dyntrans 40 ipsec-isakmp
set peer 95.166.108.250
set transform-set des-transform
match address 174
crypto map dyntrans 50 ipsec-isakmp
set peer 78.193.137.76
set transform-set des-transform
match address 175
crypto map dyntrans 100 ipsec-isakmp dynamic dynmap
interface Port-channel1
no ip address
hold-queue 150 in
interface Port-channel1.8
encapsulation dot1Q 8
ip address 10.192.8.1 255.255.255.0
interface Port-channel1.16
encapsulation dot1Q 16
ip address 10.192.16.1 255.255.255.0
ip information-reply
ip nat inside
ip virtual-reassembly in
interface Port-channel1.32
encapsulation dot1Q 32
ip address 10.192.32.1 255.255.255.0
ip information-reply
interface Port-channel1.40
encapsulation dot1Q 40
ip address 10.192.40.1 255.255.255.0
ip information-reply
ip nat inside
ip virtual-reassembly in
interface Port-channel1.100
encapsulation dot1Q 100
ip address 185.20.242.61 255.255.255.248
ip access-group WORLD-IN in
ip nat outside
ip virtual-reassembly in
crypto map dyntrans
interface FastEthernet0/0
no ip address
duplex auto
speed auto
channel-group 1
interface FastEthernet0/1
no ip address
duplex auto
speed auto
channel-group 1
ip forward-protocol nd
no ip http server
no ip http secure-server
ip nat inside source list 115 interface Loopback2 overload
ip nat inside source list 116 interface Loopback0 overload
ip nat inside source list 161 interface Port-channel1.100 overload
ip nat inside source static tcp 10.192.16.11 25 185.20.242.50 25 extendable
ip nat inside source static tcp 10.192.16.11 143 185.20.242.50 143 extendable
ip nat inside source static tcp 10.192.16.11 993 185.20.242.50 993 extendable
ip nat inside source static tcp 10.192.16.11 25 185.20.242.50 1025 extendable
ip nat inside source static tcp 10.192.16.11 80 185.20.242.51 80 extendable
ip nat inside source static tcp 10.192.16.11 443 185.20.242.51 443 extendable
ip nat inside source static udp 10.192.16.2 5060 185.20.242.52 5060 extendable
ip nat inside source static tcp 10.192.16.32 80 185.20.242.53 80 extendable
ip nat inside source static tcp 10.192.16.31 8081 185.20.242.54 8081 extendable
ip route 0.0.0.0 0.0.0.0 185.20.242.57
ip route 185.20.242.32 255.255.255.240 185.20.242.58
ip access-list standard OAM-IN
permit 10.209.2.0 0.0.0.255 log
permit 10.29.32.0 0.0.3.255
permit 10.192.0.0 0.0.255.255 log
ip access-list extended WORLD-IN
remark General Stuff
permit icmp any any echo
permit icmp any any echo-reply
permit icmp any any unreachable
permit icmp any any ttl-exceeded
permit icmp any any packet-too-big
permit icmp any any traceroute
permit icmp any any administratively-prohibited
deny   ip 127.0.0.0 0.255.255.255 any
deny   ip 192.0.2.0 0.0.0.255 any
deny   ip 224.0.0.0 31.255.255.255 any
deny   ip host 255.255.255.255 any
deny   ip 10.0.0.0 0.255.255.255 any
deny   ip 172.16.0.0 0.15.255.255 any
deny   ip 192.168.0.0 0.0.255.255 any
remark Drop SMB/Netbios noise
deny   tcp any any eq 445
deny   tcp any any eq 137
permit tcp any any established
remark Nianet/TDC NTP servers
permit udp host 83.136.89.6 any eq ntp
permit udp host 83.136.89.4 any eq ntp
permit udp host 193.162.159.194 any eq ntp
remark Nianet DNS
permit udp host 83.136.89.6 eq domain any
permit udp host 83.136.89.4 eq domain any
remark Any DNS to infon
permit udp any eq domain host 185.20.242.61
remark Services
permit tcp any host 185.20.242.50 eq smtp
permit tcp any host 185.20.242.50 eq 143
permit tcp any host 185.20.242.50 eq 993
permit tcp any host 185.20.242.51 eq www
permit tcp any host 185.20.242.51 eq 443
permit tcp any host 185.20.242.54 eq 8081
permit esp host 62.116.206.92 host 185.20.242.61
permit ip host 62.116.206.92 host 185.20.242.61
permit esp host 81.174.150.47 host 185.20.242.61
permit ip host 81.174.150.47 host 185.20.242.61
permit ip host 92.26.172.37 host 185.20.242.61
permit esp host 92.26.172.37 host 185.20.242.61
permit ip 78.147.0.0 0.0.255.255 host 185.20.242.61
permit ip host 78.193.137.76 host 185.20.242.61
permit esp 78.147.0.0 0.0.255.255 host 185.20.242.61
permit ip host 95.166.108.250 host 185.20.242.61
permit esp host 95.166.108.250 host 185.20.242.61
permit ip host 78.147.99.41 host 185.20.242.61
permit tcp any host 185.20.242.61 eq 443
permit udp any host 185.20.242.61 eq netbios-ns
permit ip host 79.170.187.234 host 185.20.242.55
permit tcp any host 185.20.242.61 eq 1723
permit gre any host 185.20.242.61
permit udp host 194.247.61.32 host 185.20.242.52
permit udp host 194.247.61.31 host 185.20.242.52
permit udp 62.41.83.0 0.0.0.255 host 185.20.242.52
permit udp 77.72.168.0 0.0.0.255 host 185.20.242.52
permit udp 77.192.32.0 0.0.0.255 host 185.20.242.52
permit udp 80.239.235.0 0.0.0.255 host 185.20.242.52
permit udp 194.120.0.0 0.0.0.255 host 185.20.242.52
permit udp 195.219.64.0 0.0.0.255 host 185.20.242.52
permit udp 203.192.180.224 0.0.0.15 host 185.20.242.52
permit udp 208.176.230.112 0.0.0.15 host 185.20.242.52
permit tcp any host 185.20.242.50 eq 1025
permit tcp any host 185.20.242.53 eq www
permit udp any eq non500-isakmp host 185.20.242.61 eq non500-isakmp
permit udp any eq isakmp host 185.20.242.61 eq isakmp
permit esp any host 185.20.242.61
deny   ip any any log
access-list 1 permit 196.47.132.38
access-list 15 permit 10.192.16.2
access-list 80 permit 10.192.69.0 0.0.0.255
access-list 115 deny   ip host 10.192.16.2 10.192.0.0 0.0.255.255
access-list 115 permit ip host 10.192.16.2 any
access-list 116 permit tcp 10.192.0.0 0.0.255.255 any eq smtp
access-list 161 deny   ip any 10.0.0.0 0.255.255.255
access-list 161 permit ip 10.192.40.0 0.0.0.255 any
access-list 161 permit ip 10.192.16.0 0.0.0.255 any
access-list 170 permit ip 10.209.0.0 0.0.255.255 10.192.72.0 0.0.3.255
access-list 170 permit ip 10.209.0.0 0.0.255.255 10.192.112.0 0.0.15.255
access-list 170 permit ip 10.192.0.0 0.0.63.255 10.192.72.0 0.0.3.255
access-list 170 permit ip 10.192.0.0 0.0.63.255 10.192.112.0 0.0.15.255
access-list 170 permit ip 10.192.72.0 0.0.7.255 10.192.112.0 0.0.15.255
access-list 170 permit ip 10.192.112.0 0.0.15.255 10.192.72.0 0.0.3.255
access-list 171 permit ip 10.209.0.0 0.0.255.255 10.192.72.0 0.0.3.255
access-list 171 permit ip 10.192.0.0 0.0.63.255 10.192.72.0 0.0.3.255
access-list 171 permit ip 10.192.64.0 0.0.31.255 10.192.72.0 0.0.3.255
access-list 171 permit ip 10.192.112.0 0.0.15.255 10.192.72.0 0.0.3.255
access-list 171 permit ip 10.192.128.0 0.0.15.255 10.192.72.0 0.0.3.255
access-list 172 permit ip 10.192.0.0 0.0.63.255 10.192.128.0 0.0.0.63
access-list 172 permit ip 10.192.112.0 0.0.15.255 10.192.128.0 0.0.0.63
access-list 172 permit ip 10.192.72.0 0.0.7.255 10.192.128.0 0.0.0.63
access-list 172 permit ip 10.209.2.0 0.0.0.255 10.192.128.0 0.0.0.63
access-list 173 permit ip 10.192.0.0 0.0.63.255 10.192.112.64 0.0.0.63
access-list 173 permit ip 10.192.64.0 0.0.31.255 10.192.112.64 0.0.0.63
access-list 173 permit ip 10.192.112.0 0.0.15.255 10.192.112.64 0.0.0.63
access-list 173 permit ip 10.192.128.0 0.0.15.255 10.192.112.64 0.0.0.63
access-list 173 permit ip 10.209.0.0 0.0.255.255 10.192.112.64 0.0.0.63
access-list 174 permit ip 10.192.0.0 0.0.63.255 10.192.112.0 0.0.0.63
access-list 174 permit ip 10.192.64.0 0.0.31.255 10.192.112.0 0.0.0.63
access-list 174 permit ip 10.192.112.0 0.0.15.255 10.192.112.0 0.0.0.63
access-list 174 permit ip 10.192.128.0 0.0.15.255 10.192.112.0 0.0.0.63
access-list 174 permit ip 10.209.0.0 0.0.255.255 10.192.112.0 0.0.0.63
access-list 175 permit ip 10.192.0.0 0.0.63.255 10.192.113.64 0.0.0.63
access-list 175 permit ip 10.192.64.0 0.0.31.255 10.192.113.64 0.0.0.63
access-list 175 permit ip 10.192.112.0 0.0.15.255 10.192.113.64 0.0.0.63
access-list 175 permit ip 10.192.128.0 0.0.15.255 10.192.113.64 0.0.0.63
access-list 175 permit ip 10.209.0.0 0.0.255.255 10.192.113.64 0.0.0.63
access-list 185 permit udp any any eq 1813
access-list 185 permit udp any any eq 1646
nls resp-timeout 1
cpd cr-id 1
control-plane
bridge 1 protocol ieee
mgcp profile default
gatekeeper
shutdown
line con 0
line aux 0
line vty 0 4
access-class OAM-IN in
password hasldfhohdsah
transport input all
scheduler allocate 20000 1000
ntp master
ntp server 193.162.159.194
c2811-test#

Similar Messages

  • Audio only records from one side

    I am using a firewire solo...when I try to record guitar or mic through it into logic it only records on the left side (no sound coming from right)...
    Doesn't happen in Garage Band.
    Thoughts?

    Well, first, make sure you are aware of what channel you are using on your interface. Then go to I/O in the track pannel in logic that you wish to use. Make sure it coressponds to the appropriate channel. MONO.

  • In-ear headphones playing audio from one side only

    My apple in-ear headphones only play audio from one side.  I've tried replacing the cap and mesh; and also tested the headphones on different devices and still get the same problem.  Any advice?

    Probably time to have them replaced.
    B-rock

  • I can only hear sound from one side of the head phone

    I've plug in my bass guitar through a cord and a converter in the line in port on my PC. Then checked 'listen to this device' (head phone) which is connected properly as it worked perfectly when I play any sound in ma PC. But when I play my guitar, I can
    only hear it from one side of the head phone. How to fix it!?

    Is that compatible to give output from both sides (R + L) ? Can you check same thing on other system ? 
    Arnav Sharma | http://arnavsharma.net/ Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading
    the thread.

  • TS2771 only getting sound from one side of the headset.  Any fixes available?

    I have an used Ipod touch.  When i connect a headset, i only sound from one channel.  Any fixes out there?

    - Try cleaning out/blowing out the headphone jack. Try inserting/removing the plug a dozen times or so.
    Try the following to rule out a software problem
    - Reset the iPod. Nothing will be lost
    Reset iPod touch: Hold down the On/Off button and the Home button at the same time for at
    least ten seconds, until the Apple logo appears.
    - Reset all settings
    Go to Settings > General > Reset and tap Reset All Settings.
    All your preferences and settings are reset. Information (such as contacts and calendars) and media (such as songs and videos) aren’t affected.
    - Restore from backup
    - Restore to factory settings/new iPod.
    - Make an appointment at the Genius Bar of an Apple store. Seems you have a bad headphone jack.
    Apple Retail Store - Genius Bar
    Apple will exchange your iPod for a refurbished one for this price. They do not fix yours.
    Apple - iPod Repair price
    A third-party place like the following will replace the jack for less. Google for more.
    iPhone Repair, Service & Parts: iPod Touch, iPad, MacBook Pro Screens
    Replace the jack yourself
    iPod Touch Repair – iFixit

  • Sound from Apple Earpods only comes from the side speakers?

    **** i normally sometimes use my Apple Earpods but today i have realised that the sound only comes from the side speakers, i've cleaned the other speakers however that doesn't help

    There is only one speaker for each ear. See here.

  • Count moving object (Inter the ROI from one side and leave ROI from other side)

    Hello All
    I want to design program that can counting moving object that inter ROI from one side and come out from the other side, I want to give each object ID number
    I have design a program that compare between object distances from one frame to the next frame, but the program efficiency is very low
    If any one can give me a sample code that I can use or modify it to suite my application

    Hello,
    you will find the code in the attachment (saved for LV2013). There is a longer delay inside the loop, remove it for efficiency.
    Roughly measuring the time to read an image, the processing takes ~8 ms on my computer (~500x200 image resolution). That is ~125 samples/images per second. Is this not fast enough for you? Considering better image resolution, the time is of course increased.
    My specifications:
    Core i7 3632QM
    6 Gb RAM
    Win 7 x64 (Labview x86 though).
    Best regards,
    K
    https://decibel.ni.com/content/blogs/kl3m3n
    "Kudos: Users may give one another Kudos on the forums for posts that they found particularly helpful or insightful."
    Attachments:
    IDMovingObjects.zip ‏64 KB

  • How to run select query from one SID to fetch record from another SID?

    I have two SID, one is AAA and another is BBB and the connection name is A1 and B1 respectively. I want to run one select query from A1 connection to fetch record B1. Can anyone help me how I can connect from one SID to another SID?

    Hi 869357,
    You can also use the copy command. (Works with limited types)
    try:
    help copyRegards,
    Turloch

  • How do you extend the frame from one side but not the whole thing?

    I am updating my blog and want to put a rectangle picture into the pre-set frame. I need to stretch it horizontally but the entire frame (i.e., both sides and top/bottom) stretched instead. How do you extend the frame from one side but not the whole thing?

    In Inspector, select the Graphic Inspector. Choose, from the Fill options, Image Fill. Select the image from the dropdown and click Open. Now go back to Inspector and click on Scale to Fit. Choose from the options in the window. There are a number of them which should address your problem:
    With the Blog template, you will probably need to insert a text box over the stock placement frame and work with that instead.
    Mark

  • G570 bought four months back - screen screw has come out from one side

    Hi there,
    I bought Ideapad G570 in June 2012 from Jumbo Electronics in Great India Place, Noida (UP). The Serial No is CBxxxxxxxx. Today I noticed that one of screws (through which lcd screen gets attached to the body) has come out of place and the laptop's screen is kind of hanging from one side. The product quality is pretty bad.
    Anyway, I have got two queries:
    1. How to avail on-site warranty support to get my laptop repaired? 
    2. When I checked about the warranty on your site through my serial no, it showed that my laptop's warranty expirtation date is  2013-04-26, which is less that a year from the date of purchase (3 June 2012). Could somebody explain me that?
    Any help would be much appreciated.
    Thanks
    Moderator Note; s/n edited for member's own protection

    Hi   deeam99
    The warranty of your system has been updated on the support website . You can directly view details from the below link .
    http://support.lenovo.com/en_US/product-service/warranty-status/default.page?
    I have sent the required details through PM .
    Now you may please contact the Local support for logging a case for the issue and get the required parts replaced
    http://support.lenovo.com/en_US/feedback/detail.page?LegacyDocID=MIGR-76613
    Do letus know if any more help is required
    Hope This Helps
    Cheers!!!
    WW Social Media
    Important Note: If you need help, post your question in the forum, and include your system type, model number and OS. Do not post your serial number.
    Did someone help you today? Press the star on the left to thank them with a Kudo!
    If you find a post helpful and it answers your question, please mark it as an "Accepted Solution"!
    Follow @LenovoForums on Twitter!
    How to send a private message? --> Check out this article.
    English Community   Deutsche Community   Comunidad en Español

  • The sound will only play through one side of the ear buds

    I have had my ipod classic 160GB for several years now. One day recently it just stopped emitting sound from one side of my ear buds. I tried different ear buds with no results. If I leave the ear bud jack plugged in half way in then it works, but I do not want to keep it unsecured like that. I do not still have my warranty on the ipod otherwise I would have contacted Apple directly.  

    You can obtain a replacement headphone jack/hold switch assembly from eBay or other online store. Opening the iPod isn't the easiest thing but it can be done with the accompanying tools, and a bit of patience and effort. Once the back is off the actual replacement of the components is quite easy though the screws are tiny. I've done half a dozen of these and/or battery swap outs.
    tt2

  • My iPad fell one night from one side (left) and now its border from the inside or the main screen  border (left side- portrait) is thicker on the other side (right side) like it moved left when it fell :(( so sad this is a gift from my mother. please help

    my iPad fell one night from one side (left) and now its border from the inside or the main screen  border (left side- portrait) is thicker on the other side (right side) like it moved left when it fell :(( so sad this is a gift from my mother. please help

    thank you. it just annoys me and im scared that my mom would notice it coz she bought it for me..

  • Lanyard headphones only play on one side

    I bought some lanyard headphones for my nano about 3 months ago, but I haven't used them a lot, once or twice a week maybe. Lately, sound only comes from one ear bud. This is frustrating since I've hardly even used them-- but I'm wondering if there is anything I might have accidentally done to settings somehow that would do this? Or are they just broken.

    Ah, had already rotated the plug a few times. I called Apple yesterday, and the status on that claim tells me this morning that the earbuds are on the local truck out for delivery already. That's awfully good service!

  • Can only connect from one direction

    I'm having trouble video confrencing... I tried searching the forums, but I'm having trouble thinking of clever search terms.
    I can only connect from one direction with one person. They can invite me to a chat and it works fine every time. However when I invite them it always fails. I can invite other people and it works fine though.
    This doesn't seem like a typical router problem, because they can invite me and we videochat just fine.
    This has been a problem for most versions of iChat that I can remember, but I'm using 3.1.5 currently.

    Hi
    Is the other person a PC user.
    Tony

  • "my home page only start from the tabs bar I don't see the top of the homepage

    I have a problem loading my Home page I don't see the top of the home page as the home page only starts from the tab bar I don't see the backward and forward arrows or the menu please tell me how to reload FireFox so that the full home page loads.
    == This happened ==
    Every time Firefox opened
    == Home page only start from the tabs bar I want to see the top part of the home page

    Press ALT or F10 in your keyboard to make the Menu Bar temporarily visible. If you want it to be permanently visible, go into ''View > Toolbars > Menu Bar'', or right-click the Navigation Toolbar (the Reload button, for example) and select ''Menu Bar''.
    If this doesn't help, right-click the navigation toolbar, select ''Customize...'' and click ''Restore Default Set''. If it doesn't appear right away, try pressing ALT or F10. You can go into ''View > Toolbars > Menu Bar'' to make it permanently visible, or right-click the Navigation Toolbar and select ''Menu Bar''.
    If none of this helps, you may be having a problem with some Firefox add-on that is hindering your Firefox's normal behavior. Try disabling all add-ons (just to check), to see if Firefox goes back to normal.

Maybe you are looking for