Hello
I’ve found a number of times that if you have a crypto map that is applied to an interface, changes made to the transform-set that is applied to this interface are not applied instantaneously. So e.g. you have this crypto map:
crypto map MYMAP ipsec-isakmp 10
set peer 8.8.8.8
set security-association lifetime kilobytes 4608000
set security-association lifetime seconds 3600
set transform-set MYSET
set pfs group5
match address MY_INTERESTING_TRAFFIC
Now if you change MYSET, your router may still send out the old MYSET. Solution no1:
- be patient, wait 15 minutes
- clear the crypto map, apply it again
- shut and unshut the interface
So if you’re troubleshooting a broken S2S VPN, make one change, wait 15 minutes, check, if it’s still not working only THEN make another change.
Today I spent 80 minutes in a troubleshooting session with an engineer from the remote end trying one thing after another and nothing worked. We ended the session and set up another one for the next day. I reverted the config to the original settings + made 1 change that should be ok (but it still wasn’t ok! ), went shopping, came back, and it just worked!
