FMC/FDT site to site VPN

edp-adm — Tue, 21 Mar 2023 10:25:23 GMT

Hello

I have Firepower 1120 and configured s2s VPN to 3rd party using parameters as below

IKEv1 Encryption AES-256 Hash SHA Lifetime: 21600

IPSec Encryption AES-256 Hash SHA Lifetime: 3600

DH14

With NAT

nat (local_ip_pool,outsite_interface) source static local_ip_pool local_ip_pool destination static external_ip_pool external_ip_pool no-proxy-arp

Tunnel is in "Unknown" status

Is there any way to debug this via FMC/FTD? I tried to setup logging at FMC Devices -> Platform Settings -> Syslog but there is nothing helpful for debugging s2s

Re: FMC/FDT site to site VPN

Herald Sison — Tue, 21 Mar 2023 16:47:23 GMT

have you tried debugging using FTD CLI?

Re: FMC/FDT site to site VPN

edp-adm — Wed, 22 Mar 2023 08:38:14 GMT

Ya there was no logs about the tunnel itself, because my FTD works as server and was waiting for connection. Setting up the connection type on my side to "Originate Only" started connecting and finally logs appear.

Re: FMC/FDT site to site VPN

edp-adm — Wed, 22 Mar 2023 15:40:54 GMT

Ok I'm able to get logs but tunnel still fails, log from device pastebin - logs

Re: FMC/FDT site to site VPN

MHM Cisco World — Wed, 22 Mar 2023 16:34:51 GMT

can not open link

Re: FMC/FDT site to site VPN

edp-adm — Wed, 22 Mar 2023 16:35:57 GMT

<165>:2023-03-22T15:10:19Z: %FTD-vpn-5-752004: Tunnel Manager dispatching a KEY_ACQUIRE message to IKEv1. Map Tag = CSM_outsite_map. Map Sequence Number = 2.
<164>:2023-03-22T15:10:19Z: %FTD-vpn-4-752010: IKEv2 Doesn't have a proposal specified
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715077: Pitcher: received a key acquire message, spi 0x0
<165>:2023-03-22T15:10:19Z: %FTD-vpn-5-713041: IP = X.X.X.X, IKE Initiator: New Phase 1, Intf outsite, IKE Peer X.X.X.X local Proxy Address Y.Y.Y.Y, remote Proxy Address X.X.X.X, Crypto map (CSM_outsite_map)
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715046: IP = X.X.X.X, constructing ISAKMP SA payload
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715046: IP = X.X.X.X, constructing NAT-Traversal VID ver 02 payload
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715046: IP = X.X.X.X, constructing NAT-Traversal VID ver 03 payload
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715046: IP = X.X.X.X, constructing NAT-Traversal VID ver RFC payload
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715046: IP = X.X.X.X, constructing Fragmentation VID + extended capabilities payload
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-713236: IP = X.X.X.X, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 172
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-713906: IKE Receiver: Packet received on Y.Y.Y.Y:500 from X.X.X.X:500
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-713236: IP = X.X.X.X, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 152
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715047: IP = X.X.X.X, processing SA payload
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-713906: IP = X.X.X.X, Oakley proposal is acceptable
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715047: IP = X.X.X.X, processing VID payload
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715047: IP = X.X.X.X, processing VID payload
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715049: IP = X.X.X.X, Received NAT-Traversal RFC VID
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715047: IP = X.X.X.X, processing VID payload
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715049: IP = X.X.X.X, Received Fragmentation VID
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715064: IP = X.X.X.X, IKE Peer included IKE fragmentation capability flags: Main Mode: True Aggressive Mode: False
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715046: IP = X.X.X.X, constructing ke payload
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715046: IP = X.X.X.X, constructing nonce payload
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715046: IP = X.X.X.X, constructing Cisco Unity VID payload
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715046: IP = X.X.X.X, constructing xauth V6 VID payload
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715048: IP = X.X.X.X, Send IOS VID
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715038: IP = X.X.X.X, Constructing ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715046: IP = X.X.X.X, constructing VID payload
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715048: IP = X.X.X.X, Send Altiga/Cisco VPN3000/Cisco ASA GW VID
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715046: IP = X.X.X.X, constructing NAT-Discovery payload
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-713906: IP = X.X.X.X, computing NAT Discovery hash
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715046: IP = X.X.X.X, constructing NAT-Discovery payload
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-713906: IP = X.X.X.X, computing NAT Discovery hash
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-713236: IP = X.X.X.X, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NAT-D (20) + NAT-D (20) + NONE (0) total length : 432
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-713906: IKE Receiver: Packet received on Y.Y.Y.Y:500 from X.X.X.X:500
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-713236: IP = X.X.X.X, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + NAT-D (20) + NAT-D (20) + NONE (0) total length : 356
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715047: IP = X.X.X.X, processing ke payload
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715047: IP = X.X.X.X, processing ISA_KE payload
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715047: IP = X.X.X.X, processing nonce payload
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715047: IP = X.X.X.X, processing NAT-Discovery payload
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-713906: IP = X.X.X.X, computing NAT Discovery hash
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715047: IP = X.X.X.X, processing NAT-Discovery payload
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-713906: IP = X.X.X.X, computing NAT Discovery hash
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-713906: IP = X.X.X.X, Connection landed on tunnel_group X.X.X.X
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-713906: Group = X.X.X.X, IP = X.X.X.X, Generating keys for Initiator...
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715046: Group = X.X.X.X, IP = X.X.X.X, constructing ID payload
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715046: Group = X.X.X.X, IP = X.X.X.X, constructing hash payload
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715076: Group = X.X.X.X, IP = X.X.X.X, Computing hash for ISAKMP
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715046: Group = X.X.X.X, IP = X.X.X.X, constructing dpd vid payload
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-713236: IP = X.X.X.X, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + VENDOR (13) + NONE (0) total length : 84
<166>:2023-03-22T15:10:19Z: %FTD-vpn-6-713172: Group = X.X.X.X, IP = X.X.X.X, Automatic NAT Detection Status: Remote end is NOT behind a NAT device This end is NOT behind a NAT device
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-713906: IKE Receiver: Packet received on Y.Y.Y.Y:500 from X.X.X.X:500
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-713236: IP = X.X.X.X, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + NONE (0) total length : 64
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715047: Group = X.X.X.X, IP = X.X.X.X, processing ID payload
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-714011: Group = X.X.X.X, IP = X.X.X.X, ID_IPV4_ADDR ID received
X.X.X.X
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715047: Group = X.X.X.X, IP = X.X.X.X, processing hash payload
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715076: Group = X.X.X.X, IP = X.X.X.X, Computing hash for ISAKMP
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-713906: IP = X.X.X.X, Connection landed on tunnel_group X.X.X.X
<166>:2023-03-22T15:10:19Z: %FTD-auth-6-113009: AAA retrieved default group policy (.DefaultS2SGroupPolicy) for user = X.X.X.X
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-713906: Group = X.X.X.X, IP = X.X.X.X, Oakley begin quick mode
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-714002: Group = X.X.X.X, IP = X.X.X.X, IKE Initiator starting QM: msg id = 4bd7018f
<165>:2023-03-22T15:10:19Z: %FTD-vpn-5-713119: Group = X.X.X.X, IP = X.X.X.X, PHASE 1 COMPLETED
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-713121: IP = X.X.X.X, Keep-alive type for this connection: None
<163>:2023-03-22T15:10:19Z: %FTD-vpn-3-713122: IP = X.X.X.X, Keep-alives configured on but peer does not support keep-alives (type = None)
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715080: Group = X.X.X.X, IP = X.X.X.X, Starting P1 rekey timer: 16200 seconds.
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-713906: Group = X.X.X.X, IP = X.X.X.X, Add to IKEv1 Tunnel Table succeeded for SA with logical ID 5033984
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-713906: Group = X.X.X.X, IP = X.X.X.X, Add to IKEv1 MIB Table succeeded for SA with logical ID 5033984
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715006: Group = X.X.X.X, IP = X.X.X.X, IKE got SPI from key engine: SPI = 0x3693a6b9
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-713906: Group = X.X.X.X, IP = X.X.X.X, oakley constructing quick mode
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715046: Group = X.X.X.X, IP = X.X.X.X, constructing blank hash payload
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715046: Group = X.X.X.X, IP = X.X.X.X, constructing IPSec SA payload
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715046: Group = X.X.X.X, IP = X.X.X.X, constructing IPSec nonce payload
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715046: Group = X.X.X.X, IP = X.X.X.X, constructing pfs ke payload
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715001: Group = X.X.X.X, IP = X.X.X.X, constructing proxy ID
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-713906: Group = X.X.X.X, IP = X.X.X.X, Transmitting Proxy Id:
Local host: Y.Y.Y.Y Protocol 0 Port 0
Remote host: X.X.X.X Protocol 0 Port 0
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-714007: Group = X.X.X.X, IP = X.X.X.X, IKE Initiator sending Initial Contact
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715046: Group = X.X.X.X, IP = X.X.X.X, constructing qm hash payload
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-714004: Group = X.X.X.X, IP = X.X.X.X, IKE Initiator sending 1st QM pkt: msg id = 4bd7018f
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-713236: IP = X.X.X.X, IKE_DECODE SENDING Message (msgid=4bd7018f) with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + KE (4) + ID (5) + ID (5) + NOTIFY (11) + NONE (0) total length : 456
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-713906: IKE Receiver: Packet received on Y.Y.Y.Y:500 from X.X.X.X:500
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-713236: IP = X.X.X.X, IKE_DECODE RECEIVED Message (msgid=d4894207) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 64
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715047: Group = X.X.X.X, IP = X.X.X.X, processing hash payload
<167>:2023-03-22T15:10:19Z: %FTD-vpn-7-715047: Group = X.X.X.X, IP = X.X.X.X, processing notify payload
<165>:2023-03-22T15:10:19Z: %FTD-vpn-5-713068: Group = X.X.X.X, IP = X.X.X.X, Received non-routine Notify message: Invalid ID info (18)
<167>:2023-03-22T15:10:27Z: %FTD-vpn-7-713906: IKE Receiver: Packet received on Y.Y.Y.Y:500 from X.X.X.X:500
<167>:2023-03-22T15:10:27Z: %FTD-vpn-7-713236: IP = X.X.X.X, IKE_DECODE RECEIVED Message (msgid=d2fb004b) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 64
<167>:2023-03-22T15:10:27Z: %FTD-vpn-7-715047: Group = X.X.X.X, IP = X.X.X.X, processing hash payload
<167>:2023-03-22T15:10:27Z: %FTD-vpn-7-715047: Group = X.X.X.X, IP = X.X.X.X, processing notify payload
<165>:2023-03-22T15:10:27Z: %FTD-vpn-5-713068: Group = X.X.X.X, IP = X.X.X.X, Received non-routine Notify message: Invalid ID info (18)
<166>:2023-03-22T15:10:30Z: %FTD-session-6-305011: Built dynamic UDP translation from any:10.215.4.2/123 to outsite:Y.Y.Y.Y/62336
<167>:2023-03-22T15:10:35Z: %FTD-vpn-7-713906: IKE Receiver: Packet received on Y.Y.Y.Y:500 from X.X.X.X:500
<167>:2023-03-22T15:10:35Z: %FTD-vpn-7-713236: IP = X.X.X.X, IKE_DECODE RECEIVED Message (msgid=a88e44ff) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 64
<167>:2023-03-22T15:10:35Z: %FTD-vpn-7-715047: Group = X.X.X.X, IP = X.X.X.X, processing hash payload
<167>:2023-03-22T15:10:35Z: %FTD-vpn-7-715047: Group = X.X.X.X, IP = X.X.X.X, processing notify payload
<165>:2023-03-22T15:10:35Z: %FTD-vpn-5-713068: Group = X.X.X.X, IP = X.X.X.X, Received non-routine Notify message: Invalid ID info (18)
<167>:2023-03-22T15:10:43Z: %FTD-vpn-7-713906: IKE Receiver: Packet received on Y.Y.Y.Y:500 from X.X.X.X:500
<167>:2023-03-22T15:10:43Z: %FTD-vpn-7-713236: IP = X.X.X.X, IKE_DECODE RECEIVED Message (msgid=8eb4f4b9) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 64
<167>:2023-03-22T15:10:43Z: %FTD-vpn-7-715047: Group = X.X.X.X, IP = X.X.X.X, processing hash payload
<167>:2023-03-22T15:10:43Z: %FTD-vpn-7-715047: Group = X.X.X.X, IP = X.X.X.X, processing notify payload
<165>:2023-03-22T15:10:43Z: %FTD-vpn-5-713068: Group = X.X.X.X, IP = X.X.X.X, Received non-routine Notify message: Invalid ID info (18)
<167>:2023-03-22T15:10:49Z: %FTD-vpn-7-715077: Group = X.X.X.X, IP = X.X.X.X, Pitcher: received key delete msg, spi 0x3693a6b9
<165>:2023-03-22T15:10:49Z: %FTD-vpn-5-713050: Group = X.X.X.X, IP = X.X.X.X, Connection terminated for peer X.X.X.X. Reason: Session Error Terminated Remote Proxy X.X.X.X, Local Proxy Y.Y.Y.Y
<167>:2023-03-22T15:10:49Z: %FTD-vpn-7-713906: Group = X.X.X.X, IP = X.X.X.X, sending delete/delete with reason message
<167>:2023-03-22T15:10:49Z: %FTD-vpn-7-715046: Group = X.X.X.X, IP = X.X.X.X, constructing blank hash payload
<167>:2023-03-22T15:10:49Z: %FTD-vpn-7-715046: Group = X.X.X.X, IP = X.X.X.X, constructing IPSec delete payload
<167>:2023-03-22T15:10:49Z: %FTD-vpn-7-715046: Group = X.X.X.X, IP = X.X.X.X, constructing qm hash payload
<167>:2023-03-22T15:10:49Z: %FTD-vpn-7-713236: IP = X.X.X.X, IKE_DECODE SENDING Message (msgid=25456395) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 68
<167>:2023-03-22T15:10:49Z: %FTD-vpn-7-715009: Group = X.X.X.X, IP = X.X.X.X, IKE Deleting SA: Remote Proxy X.X.X.X, Local Proxy Y.Y.Y.Y
<163>:2023-03-22T15:10:49Z: %FTD-vpn-3-713902: Group = X.X.X.X, IP = X.X.X.X, Removing peer from correlator table failed, no match!
<167>:2023-03-22T15:10:49Z: %FTD-vpn-7-713906: Group = X.X.X.X, IP = X.X.X.X, IKE SA MM:4aca0c69 rcv'd Terminate: state MM_ACTIVE flags 0x00000062, refcnt 1, tuncnt 0
<167>:2023-03-22T15:10:49Z: %FTD-vpn-7-713906: Group = X.X.X.X, IP = X.X.X.X, Remove from IKEv1 Tunnel Table succeeded for SA with logicalId 5033984
<167>:2023-03-22T15:10:49Z: %FTD-vpn-7-713906: Group = X.X.X.X, IP = X.X.X.X, Remove from IKEv1 MIB Table succeeded for SA with logical ID 5033984
<167>:2023-03-22T15:10:49Z: %FTD-vpn-7-713906: Group = X.X.X.X, IP = X.X.X.X, IKE SA MM:4aca0c69 terminating: flags 0x01000022, refcnt 0, tuncnt 0
<167>:2023-03-22T15:10:49Z: %FTD-vpn-7-713906: Group = X.X.X.X, IP = X.X.X.X, sending delete/delete with reason message
<164>:2023-03-22T15:10:49Z: %FTD-vpn-4-752012: IKEv1 was unsuccessful at setting up a tunnel. Map Tag = CSM_outsite_map. Map Sequence Number = 2.
<163>:2023-03-22T15:10:49Z: %FTD-vpn-3-752015: Tunnel Manager has failed to establish an L2L SA. All configured IKE versions failed to establish the tunnel. Map Tag= CSM_outsite_map. Map Sequence Number = 2.
<167>:2023-03-22T15:10:49Z: %FTD-vpn-7-752002: Tunnel Manager Removed entry. Map Tag = CSM_outsite_map. Map Sequence Number = 2.
<167>:2023-03-22T15:10:49Z: %FTD-vpn-7-715046: Group = X.X.X.X, IP = X.X.X.X, constructing blank hash payload
<167>:2023-03-22T15:10:49Z: %FTD-vpn-7-715046: Group = X.X.X.X, IP = X.X.X.X, constructing IKE delete payload
<167>:2023-03-22T15:10:49Z: %FTD-vpn-7-715046: Group = X.X.X.X, IP = X.X.X.X, constructing qm hash payload
<167>:2023-03-22T15:10:49Z: %FTD-vpn-7-713236: IP = X.X.X.X, IKE_DECODE SENDING Message (msgid=f27b7ff1) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 80
<167>:2023-03-22T15:10:49Z: %FTD-vpn-7-715077: Pitcher: received key delete msg, spi 0x3693a6b9
<165>:2023-03-22T15:10:49Z: %FTD-vpn-5-713259: Group = X.X.X.X, IP = X.X.X.X, Session is being torn down. Reason: Unknown
<164>:2023-03-22T15:10:49Z: %FTD-auth-4-113019: Group = X.X.X.X, Username = X.X.X.X, IP = X.X.X.X, Session disconnected. Session Type: LAN-to-LAN, Duration: 0h:00m:30s, Bytes xmt: 0, Bytes rcv: 0, Reason: Unknown
<167>:2023-03-22T15:10:49Z: %FTD-vpn-7-713906: Ignoring msg to mark SA with dsID 5033984 dead because SA deleted

topic Re: FMC/FDT site to site VPN in Network Security

FMC/FDT site to site VPN

Re: FMC/FDT site to site VPN

Re: FMC/FDT site to site VPN

Re: FMC/FDT site to site VPN

Re: FMC/FDT site to site VPN

Re: FMC/FDT site to site VPN