Log Questions

jasonw · ‎11-19-2014

For some reason I'm not finding the correct fourm to post this question. but maybe someone would be willing to help.

We mostly have a pretty complex network with a many routers and ASA's And I notice in our logging I'm seeing things that might be considered normal but to me I question it.

We hired a outside company to setup the network and I see alot of these messages in our logging. and I just wanted to see if these kinds of messages are normal or should we maybe get another group to take a look and see if we have any problems. Reason I'm mostly asking is over all something if our network seam slow and some of the routing I read in the configs seam a little off.

I had to change the IP address of public IP's to bogus numbers.

002-ASA    11-19-2014 05:30:41    %ASA-4-713903: IP = 001.001.001.001, Information Exchange processing failed
001-ASA    11-19-2014 05:30:40    %ASA-4-713903: IP = 002.002.002.002, Header invalid, missing SA payload! (next payload = 4)
002-ASA    11-19-2014 05:30:40    %ASA-5-713904: IP = 001.001.001.001, Received an un-encrypted INVALID_COOKIE notify message, dropping
001-ASA    11-19-2014 05:30:38    %ASA-4-752012: IKEv1 was unsuccessful at setting up a tunnel. Map Tag = outside_map. Map Sequence Number = 20.
001-ASA    11-19-2014 05:30:38    %ASA-3-752015: Tunnel Manager has failed to establish an L2L SA. All configured IKE versions failed to establish the tunnel. Map Tag= outside_map. Map Sequence Number = 20.
001-ASA    11-19-2014 05:30:32    %ASA-4-713903: Group = 002.002.002.002, IP = 002.002.002.002, Can't find a valid tunnel group, aborting...!
002-ASA    11-19-2014 05:30:32    %ASA-5-752004: Tunnel Manager dispatching a KEY_ACQUIRE message to IKEv1. Map Tag = outside_map. Map Sequence Number = 20.
002-ASA    11-19-2014 05:30:32    %ASA-4-752010: IKEv2 Doesn't have a proposal specified
002-ASA    11-19-2014 05:30:32    %ASA-5-713041: IP = 001.001.001.001, IKE Initiator: New Phase 1, Intf inside, IKE Peer 001.001.001.001 local Proxy Address 192.168.13.32, remote Proxy Address 192.168.52.0, Crypto map (outside_map)
002-ASA    11-19-2014 05:30:22    %ASA-3-752015: Tunnel Manager has failed to establish an L2L SA. All configured IKE versions failed to establish the tunnel. Map Tag= outside_map. Map Sequence Number = 20.
002-ASA    11-19-2014 05:30:22    %ASA-4-752012: IKEv1 was unsuccessful at setting up a tunnel. Map Tag = outside_map. Map Sequence Number = 20.
002-ASA    11-19-2014 05:30:14    %ASA-4-713903: IP = 001.001.001.001, Information Exchange processing failed
002-ASA    11-19-2014 05:30:14    %ASA-5-713904: IP = 001.001.001.001, Received an un-encrypted INVALID_COOKIE notify message, dropping
001-ASA    11-19-2014 05:30:14    %ASA-4-713903: IP = 002.002.002.002, Header invalid, missing SA payload! (next payload = 4)
002-ASA    11-19-2014 05:30:06    %ASA-4-713903: IP = 001.001.001.001, Information Exchange processing failed
002-ASA    11-19-2014 05:30:06    %ASA-5-713904: IP = 001.001.001.001, Received an un-encrypted INVALID_COOKIE notify message, dropping
001-ASA    11-19-2014 05:30:06    %ASA-4-713903: IP = 002.002.002.002, Header invalid, missing SA payload! (next payload = 4)
001-ASA    11-19-2014 05:30:04    %ASA-5-713041: IP = 003.003.003.003, IKE Initiator: New Phase 1, Intf inside, IKE Peer 003.003.003.003 local Proxy Address 192.168.52.0, remote Proxy Address 192.168.13.32, Crypto map (outside_map)
001-ASA    11-19-2014 05:30:04    %ASA-4-752010: IKEv2 Doesn't have a proposal specified
001-ASA    11-19-2014 05:30:03    %ASA-5-752004: Tunnel Manager dispatching a KEY_ACQUIRE message to IKEv1. Map Tag = outside_map. Map Sequence Number = 20.
002-ASA    11-19-2014 05:29:58    %ASA-4-713903: IP = 001.001.001.001, Information Exchange processing failed
002-ASA    11-19-2014 05:29:58    %ASA-5-713904: IP = 001.001.001.001, Received an un-encrypted INVALID_COOKIE notify message, dropping
001-ASA    11-19-2014 05:29:58    %ASA-4-713903: IP = 002.002.002.002, Header invalid, missing SA payload! (next payload = 4)
001-ASA    11-19-2014 05:29:56    %ASA-3-752015: Tunnel Manager has failed to establish an L2L SA. All configured IKE versions failed to establish the tunnel. Map Tag= outside_map. Map Sequence Number = 20.
001-ASA    11-19-2014 05:29:56    %ASA-4-752012: IKEv1 was unsuccessful at setting up a tunnel. Map Tag = outside_map. Map Sequence Number = 20.
001-ASA    11-19-2014 05:29:50    %ASA-4-713903: Group = 002.002.002.002, IP = 002.002.002.002, Can't find a valid tunnel group, aborting...!
002-ASA    11-19-2014 05:29:50    %ASA-4-752010: IKEv2 Doesn't have a proposal specified
002-ASA    11-19-2014 05:29:50    %ASA-5-713041: IP = 001.001.001.001, IKE Initiator: New Phase 1, Intf inside, IKE Peer 001.001.001.001 local Proxy Address 192.168.13.32, remote Proxy Address 192.168.52.0, Crypto map (outside_map)
002-ASA    11-19-2014 05:29:50    %ASA-5-752004: Tunnel Manager dispatching a KEY_ACQUIRE message to IKEv1. Map Tag = outside_map. Map Sequence Number = 20.
002-ASA    11-19-2014 05:29:44    %ASA-3-752015: Tunnel Manager has failed to establish an L2L SA. All configured IKE versions failed to establish the tunnel. Map Tag= outside_map. Map Sequence Number = 20.
002-ASA    11-19-2014 05:29:43    %ASA-4-752012: IKEv1 was unsuccessful at setting up a tunnel. Map Tag = outside_map. Map Sequence Number = 20.
002-ASA    11-19-2014 05:29:36    %ASA-4-713903: IP = 001.001.001.001, Information Exchange processing failed
002-ASA    11-19-2014 05:29:36    %ASA-5-713904: IP = 001.001.001.001, Received an un-encrypted INVALID_COOKIE notify message, dropping
001-ASA    11-19-2014 05:29:36    %ASA-4-713903: IP = 002.002.002.002, Header invalid, missing SA payload! (next payload = 4)
002-ASA    11-19-2014 05:29:26    %ASA-5-713904: IP = 001.001.001.001, Received an un-encrypted INVALID_COOKIE notify message, dropping
002-ASA    11-19-2014 05:29:26    %ASA-4-713903: IP = 001.001.001.001, Information Exchange processing failed
001-ASA    11-19-2014 05:29:26    %ASA-4-713903: IP = 002.002.002.002, Header invalid, missing SA payload! (next payload = 4)
001-ASA    11-19-2014 05:29:24    %ASA-5-713041: IP = 003.003.003.003, IKE Initiator: New Phase 1, Intf inside, IKE Peer 003.003.003.003 local Proxy Address 192.168.52.0, remote Proxy Address 192.168.13.32, Crypto map (outside_map)
001-ASA    11-19-2014 05:29:24    %ASA-4-752010: IKEv2 Doesn't have a proposal specified
001-ASA    11-19-2014 05:29:24    %ASA-5-752004: Tunnel Manager dispatching a KEY_ACQUIRE message to IKEv1. Map Tag = outside_map. Map Sequence Number = 20.
002-ASA    11-19-2014 05:29:18    %ASA-4-713903: IP = 001.001.001.001, Information Exchange processing failed
002-ASA    11-19-2014 05:29:18    %ASA-5-713904: IP = 001.001.001.001, Received an un-encrypted INVALID_COOKIE notify message, dropping
001-ASA    11-19-2014 05:29:18    %ASA-4-713903: IP = 002.002.002.002, Header invalid, missing SA payload! (next payload = 4)
001-ASA    11-19-2014 05:29:13    %ASA-3-752015: Tunnel Manager has failed to establish an L2L SA. All configured IKE versions failed to establish the tunnel. Map Tag= outside_map. Map Sequence Number = 20.
001-ASA    11-19-2014 05:29:13    %ASA-4-752012: IKEv1 was unsuccessful at setting up a tunnel. Map Tag = outside_map. Map Sequence Number = 20.
001-ASA    11-19-2014 05:29:10    %ASA-4-713903: Group = 002.002.002.002, IP = 002.002.002.002, Can't find a valid tunnel group, aborting...!
002-ASA    11-19-2014 05:29:10    %ASA-5-713041: IP = 001.001.001.001, IKE Initiator: New Phase 1, Intf inside, IKE Peer 001.001.001.001 local Proxy Address 192.168.13.32, remote Proxy Address 192.168.52.0, Crypto map (outside_map)
002-ASA    11-19-2014 05:29:10    %ASA-4-752010: IKEv2 Doesn't have a proposal specified
002-ASA    11-19-2014 05:29:10    %ASA-5-752004: Tunnel Manager dispatching a KEY_ACQUIRE message to IKEv1. Map Tag = outside_map. Map Sequence Number = 20.
002-ASA    11-19-2014 05:29:02    %ASA-3-752015: Tunnel Manager has failed to establish an L2L SA. All configured IKE versions failed to establish the tunnel. Map Tag= outside_map. Map Sequence Number = 20.
002-ASA    11-19-2014 05:29:02    %ASA-4-752012: IKEv1 was unsuccessful at setting up a tunnel. Map Tag = outside_map. Map Sequence Number = 20.
002-ASA    11-19-2014 05:28:54    %ASA-4-713903: IP = 001.001.001.001, Information Exchange processing failed
002-ASA    11-19-2014 05:28:54    %ASA-5-713904: IP = 001.001.001.001, Received an un-encrypted INVALID_COOKIE notify message, dropping
001-ASA    11-19-2014 05:28:54    %ASA-4-713903: IP = 002.002.002.002, Header invalid, missing SA payload! (next payload = 4)
002-ASA    11-19-2014 05:28:46    %ASA-4-713903: IP = 001.001.001.001, Information Exchange processing failed
002-ASA    11-19-2014 05:28:46    %ASA-5-713904: IP = 001.001.001.001, Received an un-encrypted INVALID_COOKIE notify message, dropping
001-ASA    11-19-2014 05:28:46    %ASA-4-713903: IP = 002.002.002.002, Header invalid, missing SA payload! (next payload = 4)
001-ASA    11-19-2014 05:28:41    %ASA-5-713041: IP = 003.003.003.003, IKE Initiator: New Phase 1, Intf inside, IKE Peer 003.003.003.003 local Proxy Address 192.168.52.0, remote Proxy Address 192.168.13.32, Crypto map (outside_map)
001-ASA    11-19-2014 05:28:41    %ASA-4-752010: IKEv2 Doesn't have a proposal specified
001-ASA    11-19-2014 05:28:41    %ASA-5-752004: Tunnel Manager dispatching a KEY_ACQUIRE message to IKEv1. Map Tag = outside_map. Map Sequence Number = 20.
002-ASA    11-19-2014 05:28:38    %ASA-4-713903: IP = 001.001.001.001, Information Exchange processing failed
002-ASA    11-19-2014 05:28:38    %ASA-5-713904: IP = 001.001.001.001, Received an un-encrypted INVALID_COOKIE notify message, dropping
001-ASA    11-19-2014 05:28:38    %ASA-4-713903: IP = 002.002.002.002, Header invalid, missing SA payload! (next payload = 4)
001-ASA    11-19-2014 05:28:31    %ASA-3-752015: Tunnel Manager has failed to establish an L2L SA. All configured IKE versions failed to establish the tunnel. Map Tag= outside_map. Map Sequence Number = 20.
001-ASA    11-19-2014 05:28:31    %ASA-4-752012: IKEv1 was unsuccessful at setting up a tunnel. Map Tag = outside_map. Map Sequence Number = 20.
001-ASA    11-19-2014 05:28:31    %ASA-4-713903: Group = 002.002.002.002, IP = 002.002.002.002, Can't find a valid tunnel group, aborting...!
002-ASA    11-19-2014 05:28:31    %ASA-5-752004: Tunnel Manager dispatching a KEY_ACQUIRE message to IKEv1. Map Tag = outside_map. Map Sequence Number = 20.
002-ASA    11-19-2014 05:28:31    %ASA-4-752010: IKEv2 Doesn't have a proposal specified
002-ASA    11-19-2014 05:28:31    %ASA-5-713041: IP = 001.001.001.001, IKE Initiator: New Phase 1, Intf inside, IKE Peer 001.001.001.001 local Proxy Address 192.168.13.32, remote Proxy Address 192.168.52.0, Crypto map (outside_map)
002-ASA    11-19-2014 05:28:23    %ASA-3-752015: Tunnel Manager has failed to establish an L2L SA. All configured IKE versions failed to establish the tunnel. Map Tag= outside_map. Map Sequence Number = 20.
002-ASA    11-19-2014 05:28:23    %ASA-4-752012: IKEv1 was unsuccessful at setting up a tunnel. Map Tag = outside_map. Map Sequence Number = 20.
002-ASA    11-19-2014 05:28:14    %ASA-4-713903: IP = 001.001.001.001, Information Exchange processing failed
002-ASA    11-19-2014 05:28:14    %ASA-5-713904: IP = 001.001.001.001, Received an un-encrypted INVALID_COOKIE notify message, dropping
001-ASA    11-19-2014 05:28:14    %ASA-4-713903: IP = 002.002.002.002, Header invalid, missing SA payload! (next payload = 4)
002-ASA    11-19-2014 05:28:06    %ASA-4-713903: IP = 001.001.001.001, Information Exchange processing failed
002-ASA    11-19-2014 05:28:06    %ASA-5-713904: IP = 001.001.001.001, Received an un-encrypted INVALID_COOKIE notify message, dropping
001-ASA    11-19-2014 05:28:06    %ASA-4-713903: IP = 002.002.002.002, Header invalid, missing SA payload! (next payload = 4)
001-ASA    11-19-2014 05:27:59    %ASA-5-713041: IP = 003.003.003.003, IKE Initiator: New Phase 1, Intf inside, IKE Peer 003.003.003.003 local Proxy Address 192.168.52.0, remote Proxy Address 192.168.13.32, Crypto map (outside_map)
001-ASA    11-19-2014 05:27:59    %ASA-4-752010: IKEv2 Doesn't have a proposal specified
001-ASA    11-19-2014 05:27:59    %ASA-5-752004: Tunnel Manager dispatching a KEY_ACQUIRE message to IKEv1. Map Tag = outside_map. Map Sequence Number = 20.
002-ASA    11-19-2014 05:27:58    %ASA-4-713903: IP = 001.001.001.001, Information Exchange processing failed
002-ASA    11-19-2014 05:27:58    %ASA-5-713904: IP = 001.001.001.001, Received an un-encrypted INVALID_COOKIE notify message, dropping
001-ASA    11-19-2014 05:27:58    %ASA-4-713903: IP = 002.002.002.002, Header invalid, missing SA payload! (next payload = 4)
001-ASA    11-19-2014 05:27:54    %ASA-3-752015: Tunnel Manager has failed to establish an L2L SA. All configured IKE versions failed to establish the tunnel. Map Tag= outside_map. Map Sequence Number = 20.
001-ASA    11-19-2014 05:27:54    %ASA-4-752012: IKEv1 was unsuccessful at setting up a tunnel. Map Tag = outside_map. Map Sequence Number = 20.
001-ASA    11-19-2014 05:27:50    %ASA-4-713903: Group = 002.002.002.002, IP = 002.002.002.002, Can't find a valid tunnel group, aborting...!
002-ASA    11-19-2014 05:27:50    %ASA-5-713041: IP = 001.001.001.001, IKE Initiator: New Phase 1, Intf inside, IKE Peer 001.001.001.001 local Proxy Address 192.168.13.32, remote Proxy Address 192.168.52.0, Crypto map (outside_map)
002-ASA    11-19-2014 05:27:50    %ASA-4-752010: IKEv2 Doesn't have a proposal specified
002-ASA    11-19-2014 05:27:50    %ASA-5-752004: Tunnel Manager dispatching a KEY_ACQUIRE message to IKEv1. Map Tag = outside_map. Map Sequence Number = 20.
002-ASA    11-19-2014 05:27:42    %ASA-3-752015: Tunnel Manager has failed to establish an L2L SA. All configured IKE versions failed to establish the tunnel. Map Tag= outside_map. Map Sequence Number = 20.
002-ASA    11-19-2014 05:27:42    %ASA-4-752012: IKEv1 was unsuccessful at setting up a tunnel. Map Tag = outside_map. Map Sequence Number = 20.
002-ASA    11-19-2014 05:27:34    %ASA-4-713903: IP = 001.001.001.001, Information Exchange processing failed
002-ASA    11-19-2014 05:27:34    %ASA-5-713904: IP = 001.001.001.001, Received an un-encrypted INVALID_COOKIE notify message, dropping
001-ASA    11-19-2014 05:27:34    %ASA-4-713903: IP = 002.002.002.002, Header invalid, missing SA payload! (next payload = 4)
002-ASA    11-19-2014 05:27:26    %ASA-4-713903: IP = 001.001.001.001, Information Exchange processing failed
002-ASA    11-19-2014 05:27:26    %ASA-5-713904: IP = 001.001.001.001, Received an un-encrypted INVALID_COOKIE notify message, dropping
001-ASA    11-19-2014 05:27:26    %ASA-4-713903: IP = 002.002.002.002, Header invalid, missing SA payload! (next payload = 4)
001-ASA    11-19-2014 05:27:22    %ASA-5-713041: IP = 003.003.003.003, IKE Initiator: New Phase 1, Intf inside, IKE Peer 003.003.003.003 local Proxy Address 192.168.52.0, remote Proxy Address 192.168.13.32, Crypto map (outside_map)
001-ASA    11-19-2014 05:27:22    %ASA-4-752010: IKEv2 Doesn't have a proposal specified
001-ASA    11-19-2014 05:27:22    %ASA-5-752004: Tunnel Manager dispatching a KEY_ACQUIRE message to IKEv1. Map Tag = outside_map. Map Sequence Number = 20.

David Johan Castro Fernandez · ‎11-19-2014

Hello Jason,

According to this logs, the crypto map with sequence number 20 is havng issues to establish the site to site IPsec, so they indicate phase 1 is not completed yet.

Usually this is an issue with the encryption algorithms defined, and also issues in the middle <ISP>.

This should not affect the performance of your ASA, or routing on your ASA.

You can confirm with --> show crypto isakmp sa

To see if the tunnel can establish phase 1.

If you have another question let me know,

Please don´t forget to rate the helpful Post!

David Castro,

Regards,