IPsec Troubleshooting
After an upgrade cisco router couldnt establish ipsec tunnel During debugs i see the below logs # debug cry isa sa *Jun 16 19:47:12.296 EEST: ISAKMP: (0):retransmitting phase 1 MM_NO_STATE... *Jun 16 19:47:12.296 EEST: ISAKMP: (0):: incrementing error counter on sa, attempt 3 of 5: retransmit phase 1 *Jun 16 19:47:12.296 EEST: ISAKMP: (0):retransmitting phase 1 MM_NO_STATE *Jun 16 19:47:12.296 EEST: ISAKMP-PAK: (0):sending packet to 88.28.206.154 my_port 500 peer_port 500 (I) MM_NO_STATE *Jun 16 19:47:12.296 EEST: ISAKMP: (0):Sending an IKE IPv4 Packet. *Jun 16 19:47:12.296 EEST: ISAKMP: (0):retransmitting phase 1 MM_NO_STATE... *Jun 16 19:47:12.296 EEST: ISAKMP: (0):: incrementing error counter on sa, attempt 3 of 5: retransmit phase 1 From the logs the issue seems to be phase 1. If you see there are increment attempts. Which means PH1 is cannot be established As we know isakmp is the PH1 of the IKEv1 IPsec. Cisco deprecated DH group 5 form supported algorithms on XE...