IPSec tunnel fail, phase one, please advise.

William Gurling — Mon, 11 Mar 2019 21:55:15 GMT

I am really new at this, so please forgive my ignorace. I've configured, to the best of my ability, a tunnel between my asa5505 and a firebox X using this guide, I had to feel my way through it since the ASDM in the guide is an older version:

http://www.watchguard.com/help/docs/edge/10/en-us/content/en-us/bovpn/manual/manual_bovpn_edge_cisco.html

When I attempt to bring the tunnel up using Ping Inside on the ASA to one of the machines on the watchguard subnet I get the following error messages, even though the ping states 100% success. I cannot ping, rdp or anything out from any of the hosts on my 192.168.240.0/24 network to the 192.168.254.0/24 network whatseover.

Can anyone point me in the right direction?

Nov 25 11:49:54 [IKEv1 DECODE]: IP = 204.116.253.76, IKE Responder starting QM: msg id = 108a9682

Nov 25 11:49:54 [IKEv1]: Group = 204.116.253.76, IP = 204.116.253.76, Received encrypted Oakley Quick Mode packet with invalid payloads, MessID = 277517954

Nov 25 11:49:54 [IKEv1 DEBUG]: Group = 204.116.253.76, IP = 204.116.253.76, sending notify message

Nov 25 11:49:54 [IKEv1 DEBUG]: Group = 204.116.253.76, IP = 204.116.253.76, Can't send p2 'Payload malformed' notify message: no SPIs (msg id 108a9682)!

Nov 25 11:49:54 [IKEv1]: Group = 204.116.253.76, IP = 204.116.253.76, QM FSM error (P2 struct &0xc9d588b0, mess id 0x108a9682)!

Nov 25 11:49:54 [IKEv1 DEBUG]: Group = 204.116.253.76, IP = 204.116.253.76, IKE QM Responder FSM error history (struct &0xc9d588b0) <state>, <event>: QM_DONE, EV_ERROR-->QM_BLD_MSG2, EV_VALIDATE_FAIL-->QM_BLD_MSG2, EV_VALIDATE_MSG-->QM_BLD_MSG2, EV_DECRYPT_OK-->QM_BLD_MSG2, NullEvent-->QM_BLD_MSG2, EV_DECRYPT_MSG-->QM_BLD_MSG2, EV_INIT_RESPONDER-->QM_START, EV_RCV_MSG

Nov 25 11:49:54 [IKEv1 DEBUG]: Group = 204.116.253.76, IP = 204.116.253.76, sending delete/delete with reason message

Nov 25 11:49:54 [IKEv1]: Group = 204.116.253.76, IP = 204.116.253.76, Removing peer from correlator table failed, no match!

IPSec tunnel fail, phase one, please advise.

William Gurling — Fri, 25 Nov 2011 17:37:58 GMT

Hmmm I can ping\rdp\whatever from the 192.168.254.0/24 (firebox) side of the tunnel into the 192.168.240.0/24(ASA) side, but not the other way around.

IPSec tunnel fail, phase one, please advise.

cadet alain — Fri, 25 Nov 2011 21:40:28 GMT

hi,

verify your crypto ACLs are mirrored on both tunnel endpoints.

Regards.

Alain

topic IPSec tunnel fail, phase one, please advise. in Network Security

IPSec tunnel fail, phase one, please advise.

IPSec tunnel fail, phase one, please advise.

IPSec tunnel fail, phase one, please advise.