VPN tunnel issue

[ittechk4u1]

Hello Experts,

Maybe anyone can help to bring UP my VPN tunnel.

SPOKE#sh cry isa policy

Global IKE policy
Protection suite of priority 20
        encryption algorithm:   AES - Advanced Encryption Standard (256 bit keys).
        hash algorithm:         Secure Hash Standard
        authentication method:  Pre-Shared Key
        Diffie-Hellman group:   #1 (768 bit)
        lifetime:               86400 seconds, no volume Limit

HUB.

Global IKE policy
Protection suite of priority 20
        encryption algorithm:   AES - Advanced Encryption Standard (256 bit keys).
        hash algorithm:         Secure Hash Standard
        authentication method:  Pre-Shared Key
        Diffie-Hellman group:   #1 (768 bit)
        lifetime:               86400 seconds, no volume Limit

Both are same still i am getting this error:

.Apr  5 11:14:15.475: ISAKMP-ERROR: (0):Diffie-Hellman group offered does not match policy!
.Apr  5 11:14:15.475: ISAKMP-ERROR: (0):atts are not acceptable. Next payload is 0
.Apr  5 11:14:15.475: ISAKMP-ERROR: (0):no offers accepted!
.Apr  5 11:14:15.479: ISAKMP-ERROR: (0):phase 1 SA policy not acceptable! (local 106.120.64.62 remote 195.243.205.120)
.Apr  5 11:14:15.479: ISAKMP-ERROR: (0):deleting SA reason "Phase1 SA policy proposal not accepted" state (I) MM_NO_STATE (peer 195.243.205.120)
.Apr  5 11:14:15.479: ISAKMP-ERROR: (0):(0): FSM action returned error: 2
.Apr  5 11:14:15.479: ISAKMP-ERROR: (0):deleting SA reason "Phase1 SA policy proposal not accepted" state (I) MM_NO_STATE (peer 195.243.205.120)
.Apr  5 11:14:17.027: ISAKMP-ERROR: (0):Diffie-Hellman group offered does not match policy!
.Apr  5 11:14:17.027: ISAKMP-ERROR: (0):atts are not acceptable. Next payload is 0
.Apr  5 11:14:17.027: ISAKMP-ERROR: (0):no offers accepted!
.Apr  5 11:14:25.475: ISAKMP-ERROR: (0):Diffie-Hellman group offered does not match policy!
.Apr  5 11:14:25.475: ISAKMP-ERROR: (0):atts are not acceptable. Next payload is 0
.Apr  5 11:14:25.475: ISAKMP-ERROR: (0):no offers accepted!

Pre shared key is exactly same...

Thanks

[Julio E. Moisa]

Hi

Have you verified the configuration of: crypto isakmp key AAAA address x.x.x.x.

[ittechk4u1]

yes its corerct on both side.

[Georg Pauwen]

Hello,

in addition to Julio's post, make sure your 'crypto isakmp key' statement has 'no-xauth' added at the end...

[ittechk4u1]

normally all other tunnels which are up and working using "no-xauth"

I removed the no-xauth for specific Location and still tunnels are not coming UP.

Thanks

[Georg Pauwen]

Hello,

sorry for the misunderstanding, the idea was to check if no-xauth' was there. By all means don't remove it.

Can you post the output of 'sh crypto isakmp default policy' ?

[ittechk4u1]

here is the Output from Spoke:

Default IKE policy
Default protection suite of priority 65507
        encryption algorithm:   AES - Advanced Encryption Standard (128 bit keys).
        hash algorithm:         Secure Hash Standard
        authentication method:  Rivest-Shamir-Adleman Signature
        Diffie-Hellman group:   #5 (1536 bit)
        lifetime:               86400 seconds, no volume limit
Default protection suite of priority 65508
        encryption algorithm:   AES - Advanced Encryption Standard (128 bit keys).
        hash algorithm:         Secure Hash Standard
        authentication method:  Pre-Shared Key
        Diffie-Hellman group:   #5 (1536 bit)
        lifetime:               86400 seconds, no volume limit
Default protection suite of priority 65509
        encryption algorithm:   AES - Advanced Encryption Standard (128 bit keys).
        hash algorithm:         Message Digest 5
        authentication method:  Rivest-Shamir-Adleman Signature
        Diffie-Hellman group:   #5 (1536 bit)
        lifetime:               86400 seconds, no volume limit
Default protection suite of priority 65510
        encryption algorithm:   AES - Advanced Encryption Standard (128 bit keys).
        hash algorithm:         Message Digest 5
        authentication method:  Pre-Shared Key
        Diffie-Hellman group:   #5 (1536 bit)
        lifetime:               86400 seconds, no volume limit
Default protection suite of priority 65511
        encryption algorithm:   Three key triple DES
        hash algorithm:         Secure Hash Standard
        authentication method:  Rivest-Shamir-Adleman Signature
        Diffie-Hellman group:   #2 (1024 bit)
        lifetime:               86400 seconds, no volume limit
Default protection suite of priority 65512
        encryption algorithm:   Three key triple DES
        hash algorithm:         Secure Hash Standard
        authentication method:  Pre-Shared Key
        Diffie-Hellman group:   #2 (1024 bit)
        lifetime:               86400 seconds, no volume limit
Default protection suite of priority 65513
        encryption algorithm:   Three key triple DES
        hash algorithm:         Message Digest 5
        authentication method:  Rivest-Shamir-Adleman Signature
        Diffie-Hellman group:   #2 (1024 bit)
        lifetime:               86400 seconds, no volume limit
Default protection suite of priority 65514
        encryption algorithm:   Three key triple DES
        hash algorithm:         Message Digest 5
        authentication method:  Pre-Shared Key
        Diffie-Hellman group:   #2 (1024 bit)
        lifetime:               86400 seconds, no volume Limit

Thanks

[Julio E. Moisa]

Hi

Is possible to share the configuration removing the sensitive information. 

Thank you in advance. 

[ittechk4u1]

please find attached config of spoke:

Info: we have 6 Location connected from HQ (HUB)...all works excpet this spoke.

Thanks

[paul driver]

Hello

a couple of your profiles are using group 5 and pre-share key my understanding only group 1- 2 and not group 5 supports psk

hash algorithm: Secure Hash Standard
authentication method: Pre-Shared Key
Diffie-Hellman group: #5 (1536 bit)

res

Paul 

[ittechk4u1]

I tried to change the policy and now state change from MM_NO to MM_SA but still tunnel is not coming UP. New policy: crypto isakmp policy 30 encr aes 256 authentication pre-share group 14 lifetime 2880 please find the attached logs: