Most IPSec VPN parameters cannot be modified if they are linked to an active crypto list.
To modify a parameter linked to an active crypto list, you must first deactivate the list using the no ip crypto-group command in the context of the interface on which the crypto list is activated.
ADDITIONAL INFORMATION:
Note:
If the crypto list is activated on more than one interface, deactivate the crypto list for each of the interfaces on which it is activated.
For example:
G430-001# interface fastethernet 10/2 G430-001(if:FastEthernet 10/2)# no ip crypto-group Done!
After modifying IPSec VPN parameters as desired, re-activate the crypto list on the interface using the ip crypto-group crypto-list-id command.
ADDITIONAL INFORMATION:
For example:
G430-001# interface fastethernet 10/2 G430-001(if:FastEthernet 10/2)# ip crypto-group 901 Done!
