Good morning, Cisco community. We're having an issue with a Cisco ASA 5525 that we had working as a VPN hub. The configuration of the VPN is an IPsec tunnel with ikev1, and the clients are Cisco ASA 5505 devices with custom certificates issued with a technical PKI (using SHA 256).
About that last point, we recently performed a certificate migration from SHA-128 to the aforementioned SHA-256 certificates. In fact, we have a main production environment where we performed the same migration and the VPNs can be established without any issues. But in this environment, the tunnels just don't work and we are unsure about what else can we try.
When we try a debug on the ASA VPN hub (debug crypto ikev1 255) we can see the client payloads and their certificates, but we constantly get a message that the username or password are incorrect. If we check the client ASA with the command show crypto isakmp sa, it's always stuck in MM_WAIT_MSG2.
The last things we tried is making sure that all the trustpoints and CRLs are correctly configured, just like the main environment..
Any ideas would be very helpful. Thank you in advance.
