Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am trying to connect a Cisco IOS router to Azure via the IPSec VPN. I have used the Cisco ISR template to establish a tunnel from my router to Azure. In the Azure control panel, I can see that the connection is established. However, while "Data Out" seems to be working, the "Data In" shows zero, and I can't SSH, RDP or nslookup to or from my local network to Azure in either direction.

As the tunnel is established, I'm sure the problem is on my router. I'm not really a networking guy (sole IT guy for a small business), so any help would be appreciated.

Here's some output from my router:

murasaki#sh crypto session
Crypto session current status

Interface: Virtual-Access2
Session status: DOWN
Peer: x.x.x.x port 500
  IPSEC FLOW: permit ip
        Active SAs: 0, origin: crypto map

Interface: Dialer1
Session status: UP-ACTIVE
Peer: x.x.x.x port 500
  IKE SA: local x.x.x.x/500 remote x.x.x.x/500 Active
  IPSEC FLOW: permit ip
        Active SAs: 2, origin: crypto map

murasaki#sho crypto isakmp sa
dst             src             state          conn-id status
x.x.x.x        x.x.x.x        QM_IDLE           2002 ACTIVE


Here's the config of the router with the sensitive bits removed / scrubbed:

version 15.0
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
hostname murasaki
aaa new-model
aaa authentication ppp default local
aaa authorization network default local 
aaa session-id common
memory-size iomem 10
crypto pki trustpoint TP-self-signed-4045734018
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-4045734018
revocation-check none
rsakeypair TP-self-signed-4045734018
ip source-route
ip cef
ip inspect name normal_traffic tcp
ip inspect name normal_traffic udp
ipv6 unicast-routing
ipv6 cef
object-group network INTERNAL_LAN 
description All Internal subnets which should be allowed out to the Internet
ip ssh time-out 60
ip ssh version 2
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 2
lifetime 28800
crypto isakmp key  address 
crypto ipsec transform-set AzureIPSec esp-aes 256 esp-sha-hmac 
crypto map AzureCryptoMap 10 ipsec-isakmp 
set peer 
set security-association lifetime kilobytes 102400000
set transform-set AzureIPSec 
match address AzureCloudVMs
bridge irb
interface BRI0
no ip address
encapsulation hdlc
isdn termination multidrop
interface ATM0
mtu 1492
no ip address
no atm ilmi-keepalive
pvc 8/35 
encapsulation aal5mux ppp dialer
dialer pool-member 1
interface Vlan1
description Main LAN
ip address
ip nat inside
ip virtual-reassembly
interface Vlan5
description Azure VLAN
ip address
interface Dialer1
mtu 1492
ip address negotiated
ip access-group PORTS_ALLOWED_IN in
ip flow ingress
ip nat outside
ip inspect normal_traffic out
ip virtual-reassembly
encapsulation ppp
ip tcp adjust-mss 1350
dialer pool 1
dialer-group 1
ipv6 address autoconfig
ipv6 enable
ppp ipcp route default
no cdp enable
crypto map AzureCryptoMap
no ip forward-protocol nd
no ip http server
no ip http secure-server
ip nat translation timeout 360
ip nat inside source list SUBNETS_AND_PROTOCOLS_ALLOWED_OUT interface Dialer1 overload
ip nat inside source static tcp 192.168.x.x 55663 interface Dialer1 55663
ip nat inside source static tcp 192.168.x.x 22 interface Dialer1 22
ip nat inside source static udp 192.168.x.x 55663 interface Dialer1 55663
ip access-list extended AzureCloudVMs
permit ip
ip access-list extended GUEST_VLAN
permit tcp any any eq 22
permit tcp any any eq www
permit tcp any any eq 443
permit tcp any any eq domain
permit udp any any eq domain
permit icmp any any
ip access-list extended PORTS_ALLOWED_IN

remark List of ports which are allowed IN

permit gre any any
permit esp any any
permit udp any any eq non500-isakmp
permit udp any any eq isakmp
permit tcp any any eq 55663
permit udp any any eq 55663
permit tcp any any eq 22
permit tcp any any eq 222
permit tcp any any eq 1723
permit tcp any any eq 443
permit icmp any any echo-reply
permit icmp any any traceroute
permit icmp any any port-unreachable
permit icmp any any time-exceeded
deny ip any any
deny tcp object-group INTERNAL_LAN any eq smtp
permit tcp object-group INTERNAL_LAN any
permit udp object-group INTERNAL_LAN any
permit icmp object-group INTERNAL_LAN any
deny ip any any
no cdp run

ipv6 route ::/0 Dialer1
share|improve this question
Shouldn't the Virtual-Access2 interface have UP status? Otherwise the rule permitting traffic between the two 192.168 subnets wouldn't seem to be in effect. – Noah Stahl May 29 '13 at 1:01
Yes, I would have thought so. But this isn't an interface I have defined, so I can't go into the config and do a 'no shut'. – Timothy May 29 '13 at 1:57
What I'm thinking is that doesn't mean it is configured to be down, but rather that your session isn't actually getting established. What does the Azure side report? – Noah Stahl May 29 '13 at 3:16
Hmm, Azure says it's up though: And the router says an IPsec and ISAKMP SA has been established. But I still can't RDP or SSH to or from anything using the Azure addresses (the 192.168.5.x range). – Timothy May 29 '13 at 5:14

1 Answer 1

up vote 0 down vote accepted

Turns out I just needed to remove the VLAN 5 and IP address from the Cisco router!

share|improve this answer
If this solved your problem, you can accept your own answer as a solution. – Tom O'Connor May 29 '13 at 10:14
Interesting. Which part of the config did you remove? – Noah Stahl May 29 '13 at 12:02
He had a local interface (vlan 5) with an IP space overlapping with its Azure subnet, so the router was trying to locally route that traffic instead of sending that into the tunnel. Also a reverse route check would've dropped that traffic when coming from Azure. – Pedro Perez Feb 20 at 0:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.