Cisco Community
English
Register
Tell us how your company is accelerating digital agility. LEARN MORE and share your story.
Register
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

2421
Views
0
Helpful
1
Replies
jasonw
Beginner
Beginner
‎11-19-2014 06:14 AM
‎11-19-2014 06:14 AM

Logging question

Are logs like this kind of normal to see?

 

We have a complex network and I'm seeing logs like this a lot. I had to change the public IP's to bogus numbers.

I just wonder if our current vender that set things up has done everything right.

 

002-ASA     11-19-2014 05:30:41     %ASA-4-713903: IP = 001.001.001.001, Information Exchange processing failed
001-ASA     11-19-2014 05:30:40     %ASA-4-713903: IP = 002.002.002.002, Header invalid, missing SA payload! (next payload = 4)
002-ASA     11-19-2014 05:30:40     %ASA-5-713904: IP = 001.001.001.001, Received an un-encrypted INVALID_COOKIE notify message, dropping
001-ASA     11-19-2014 05:30:38     %ASA-4-752012: IKEv1 was unsuccessful at setting up a tunnel. Map Tag = outside_map. Map Sequence Number = 20.
001-ASA     11-19-2014 05:30:38     %ASA-3-752015: Tunnel Manager has failed to establish an L2L SA. All configured IKE versions failed to establish the tunnel. Map Tag= outside_map. Map Sequence Number = 20.
001-ASA     11-19-2014 05:30:32     %ASA-4-713903: Group = 002.002.002.002, IP = 002.002.002.002, Can't find a valid tunnel group, aborting...!
002-ASA     11-19-2014 05:30:32     %ASA-5-752004: Tunnel Manager dispatching a KEY_ACQUIRE message to IKEv1. Map Tag = outside_map. Map Sequence Number = 20.
002-ASA     11-19-2014 05:30:32     %ASA-4-752010: IKEv2 Doesn't have a proposal specified
002-ASA     11-19-2014 05:30:32     %ASA-5-713041: IP = 001.001.001.001, IKE Initiator: New Phase 1, Intf inside, IKE Peer 001.001.001.001 local Proxy Address 192.168.13.32, remote Proxy Address 192.168.52.0, Crypto map (outside_map)
002-ASA     11-19-2014 05:30:22     %ASA-3-752015: Tunnel Manager has failed to establish an L2L SA. All configured IKE versions failed to establish the tunnel. Map Tag= outside_map. Map Sequence Number = 20.
002-ASA     11-19-2014 05:30:22     %ASA-4-752012: IKEv1 was unsuccessful at setting up a tunnel. Map Tag = outside_map. Map Sequence Number = 20.
002-ASA     11-19-2014 05:30:14     %ASA-4-713903: IP = 001.001.001.001, Information Exchange processing failed
002-ASA     11-19-2014 05:30:14     %ASA-5-713904: IP = 001.001.001.001, Received an un-encrypted INVALID_COOKIE notify message, dropping
001-ASA     11-19-2014 05:30:14     %ASA-4-713903: IP = 002.002.002.002, Header invalid, missing SA payload! (next payload = 4)
002-ASA     11-19-2014 05:30:06     %ASA-4-713903: IP = 001.001.001.001, Information Exchange processing failed
002-ASA     11-19-2014 05:30:06     %ASA-5-713904: IP = 001.001.001.001, Received an un-encrypted INVALID_COOKIE notify message, dropping
001-ASA     11-19-2014 05:30:06     %ASA-4-713903: IP = 002.002.002.002, Header invalid, missing SA payload! (next payload = 4)
001-ASA     11-19-2014 05:30:04     %ASA-5-713041: IP = 003.003.003.003, IKE Initiator: New Phase 1, Intf inside, IKE Peer 003.003.003.003 local Proxy Address 192.168.52.0, remote Proxy Address 192.168.13.32, Crypto map (outside_map)
001-ASA     11-19-2014 05:30:04     %ASA-4-752010: IKEv2 Doesn't have a proposal specified
001-ASA     11-19-2014 05:30:03     %ASA-5-752004: Tunnel Manager dispatching a KEY_ACQUIRE message to IKEv1. Map Tag = outside_map. Map Sequence Number = 20.
002-ASA     11-19-2014 05:29:58     %ASA-4-713903: IP = 001.001.001.001, Information Exchange processing failed
002-ASA     11-19-2014 05:29:58     %ASA-5-713904: IP = 001.001.001.001, Received an un-encrypted INVALID_COOKIE notify message, dropping
001-ASA     11-19-2014 05:29:58     %ASA-4-713903: IP = 002.002.002.002, Header invalid, missing SA payload! (next payload = 4)
001-ASA     11-19-2014 05:29:56     %ASA-3-752015: Tunnel Manager has failed to establish an L2L SA. All configured IKE versions failed to establish the tunnel. Map Tag= outside_map. Map Sequence Number = 20.
001-ASA     11-19-2014 05:29:56     %ASA-4-752012: IKEv1 was unsuccessful at setting up a tunnel. Map Tag = outside_map. Map Sequence Number = 20.
001-ASA     11-19-2014 05:29:50     %ASA-4-713903: Group = 002.002.002.002, IP = 002.002.002.002, Can't find a valid tunnel group, aborting...!
002-ASA     11-19-2014 05:29:50     %ASA-4-752010: IKEv2 Doesn't have a proposal specified
002-ASA     11-19-2014 05:29:50     %ASA-5-713041: IP = 001.001.001.001, IKE Initiator: New Phase 1, Intf inside, IKE Peer 001.001.001.001 local Proxy Address 192.168.13.32, remote Proxy Address 192.168.52.0, Crypto map (outside_map)
002-ASA     11-19-2014 05:29:50     %ASA-5-752004: Tunnel Manager dispatching a KEY_ACQUIRE message to IKEv1. Map Tag = outside_map. Map Sequence Number = 20.
002-ASA     11-19-2014 05:29:44     %ASA-3-752015: Tunnel Manager has failed to establish an L2L SA. All configured IKE versions failed to establish the tunnel. Map Tag= outside_map. Map Sequence Number = 20.
002-ASA     11-19-2014 05:29:43     %ASA-4-752012: IKEv1 was unsuccessful at setting up a tunnel. Map Tag = outside_map. Map Sequence Number = 20.
002-ASA     11-19-2014 05:29:36     %ASA-4-713903: IP = 001.001.001.001, Information Exchange processing failed
002-ASA     11-19-2014 05:29:36     %ASA-5-713904: IP = 001.001.001.001, Received an un-encrypted INVALID_COOKIE notify message, dropping
001-ASA     11-19-2014 05:29:36     %ASA-4-713903: IP = 002.002.002.002, Header invalid, missing SA payload! (next payload = 4)
002-ASA     11-19-2014 05:29:26     %ASA-5-713904: IP = 001.001.001.001, Received an un-encrypted INVALID_COOKIE notify message, dropping
002-ASA     11-19-2014 05:29:26     %ASA-4-713903: IP = 001.001.001.001, Information Exchange processing failed
001-ASA     11-19-2014 05:29:26     %ASA-4-713903: IP = 002.002.002.002, Header invalid, missing SA payload! (next payload = 4)
001-ASA     11-19-2014 05:29:24     %ASA-5-713041: IP = 003.003.003.003, IKE Initiator: New Phase 1, Intf inside, IKE Peer 003.003.003.003 local Proxy Address 192.168.52.0, remote Proxy Address 192.168.13.32, Crypto map (outside_map)
001-ASA     11-19-2014 05:29:24     %ASA-4-752010: IKEv2 Doesn't have a proposal specified
001-ASA     11-19-2014 05:29:24     %ASA-5-752004: Tunnel Manager dispatching a KEY_ACQUIRE message to IKEv1. Map Tag = outside_map. Map Sequence Number = 20.
002-ASA     11-19-2014 05:29:18     %ASA-4-713903: IP = 001.001.001.001, Information Exchange processing failed
002-ASA     11-19-2014 05:29:18     %ASA-5-713904: IP = 001.001.001.001, Received an un-encrypted INVALID_COOKIE notify message, dropping
001-ASA     11-19-2014 05:29:18     %ASA-4-713903: IP = 002.002.002.002, Header invalid, missing SA payload! (next payload = 4)
001-ASA     11-19-2014 05:29:13     %ASA-3-752015: Tunnel Manager has failed to establish an L2L SA. All configured IKE versions failed to establish the tunnel. Map Tag= outside_map. Map Sequence Number = 20.
001-ASA     11-19-2014 05:29:13     %ASA-4-752012: IKEv1 was unsuccessful at setting up a tunnel. Map Tag = outside_map. Map Sequence Number = 20.
001-ASA     11-19-2014 05:29:10     %ASA-4-713903: Group = 002.002.002.002, IP = 002.002.002.002, Can't find a valid tunnel group, aborting...!
002-ASA     11-19-2014 05:29:10     %ASA-5-713041: IP = 001.001.001.001, IKE Initiator: New Phase 1, Intf inside, IKE Peer 001.001.001.001 local Proxy Address 192.168.13.32, remote Proxy Address 192.168.52.0, Crypto map (outside_map)
002-ASA     11-19-2014 05:29:10     %ASA-4-752010: IKEv2 Doesn't have a proposal specified
002-ASA     11-19-2014 05:29:10     %ASA-5-752004: Tunnel Manager dispatching a KEY_ACQUIRE message to IKEv1. Map Tag = outside_map. Map Sequence Number = 20.
002-ASA     11-19-2014 05:29:02     %ASA-3-752015: Tunnel Manager has failed to establish an L2L SA. All configured IKE versions failed to establish the tunnel. Map Tag= outside_map. Map Sequence Number = 20.
002-ASA     11-19-2014 05:29:02     %ASA-4-752012: IKEv1 was unsuccessful at setting up a tunnel. Map Tag = outside_map. Map Sequence Number = 20.
002-ASA     11-19-2014 05:28:54     %ASA-4-713903: IP = 001.001.001.001, Information Exchange processing failed
002-ASA     11-19-2014 05:28:54     %ASA-5-713904: IP = 001.001.001.001, Received an un-encrypted INVALID_COOKIE notify message, dropping
001-ASA     11-19-2014 05:28:54     %ASA-4-713903: IP = 002.002.002.002, Header invalid, missing SA payload! (next payload = 4)
002-ASA     11-19-2014 05:28:46     %ASA-4-713903: IP = 001.001.001.001, Information Exchange processing failed
002-ASA     11-19-2014 05:28:46     %ASA-5-713904: IP = 001.001.001.001, Received an un-encrypted INVALID_COOKIE notify message, dropping
001-ASA     11-19-2014 05:28:46     %ASA-4-713903: IP = 002.002.002.002, Header invalid, missing SA payload! (next payload = 4)
001-ASA     11-19-2014 05:28:41     %ASA-5-713041: IP = 003.003.003.003, IKE Initiator: New Phase 1, Intf inside, IKE Peer 003.003.003.003 local Proxy Address 192.168.52.0, remote Proxy Address 192.168.13.32, Crypto map (outside_map)
001-ASA     11-19-2014 05:28:41     %ASA-4-752010: IKEv2 Doesn't have a proposal specified
001-ASA     11-19-2014 05:28:41     %ASA-5-752004: Tunnel Manager dispatching a KEY_ACQUIRE message to IKEv1. Map Tag = outside_map. Map Sequence Number = 20.
002-ASA     11-19-2014 05:28:38     %ASA-4-713903: IP = 001.001.001.001, Information Exchange processing failed
002-ASA     11-19-2014 05:28:38     %ASA-5-713904: IP = 001.001.001.001, Received an un-encrypted INVALID_COOKIE notify message, dropping
001-ASA     11-19-2014 05:28:38     %ASA-4-713903: IP = 002.002.002.002, Header invalid, missing SA payload! (next payload = 4)
001-ASA     11-19-2014 05:28:31     %ASA-3-752015: Tunnel Manager has failed to establish an L2L SA. All configured IKE versions failed to establish the tunnel. Map Tag= outside_map. Map Sequence Number = 20.
001-ASA     11-19-2014 05:28:31     %ASA-4-752012: IKEv1 was unsuccessful at setting up a tunnel. Map Tag = outside_map. Map Sequence Number = 20.
001-ASA     11-19-2014 05:28:31     %ASA-4-713903: Group = 002.002.002.002, IP = 002.002.002.002, Can't find a valid tunnel group, aborting...!
002-ASA     11-19-2014 05:28:31     %ASA-5-752004: Tunnel Manager dispatching a KEY_ACQUIRE message to IKEv1. Map Tag = outside_map. Map Sequence Number = 20.
002-ASA     11-19-2014 05:28:31     %ASA-4-752010: IKEv2 Doesn't have a proposal specified
002-ASA     11-19-2014 05:28:31     %ASA-5-713041: IP = 001.001.001.001, IKE Initiator: New Phase 1, Intf inside, IKE Peer 001.001.001.001 local Proxy Address 192.168.13.32, remote Proxy Address 192.168.52.0, Crypto map (outside_map)
002-ASA     11-19-2014 05:28:23     %ASA-3-752015: Tunnel Manager has failed to establish an L2L SA. All configured IKE versions failed to establish the tunnel. Map Tag= outside_map. Map Sequence Number = 20.
002-ASA     11-19-2014 05:28:23     %ASA-4-752012: IKEv1 was unsuccessful at setting up a tunnel. Map Tag = outside_map. Map Sequence Number = 20.
002-ASA     11-19-2014 05:28:14     %ASA-4-713903: IP = 001.001.001.001, Information Exchange processing failed
002-ASA     11-19-2014 05:28:14     %ASA-5-713904: IP = 001.001.001.001, Received an un-encrypted INVALID_COOKIE notify message, dropping
001-ASA     11-19-2014 05:28:14     %ASA-4-713903: IP = 002.002.002.002, Header invalid, missing SA payload! (next payload = 4)
002-ASA     11-19-2014 05:28:06     %ASA-4-713903: IP = 001.001.001.001, Information Exchange processing failed
002-ASA     11-19-2014 05:28:06     %ASA-5-713904: IP = 001.001.001.001, Received an un-encrypted INVALID_COOKIE notify message, dropping
001-ASA     11-19-2014 05:28:06     %ASA-4-713903: IP = 002.002.002.002, Header invalid, missing SA payload! (next payload = 4)
001-ASA     11-19-2014 05:27:59     %ASA-5-713041: IP = 003.003.003.003, IKE Initiator: New Phase 1, Intf inside, IKE Peer 003.003.003.003 local Proxy Address 192.168.52.0, remote Proxy Address 192.168.13.32, Crypto map (outside_map)
001-ASA     11-19-2014 05:27:59     %ASA-4-752010: IKEv2 Doesn't have a proposal specified
001-ASA     11-19-2014 05:27:59     %ASA-5-752004: Tunnel Manager dispatching a KEY_ACQUIRE message to IKEv1. Map Tag = outside_map. Map Sequence Number = 20.
002-ASA     11-19-2014 05:27:58     %ASA-4-713903: IP = 001.001.001.001, Information Exchange processing failed
002-ASA     11-19-2014 05:27:58     %ASA-5-713904: IP = 001.001.001.001, Received an un-encrypted INVALID_COOKIE notify message, dropping
001-ASA     11-19-2014 05:27:58     %ASA-4-713903: IP = 002.002.002.002, Header invalid, missing SA payload! (next payload = 4)
001-ASA     11-19-2014 05:27:54     %ASA-3-752015: Tunnel Manager has failed to establish an L2L SA. All configured IKE versions failed to establish the tunnel. Map Tag= outside_map. Map Sequence Number = 20.
001-ASA     11-19-2014 05:27:54     %ASA-4-752012: IKEv1 was unsuccessful at setting up a tunnel. Map Tag = outside_map. Map Sequence Number = 20.
001-ASA     11-19-2014 05:27:50     %ASA-4-713903: Group = 002.002.002.002, IP = 002.002.002.002, Can't find a valid tunnel group, aborting...!
002-ASA     11-19-2014 05:27:50     %ASA-5-713041: IP = 001.001.001.001, IKE Initiator: New Phase 1, Intf inside, IKE Peer 001.001.001.001 local Proxy Address 192.168.13.32, remote Proxy Address 192.168.52.0, Crypto map (outside_map)
002-ASA     11-19-2014 05:27:50     %ASA-4-752010: IKEv2 Doesn't have a proposal specified
002-ASA     11-19-2014 05:27:50     %ASA-5-752004: Tunnel Manager dispatching a KEY_ACQUIRE message to IKEv1. Map Tag = outside_map. Map Sequence Number = 20.
002-ASA     11-19-2014 05:27:42     %ASA-3-752015: Tunnel Manager has failed to establish an L2L SA. All configured IKE versions failed to establish the tunnel. Map Tag= outside_map. Map Sequence Number = 20.
002-ASA     11-19-2014 05:27:42     %ASA-4-752012: IKEv1 was unsuccessful at setting up a tunnel. Map Tag = outside_map. Map Sequence Number = 20.
002-ASA     11-19-2014 05:27:34     %ASA-4-713903: IP = 001.001.001.001, Information Exchange processing failed
002-ASA     11-19-2014 05:27:34     %ASA-5-713904: IP = 001.001.001.001, Received an un-encrypted INVALID_COOKIE notify message, dropping
001-ASA     11-19-2014 05:27:34     %ASA-4-713903: IP = 002.002.002.002, Header invalid, missing SA payload! (next payload = 4)
002-ASA     11-19-2014 05:27:26     %ASA-4-713903: IP = 001.001.001.001, Information Exchange processing failed
002-ASA     11-19-2014 05:27:26     %ASA-5-713904: IP = 001.001.001.001, Received an un-encrypted INVALID_COOKIE notify message, dropping
001-ASA     11-19-2014 05:27:26     %ASA-4-713903: IP = 002.002.002.002, Header invalid, missing SA payload! (next payload = 4)
001-ASA     11-19-2014 05:27:22     %ASA-5-713041: IP = 003.003.003.003, IKE Initiator: New Phase 1, Intf inside, IKE Peer 003.003.003.003 local Proxy Address 192.168.52.0, remote Proxy Address 192.168.13.32, Crypto map (outside_map)
001-ASA     11-19-2014 05:27:22     %ASA-4-752010: IKEv2 Doesn't have a proposal specified
001-ASA     11-19-2014 05:27:22     %ASA-5-752004: Tunnel Manager dispatching a KEY_ACQUIRE message to IKEv1. Map Tag = outside_map. Map Sequence Number = 20.

 

Labels:
1 person had this problem
0 Helpful
1 ACCEPTED SOLUTION

Accepted Solutions
David Johan Castro Fernandez
Participant
Participant
‎11-19-2014 08:50 PM
‎11-19-2014 08:50 PM

 Hello Jason,

 

According to this logs, the crypto map with sequence number 20 is havng issues to establish the site to site IPsec, so they indicate phase 1 is not completed yet.

 

Usually this is an issue with the encryption algorithms defined, and also issues in the middle <ISP>.

 

This should not affect the performance of your ASA, or routing on your ASA.

 

You can confirm with --> show crypto isakmp sa

 

To see if the tunnel can establish phase 1.

 

If you have another question let me know,

 

Please don´t forget to rate the helpful Post!

 

David Castro,

 

Regards,

View solution in original post

0 Helpful
1 REPLY 1
David Johan Castro Fernandez
Participant
Participant
‎11-19-2014 08:50 PM
‎11-19-2014 08:50 PM

 Hello Jason,

 

According to this logs, the crypto map with sequence number 20 is havng issues to establish the site to site IPsec, so they indicate phase 1 is not completed yet.

 

Usually this is an issue with the encryption algorithms defined, and also issues in the middle <ISP>.

 

This should not affect the performance of your ASA, or routing on your ASA.

 

You can confirm with --> show crypto isakmp sa

 

To see if the tunnel can establish phase 1.

 

If you have another question let me know,

 

Please don´t forget to rate the helpful Post!

 

David Castro,

 

Regards,

View solution in original post

0 Helpful
Latest Contents
Simple, secure tools to help protect your hybrid workplace
Created by Kelli Glass on 06-16-2021 05:47 PM
0
0
0
0
When we said the word “hybrid” in the past, it usually recalled the image of a new variety of plant or maybe an electric car. These days, it applies to the workplace too.   The future of work isn’t “changing” to a h... view more
Cisco Network Security Ask the Experts Resources
Created by vivichia on 06-10-2021 05:21 PM
0
10
0
10
Thanks for attending our Ask the Experts (ATXs) session! Here’s the post-session resources for easy reference. New to ATXs? An ATXs session, offered at no cost, is an hour of real-time learning led by Cisco experts, who will answer your technology q... view more
MGRE Easy Steps
Created by dhr.tech1 on 06-09-2021 04:09 PM
0
0
0
0
                                    Setup MGRE     &nbs... view more
Secure Endpoint Frequently Asked Questions
Created by E.L. Howard on 06-09-2021 10:39 AM
0
5
0
5
Cisco Secure Endpoint New packages fit for every organization Every Cisco Secure Endpoint (formerly AMP for Endpoints) package comes with Cisco SecureX built-in. It’s our cloud-native platform that integrates all your security solutions into one view wit... view more
#CiscoChat Live - Redefining NetWORK Security
Created by greghami on 06-09-2021 09:48 AM
0
0
0
0
Our Cisco experts and guests chat about how the integration of Cisco Secure Firewall + Secure Workload is securely accelerating application delivery by allowing NetOps to start running at DevOps speed, and what that means for business success. https://com... view more
Content for Community-Ad