Here's a good Cisco link for the VRF Aware IPSec configuration. You can configure multiple pre-shared key (PSK) and peer address under the crypto keyring vrf command.
R1(config)#crypto keyring MYKEYRING vrf CUST-1
R1(conf-keyring)#pre-shared-key address 20.7.16.4 key key123
R1(conf-keyring)#pre-shared-key address 202.8.26.1 key key456
R1(conf-keyring)#
R1(conf-keyring)#do show run | section crypto
crypto keyring MYKEYRING vrf CUST-1
pre-shared-key address 20.7.16.4 key key123
pre-shared-key address 202.8.26.1 key key456
I just used tunnel vrf CUST-1 under the GRE tunnel used by CUST-2 VRF.
R1#show run interface Tunnel1
Building configuration...
Current configuration : 288 bytes
!
interface Tunnel1
ip vrf forwarding CUST-2
ip address 172.20.1.1 255.255.255.252
tunnel source 172.20.10.6
tunnel destination 172.20.10.7
tunnel vrf CUST-1
!
end
I initially configured a separate crypto keyring using a different VRF (CUST-2) but was getting this log error:
.Feb 9 10:29:08.488 UTC: %CRYPTO-6-IKMP_NO_PRESHARED_KEY: Pre-shared key for remote peer at 202.8.26.1 is missing
The debug also showed it's due to a missing PSK. I didn't notice it's using CUST-1 VRF.
R1#debug crypto isakmp
Crypto ISAKMP debugging is on
.Feb 9 10:32:12.466 UTC: ISAKMP (0): received packet from 202.8.26.1 dport 500 sport 500 CUST-1 (N) NEW SA
.Feb 9 10:32:12.466 UTC: ISAKMP: Created a peer struct for 202.8.26.1, peer port 500
.Feb 9 10:32:12.466 UTC: ISAKMP: New peer created peer = 0x2A60D02C peer_handle = 0x8000004E
.Feb 9 10:32:12.466 UTC: ISAKMP: Locking peer struct 0x2A60D02C, refcount 1 for crypto_isakmp_process_block
.Feb 9 10:32:12.466 UTC: ISAKMP: local port 500, remote port 500
.Feb 9 10:32:12.466 UTC: ISAKMP:(0):insert sa successfully sa = 2A4C0234
.Feb 9 10:32:12.466 UTC: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
.Feb 9 10:32:12.466 UTC: ISAKMP:(0):Old State = IKE_READY New State = IKE_R_MM1
.Feb 9 10:32:12.466 UTC: ISAKMP:(0): processing SA payload. message ID = 0
.Feb 9 10:32:12.466 UTC: ISAKMP:(0): processing vendor id payload
.Feb 9 10:32:12.466 UTC: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch
.Feb 9 10:32:12.466 UTC: ISAKMP:(0): vendor ID is NAT-T v2
.Feb 9 10:32:12.466 UTC: ISAKMP:(0): processing vendor id payload
.Feb 9 10:32:12.466 UTC: ISAKMP:(0): vendor ID seems Unity/DPD but major 157 mismatch
.Feb 9 10:32:12.466 UTC: ISAKMP:(0): vendor ID is NAT-T v3
.Feb 9 10:32:12.466 UTC: ISAKMP:(0): processing vendor id payload
.Feb 9 10:32:12.466 UTC: ISAKMP:(0): vendor ID seems Unity/DPD but major 69 mismatch
.Feb 9 10:32:12.466 UTC: ISAKMP (0): vendor ID is NAT-T RFC 3947
.Feb 9 10:32:12.466 UTC: ISAKMP:(0): processing vendor id payload
.Feb 9 10:32:12.466 UTC: ISAKMP:(0): processing IKE frag vendor id payload
.Feb 9 10:32:12.470 UTC: ISAKMP:(0):Support for IKE Fragmentation not enabled
.Feb 9 10:32:12.470 UTC: ISAKMP:(0):No pre-shared key with 202.8.26.1!
.Feb 9 10:32:12.470 UTC: %CRYPTO-6-IKMP_NO_PRESHARED_KEY: Pre-shared key for remote peer at 202.8.26.1 is missing
.Feb 9 10:32:12.470 UTC: ISAKMP : Scanning profiles for xauth ...
.Feb 9 10:32:12.470 UTC: ISAKMP:(0):Checking ISAKMP transform 1 against priority 10 policy
.Feb 9 10:32:12.470 UTC: ISAKMP: default group 2
.Feb 9 10:32:12.470 UTC: ISAKMP: encryption AES-CBC
.Feb 9 10:32:12.470 UTC: ISAKMP: keylength of 128
.Feb 9 10:32:12.470 UTC: ISAKMP: hash SHA
.Feb 9 10:32:12.470 UTC: ISAKMP: auth pre-share
.Feb 9 10:32:12.470 UTC: ISAKMP: life type in seconds
.Feb 9 10:32:12.470 UTC: ISAKMP: life duration (VPI) of 0x0 0x0 0xA8 0xC0
.Feb 9 10:32:12.470 UTC: ISAKMP:(0):Preshared authentication offered but does not match policy!
.Feb 9 10:32:12.470 UTC: ISAKMP:(0):atts are not acceptable. Next payload is 0
.Feb 9 10:32:12.470 UTC: ISAKMP:(0):no offers accepted!
.Feb 9 10:32:12.470 UTC: ISAKMP:(0): phase 1 SA policy not acceptable! (local 61.4.11.2 remote 202.8.26.1)
.Feb 9 10:32:12.470 UTC: ISAKMP (0): incrementing error counter on sa, attempt 1 of 5: construct_fail_ag_init
.Feb 9 10:32:12.470 UTC: ISAKMP:(0): Failed to construct AG informational message.
.Feb 9 10:32:12.470 UTC: ISAKMP:(0): sending packet to 202.8.26.1 my_port 500 peer_port 500 (R) MM_NO_STATE
.Feb 9 10:32:12.470 UTC: ISAKMP:(0):Sending an IKE IPv4 Packet.
.Feb 9 10:32:12.470 UTC: ISAKMP:(0):peer does not do paranoid keepalives.
.Feb 9 10:32:12.470 UTC: ISAKMP:(0):deleting SA reason "Phase1 SA policy proposal not accepted" state (R) MM_NO_STATE (peer 202.8.26.1)
