Hi everybody,
I have an FTD with FMC that must have a VPN tunnel IPSec with a router.
I have configured the FTD following all the instructions but I receive the message log error "Failed to authenticate the IKE SA".
Reading the debug messages I found this:
Both endpoints use the same PSK, maybe is something about the algorithms.
This is the remote peer config:
I've uploaded the debug logs too, please help me to find a solution.
Thanks for your help!!
Accepted Solutions
@angelito_mas YES
The purpose of a NAT exemption rule when used with a VPN is to ensure traffic over the VPN is not translated. The original source and translated source are the same network and the original destination and translated destination are the same network.
In you scenario create an object for 10.86.170.0/24, this is the source network and another object for the destination network as 10.38.220.192/26. Repeat for the other internal networks. Then create the NAT exemption rules.
Only traffic from 10.86.170.0/24 to 10.38.220.192/26 will match this NAT exemption rule, traffic over the VPN will be routed using the real IP address. Traffic to the internet from these internal networks, which has a destination IP address of something other than 10.38.220.192/26 will not match this rule and match the existing Auto NAT and be translated behind the Firewall outside interface IP address.
Example:
I run lab, to config IKEv2 between ASA and Router IOS,
I face same issue as you but
by check debug line by line I found issue
points to care in config :-
1- user address under ikev2 policy
2- use identity local address under profile
3- in proposal please match integrity with prf you use per-router and per-asa
4- transform set in router must not contain any AH, and in same time config hash in transform set and config same integrity in IKEv2 proposal in ASA
I do all and I success.
IOU1#show run
IOU1#show running-config
Building configuration...
Current configuration : 2744 bytes
!
! Last configuration change at 22:38:33 UTC Mon Mar 13 2023
!
version 15.5
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname IOU1
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
!
!
!
bsd-client server url https://cloudsso.cisco.com/as/token.oauth2
mmi polling-interval 60
--More--
*Mar 13 22:38:33.352: %SYS-5-CONFIG_I: Configured from console by console
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
!
!
!
!
!
no ip icmp rate-limit unreachable
!
!
!
!
!
!
!
!
!
!
!
!
no ip domain lookup
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
cts logging verbose
!
!
!
redundancy
!
!
ip tcp synwait-time 5
!
!
crypto ikev2 proposal mhm
encryption des
integrity md5
group 5
!
crypto ikev2 policy mhm
match address local 100.0.0.2
proposal mhm
!
crypto ikev2 keyring mhm
peer any
address 100.0.0.1
pre-shared-key local mhm
pre-shared-key remote mhm
!
!
!
crypto ikev2 profile mhm
match address local 100.0.0.2
match identity remote address 100.0.0.1 255.255.255.255
identity local address 100.0.0.2
authentication remote pre-share
authentication local pre-share
keyring local mhm
!
!
!
crypto ipsec transform-set mhm esp-des esp-md5-hmac
mode tunnel
!
!
!
crypto map mhm 10 ipsec-isakmp
set peer 100.0.0.1
set transform-set mhm
set pfs group5
set ikev2-profile mhm
match address 100
!
!
!
!
!
interface Ethernet0/0
ip address 100.0.0.2 255.255.255.0
crypto map mhm
!
interface Ethernet0/1
no ip address
shutdown
!
interface Ethernet0/2
no ip address
shutdown
!
interface Ethernet0/3
no ip address
shutdown
!
interface Ethernet1/0
no ip address
shutdown
!
interface Ethernet1/1
no ip address
shutdown
!
interface Ethernet1/2
no ip address
shutdown
!
interface Ethernet1/3
ip address 20.0.0.2 255.255.255.0
!
interface Serial2/0
no ip address
shutdown
serial restart-delay 0
!
interface Serial2/1
no ip address
shutdown
serial restart-delay 0
!
interface Serial2/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial2/3
no ip address
shutdown
serial restart-delay 0
!
interface Serial3/0
no ip address
shutdown
serial restart-delay 0
!
interface Serial3/1
no ip address
shutdown
serial restart-delay 0
!
interface Serial3/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial3/3
no ip address
shutdown
serial restart-delay 0
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
ip route 0.0.0.0 0.0.0.0 100.0.0.1
!
!
!
access-list 100 permit ip 20.0.0.0 0.0.0.255 10.0.0.0 0.0.0.255
!
control-plane
!
!
!
!
!
!
!
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
line vty 0 4
login
transport input none
