Router to Router VPN error

Hi Everyone, I have a lab with (3) 2500series routers IOS 12.2. Have setup an ipsec vpn between the far side routers, but the ipsec sa is not establishing. After debugging isakmp to see if they establish phase 1, I get the following error:
03:52:45: ISAKMP: reserved not zero on ID payload!
03:52:45: %CRYPTO-4-IKMP_BAD_MESSAGE: IKE message from 172.16.0.100 failed its sanity check or is malformed
Here is the complete debug:
Boston#debug crypto isakmp
03:52:34: ISAKMP (0:0): received packet from 172.16.0.100 (N) NEW SA
03:52:34: ISAKMP: local port 500, remote port 500
03:52:34: ISAKMP (0:2): processing SA payload. message ID = 0
03:52:34: ISAKMP (0:2): found peer pre-shared key matching 172.16.0.100
03:52:34: ISAKMP (0:2): Checking ISAKMP transform 1 against priority 105 policy
03:52:34: ISAKMP: encryption DES-CBC
03:52:34: ISAKMP: hash MD5
03:52:34: ISAKMP: default group 2
03:52:34: ISAKMP: auth pre-share
03:52:34: ISAKMP: life type in seconds
03:52:34: ISAKMP: life duration (VPI) of 0x0 0x1 0x51 0x80
03:52:34: ISAKMP (0:2): atts are acceptable. Next payload is 0
03:52:36: ISAKMP (0:2): SA is doing pre-shared key authentication using id type ID_IPV4_ADDR
03:52:36: ISAKMP (0:2): sending packet to 172.16.0.100 (R) MM_SA_SETUP
03:52:39: ISAKMP (0:2): received packet from 172.16.0.100 (R) MM_SA_SETUP
03:52:39: ISAKMP (0:2): processing KE payload. message ID = 0
03:52:42: ISAKMP (0:2): processing NONCE payload. message ID = 0
03:52:42: ISAKMP (0:2): found peer pre-shared key matching 172.16.0.100
03:52:42: ISAKMP (0:2): SKEYID state generated
03:52:42: ISAKMP (0:2): processing vendor id payload
03:52:42: ISAKMP (0:2): speaking to another IOS box!
03:52:42: ISAKMP (0:2): sending packet to 172.16.0.100 (R) MM_KEY_EXCH
03:52:45: ISAKMP (0:2): received packet from 172.16.0.100 (R) MM_KEY_EXCH
03:52:45: ISAKMP: reserved not zero on ID payload!
03:52:45: %CRYPTO-4-IKMP_BAD_MESSAGE: IKE message from 172.16.0.100 failed its sanity check or is malformed
03:52:45: ISAKMP (0:2): incrementing error counter on sa: PAYLOAD_MALFORMED
03:52:45: ISAKMP (0:2): sending packet to 172.16.0.100 (R) MM_KEY_EXCH
03:52:45: ISAKMP (0:2): incrementing error counter on sa: reset_retransmission
03:52:45: ISAKMP (0:1): purging SA., sa=36B920, delme=36B920
03:52:46: ISAKMP (0:2): retransmitting phase 1 MM_KEY_EXCH...
03:52:46: ISAKMP (0:2): incrementing error counter on sa: retransmit phase 1
03:52:46: ISAKMP (0:2): no outgoing phase 1 packet to retransmit. MM_KEY_EXCH
03:52:46: ISAKMP (0:2): received packet from 172.16.0.100 (R) MM_KEY_EXCH
03:52:46: ISAKMP: reserved not zero on ID payload!
03:52:46: ISAKMP (0:2): incrementing error counter on sa: PAYLOAD_MALFORMED
03:52:46: ISAKMP (0:2): sending packet to 172.16.0.100 (R) MM_KEY_EXCH
03:52:46: ISAKMP (0:2): incrementing error counter on sa: reset_retransmission
03:52:47: ISAKMP (0:2): retransmitting phase 1 MM_KEY_EXCH...
03:52:47: ISAKMP (0:2): peer does not do paranoid keepalives.
03:52:47: ISAKMP (0:2): deleting SA reason "death by retransmission P1" state (R) MM_KEY_EXCH (peer 172.16.0.100) input queue 0
03:52:48: ISAKMP (0:2): received packet from 172.16.0.100 (R) MM_NO_STATE
03:52:58: ISAKMP (0:2): received packet from 172.16.0.100 (R) MM_NO_STATE
03:53:47: ISAKMP (0:2): purging SA., sa=36BE64, delme=36BE64

"reserved not zero on payload" generally means your pre-shared keys don't match. Try removing the "crypto isakmp key ...." line and retyping it in again on both sides. In particular DON'T cut/paste it from one router config into another, this quite often puts a space character onto the end of the key, which the router interprets as part of the key and they therefore don't match.

Similar Messages

Router WRV54G Quick vpn client 1.10 ruuing on XP (remotel...

router WRV54G
Quick vpn client 1.10 ruuing on XP (remotely)
well, the client can connect to VPN router and i can verify the status online on tab vpn BUT
after 2-3 min. client receive the error message
"the gateway not responding"
AND
if client tries to ping from command prompt to the local ip addresses he find "negociating IP security"
status of router is :
- all security including firewall is disabled
- i have public IP address on Router having 255.255.255.0 subnet
- my local subnet is 10.10.1.x
please tell me what should be done
Thanks
Message Edited by SHAQ on 12-18-2007 09:26 AM

try upgrading / reflashing the firmware of the wrv54g to the latest available from www.linksys.com/download
try changing the MTU size on the client router to 1452
check whether it makes any difference

Router-to-PIX VPN Tunnels fade in and out

Does anyone know of any problems with Router-to-PIX vpn tunnels? For a number of months we've had about 35 831Routers vpn'd into our PIX515 and the tunnel has been stable. Recently, however, the tunnel has been dropping out at a number of sites.
When the tunnel goes down the users still have access to their local internet but obviously not to the shared network resources of the vpn tunnel. In most cases the tunnel can be re-established at each location simply by rebooting the router. Only problem with that is that some of the locations are having to reboot their 831Router more than two or three times a day.
I've added keepalive statements into theconfig of the routers and the PIX. Specifically I've added these two lines to the routers:
Crypto isakmp keepalive 10 5
crypto ipsec secutity-association lifetime seconds 28800
I added a similar isakmp keepalive to the PIX. Any suggestions would be appreciated as some of my users are getting frustrated.
Thank you,
Chris

Try using the debug commands and see if you are getting any error messages that might give us some idea.

Wireless and hard wired router giving me an error message, network cable unplugged

I have two Linksys routers, WRT54G and the BEFSR41. Have run the install disk on both, but once I link my CAT 5 Etehrnet cables to the router, I get the unplugged netwrok cable error. I have internet access through my cable modem directly to the PC, but once I run the connection through the router I get the error. Linksys help line was lost, as was my ISP help line. Tried assigning IP, physically unhooked and rehooked all the cables, etc., etc., I thought maybe I had a bad router with the hard wired, but wireless is same error. Any suggestions??

Try this setting:
1) Lower down the Ethernet card speed to 10Half Mbps .....
2) Use any other cable ...
3) if still you are getting same error ..... reset the router for few seconds .....
See if it works ....

VPN between ASA5505 Easy VPN Server and 881G Router as Easy VPN Client

Hello,
I have problem in VPN between ASA5505 Easy VPN Server and 881G Router as Easy VPN Client. ASA 5505 have 7.2.3 software and 881G router have 15.1 software.
881G is configured as hardware client in network exstention mode, and it is placed behind NAT. ASA5505 is working as server. Same VPN Group works correctly from VPN software clients.
When I send traffic from 881G client side, in show cryto sessin detail I see encrypted packets. But with same command I dont see decrypted packet on ASA5505 side. On both devices Phase 1 and Phase 2 are UP.
VPN is working when I replace ASA5505 with ASA5510 correctly with have 8.4.6 software. But problem is that i need to do this VPN between ASA5505 and 881G.
Can you help me, how can I debug or troubleshoot this problem ?
I am unable to update software on ASA5505 side.

Hello,
Hire is what my config look like:
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set pfs
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 40 set pfs
crypto dynamic-map outside_dyn_map 40 set transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 60 set pfs
crypto dynamic-map outside_dyn_map 60 set transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 80 set pfs
crypto dynamic-map outside_dyn_map 80 set transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 100 set pfs
crypto dynamic-map outside_dyn_map 100 set transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 120 set pfs
crypto dynamic-map outside_dyn_map 120 set transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 140 set pfs
crypto dynamic-map outside_dyn_map 140 set transform-set ESP-AES-128-SHA
crypto dynamic-map outside_dyn_map 160 set pfs
crypto dynamic-map outside_dyn_map 160 set transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 180 set pfs
crypto dynamic-map outside_dyn_map 180 set transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 200 set pfs
crypto dynamic-map outside_dyn_map 200 set transform-set ESP-AES-256-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 1
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 2
authentication pre-share
encryption 3des
hash sha
group 1
lifetime 86400
crypto isakmp policy 3
authentication pre-share
encryption des
hash sha
group 2
lifetime 86400
tunnel-group HW-CLIENT-GROUPR type ipsec-ra
tunnel-group HW-CLIENT-GROUP general-attributes
address-pool HW-CLIENT-GROUP-POOL
default-group-policy HW-CLIENT-GROUP
tunnel-group HW-CLIENT-GROUP ipsec-attributes
pre-shared-key *******
group-policy HW-CLIENT-GROUP internal
group-policy HW-CLIENT-GROUP attributes
password-storage enable
split-tunnel-policy tunnelspecified
split-tunnel-network-list value cisco_splitTunnelAcl
nem enable

No route to host:connect -- error in the struts-config.xml file

hi all,
acutally am doing a struts application in that i have written everything properly
but getting this kinda no route to host:connect error
my struts-config.xml file is like this...
<struts-config>
<form-beans>
<form-bean name="myForm" type="MyForm">
</form-beans>
<action-mappings>
<action path="/action"
               name="myForm"
               type="MyAction"
               scope="request"
               validate="true" >
               <forward name="success" path="/success.jsp" />
               <forward name="failure" path="/failure.jsp" />
     </action>
</action-mappings>
</struts-config>
sikandar

Hi Lee,
I am working on Oracle ADF 10.1.2 and getting the same problem. The lines in my struts-config.xml are as below:
<action path="/unitsView" className="oracle.adf.controller.struts.actions.DataActionMapping" type="view.UnitsViewAction" name="DataForm" parameter="/unitsView.uix" unknown="false">
<set-property property="modelReference" value="unitsViewUIModel"/>
<forward name="unitsEditLink" path="/unitsEdit.do"/>
</action>
<action path="/unitsView" className="oracle.adf.controller.struts.actions.DataActionMapping" type="view.UnitsViewAction" name="DataForm" parameter="/unitsView.uix" unknown="false">
<set-property property="modelReference" value="unitsViewUIModel"/>
<forward name="unitsCreateLink" path="/unitsCreate.do"/>
</action>
I have two lines with [action path="/unitsView"]. The reason why is that I want the user to go to the form create screen for the create button and form edit screen for the edit button. If this does not work, it seems to mean that only a single screen can be used for create/edit functions. However, the ADF editor diagram looks perfectly to point to create.uix and edit.uix respectively.
Please shed some light.
Thanks,
Regards,
Michael

SAP router installation for VPN method

Hi All,
Can any one share me the steps to perform SAP Router Configuration with VPN method.
Also what are changes i need to make in saproutab file.
Appreciate your inputs.
Thanks
Pradeep.

There is paperwork that you need to fill out with IPSec information, once its filled out you fax it over to SAP.
Not entirely sure what changes need to be made in saprouttab? Are you changing SAPRouter to no longer perform SNC to SAP?
Here is the doco I used for my company - https://support.sap.com/content/dam/library/SAP%20Support%20Portal/remote-support/RemoteSupport.pdf

Router to Router Dialer VPN

one of my router is configured with site to site vpn, I want this router to establish a dialer vpn from a remote router,
Remote router will be configured as dialer vpn as there is no Live IP available in remote site, I dont want to configure it as Site to site vpn,
Please refer some docuement to achive this goal,

Hi Karsten -
I'm afraid I cannot use the EasyVPN feature at all.
The vendor informs me that there is another IPSec VPN tunnel which connects back to their office to provide other capabilities.
So I have to use L2L IPSec -- and do it with a dynamic IP from the router side, to a fixed IP on the ASA side.
Is it possible to build the tunnel-group on the ASA side so that it doesn't require a known IP for the remote side of the tunnel?
I'm using DefaultL2L tunnel group (on the ASA) at the moment to terminate the VPN when the router is using the satellite connection via FA90/1, with a fixed IP address.
But the DefaultL2L group doesn't have the IP of the router -- yet it works...
The same VPN config, used from the FA0/0 interface of the router with the same crypto map
just gives the traditional "No match, deleting SA" message..
I can see the router trying to establish the VPN, but it's just not able to negotiate, and the only reason I could think of was that the FA0/0 interface had a DHCP address instead of a static IP.
Strange that it works OK with the ASA's DefaultL2L tunnel group, with no mention of the router's FA0/1 static IP, yet the FA0/0 with a dynamic IP won't work.
We did just hook up the satellite and used FA0/1 to test it -- vpn came up instantly...

Router to Router VPN with Overlapping internal networks

Hello Experts,
One quick question. How do I configure a Router to Router VPN with overlapping internal networks???
Both of my internal networks have ip address of 192.168.10.0 and 192.168.10.0
Any link or config will be appreciated. I've been looking but no luck.
Thanks,
Randall

Randall,
Please refer the below URL for configuration details:
Configuring an IPSec Tunnel Between Routers with Duplicate LAN Subnets
http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a00800b07ed.shtml
Let me know if it helps.
Regards,
Arul
** Please rate all helpful posts **

Router-to-Router VPN Security

Hi there,
Should we worry about the the security on router-to-router VPN over internet (IPSec) ?
We have two offices.
Office A has Cisco 2811 router (internal, private) and ASA 5510 firewall.
Office B has Cisco 2821 router (internal, private) and ASA 5505 firewall.
Office B has private subnets that extend to 7 hops away. (running RIP)
If we want to set up a site-to-stie VPN between these two offices, should we set it up on ASA's or routers?
If we set up VPN on routers, does that mean we need to connect one interface to the internet on each router and suffer from Internet attacks?
How do we defend our routers then?
Thanks in advance!
-Andrew

Hi,
when it comes to site to site vpn I usually prefer routers. Whith a little bit of tweaking NAT and routing you should be able to operate a public address on the routers even if they are behind the firewall.
The advantage of IOS based VPN is e.g. the possibility of routing protocols through the VPN tunnels which would give another level of resiliency. Configure tunnel interfaces on the routers with a tunnel mode IPsec and a tunnel protection profile. You can then run e.g. EIGRP to find a possible alternate path if one of the tunnels fails. Its much easier than anything I can think of on the ASA.
Rgds, MiKa

Cisco 831 Router to Configure VPN Access

Hello,
I need assistance in configuring a VPN in a Cisco 831 Router. I do not have any experience in configuring routers and VPN's, and would appreciate if any one could help out.
I would like to connect three Laptops to the Cisco 831 via Cisco VPN Client. Three laptops must have 10.42.6.x Address assigned by the router on the VPN Connection. They will also need access to the internal network which is 192.168.x.x private network. The Cisco has a Static IP on the Internal Interface and External Interface. I have tried several different ways of doing this, however I must be doing something wrong in my config.
Any help or suggestions would be appreciated.

Hi Robert
You can refer the below link in finding out the exact config to start with.
do make sure that your Cisco 831 box with the current IOS code installed in it supports the required feature to run the same..
http://www.cisco.com/en/US/tech/tk583/tk372/tech_configuration_examples_list.html#anchor16
regds

Does 1841 router support IPsec vpn?

Hi,
how can i check if my router supports IPsec VPN?
Cisco 1841 Software (C18410IPBASEK9-M), 12.4(11)T
regards
kimhoe

Hi,
Yes, it does support IPSEC VPN. You can check it from software adviser tool at Cisco site,
http://www.cisco.com/en/US/partner/support/tsd_most_requested_tools.html
Regards,
~JG
Please rate helpful posts

How do i get my wifi to work again on my ipod touch . it says no wifi and wont let me turn it on .. says something bout the VPN error, please anyone help

my wifi dont work or even trys to find or turn on ... something bout the VPN error .. how do i connect to VPN? thinking that will let my wifi work?

See:
iOS: Wi-Fi or Bluetooth settings grayed out or dim
One user reported that placing the iPod in the freezer fixed the problem.
If not successful, an appointment at the Genius Bar of an Apple store is usually in order.
Apple Retail Store - Genius Bar

Routes and Routes Determination

Hello All,
I m basically a technical person and i m doing recording for routes and routes determination.
I am facing one problem.
while executing transaction 0vtc in one system , while saving data its asking for transport request.
and when i execute the same transaction in IDES system , and when i save data it does not ask for the transport request.
Is there any config for that?
Please help me out...its required asap..
thanks,
jigs
Helpful ans will be rewarded.

Hi
not sure if this would help. but going through some of the older posts here, here's something I gathered:-
++++++++++++++++++++++
It also depends on the client settings, which is done by the BASIS guys. If the client settings are done in such a way that system should not generate requests then it will not generate a request.
If the system is created as a Sandbox then also system will not ask for a request.
using the T codes SE01 where all the list can be viewed , then select the task or transport request click on the trucj button .
+++++++++++++++++++++
hope it's a start

Difference between Routing & Rate Routing

Hi All,
can anyone tell me difference between Routing & Rate Routing? can we use routing for REM? if no, then what will be the effect?
Thanks,
Rinky

Hi Rinky ,
Routing and rate routing are task list in broad manner .
standard task list: Describes the worksteps necessary to produce a material or perform an activity without reference to an order.( that means they are created without reference to order )
Essential objects of a task list are header, operations, material component allocations, production resources/tools and inspection characteristics.
Together with specific dates and quantities, task list data forms an important part of the order.
The following task list types exist in the R/3 System:
routing
reference operation set
rate routing
reference rate routing
inspection plan
maintenance task list
standard network
master recipe
Routing is created with ca01 and rate routing by ca21 .
Routing is used in discrete manufacuting and rate routing in repetitive .
Rate routing generally has only one operation and prod line instead of work centers and operations in routings .
Both routings can be used for scheduling , cosing and capacity planning .
Hope this was helpful answer !
Neal
Edited by: Neal Gibson on Jun 30, 2008 11:46 AM

Routing & rate routing

hello everyone,
myself rekha bamgude,i want to know difference between routing & rate routing?

Hi rekha to get a quick (or any) response, create your new discussion in a space related to your query. This way it will be visible to topic experts who will then see and reply to it.
Please move this thread to the relevant forum Enterprise Resource Planning (SAP ERP)
as you mention
i want to know difference between routing & rate routing?
Many times we told this word (Search before you post ).
please see this thread for more details.
Difference between routing and rate routing
poorna

Router to Router VPN error

Similar Messages

Maybe you are looking for