Connexion IPSEC / IKEv2 entre 3 sites (2 routeur ISR et Gateway AZURE) non établie / Connexion IPSEC/IKEv2 between 3 sites (2 routeur ISR and Gateway AZURE) not etablished

[perparimkadirolli]

Salut,

Je dois connecter 3 sites (SITE_A - SITE_B et AZURE NEtwork) tous ensemble. Le problème est que je ne peux pas connecter mes deux routeurs ISR 2911 ensemble.

Voici ma configuration en eux:

Texte d'origine:

Hi,
I have to connect 3 sites (SITE_A - SITE_B and AZURE NEtwork) all together. The issue is i can't connect my both router ISR 2911 together.
Here my config in them:

Routeur SITE_A:

R1_SiteA(config)#interface G0/0
R1_SiteA(config-if)#ip address 192.168.40.150 255.255.255.0
R1_SiteA(config-if)#ip nat outside
R1_SiteA(config-if)#no shutdown
R1_SiteA(config-if)#exit
!
R1_SiteA(config)#interface G0/1
R1_SiteA(config-if)#ip address 192.168.20.150 255.255.255.0
R1_SiteA(config-if)# ip nat inside
R1_SiteA(config-if)#no shutdown
R1_SiteA(config-if)#exit
!
R1_SiteA(config)#access-list 10 permit 192.168.0.0 0.0.0.255
!
R1_SiteA(config)#access-list 110 permit ip 192.168.0.0 0.0.0.255 10.2.0.0 0.0.0.255
R1_SiteA(config)#access-list 110 permit udp host 51.xxx.xxx.xxx (AZURE GATEWAY)) eq isakmp host 192.168.40.150
R1_SiteA(config)#access-list 110 permit esp host 51.xxx.xxx.xxx host 192.168.40.150
!
//ACL POUR VPN SITE_A - SITE_B
R1_SiteA(config)#access-list 120 permit ip 192.168.0.0 0.0.0.255 192.168.1.0 0.0.0.255
R1_SiteA(config)#access-list 120 permit udp host 178.xxx.xxx.xxx (SITE_B GATEWAY) eq isakmp host 192.168.40.150
R1_SiteA(config)#access-list 120 permit esp host 178.xxx.xxx.xxx host 192.168.40.150
!
R1_SiteA(config)#ip nat inside source list 10 interface G0/0 overload
!
R1_SiteA(config)#license boot module c2900 technology-package securityk9
R1_SiteA(config)#exit
R1_SiteA#reload
!
R1_SiteA(config)#conf
!
R1_SiteA(config)#crypto ikev2 proposal PROP-AZURE
R1_SiteA(config-ikev2-proposal)#encryption aes-cbc-256 aes-cbc-128 3des
R1_SiteA(config-ikev2-proposal)#integrity sha256
R1_SiteA(config-ikev2-proposal)#group 2
R1_SiteA(config-ikev2-proposal)#exit
!
R1_SiteA(config)#crypto ikev2 proposal PROP-SITEB
R1_SiteA(config-ikev2-proposal)#encryption aes-gcm-256
R1_SiteA(config-ikev2-proposal)#group 2
R1_SiteA(config-ikev2-proposal)#prf sha256
R1_SiteA(config-ikev2-proposal)#exit
!
R1_SiteA(config)#crypto ikev2 policy POLICE-AZURE
R1_SiteA(config-ikev2-policy)#proposal PROP-AZURE
R1_SiteA(config-ikev2-policy)#exit
!
R1_SiteA(config)#crypto ikev2 policy POLICE-SITEB
R1_SiteA(config-ikev2-policy)#proposal PROP-SITEB
R1_SiteA(config-ikev2-policy)#exit
!
R1_SiteA(config)#key config-key password-encrypt xxxxxxx
!
R1_SiteA(config)#crypto ikev2 keyring KEYRING-AZURE
R1_SiteA(config-ikev2-keyring)#peer 51.103.155.76
R1_SiteA(config-ikev2-keyring-peer)#address 51.103.155.76
R1_SiteA(config-ikev2-keyring-peer)#pre-shared-key xxxxxx
R1_SiteA(config-ikev2-keyring-peer)#exit
R1_SiteA(config-ikev2-keyring)#exit
!
//PORTE-CLéS POUR VPN SITEA - SITEB
R1_SiteA(config)#crypto ikev2 keyring KEYRING-SITEB
R1_SiteA(config-ikev2-keyring)#peer 178.xxx.xxx.xxx
R1_SiteA(config-ikev2-keyring-peer)#address 178.xxx.xxx.xxx
R1_SiteA(config-ikev2-keyring-peer)#pre-shared-key yyyyyyyy
R1_SiteA(config-ikev2-keyring-peer)#exit
R1_SiteA(config-ikev2-keyring)#exit
!
R1_SiteA(config)#crypto ikev2 profile PROFILE-AZURE
R1_SiteA(config-ikev2-profile)#match address local interface G0/0
R1_SiteA(config-ikev2-profile)#match identity remote address 51.xxx.xxx.xxx 255.255.255.255
R1_SiteA(config-ikev2-profile)#authentication remote pre-share
R1_SiteA(config-ikev2-profile)#authentication local pre-share
R1_SiteA(config-ikev2-profile)#keyring local KEYRING-AZURE
R1_SiteA(config-ikev2-profile)#exit
!
R1_SiteA(config)#crypto ikev2 profile PROFILE-SITEB
R1_SiteA(config-ikev2-profile)#match address local interface G0/0
R1_SiteA(config-ikev2-profile)#match identity remote address 178.174.xxx.xxx 255.255.255.255
R1_SiteA(config-ikev2-profile)#authentication remote pre-share
R1_SiteA(config-ikev2-profile)#authentication local pre-share
R1_SiteA(config-ikev2-profile)#keyring local KEYRING-SITEB
R1_SiteA(config-ikev2-profile)#exit
!
R1_SiteA(config)#$crypto ipsec transform-set TRANS-AZURE esp-aes 256 esp-sha256-hmac
R1_SiteA(cfg-crypto-trans)#mode tunnel
R1_SiteA(cfg-crypto-trans)#exit
!
R1_SiteA(config)#$crypto ipsec transform-set TRANS-SITEB esp-gcm 256
R1_SiteA(cfg-crypto-trans)#mode tunnel
R1_SiteA(cfg-crypto-trans)#exit
!
R1_SiteA(config)#crypto ipsec profile TUNNEL1
R1_SiteA(ipsec-profile)#set transform-set TRANS-AZURE
R1_SiteA(ipsec-profile)#set ikev2-profile PROFILE-AZURE
R1_SiteA(ipsec-profile)#exit
!
R1_SiteA(config)#interface tunnel1
R1_SiteA(config-if)#ip address 192.168.100.1 255.255.255.0
R1_SiteA(config-if)#ip tcp adjust-mss 1350
R1_SiteA(config-if)#tunnel source G0/0
R1_SiteA(config-if)#tunnel mode ipsec ipv4
R1_SiteA(config-if)#tunnel destination 51.xxx.xxx.xxx
R1_SiteA(config-if)#tunnel protection ipsec profile TUNNEL1
R1_SiteA(config-if)#no shutdown
R1_SiteA(config-if)#exit
!
R1_SiteA(config)#crypto ipsec profile TUNNEL2
R1_SiteA(ipsec-profile)#set transform-set TRANS-SITEB
R1_SiteA(ipsec-profile)#set ikev2-profile PROFILE-SITEB
R1_SiteA(ipsec-profile)#exit
!
R1_SiteA(config)#interface tunnel2
R1_SiteA(config-if)#ip address 192.168.101.1 255.255.255.255
R1_SiteA(config-if)#ip tcp adjust-mss 1350
R1_SiteA(config-if)#tunnel source G0/0
R1_SiteA(config-if)#tunnel mode ipsec ipv4
R1_SiteA(config-if)#tunnel destination 178.xxx.xxx.xxx
R1_SiteA(config-if)#tunnel protection ipsec profile TUNNEL2
R1_SiteA(config-if)#no shutdown
!
R1_SiteA(config)#ip route 10.2.0.0 255.255.255.0 tunnel1
!
R1_SiteA(config)#ip route 192.168.1.0 255.255.255.0 tunnel2

Routeur SITE_B:

R1_SiteB(config)#interface G0/0
R1_SiteB(config-if)#ip address 192.168.20.150 255.255.255.0
R1_SiteB(config-if)#ip nat outside
R1_SiteB(config-if)#no shutdown
R1_SiteB(config-if)#exit
!
R1_SiteB(config)#interface G0/1
R1_SiteB(config-if)#ip address 192.168.1.1 255.255.255.0
R1_SiteB(config-if)#ip nat inside
R1_SiteB(config-if)#no shutdown
R1_SiteB(config-if)#exit
!
//ACL NAT OVERLOAD
R1_SiteB(config)#access-list 10 permit 192.168.1.0 0.0.0.255
!
//ACL POUR VPN SITE_B - AZURE
R1_SiteB(config)#access-list 110 permit ip 192.168.1.0 0.0.0.255 10.2.0.0 0.0.0.255
R1_SiteB(config)#access-list 110 permit udp host 51.xxx.xxx.xxx eq isakmp host 192.168.20.150
R1_SiteB(config)#access-list 110 permit esp host 51.xxx.xxx.xxx host 192.168.20.150
!
//ACL POUR VPN SITE_B - SITE_A
R1_SiteB(config)#access-list 120 permit ip 192.168.1.0 0.0.0.255 192.168.0.0 0.0.0.255
R1_SiteB(config)#access-list 120 permit udp host 85.xxx.xxx.xxx(SITEA GATEWAY) eq isakmp host 192.168.20.150
R1_SiteB(config)#access-list 120 permit esp host 85.xxx.xxx.xxx host 192.168.20.150
!
R1_SiteB(config)#ip nat inside source list 10 interface G0/0 overload
!
R1_SiteB(config)#license boot module c2900 technology-package securityk9
R1_SiteB(config)#exit
R1_SiteB#write
R1_SiteB#reload
!
R1_SiteB(config)#conf
!
R1_SiteB(config)#crypto ikev2 proposal PROP-AZURE
R1_SiteB(config-ikev2-proposal)#encryption aes-cbc-256 aes-cbc-128 3des
R1_SiteB(config-ikev2-proposal)#integrity sha256
R1_SiteB(config-ikev2-proposal)#group 2
R1_SiteB(config-ikev2-proposal)#exit
!
R1_SiteB(config)#crypto ikev2 proposal PROP-SITEA
R1_SiteB(config-ikev2-proposal)#encryption aes-gcm-256
R1_SiteB(config-ikev2-proposal)#group 2
R1_SiteB(config-ikev2-proposal)#prf sha256
R1_SiteB(config-ikev2-proposal)#exit
!
R1_SiteB(config)#crypto ikev2 policy POLICE-AZURE
R1_SiteB(config-ikev2-policy)#proposal PROP-AZURE
R1_SiteB(config-ikev2-policy)#exit
!
R1_SiteB(config)#crypto ikev2 policy POLICE-SITEA
R1_SiteB(config-ikev2-policy)#proposal PROP-SITEA
R1_SiteB(config-ikev2-policy)#exit
!
R1_SiteB(config)#key config-key password-encrypt projetdiplome2022
!
//PORTE-CLéS POUR VPN SITE_B - AZURE
R1_SiteB(config)#crypto ikev2 keyring KEYRING-AZURE
R1_SiteB(config-ikev2-keyring)#peer 51.xxx.xxx.xxx
R1_SiteB(config-ikev2-keyring-peer)#address 51.xxx.xxx.xxx
R1_SiteB(config-ikev2-keyring-peer)#pre-shared-key projetdiplome2022
R1_SiteB(config-ikev2-keyring-peer)#exit
R1_SiteB(config-ikev2-keyring)#exit
!
//PORTE-CLéS POUR VPN SITE_B - SITEA
1_SiteB(config-ikev2-keyring)#peer 85.xxx.xxx.xxx
R1_SiteB(config-ikev2-keyring-peer)#address 85.xxx.xxx.xxx
R1_SiteB(config-ikev2-keyring-peer)#pre-shared-key diplomeprojet2022
R1_SiteB(config-ikev2-keyring-peer)#exit
R1_SiteB(config-ikev2-keyring)#exit
!
R1_SiteB(config)#crypto ikev2 profile PROFILE-AZURE
R1_SiteB(config-ikev2-profile)#match address local interface G0/0
R1_SiteB(config-ikev2-profile)#match identity remote address 51.xxx.xxx.xxx 255.255.255.255
R1_SiteB(config-ikev2-profile)#authentication remote pre-share
R1_SiteB(config-ikev2-profile)#authentication local pre-share
R1_SiteB(config-ikev2-profile)#keyring local KEYRING-AZURE
R1_SiteB(config-ikev2-profile)#exit
!
R1_SiteB(config)#crypto ikev2 profile PROFILE-SITEA
R1_SiteB(config-ikev2-profile)#match address local interface G0/0
R1_SiteB(config-ikev2-profile)#match identity remote address 85.xxx.xxx.xxx 255.255.255.255
R1_SiteB(config-ikev2-profile)#authentication remote pre-share
R1_SiteB(config-ikev2-profile)#authentication local pre-share
R1_SiteB(config-ikev2-profile)#keyring local KEYRING-SITEA
R1_SiteB(config-ikev2-profile)#exit
!
R1_SiteB(config)#$crypto ipsec transform-set TRANS-AZURE esp-aes 256 esp-sha256-hmac
R1_SiteB(cfg-crypto-trans)#mode tunnel
R1_SiteB(cfg-crypto-trans)#exit
!
R1_SiteB(config)#$crypto ipsec transform-set TRANS-SITEA esp-gcm 256
R1_SiteB(cfg-crypto-trans)#mode tunnel
R1_SiteB(cfg-crypto-trans)#exit
!
R1_SiteB(config)#crypto ipsec profile TUNNEL1
R1_SiteB(ipsec-profile)#set transform-set TRANS-AZURE
R1_SiteB(ipsec-profile)#set ikev2-profile PROFILE-AZURE
R1_SiteB(ipsec-profile)#exit
!
R1_SiteB(config)#crypto ipsec profile TUNNEL2
R1_SiteB(ipsec-profile)#set transform-set TRANS-SITEA
R1_SiteB(ipsec-profile)#set ikev2-profile PROFILE-SITEA
R1_SiteB(ipsec-profile)#exit
!
R1_SiteB(config)#interface tunnel1
R1_SiteB(config-if)#ip address 192.168.103.1 255.255.255.0
R1_SiteB(config-if)#ip tcp adjust-mss 1350
R1_SiteB(config-if)#tunnel source G0/0
R1_SiteB(config-if)#tunnel mode ipsec ipv4
R1_SiteB(config-if)#tunnel destination 51.xxx.xxx.xxx
R1_SiteB(config-if)#tunnel protection ipsec profile TUNNEL1
R1_SiteB(config-if)#no shutdown
R1_SiteB(config-if)#exit
!
R1_SiteB(config)#interface tunnel2
R1_SiteB(config-if)#ip address 192.168.102.1 255.255.255.0
R1_SiteB(config-if)#ip tcp adjust-mss 1350
R1_SiteB(config-if)#tunnel source G0/0
R1_SiteB(config-if)#tunnel mode ipsec ipv4
R1_SiteB(config-if)#tunnel destination 88.xxx.xxx.xxx
R1_SiteB(config-if)#tunnel protection ipsec profile TUNNEL2
R1_SiteB(config-if)#no shutdown
R1_SiteB(config-if)#exit
!
R1_SiteA(config)#ip route 10.2.0.0 255.255.255.0 tunnel1
!
R1_SiteB(config)#ip route 192.168.1.0 255.255.255.0 tunnel2

J'ai ce message IKEV2 DEBUG sur les deux routeur ISR 2911 (SITE A et SITE B):

I have this message IKEV2 DEBUG on both router ISR 2911 (SITE A and SITE B):

Sep 16 14:20:04.969: IKEv2:% Getting preshared key from profile keyring KEYRING-AZURE
Sep 16 14:20:04.969: IKEv2:% Matched peer block '51.103.155.76'
Sep 16 14:20:04.969: IKEv2:Searching Policy with fvrf 0, local address 192.168.20.150
Sep 16 14:20:04.969: IKEv2:Found Policy 'POLICE-AZURE'
Sep 16 14:20:04.969: IKEv2:SA is already in negotiation, hence not negotiating again
Sep 16 14:20:05.689: IKEv2:% Getting preshared key from profile keyring KEYRING-SITEA
Sep 16 14:20:05.689: IKEv2:% Matched peer block '85.128.89.199'
Sep 16 14:20:05.689: IKEv2:Searching Policy with fvrf 0, local address 192.168.20.150
Sep 16 14:20:05.689: IKEv2:Found Policy 'POLICE-AZURE'
Sep 16 14:20:05.689: IKEv2:SA is already in negotiation, hence not negotiating again
Sep 16 14:20:34.969: IKEv2:% Getting preshared key from profile keyring KEYRING-AZURE
Sep 16 14:20:34.969: IKEv2:% Matched peer block '51.103.155.76'
Sep 16 14:20:34.969: IKEv2:Searching Policy with fvrf 0, local address 192.168.20.150
Sep 16 14:20:34.969: IKEv2:Found Policy 'POLICE-AZURE'
Sep 16 14:20:34.969: IKEv2:SA is already in negotiation, hence not negotiating again
Sep 16 14:20:35.689: IKEv2:% Getting preshared key from profile keyring KEYRING-SITEA
Sep 16 14:20:35.689: IKEv2:% Matched peer block '85.128.89.199'
Sep 16 14:20:35.689: IKEv2:Searching Policy with fvrf 0, local address 192.168.20.150
Sep 16 14:20:35.689: IKEv2:Found Policy 'POLICE-AZURE'
Sep 16 14:20:35.689: IKEv2:SA is already in negotiation, hence not negotiating again
Sep 16 14:20:36.309: IKEv2:(SESSION ID = 1,SA ID = 2):Retransmitting packet

Sep 16 14:20:36.309: IKEv2:(SESSION ID = 1,SA ID = 2):Sending Packet [To 85.128.89.199:500/From 192.168.20.150:500/VRF i0:f0]
Initiator SPI : E177725B04C8BA42 - Responder SPI : 0000000000000000 Message id: 0
IKEv2 IKE_SA_INIT Exchange REQUEST
Payload contents:
SA KE N VID VID NOTIFY(NAT_DETECTION_SOURCE_IP) NOTIFY(NAT_DETECTION_DESTINATION_IP)

[carljose]

Salut Perparimkadirolli !

J'étais entrain de revoir ta question, Je sais bien que tu essais d'établir un VPN entre 3 sites, mais je pense que le mieux ce serait, de nous focaliser un site á la fois, sinon ça fera trop d'information á accumuler, choisis l'un des sites et on pourra travailler dessus,

ceci étant dit, tu pourrais poster le message complet des logs, tu n'as seulement qu'une partie, ce sera de beaucoup d'aide, si tu le postais en complet, pour qu'on puisse voir ou analyser quelques pistes.

Merci!

[perparimkadirolli]

Salut carljose!

enfait ce que je veux faire c'est avoir une connexion VPN direct entre mes deux sites. J'ai déjà mis en place les VPN entre Site B - Azure et Site A - Azure mais je voudrais maintenant avoir une une connexion direct entre site A et site B. En résumé, je veux avoir deux VPN sur les interface G0/0 (WAN) de mes deux routeurs ISR 2911 sans utiliser DMVPN. Est-ce que c'est possible? J'ai joint un schéma pour mieux illustrer.

Voici le résultat de la commande debug crypto IKEv2: 

Sep 22 06:33:16.412: IPSEC:(SESSION ID = 1) (key_engine) request timer fired: count = 5,
(identity) local= 192.168.40.150:0, remote= 178.174.xxx.xxx:0,
local_proxy= 0.0.0.0/0.0.0.0/256/0,
remote_proxy= 0.0.0.0/0.0.0.0/256/0
Sep 22 06:33:47.660: IPSEC(sa_request): ,
(key eng. msg.) OUTBOUND local= 192.168.40.150:500, remote= 178.174.35.xxx:xxx,
local_proxy= 0.0.0.0/0.0.0.0/256/0,
remote_proxy= 0.0.0.0/0.0.0.0/256/0,
protocol= ESP, transform= esp-gcm 256 (Tunnel),
lifedur= 86400s and 4608000kb,
spi= 0x0(0), conn_id= 0, keysize= 256, flags= 0x0
Sep 22 06:33:47.660: IKEv2:% Getting preshared key from profile keyring KEYRING-SITEB
Sep 22 06:33:47.660: IKEv2:% Matched peer block '178.174.xxx.xxx'
Sep 22 06:33:47.660: IKEv2:Searching Policy with fvrf 0, local address 192.168.40.150
Sep 22 06:33:47.660: IKEv2:Found Policy 'POLICE-AZURE'
Sep 22 06:33:47.660: IKEv2:(SESSION ID = 1,SA ID = 1):[IKEv2 -> Crypto Engine] Computing DH public key, DH Group 2
Sep 22 06:33:47.660: IKEv2:(SA ID = 1):[Crypto Engine -> IKEv2] DH key Computation PASSED
Sep 22 06:33:47.660: IKEv2:(SESSION ID = 1,SA ID = 1):Request queued for computation of DH key
Sep 22 06:33:47.660: IKEv2:IKEv2 initiator - no config data to send in IKE_SA_INIT exch
Sep 22 06:33:47.660: IKEv2:(SESSION ID = 1,SA ID = 1):Generating IKE_SA_INIT message
Sep 22 06:33:47.660: IKEv2:(SESSION ID = 1,SA ID = 1):IKE Proposal: 1, SPI size: 0 (initial negotiation),
Num. transforms: 6
AES-CBC AES-CBC 3DES SHA256 SHA256 DH_GROUP_1024_MODP/Group 2

Sep 22 06:33:47.660: IKEv2:(SESSION ID = 1,SA ID = 1):Sending Packet [To 178.174.xxx.xxx:500/From 192.168.40.150:500/VRF i0:f0]
Initiator SPI : 58AA0FA18ECDEC71 - Responder SPI : 0000000000000000 Message id: 0
IKEv2 IKE_SA_INIT Exchange REQUEST
Payload contents:
SA KE N VID VID NOTIFY(NAT_DETECTION_SOURCE_IP) NOTIFY(NAT_DETECTION_DESTINATION_IP)

Sep 22 06:33:47.660: IKEv2:(SESSION ID = 1,SA ID = 1):Insert SA
Sep 22 06:33:49.652: IKEv2:(SESSION ID = 1,SA ID = 1):Retransmitting packet

Sep 22 06:33:49.652: IKEv2:(SESSION ID = 1,SA ID = 1):Sending Packet [To 178.174.xxx.xxx:500/From 192.168.40.150:500/VRF i0:f0]
Initiator SPI : 58AA0FA18ECDEC71 - Responder SPI : 0000000000000000 Message id: 0
IKEv2 IKE_SA_INIT Exchange REQUEST
Payload contents:
SA KE N VID VID NOTIFY(NAT_DETECTION_SOURCE_IP) NOTIFY(NAT_DETECTION_DESTINATION_IP)

Sep 22 06:33:53.280: IKEv2:(SESSION ID = 1,SA ID = 1):Retransmitting packet

Sep 22 06:33:53.280: IKEv2:(SESSION ID = 1,SA ID = 1):Sending Packet [To 178.174.xxx.xxx:500/From 192.168.40.150:500/VRF i0:f0]
Initiator SPI : 58AA0FA18ECDEC71 - Responder SPI : 0000000000000000 Message id: 0
IKEv2 IKE_SA_INIT Exchange REQUEST
Payload contents:
SA KE N VID VID NOTIFY(NAT_DETECTION_SOURCE_IP) NOTIFY(NAT_DETECTION_DESTINATION_IP)

Sep 22 06:34:00.812: IKEv2:(SESSION ID = 1,SA ID = 1):Retransmitting packet

Sep 22 06:34:00.812: IKEv2:(SESSION ID = 1,SA ID = 1):Sending Packet [To 178.174.xxx.xxx:500/From 192.168.40.150:500/VRF i0:f0]
Initiator SPI : 58AA0FA18ECDEC71 - Responder SPI : 0000000000000000 Message id: 0
IKEv2 IKE_SA_INIT Exchange REQUEST
Payload contents:
SA KE N VID VID NOTIFY(NAT_DETECTION_SOURCE_IP) NOTIFY(NAT_DETECTION_DESTINATION_IP)

Sep 22 06:34:16.741: IKEv2:(SESSION ID = 1,SA ID = 1):Retransmitting packet

Sep 22 06:34:16.741: IKEv2:(SESSION ID = 1,SA ID = 1):Sending Packet [To 178.174.xxx.xxx:500/From 192.168.40.150:500/VRF i0:f0]
Initiator SPI : 58AA0FA18ECDEC71 - Responder SPI : 0000000000000000 Message id: 0
IKEv2 IKE_SA_INIT Exchange REQUEST
Payload contents:
SA KE N VID VID NOTIFY(NAT_DETECTION_SOURCE_IP) NOTIFY(NAT_DETECTION_DESTINATION_IP)