Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My ISP installed a program in my company to send SMS messages, I configured the router's site to site VPN but it does not work. It fails with an error check peer connect failed

this is the config:


Building configuration...

Current configuration : 5269 bytes
!
! Last configuration change at 11:09:17 GMT Sat Jun 15 2013 by admin
!
version 15.0
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime
service timestamps log datetime msec localtime
service password-encryption
!
hostname 
!
boot-start-marker
boot-end-marker
!
logging buffered 4096
enable password  
!
no aaa new-model
!
!
!
clock timezone GMT 3
!
!
crypto pki trustpoint TP-self-signed-4256698250
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-4256698250
 revocation-check none
 rsakeypair TP-self-signed-4256698250
!
!
crypto pki certificate chain TP-self-signed-4256698250
 certificate self-signed 01

        quit
no ipv6 cef
no ip source-route
ip cef
!
!
!
!
no ip bootp server
ip domain name 
!
multilink bundle-name authenticated
!
!
license udi pid C3900-SPE150/K9 sn FOC14400CCR
!
!
username XXXXX privilege 15 secret 5 
!
redundancy
!
!
!
!
crypto isakmp policy 1
 encr 3des
 hash md5
 authentication pre-share
crypto isakmp key KEEEEEE address XXX.XXX.XXX.XXX (PEER IP)
!
crypto ipsec security-association lifetime seconds 86400
!
crypto ipsec transform-set vpn-for-sms esp-3des esp-md5-hmac
crypto ipsec df-bit clear
!
!
crypto map vpn-sms 10 ipsec-isakmp
 set peer XXX.XXX.XXX.XXX (PEER IP)
 set transform-set vpn-for-sms
 match address vpn-acc-sms
!
!
!
!
!
interface GigabitEthernet0/0
 description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-GE 0/0$
 no ip address
 duplex auto
 speed auto
 !
!
interface GigabitEthernet0/0.XXX
 description Ethernet0/0.389 dot1q vlan id=XXX. By VPNSC: Job Id# = 81826
 encapsulation dot1Q 389
 ip address 
!
interface GigabitEthernet0/1
 ip address XX.XX.XX.XX 255.255.255.248    ((First Real IP 1) 
 ip nat outside
 ip virtual-reassembly
 duplex auto
 speed auto
 crypto map vpn-sms
 !
!
interface GigabitEthernet0/2
 ip address 192.168.10.2 255.255.255.252
 ip nat inside
 ip virtual-reassembly
 duplex auto
 speed auto
 !
!
interface ATM0/0/0
 no ip address
 shutdown
 no atm ilmi-keepalive
 !
!
router bgp 64803
 no synchronization
 bgp log-neighbor-changes
 network 10.33.20.0 mask 255.255.255.0
 network 10.33.21.0 mask 255.255.255.0
 network 172.16.0.0
 network 172.16.0.0 mask 255.255.255.0
 network 192.168.10.0 mask 255.255.255.252
 network 192.168.100.0
 neighbor              remote-as 65000
 no auto-summary
!
ip forward-protocol nd
!
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip nat inside source static 192.168.100.2 interface GigabitEthernet0/1
ip nat inside source static 10.33.21.33(Server ip) XX.XX.XX.XX (Real Ip 2)
ip route 0.0.0.0 0.0.0.0 XX.XX.XX.XX (MY Getway)

ip route 10.33.18.0 255.255.255.0 192.168.10.1
ip route 10.33.19.0 255.255.255.0 192.168.10.1
ip route 10.33.20.0 255.255.255.0 192.168.10.1
ip route 10.33.21.0 255.255.255.0 192.168.10.1
ip route 172.16.0.0 255.255.255.0 192.168.10.1
ip route 192.168.100.0 255.255.255.0 192.168.10.1
!
ip access-list extended vpn-acc-sms
 permit ip host XX.XX.XX.XX (Real Ip 2) host 212.118.129.59
 permit ip host XX.XX.XX.XX (Real Ip 2) host 212.118.129.200
!
access-list 23 permit 10.10.10.0 0.0.0.7
!
!
!
!
!
snmp-server community public RO
snmp-server host 172.16.0.200 public
!
control-plane
 !
!
banner exec

Router Name:  
Location:      

banner login

Unauthorized Access is Prohibited

!
line con 0
 password 7 
 login
line aux 0
line vty 0 4
 privilege level 15
 password 7 
 login
 transport input telnet ssh
line vty 5 15
 access-class 23 in
 privilege level 15
 login local
 transport input telnet ssh
!
scheduler allocate 20000 1000
end
share|improve this question
    
are there firewalls between the routers? –  user1008764 Jun 15 '13 at 19:18
    
no .. but Behind the router has 2 Firewall , ASA , TMG –  user177928 Jun 16 '13 at 5:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.