cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Join Customer Connection to register!
579
Views
0
Helpful
2
Replies
jerry.bonner
Beginner

IPSEC issues with LTE / Verizon

I'm not sure where else to go with this one.....

We're testing the EHWIC-4G-LTE-VZ card with a 2901 router in our lab. We had a flexvpn setup over Verizon to an ASR1000 on the other end. Nothing fancy :

crypto ikev2 client flexvpn EnventisFlex
peer 1 x.x.x.x
client connect Tunnel1

interface Cellular0/2/0
description IPSec Failver 3rd Party Circuit
vrf forwarding ipsecOutside
ip address negotiated
encapsulation slip
dialer in-band
dialer idle-timeout 5
dialer enable-timeout 10
dialer string lte
dialer watch-group 1
end

interface Tunnel1
description Connection to 511/EDC
ip unnumbered Loopback50
ip mtu 1400
ip pim sparse-mode
ip tcp adjust-mss 1360
tunnel source Cellular0/2/0
tunnel destination dynamic
tunnel path-mtu-discovery
tunnel vrf ipsecOutside
tunnel protection ipsec profile EnventisIPSecProfile
end

This was working for a while, then suddenly it stopped working and the IKE exchange between the two wouldn't complete. So I started digging and did a few packet captures on both sides. From the ASR 1000 side, pcap looks like this :

2901 SA_INIT >  A1K (port 500, 500 bytes)

A1K SA_INIT > 2901 (port 500, 500 bytes)

2901 IKE_AUTH > A1K (port 4500, 2000 bytes w/ fragments)

A1K IKE_AUTH > 2901 (port 4500, 2000 bytes w/ fragments)

2901 IKE_AUTH > A1K (port 4500, 2000 bytes w/ fragments)

A1K IKE_AUTH > 2901 (port 4500, 2000 bytes w/ fragments)

2901 IKE_AUTH > A1K (port 4500, 2000 bytes w/ fragments)

A1K IKE_AUTH > 2901 (port 4500, 2000 bytes w/ fragments)

2901 IKE_AUTH > A1K (port 4500, 2000 bytes w/ fragments)

A1K IKE_AUTH > 2901 (port 4500, 2000 bytes w/ fragments)

The 2901 never receives the IKE_AUTH response from the ASR 1000 so both ends just keep retransmitting. Ok....why not? MTU issue? So I start some pings from the 2901 over the Cellular connection :

! Ping msnbc

Router# ping vrf ipsecOutside 23.222.203.175 size 1500
Type escape sequence to abort.
Sending 5, 1500-byte ICMP Echos to 23.222.203.175, timeout is 2 seconds:
.....

5 minute output rate 0 bits/sec, 0 packets/sec
0 packets input, 0 bytes, 0 no buffer
Received 0 broadcasts (0 IP multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
5 packets output, 7500 bytes, 0 underruns

Router# clear counters cell 0/2/0
Clear "show interface" counters on this interface [confirm]
Cellular0/2/0 QoS statistics data clear currently is not supported.

Router# ping vrf ipsecOutside 23.222.203.175 size 1444
Type escape sequence to abort.
Sending 5, 1444-byte ICMP Echos to 23.222.203.175, timeout is 2 seconds:
!!!!!

5 minute output rate 1000 bits/sec, 1 packets/sec
5 packets input, 7220 bytes, 0 no buffer
Received 0 broadcasts (0 IP multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
5 packets output, 7220 bytes, 0 underruns

Router# ping vrf ipsecOutside 23.222.203.175 size 1445
Type escape sequence to abort.
Sending 5, 1500-byte ICMP Echos to 23.222.203.175, timeout is 2 seconds:
.....

um ok, so :

Router# ping vrf ipsecOutside 8.8.8.8 size 1500

Type escape sequence to abort.
Sending 5, 1500-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 136/141/144 ms

Router# ping vrf ipsecOutside 8.8.8.8 size 1500 df-bit
Type escape sequence to abort.
Sending 5, 1500-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
Packet sent with the DF bit set
!!!!!

Seriously, WTF is happening!? Verizon likely uses some funky CGN, but as long as we get ICMP unreachables for the dropped packets, PMTUD would probably work. But unfortunately when performing packet captures on remote nodes, I do not receive any such responses to dropped packets.

What am I missing something here? How would I go about getting IPSEC to work over this connection with this kind of NAT behavior from the carrier?

2 REPLIES 2
Georg Pauwen
VIP Expert

Hello,

what do you crypto isakmp policies look like ?

Somehow I have a feeling that the cellular connection is involved here. Since you have this set up in a lab, can you test the same configuration with an Ethernet connection ?

Oh sorry. Good point...I neglected to mention that everything works just fine over an ethernet connection. But here are the ike policies....

crypto ikev2 profile CertProfile
match fvrf ipsecOutside
match identity remote fqdn domain blah.com
identity local fqdn node.domain.com
authentication local rsa-sig
authentication remote rsa-sig
pki trustpoint TP
dpd 10 2 periodic
aaa authorization group cert list default default

crypto ipsec transform-set AES128 esp-aes esp-sha-hmac
mode transport
crypto ipsec df-bit clear
!
crypto ipsec profile IPSecProfile
set transform-set AES128
set ikev2-profile CertProfile

crypto ikev2 client flexvpn Flex
peer 1 1.2.3.4
client connect Tunnel1
!