ā08-06-2024 09:05 AM
Hi Team:
Am having a hard time to understand what went wrong. The site to site was working but I notice the output below:
FAB#show crypto ikev2 sa
IPv4 Crypto IKEv2 SA
Tunnel-id Local Remote fvrf/ivrf Status
1 160.238.160.18/500 200.32.190.146/500 none/none IN-NEG
Encr: Unknown - 0, PRF: Unknown - 0, Hash: None, DH Grp:0, Auth sign: Unknown - 0, Auth verify: Unknown - 0
Life/Active Time: 86400/0 sec
IPv6 Crypto IKEv2 SA
It was in a ready status before and working but now it does not want to establish
ā08-09-2024 07:05 AM
@MHM Cisco World are you talking on the firewall side for the lifetime byte? and yes am using aes-gcm on both sides
ā08-09-2024 07:09 AM
Yes firewall side why you set lifetime in bytes?
And for second Q can you change SA for testing only.
Not all router support aes-gcm and some support it without hash.
So change SA to different and try again ping from router to ftd (lan to lan)
MHM
ā08-09-2024 07:13 AM
I will change the SA side right now and for the lifetime in bytes thats the default? Should I leave it blank? What does that do if I may ask?
ā08-09-2024 07:21 AM
Yes please use blank
MHM
ā08-09-2024 07:25 AM
Are these the same as just AES? aes-192, aes-256
aes-cbc-128 AES-CBC-128
aes-cbc-192 AES-CBC-192
aes-cbc-256 AES-CBC-256
ā08-09-2024 07:59 AM
Yes you are correct
MHM
ā08-09-2024 02:14 PM
I did the changes but nothing still
FABSPLRT#ping 192.168.1.251 source vlan20
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.251, timeout is 2 seconds:
Packet sent with a source address of 10.20.20.1
...
*Aug 9 21:12:30.369: IKEv2-PAK:(SESSION ID = 101,SA ID = 1):Next payload: ENCR, version: 2.0 Exchange type: INFORMATIONAL, flags: INITIATOR Message id: 1926, length: 80
Payload contents:
*Aug 9 21:12:30.370: IKEv2-PAK:(SESSION ID = 101,SA ID = 1):Next payload: ENCR, version: 2.0 Exchange type: INFORMATIONAL, flags: RESPONDER MSG-RESPONSE Message id: 1926, length: 80
Payload contents:
ENCR Next payload: NONE, reserved: 0x0, length: 52
..
Success rate is 0 percent (0/5)
FABSPLRT#
*Aug 9 21:12:40.369: IKEv2-PAK:(SESSION ID = 101,SA ID = 1):Next payload: ENCR, version: 2.0 Exchange type: INFORMATIONAL, flags: INITIATOR Message id: 1927, length: 80
Payload contents:
*Aug 9 21:12:40.370: IKEv2-PAK:(SESSION ID = 101,SA ID = 1):Next payload: ENCR, version: 2.0 Exchange type: INFORMATIONAL, flags: RESPONDER MSG-RESPONSE Message id: 1927, length: 80
Payload contents:
ENCR Next payload: NONE, reserved: 0x0, length: 52
*Aug 9 21:12:50.369: IKEv2-PAK:(SESSION ID = 101,SA ID = 1):Next payload: ENCR, version: 2.0 Exchange type: INFORMATIONAL, flags: INITIATOR Message id: 1928, length: 80
Payload contents:
*Aug 9 21:12:50.370: IKEv2-PAK:(SESSION ID = 101,SA ID = 1):Next payload: ENCR, version: 2.0 Exchange type: INFORMATIONAL, flags: RESPONDER MSG-RESPONSE Message id: 1928, length: 80
Payload contents:
ENCR Next payload: NONE, reserved: 0x0, length: 52
ā08-09-2024 02:18 PM
this is the output from debug crypto ikev2
FABSPLRT#
FABSPLRT#
*Aug 9 21:16:00.369: IKEv2:(SESSION ID = 101,SA ID = 1):Received Packet [From 200.32.233.146:500/To 160.238.137.18:500/VRF i0:f0]
Initiator SPI : 47DA3CE054C5B90D - Responder SPI : 253F32CFCCA3F92F Message id: 1947
IKEv2 INFORMATIONAL Exchange REQUEST
Payload contents:
*Aug 9 21:16:00.369: IKEv2:(SESSION ID = 101,SA ID = 1):Received DPD/liveness query
*Aug 9 21:16:00.369: IKEv2:(SESSION ID = 101,SA ID = 1):Building packet for encryption.
*Aug 9 21:16:00.370: IKEv2:(SESSION ID = 101,SA ID = 1):Sending ACK to informational exchange
*Aug 9 21:16:00.370: IKEv2:(SESSION ID = 101,SA ID = 1):Sending Packet [To 200.32.233.146:500/From 160.238.137.18:500/VRF i0:f0]
Initiator SPI : 47DA3CE054C5B90D - Responder SPI : 253F32CFCCA3F92F Message id: 1947
IKEv2 INFORMATIONAL Exchange RESPONSE
Payload contents:
ENCR
*Aug 9 21:16:10.369: IKEv2:(SESSION ID = 101,SA ID = 1):Received Packet [From 200.32.233.146:500/To 160.238.137.18:500/VRF i0:f0]
Initiator SPI : 47DA3CE054C5B90D - Responder SPI : 253F32CFCCA3F92F Message id: 1948
IKEv2 INFORMATIONAL Exchange REQUEST
Payload contents:
*Aug 9 21:16:10.369: IKEv2:(SESSION ID = 101,SA ID = 1):Received DPD/liveness query
*Aug 9 21:16:10.369: IKEv2:(SESSION ID = 101,SA ID = 1):Building packet for encryption.
*Aug 9 21:16:10.370: IKEv2:(SESSION ID = 101,SA ID = 1):Sending ACK to informational exchange
*Aug 9 21:16:10.370: IKEv2:(SESSION ID = 101,SA ID = 1):Sending Packet [To 200.32.233.146:500/From 160.238.137.18:500/VRF i0:f0]
Initiator SPI : 47DA3CE054C5B90D - Responder SPI : 253F32CFCCA3F92F Message id: 1948
IKEv2 INFORMATIONAL Exchange RESPONSE
Payload contents:
ENCR
*Aug 9 21:16:20.369: IKEv2:(SESSION ID = 101,SA ID = 1):Received Packet [From 200.32.233.146:500/To 160.238.137.18:500/VRF i0:f0]
Initiator SPI : 47DA3CE054C5B90D - Responder SPI : 253F32CFCCA3F92F Message id: 1949
IKEv2 INFORMATIONAL Exchange REQUEST
Payload contents:
*Aug 9 21:16:20.369: IKEv2:(SESSION ID = 101,SA ID = 1):Received DPD/liveness query
*Aug 9 21:16:20.370: IKEv2:(SESSION ID = 101,SA ID = 1):Building packet for encryption.
*Aug 9 21:16:20.370: IKEv2:(SESSION ID = 101,SA ID = 1):Sending ACK to informational exchange
*Aug 9 21:16:20.370: IKEv2:(SESSION ID = 101,SA ID = 1):Sending Packet [To 200.32.233.146:500/From 160.238.137.18:500/VRF i0:f0]
Initiator SPI : 47DA3CE054C5B90D - Responder SPI : 253F32CFCCA3F92F Message id: 1949
IKEv2 INFORMATIONAL Exchange RESPONSE
Payload contents:
ENCR
ā08-11-2024 08:33 AM
In router
Show crypto session
Show crypto ikev2 detail
Show crypto ipsec sa
Do this twice before ping and after ping
Share output as text file let me check
Thanks
MHM
ā08-11-2024 12:56 PM
Please follow this as a sample:
this is with certs but almost 99% applies to you except using pre-shared key..
run the debugs and get output and we can see what is failing and help you..
attach latest relevant configs
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide