Cisco Router ro Router IPSEC config

Question

I have the following configurations,

R1:

crypto keyring KR
  pre-shared-key address 1.1.1.2 key cisco
!
crypto isakmp policy 10
 encr 3des
 authentication pre-share
 group 2
crypto isakmp profile PROFILE
   keyring KR
   match identity address 1.1.1.2 255.255.255.255
!
!
crypto ipsec transform-set TRANSFORM_SET esp-3des esp-sha-hmac
!
crypto map MAP 10 ipsec-isakmp
 set peer 1.1.1.2
 set transform-set TRANSFORM_SET
 set isakmp-profile PROFILE
 match address IPSEC_ACL
!    
ip access-list extended IPSEC_ACL
 permit ip host 1.1.1.1 host 1.1.1.2
!
int e0/0
ip address 1.1.1.1 255.255.255.0
crypto map MAP

and R2:

crypto keyring KR
  pre-shared-key address 1.1.1.1 key cisco
!
crypto isakmp policy 10
 encr 3des
 authentication pre-share
 group 2
crypto isakmp profile PROFILE
   keyring KR
   match identity address 1.1.1.1 255.255.255.255
!
!
crypto ipsec transform-set TRANSFORM_SET esp-3des esp-sha-hmac
!
crypto map MAP 10 ipsec-isakmp
 set peer 1.1.1.1
 set transform-set TRANSFORM_SET
 set isakmp-profile PROFILE
 match address IPSEC_ACL
!    
ip access-list extended IPSEC_ACL
 permit ip host 1.1.1.2 host 1.1.1.1
!
int e0/0
ip address 1.1.1.2 255.255.255.0
crypto map MAP

The IPSEC tunnel won't come up any idea why?

Answer 1

The match address ACL should be the IP ranges which will be going over the link not the IPs where the crypto maps are.

For example, If IP range 192.168.1.0/24 is on R1 and 192.168.2.0/24 is on R2 and the hosts on 192.168.1.0/24 want to talk to 192.168.2.0/24 via the tunnel you would need to set the ACLs to be the following.

R1

ip access-list extended IPSEC_ACL
 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255

R2

ip access-list extended IPSEC_ACL
 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255

The routers will then try to bring up the tunnel when traffic goes from 192.168.1.0/24 to 192.168.2.0/24 or from 192.168.2.0/24 to 192.168.1.0/24

You can try the following to look at the debug output to see where the tunnel is failing on coming up

debug crypto isakmp
debug crypto ipsec

to disable the debugging use

undebug all

or

no debug all 

if you don't see any debug output you might need to enable terminal monitor

terminal monitor