无法删掉IPsec crypto isakmp profile的解决方法

原因

在删除IPsec crypto isakmp 出现以下提示在被使用中

#no crypto isakmp profile cp--5007001

% Profile cp--5007001 is still in use and cannot be removed

解决方法

1：先找到isakmp profile 被调用的session远端IP

#show crypto session isakmp profile  cp--5007001
Crypto session current status

Interface: GigabitEthernet0/1.21
Profile: cp--5007001
Session status: UP-IDLE
Peer: 61.145.177.X port 4500 
  Session ID: 0  
  IKEv1 SA: local 119.145.254.5X/4500 remote 61.145.177.X/4500 Active 

从上面我们可以看到远端的IP地址为 61.145.177.X/

2: 找到对应session对应的conn-id，并清除它

#show crypto isakmp sa 
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
119.145.254.5X 61.145.177.X  QM_IDLE          12413 ACTIVE     //发现conn-id 为12413

#clear crypto isakmp 12413   // 清除找到的sa ，清除需要等个几秒等出现以下状态就可以删掉

#show crypto isakmp sa 
119.145.254.5X 61.145.177.X  AG_INIT_EXCH         0 ACTIVE
119.145.254.5X 61.145.177.X  MM_NO_STATE          0 ACTIVE (deleted)

3: 成功删掉 isakmp profile

#no crypto isakmp profile cp--5007001