IPsec HA Redundancy Issue: Tunnel Not Establishing

[tataizo]

Hello everyone,

I am experiencing an issue while deploying IPsec with High Availability (HA) redundancy. The IPsec tunnels are not coming up as expected, and I am reaching out for assistance to help resolve this.

### Configuration Details:

**Crypto Configuration**:

crypto pki trustpoint SLA-TrustPoint
enrollment pkcs12
revocation-check crl
hash sha256
crypto pki certificate chain SLA-TrustPoint
certificate ca 01
quit
crypto isakmp policy 2255
encryption aes 256
hash sha
authentication pre-share
group 14
lifetime 3600
crypto isakmp key Gimec@123 address 172.16.100.1
crypto ipsec transform-set IPSEC_TS_EQUINIX_GCP esp-aes 256 esp-sha-hmac
mode tunnel
crypto ipsec profile IPSEC_PROFILE_EQUINIX_GCP
set security-association lifetime seconds 7200
set transform-set IPSEC_TS_EQUINIX_GCP

**Tunnel Interface Configuration**:

interface Tunnel10
ip address 10.10.10.2 255.255.255.255
ip mtu 1400
ip tcp adjust-mss 1360
load-interval 30
tunnel source GigabitEthernet11
tunnel mode ipsec ipv4
tunnel destination 172.16.100.1
tunnel protection ipsec profile IPSEC_PROFILE_EQUINIX_GCP

### Logs:

#### ISAKMP Status:

sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id status
172.16.100.1 169.254.7.10 MM_NO_STATE 0 ACTIVE
172.16.100.1 169.254.7.10 MM_NO_STATE 0 ACTIVE (deleted)

#### IPsec Status:

sh crypto ipsec sa
interface: Tunnel10
Crypto map tag: Tunnel10-head-0, local addr 169.254.7.10
protected vrf: (none)
local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
current_peer 172.16.100.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0

It seems that ISAKMP is stuck in the "MM_NO_STATE" status, and no packets are being encrypted or decrypted. This suggests there might be an issue with the initial ISAKMP negotiation or IPsec profile.

I would appreciate any insights or troubleshooting steps that could help resolve this issue.

Thank you for your support!

[jamespatrickm]

Hi @tataizo,

Welcome to Google Cloud Community!

ISAKMP Key Mismatch could be possible. Double-check your pre-shared keys(PSK) if it matches on both ends. Perhaps you might also want to avoid special characters for your pre-shared keys. Another possible cause is the Policy Configuration, make sure that both sides have the same configuration.

For reference, see the following:

• crypto isakmp key
• pre-shared-key characters inquiry

I hope this helps.