VRF aware IPSEC with vrf-lite

A lot of firsts for me on this But I am trying to link multiple VRF's via IPSEC utilizing one public interface on each side of the tunnel. I do not have MPLS or BGP... Is this what they mean by VRF-lite?

Everything works individually, but when I add multiple profiles, it matches the last profile in the show run... regardless of which vrf/interface it is mapped to. Sometimes this is correct... majority of the time it is not.

I can add one profile, send traffic to bring up the SA, then add the next profile, send traffic through that vrf to bring up that SA... and so on until all VRF's have an active SA and everything works in this case... but if I clear all the SA's and try traffic through any vrf, it does not work unless it is the VRF matching the last profile.

It appears to me that it matches the "match identity" config regardless of what vrf/crypto map/interface the profile is assigned. Can someone see what I might have done wrong?


ip vrf fvrf
rd 2:2
!
ip vrf fvrfcust
rd 10:10
!
ip vrf fvrfcust2
rd 68:2
!
ip vrf fvrfcust3
rd 69:3
!
ip vrf fvrfcust4
rd 70:4
!
crypto keyring PE1to2key
pre-shared-key address 1.1.1.4 key pe1to2key
crypto keyring fvrf vrf fvrf
description Keyring for FVRF test
pre-shared-key address 6.6.6.4 key fvrfkey
!
crypto isakmp policy 5
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp profile fvrfprof
description ISAKMP Profile for FVRF test
vrf fvrfcust
keyring fvrf
match identity address 6.6.6.4 255.255.255.255 fvrf
crypto isakmp profile fvrfcust2
description ISAKMP Profile for FVRF cust2
vrf fvrfcust2
keyring fvrf
match identity address 6.6.6.4 255.255.255.255 fvrf
crypto isakmp profile fvrfcust3
description ISAKMP Profile for FVRF cust3
vrf fvrfcust3
keyring fvrf
match identity address 6.6.6.4 255.255.255.255 fvrf
crypto isakmp profile fvrfcust4
description ISAKMP Profile for FVRF cust4
vrf fvrfcust4
keyring fvrf
match identity address 6.6.6.4 255.255.255.255 fvrf
!
!
crypto ipsec transform-set 3desmd5 esp-3des esp-md5-hmac
!
crypto map PE2 10 ipsec-isakmp
set peer 1.1.1.4
set transform-set 3desmd5
set isakmp-profile PE1
match address 100
!
crypto map fvrfcust2 local-address FastEthernet0/1.10
crypto map fvrfcust2 10 ipsec-isakmp
set peer 6.6.6.4
set transform-set 3desmd5
set isakmp-profile fvrfcust2
match address fvrfcust2
!
crypto map fvrfcust3 local-address FastEthernet0/1.10
crypto map fvrfcust3 10 ipsec-isakmp
set peer 6.6.6.4
set transform-set 3desmd5
set isakmp-profile fvrfcust3
match address fvrfcust3
!
crypto map fvrfcust4 local-address FastEthernet0/1.10
crypto map fvrfcust4 10 ipsec-isakmp
set peer 6.6.6.4
set transform-set 3desmd5
set isakmp-profile fvrfcust4
match address fvrfcust4
!
crypto map fvrfcustCM local-address FastEthernet0/1.10
crypto map fvrfcustCM 10 ipsec-isakmp
set peer 6.6.6.4
set transform-set 3desmd5
set isakmp-profile fvrfprof
match address FVRFCustACL
!

Thanks!