Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About train_wreck
Stats
Member since
03-04-2016
95
Posts
25
Helpful
2
Solutions
Certifications
Created by
train_wreck
in Small Business Routers
in Small Business Routers
08-27-2019
02:51 AM
08-27-2019
02:51 AM
I have a RV340W with the latest firmware 1.0.03.16. It is configured for DHCP IPv6 prefix delegation, with the prefix being applied to VLAN1 and router advertisements enabled on VLAN1. All hosts are receiving valid global IPv6 addresses from within the DHCP provided subnet. However, every 10-20 IPv6 packets are being dropped. Shown below is a continuous ping from one of the local hosts to gmail.com: [root@STREAMCLIENT root]# ping gmail.com
PING gmail.com(ya-in-x11.1e100.net (2607:f8b0:4002:c03::11)) 56 data bytes
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=1 ttl=43 time=30.10 ms
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=2 ttl=43 time=26.3 ms
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=3 ttl=43 time=34.6 ms
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=4 ttl=43 time=32.5 ms
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=5 ttl=43 time=30.7 ms
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=6 ttl=43 time=28.9 ms
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=7 ttl=43 time=27.8 ms
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=8 ttl=43 time=24.5 ms
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=9 ttl=43 time=23.1 ms
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=10 ttl=43 time=31.3 ms
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=11 ttl=43 time=30.5 ms
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=12 ttl=43 time=28.6 ms
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=13 ttl=43 time=25.6 ms
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=14 ttl=43 time=34.3 ms
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=15 ttl=43 time=31.8 ms
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=16 ttl=43 time=30.8 ms
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=17 ttl=43 time=30.3 ms
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=18 ttl=43 time=27.7 ms
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=19 ttl=43 time=26.4 ms
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=20 ttl=43 time=24.0 ms
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=21 ttl=43 time=23.3 ms
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=22 ttl=43 time=41.1 ms
ping: sendmsg: Network is unreachable
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=24 ttl=43 time=29.0 ms
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=25 ttl=43 time=29.2 ms
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=26 ttl=43 time=25.10 ms
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=27 ttl=43 time=24.8 ms
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=28 ttl=43 time=32.4 ms
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=29 ttl=43 time=31.3 ms
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=30 ttl=43 time=30.3 ms
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=31 ttl=43 time=37.7 ms
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=32 ttl=43 time=26.7 ms
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=33 ttl=43 time=23.9 ms
ping: sendmsg: Network is unreachable
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=35 ttl=43 time=30.2 ms
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=36 ttl=43 time=29.7 ms
64 bytes from ya-in-x11.1e100.net (2607:f8b0:4002:c03::11): icmp_seq=37 ttl=43 time=26.5 ms As you can see, the host periodically thinks that the "network is unreachable." This happens on every inside host, and regardless of whether they are connected to WiFi or wired. Here is IPv6 WAN config: Here is IPv6 LAN and Router Advertisement config: This problem does not happen with any other router. Only the RV340W has this problem. What is going on? There is nothing useful whatsoever in the logs......
... View more
Labels:
Created by
train_wreck
in Small Business Routers
in Small Business Routers
07-08-2019
09:38 PM
07-08-2019
09:38 PM
@chamel123 wrote: I'm not as familiar with certificate and openssl as I'd like. Since my certificate is a CA (LestEncrypt) wildcard cert (*.mydomain,com) do you think I can alter the one I have to include the IP? It's already sign by a CA. In the meantime, I think I'm overdue for an openssl crash course. Anyway, tx for your reply You would need to get a new cert signed by the CA. There isn't a way to add the IP option to the cert you already have - it is added by the CA at the time of the cert being signed. It's added in the "Subject Alternative Name" field of the certificate, using the notation IP:w.x.y.z Also, I don't necessarily recommend using LetsEncrypt for a device cert, simply because the certs from LetsEncrypt typically expire every 3 months, and there is no automatic way to have the Cisco device update it. You will have to manually request a new cert from LetsEncrypt, then manually log in to the Cisco device and upload it.
... View more
Created by
train_wreck
in Small Business Routers
in Small Business Routers
07-08-2019
09:28 PM
07-08-2019
09:28 PM
Jo - where is the option you are talking about with regards to "Firewall =ON" ? If you mean the checkbox on this page next to the word "Firewall" and labeled "Enable", all this does is grey out all of the options on the page. Selecting/Deselecting it still does not allow you to deselect the "HTTPS" option. It remains permanently selected, and greyed out. Shown below is my RV340W's page running 1.0.03.15:
... View more
Created by
train_wreck
in Small Business Routers
in Small Business Routers
07-08-2019
09:19 PM
07-08-2019
09:19 PM
Yes, the values should remain after a firmware upgrade. And you're right that %any works in the field. I suspect Cisco is just using Strongswan underneath as well.
... View more
Created by
train_wreck
in Small Business Routers
in Small Business Routers
06-13-2019
04:32 AM
06-13-2019
04:32 AM
I've seen this exact kind of issue on a ZyXel device, because the config page was trying to redirect to HTTPS, and was using the IP address instead of the domain name that the user originally used to access the page. The result was broken HTTPS and a warning message like this shown. On that Zyxel device, I could disable HTTPS for the config page and use plain HTTP, which fixed this. Unfortunately, the Cisco device does not appear to allow this. The checkbox is greyed out for HTTPS (located at Firewall -> Basic Settings -> HTTPS), meaning you cannot disable it. The only other option would be to possibly include the IP address of the Cisco device into the certificate, using an IP:<ipaddr> option in the X509v.3 extension header. That way the HTTPS redirect should be valid.
... View more
05-25-2019
12:10 AM
I have narrowed this down to a problem with the RV340 router. I have since added 2 more additional crypto map sites to different devices (a Fortigate 30E and a ZyXel USG40), and both work flawlessly, in addition to the original ASA that has remained working the whole time. Only the RV340 has this problem. All devices use certificates that were signed with my internal CA. My original configuration was mostly correct; I did not have to use IPsec profiles or multiple IKEv2 profiles to accomplish this, and in fact because I was using crypto maps, the ipsec profile was unnecessary. Only 1 IKEv2 profile is used in multiple crypto map entries, and all are configured the same and are working fine (except the RV340). This will not be the first problem I have had with the RV340, VPN-related or otherwise. Cisco really needs to get out of the "Small Business" VPN router business, it's obvious they don't really care about it.
... View more
05-24-2019
01:45 AM
Also, I tried adding a second ikev2 profile, with a second certmap and a second ipsec profile linked to the ikev2 profile. This changed nothing. The problem is still there, and the error is still the same ("EV_FAIL").
... View more
05-24-2019
01:11 AM
@Giuseppe Larosa wrote: From the log messages of your first post we see: that there are NAT issues. Is the RV340 router behind NAT ? No, it is not. Both WAN IPs of both devices are within the same /29 (e.g., the ISR is at 50.x.x.3/29 and the RV340 is at 50.x.x.4/29) and are connected to the same VLAN on the same switch.
... View more
05-23-2019
07:55 PM
@Georg Pauwen wrote: Hello, assuming that you are running router firmware version 1.0.02.16 (which was released in January, and which is the first to support ikev2), and that obviously the encryption, decryption, and authentication parameters on the RV340 match what you have configured on the ISR, you might want to try a second policy, separate from the policy for the ASA, and use the parameters outlined in the document below: https://www.cisco.com/c/en/us/support/docs/smb/routers/cisco-rv-series-small-business-routers/Configuring_IKEv2_on_the_RV34x_Series_Router.html I am actually running the newest firmware on the RV340 (1.0.03.15). Are you saying that I specifically need to use those encr/hash/DH settings in that document? Or are you just providing that for reference? I can assure you that all settings are duplicated on the RV340 (with obvious mirroring of the subnets on each side). And when you say "second policy", do you mean a second profile? As in, "crypto ikev2 profile RV340W"? I am intending to use the same policy & proposal for both the ASA and the RV340..... surely this can be done? Also, when I try to create a new "crypto ikev2 profile" for the RV340, I find that I am also not allowed to use the same certmap.... I would have to duplicate the certmap already in use and name it "CERTMAP2", or something. That doesn't seem right..... All devices are using certs signed by the same CA.
... View more
05-22-2019
10:29 PM
I have a 4321 ver. 15.5 that has a certificate authentication IKEv2 site to site tunnel setup to an ASA. This tunnel is working fine. I am adding a second S2S tunnel to a Cisco RV340 router. Phase 1 is coming up OK, but phase 2 never establishes. The RV340 thinks that everything is fine and the phase 2 is up, but the ISR does not. Config: Current configuration : 9407 bytes
!
! Last configuration change at 00:16:41 CDT Thu May 23 2019 by user
!
version 15.5
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
no platform punt-keepalive disable-kernel-core
platform hardware throughput level 100000
!
hostname 4321-pLAN9-co
!
boot-start-marker
boot-end-marker
!
!
vrf definition Mgmt-intf
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
!
enable secret 5 xxxxx
!
aaa new-model
!
!
aaa authentication login default local
!
!
!
!
!
!
aaa session-id common
clock timezone CDT -5 0
clock summer-time CDT recurring 1 Sun Nov 2:00 2 Sun Mar 2:00
!
!
!
!
!
!
!
!
!
!
!
ip name-server 75.75.75.75
ip dhcp excluded-address 192.168.211.2
!
ip dhcp pool DHCP
network 192.168.211.0 255.255.255.248
default-router 192.168.211.1
dns-server 192.168.211.1
lease 0 0 10
!
!
!
!
!
!
!
!
!
!
subscriber templating
!
multilink bundle-name authenticated
!
!
!
crypto pki trustpoint pLAN9
enrollment terminal
fqdn none
subject-name CN=4321.pLAN9.co
revocation-check none
rsakeypair MAINRSA
!
!
!
crypto pki certificate map CERTMAP 10
issuer-name co = CA_COMMON_NAME
!
crypto pki certificate chain pLAN9
certificate 00CF75E3A8D2772F2D
xxxxxxxxxxxxxxxxxxxxxx
quit
certificate ca 00A64BD6B54544EEC6
xxxxxxxxxxxxxxxxxxxxx
quit
license udi pid ISR4321/K9 sn FDO21032NET
!
spanning-tree extend system-id
!
username user password 7 xxxxxx
!
redundancy
mode none
!
crypto ikev2 proposal aes256-sha1
encryption aes-cbc-256
integrity sha1
group 5
!
crypto ikev2 policy policy
proposal aes256-sha1
!
!
crypto ikev2 profile ASA
match certificate CERTMAP
identity local dn
authentication local rsa-sig
authentication remote rsa-sig
pki trustpoint pLAN9
lifetime 28800
!
no crypto ikev2 http-url cert
!
!
vlan internal allocation policy ascending
no cdp run
!
!
class-map type inspect match-any ALL
match protocol tcp
match protocol udp
match protocol icmp
class-map type inspect match-any EXPOSED
match access-group name EXPOSED
!
policy-map type inspect OUT_IN_POL
class type inspect EXPOSED
inspect
class class-default
drop log
policy-map type inspect SELF_OUT_POL
class type inspect ALL
inspect
class class-default
drop log
policy-map type inspect IN_OUT_POL
class type inspect ALL
inspect
class class-default
drop log
policy-map type inspect OUT_SELF_POL
class type inspect EXPOSED
inspect
class class-default
drop log
!
zone security INSIDE
zone security OUTSIDE
zone-pair security IN_OUT_ZONE source INSIDE destination OUTSIDE
service-policy type inspect IN_OUT_POL
zone-pair security OUT_IN_ZONE source OUTSIDE destination INSIDE
service-policy type inspect OUT_IN_POL
zone-pair security OUT_SELF_ZONE source OUTSIDE destination self
service-policy type inspect OUT_SELF_POL
zone-pair security SELF_OUT_ZONE source self destination OUTSIDE
service-policy type inspect SELF_OUT_POL
!
!
!
!
!
crypto isakmp identity dn
!
!
crypto ipsec transform-set aes256-sha1 esp-aes 256 esp-sha-hmac
mode tunnel
!
!
crypto ipsec profile profile
set transform-set aes256-sha1
set ikev2-profile ASA
!
!
crypto map MAP 10 ipsec-isakmp
set peer ASA_WAN_IP
set security-association lifetime kilobytes disable
set security-association lifetime seconds 28800
set transform-set aes256-sha1
set pfs group5
set ikev2-profile ASA
match address VPN_1176
crypto map MAP 20 ipsec-isakmp
set peer RV340_WAN_IP
set security-association lifetime kilobytes disable
set security-association lifetime seconds 28800
set transform-set aes256-sha1
set pfs group5
set ikev2-profile ASA
match address VPN_340
!
!
!
!
!
!
!
!
!
!
!
!
interface GigabitEthernet0/0/0
no ip address
shutdown
negotiation auto
!
interface GigabitEthernet0/0/1
ip address ISR4321_WAN_IP 255.255.255.248
ip nat outside
zone-member security OUTSIDE
negotiation auto
crypto map MAP
!
interface GigabitEthernet0/1/0
switchport access vlan 20
switchport mode access
spanning-tree bpdufilter enable
!
interface GigabitEthernet0/1/1
switchport access vlan 20
switchport mode access
spanning-tree bpdufilter enable
!
interface GigabitEthernet0/1/2
switchport access vlan 20
switchport mode access
spanning-tree bpdufilter enable
!
interface GigabitEthernet0/1/3
switchport access vlan 20
switchport mode access
spanning-tree bpdufilter enable
!
interface GigabitEthernet0
vrf forwarding Mgmt-intf
no ip address
shutdown
negotiation auto
!
interface Vlan1
no ip address
shutdown
!
interface Vlan20
ip address 192.168.211.1 255.255.255.248
ip nat inside
zone-member security INSIDE
!
ip nat inside source list NAT interface GigabitEthernet0/0/1 overload
ip forward-protocol nd
no ip http server
no ip http secure-server
ip tftp source-interface GigabitEthernet0
ip dns server
ip route 0.0.0.0 0.0.0.0 DEFAULT_GATEWAY
ip route 192.168.34.0 255.255.255.240 RV340_WAN_IP
ip route 192.168.222.0 255.255.255.224 ASA_WAN_IP
ip ssh source-interface Vlan20
!
!
ip access-list extended EXPOSED
permit icmp any any
permit udp any any eq isakmp
permit udp any any eq non500-isakmp
permit esp any any
permit ip 192.168.222.0 0.0.0.31 any
permit ip 192.168.211.8 0.0.0.7 any
permit ip 192.168.34.0 0.0.0.15 any
ip access-list extended NAT
deny ip 192.168.211.0 0.0.0.15 192.168.34.0 0.0.0.15
deny ip 192.168.211.0 0.0.0.7 192.168.211.8 0.0.0.7
deny ip 192.168.211.0 0.0.0.15 192.168.222.0 0.0.0.31
permit ip 192.168.211.0 0.0.0.15 any
ip access-list extended VPN_1176
permit ip 192.168.211.0 0.0.0.15 192.168.222.0 0.0.0.31
ip access-list extended VPN_340
permit ip 192.168.211.0 0.0.0.15 192.168.34.0 0.0.0.15
!
!
!
!
!
!
control-plane
!
!
line con 0
stopbits 1
line aux 0
stopbits 1
line vty 0 4
transport input ssh
!
!
end debug output during failure: *May 23 05:27:12.293: IKEv2-INTERNAL:New ikev2 sa request admitted
*May 23 05:27:12.293: IKEv2-INTERNAL:Incrementing incoming negotiating sa count by one
*May 23 05:27:12.293: IKEv2-PAK:Next payload: SA, version: 2.0 Exchange type: IKE_SA_INIT, flags: INITIATOR Message id: 0, length: 596
Payload contents:
SA Next payload: KE, reserved: 0x0, length: 244
last proposal: 0x2, reserved: 0x0, length: 44
Proposal: 1, Protocol id: IKE, SPI size: 0, #trans: 4 last transform: 0x3, reserved: 0x0: length: 12
type: 1, reserved: 0x0, id: AES-CBC
last transform: 0x3, reserved: 0x0: length: 8
type: 3, reserved: 0x0, id: SHA96
last transform: 0x3, reserved: 0x0: length: 8
type: 2, reserved: 0x0, id: SHA1
last transform: 0x0, reserved: 0x0: length: 8
type: 4, reserved: 0x0, id: DH_GROUP_1536_MODP/Group 5
last proposal: 0x0, reserved: 0x0, length: 196
Proposal: 2, Protocol id: IKE, SPI size: 0, #trans: 22 last transform: 0x3, reserved: 0x0: length: 12
type: 1, reserved: 0x0, id: AES-CBC
last transform: 0x3, reserved: 0x0: length: 12
type: 1, reserved: 0x0, id: AES-CBC
last transform: 0x3, reserved: 0x0: length: 12
type: 1, reserved: 0x0, id: AES-CBC
last transform: 0x3, reserved: 0x0: length: 8
type: 1, reserved: 0x0, id: 3DES
last transform: 0x3, reserved: 0x0: length: 8
type: 3, reserved: 0x0, id: SHA256
last transform: 0x3, reserved: 0x0: length: 8
type: 3, reserved: 0x0, id: SHA384
last transform: 0x3, reserved: 0x0: length: 8
type: 3, reserved: 0x0, id: SHA512
last transform: 0x3, reserved: 0x0: length: 8
type: 3, reserved: 0x0, id: AES XCBC 96
last transform: 0x3, reserved: 0x0: length: 8
type: 3, reserved: 0x0, id: SHA96
last transform: 0x3, reserved: 0x0: length: 8
type: 3, reserved: 0x0, id: MD596
last transform: 0x3, reserved: 0x0: length: 8
type: 2, reserved: 0x0, id: AES CBC
last transform: 0x3, reserved: 0x0: length: 8
type: 2, reserved: 0x0, id: SHA256
last transform: 0x3, reserved: 0x0: length: 8
type: 2, reserved: 0x0, id: SHA384
last transform: 0x3, reserved: 0x0: length: 8
type: 2, reserved: 0x0, id: SHA512
last transform: 0x3, reserved: 0x0: length: 8
type: 2, reserved: 0x0, id: SHA1
last transform: 0x3, reserved: 0x0: length: 8
type: 2, reserved: 0x0, id: MD5
last transform: 0x3, reserved: 0x0: length: 8
type: 4, reserved: 0x0, id: DH_GROUP_3072_MODP/Group 15
last transform: 0x3, reserved: 0x0: length: 8
type: 4, reserved: 0x0, id: DH_GROUP_4096_MODP/Group 16
last transform: 0x3, reserved: 0x0: length: 8
type: 4, reserved: 0x0, id: Unknown - 18
last transform: 0x3, reserved: 0x0: length: 8
type: 4, reserved: 0x0, id: DH_GROUP_2048_MODP/Group 14
last transform: 0x3, reserved: 0x0: length: 8
type: 4, reserved: 0x0, id: DH_GROUP_2048_256_MODP/Group 24
last transform: 0x0, reserved: 0x0: length: 8
type: 4, reserved: 0x0, id: DH_GROUP_1024_MODP/Group 2
KE Next payload: N, reserved: 0x0, length: 200
DH group: 5, Reserved: 0x0
N Next payload: NOTIFY, reserved: 0x0, length: 36
*May 23 05:27:12.294: IKEv2-INTERNAL:Parse Notify Payload: NAT_DETECTION_SOURCE_IP NOTIFY(NAT_DETECTION_SOURCE_IP) Next payload: NOTIFY, reserved: 0x0, length: 28
Security protocol id: Unknown - 0, spi size: 0, type: NAT_DETECTION_SOURCE_IP
*May 23 05:27:12.294: IKEv2-INTERNAL:Parse Notify Payload: NAT_DETECTION_DESTINATION_IP NOTIFY(NAT_DETECTION_DESTINATION_IP) Next payload: NOTIFY, reserved: 0x0, length: 28
Security protocol id: Unknown - 0, spi size: 0, type: NAT_DETECTION_DESTINATION_IP
*May 23 05:27:12.294: IKEv2-INTERNAL:Parse Notify Payload: IKEV2_FRAGMENTATION_SUPPORTED NOTIFY(IKEV2_FRAGMENTATION_SUPPORTED) Next payload: NOTIFY, reserved: 0x0, length: 8
Security protocol id: Unknown - 0, spi size: 0, type: IKEV2_FRAGMENTATION_SUPPORTED
*May 23 05:27:12.294: IKEv2-INTERNAL:Parse Notify Payload: Unknown - 16431 NOTIFY(Unknown - 16431) Next payload: NOTIFY, reserved: 0x0, length: 16
Security protocol id: Unknown - 0, spi size: 0, type: Unknown - 0
*May 23 05:27:12.294: IKEv2-INTERNAL:Parse Notify Payload: REDIRECT_SUPPORTED NOTIFY(REDIRECT_SUPPORTED) Next payload: NONE, reserved: 0x0, length: 8
Security protocol id: Unknown - 0, spi size: 0, type: REDIRECT_SUPPORTED
*May 23 05:27:12.294: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):SM Trace-> SA: I_SPI=0E4072C2DD4A6542 R_SPI=7F99B96F1A6D2949 (R) MsgID = 0 CurState: IDLE Event: EV_RECV_INIT
*May 23 05:27:12.294: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):SM Trace-> SA: I_SPI=0E4072C2DD4A6542 R_SPI=7F99B96F1A6D2949 (R) MsgID = 0 CurState: R_INIT Event: EV_VERIFY_MSG
*May 23 05:27:12.294: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):SM Trace-> SA: I_SPI=0E4072C2DD4A6542 R_SPI=7F99B96F1A6D2949 (R) MsgID = 0 CurState: R_INIT Event: EV_INSERT_SA
*May 23 05:27:12.294: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):SM Trace-> SA: I_SPI=0E4072C2DD4A6542 R_SPI=7F99B96F1A6D2949 (R) MsgID = 0 CurState: R_INIT Event: EV_GET_IKE_POLICY
*May 23 05:27:12.294: IKEv2-INTERNAL:Adding Proposal aes256-sha1 to toolkit policy
*May 23 05:27:12.295: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):SM Trace-> SA: I_SPI=0E4072C2DD4A6542 R_SPI=7F99B96F1A6D2949 (R) MsgID = 0 CurState: R_INIT Event: EV_PROC_MSG
*May 23 05:27:12.295: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):SM Trace-> SA: I_SPI=0E4072C2DD4A6542 R_SPI=7F99B96F1A6D2949 (R) MsgID = 0 CurState: R_INIT Event: EV_DETECT_NAT
*May 23 05:27:12.295: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):Process NAT discovery notify
*May 23 05:27:12.295: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):Processing nat detect src notify
*May 23 05:27:12.295: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):Remote address matched
*May 23 05:27:12.295: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):Processing nat detect dst notify
*May 23 05:27:12.295: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):Local address matched
*May 23 05:27:12.295: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):No NAT found
*May 23 05:27:12.295: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):SM Trace-> SA: I_SPI=0E4072C2DD4A6542 R_SPI=7F99B96F1A6D2949 (R) MsgID = 0 CurState: R_INIT Event: EV_CHK_CONFIG_MODE
*May 23 05:27:12.295: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):SM Trace-> SA: I_SPI=0E4072C2DD4A6542 R_SPI=7F99B96F1A6D2949 (R) MsgID = 0 CurState: R_BLD_INIT Event: EV_SET_POLICY
*May 23 05:27:12.295: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):Setting configured policies
*May 23 05:27:12.295: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):SM Trace-> SA: I_SPI=0E4072C2DD4A6542 R_SPI=7F99B96F1A6D2949 (R) MsgID = 0 CurState: R_BLD_INIT Event: EV_CHK_AUTH4PKI
*May 23 05:27:12.295: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):SM Trace-> SA: I_SPI=0E4072C2DD4A6542 R_SPI=7F99B96F1A6D2949 (R) MsgID = 0 CurState: R_BLD_INIT Event: EV_PKI_SESH_OPEN
*May 23 05:27:12.295: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):Opening a PKI session
*May 23 05:27:12.295: CRYPTO_PKI: (9000F) Session started - identity not specified
*May 23 05:27:12.295: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):SM Trace-> SA: I_SPI=0E4072C2DD4A6542 R_SPI=7F99B96F1A6D2949 (R) MsgID = 0 CurState: R_BLD_INIT Event: EV_GEN_DH_KEY
*May 23 05:27:12.304: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):SM Trace-> SA: I_SPI=0E4072C2DD4A6542 R_SPI=7F99B96F1A6D2949 (R) MsgID = 0 CurState: R_BLD_INIT Event: EV_NO_EVENT
*May 23 05:27:12.304: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):SM Trace-> SA: I_SPI=0E4072C2DD4A6542 R_SPI=7F99B96F1A6D2949 (R) MsgID = 0 CurState: R_BLD_INIT Event: EV_OK_RECD_DH_PUBKEY_RESP
*May 23 05:27:12.304: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):Action: Action_Null
*May 23 05:27:12.304: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):SM Trace-> SA: I_SPI=0E4072C2DD4A6542 R_SPI=7F99B96F1A6D2949 (R) MsgID = 0 CurState: R_BLD_INIT Event: EV_GEN_DH_SECRET
*May 23 05:27:12.314: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):SM Trace-> SA: I_SPI=0E4072C2DD4A6542 R_SPI=7F99B96F1A6D2949 (R) MsgID = 0 CurState: R_BLD_INIT Event: EV_NO_EVENT
*May 23 05:27:12.314: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):SM Trace-> SA: I_SPI=0E4072C2DD4A6542 R_SPI=7F99B96F1A6D2949 (R) MsgID = 0 CurState: R_BLD_INIT Event: EV_OK_RECD_DH_SECRET_RESP
*May 23 05:27:12.314: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):Action: Action_Null
*May 23 05:27:12.314: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):SM Trace-> SA: I_SPI=0E4072C2DD4A6542 R_SPI=7F99B96F1A6D2949 (R) MsgID = 0 CurState: R_BLD_INIT Event: EV_GEN_SKEYID
*May 23 05:27:12.314: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):Generate skeyid
*May 23 05:27:12.314: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):SM Trace-> SA: I_SPI=0E4072C2DD4A6542 R_SPI=7F99B96F1A6D2949 (R) MsgID = 0 CurState: R_BLD_INIT Event: EV_GET_CONFIG_MODE
*May 23 05:27:12.314: IKEv2-INTERNAL:No config data to send to toolkit:
*May 23 05:27:12.314: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):SM Trace-> SA: I_SPI=0E4072C2DD4A6542 R_SPI=7F99B96F1A6D2949 (R) MsgID = 0 CurState: R_BLD_INIT Event: EV_BLD_MSG
*May 23 05:27:12.314: IKEv2-INTERNAL:Construct Vendor Specific Payload: DELETE-REASON
*May 23 05:27:12.314: IKEv2-INTERNAL:Construct Vendor Specific Payload: (CUSTOM)
*May 23 05:27:12.314: IKEv2-INTERNAL:Construct Notify Payload: NAT_DETECTION_SOURCE_IP
*May 23 05:27:12.314: IKEv2-INTERNAL:Construct Notify Payload: NAT_DETECTION_DESTINATION_IP
*May 23 05:27:12.314: IKEv2-PAK:(SESSION ID = 6,SA ID = 2):Next payload: SA, version: 2.0 Exchange type: IKE_SA_INIT, flags: RESPONDER MSG-RESPONSE Message id: 0, length: 437
Payload contents:
SA Next payload: KE, reserved: 0x0, length: 48
last proposal: 0x0, reserved: 0x0, length: 44
Proposal: 1, Protocol id: IKE, SPI size: 0, #trans: 4 last transform: 0x3, reserved: 0x0: length: 12
type: 1, reserved: 0x0, id: AES-CBC
last transform: 0x3, reserved: 0x0: length: 8
type: 2, reserved: 0x0, id: SHA1
last transform: 0x3, reserved: 0x0: length: 8
type: 3, reserved: 0x0, id: SHA96
last transform: 0x0, reserved: 0x0: length: 8
type: 4, reserved: 0x0, id: DH_GROUP_1536_MODP/Group 5
KE Next payload: N, reserved: 0x0, length: 200
DH group: 5, Reserved: 0x0
N Next payload: VID, reserved: 0x0, length: 36
VID Next payload: VID, reserved: 0x0, length: 23
VID Next payload: NOTIFY, reserved: 0x0, length: 21
NOTIFY(NAT_DETECTION_SOURCE_IP) Next payload: NOTIFY, reserved: 0x0, length: 28
Security protocol id: Unknown - 0, spi size: 0, type: NAT_DETECTION_SOURCE_IP
NOTIFY(NAT_DETECTION_DESTINATION_IP) Next payload: CERTREQ, reserved: 0x0, length: 28
Security protocol id: Unknown - 0, spi size: 0, type: NAT_DETECTION_DESTINATION_IP
CERTREQ Next payload: NONE, reserved: 0x0, length: 25
Cert encoding X.509 Certificate - signature
*May 23 05:27:12.315: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):SM Trace-> SA: I_SPI=0E4072C2DD4A6542 R_SPI=7F99B96F1A6D2949 (R) MsgID = 0 CurState: INIT_DONE Event: EV_DONE
*May 23 05:27:12.315: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):SM Trace-> SA: I_SPI=0E4072C2DD4A6542 R_SPI=7F99B96F1A6D2949 (R) MsgID = 0 CurState: INIT_DONE Event: EV_CHK4_ROLE
*May 23 05:27:12.315: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):SM Trace-> SA: I_SPI=0E4072C2DD4A6542 R_SPI=7F99B96F1A6D2949 (R) MsgID = 0 CurState: INIT_DONE Event: EV_START_TMR
*May 23 05:27:12.315: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):SM Trace-> SA: I_SPI=0E4072C2DD4A6542 R_SPI=7F99B96F1A6D2949 (R) MsgID = 0 CurState: R_WAIT_AUTH Event: EV_NO_EVENT
*May 23 05:27:12.485: IKEv2-INTERNAL:Got a packet from dispatcher
*May 23 05:27:12.485: IKEv2-INTERNAL:Processing an item off the pak queue
*May 23 05:27:12.485: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):Request has mess_id 1; expected 1 through 1
*May 23 05:27:12.485: IKEv2-PAK:(SESSION ID = 6,SA ID = 2):Next payload: ENCR, version: 2.0 Exchange type: IKE_AUTH, flags: INITIATOR Message id: 1, length: 1324
Payload contents:
IDi Next payload: CERT, reserved: 0x0, length: 67
Id type: DER ASN1 DN, Reserved: 0x0 0x0
CERT Next payload: CERTREQ, reserved: 0x0, length: 771
Cert encoding X.509 Certificate - signature
CERTREQ Next payload: IDr, reserved: 0x0, length: 25
Cert encoding X.509 Certificate - signature
IDr Next payload: AUTH, reserved: 0x0, length: 34
Id type: DER ASN1 DN, Reserved: 0x0 0x0
AUTH Next payload: SA, reserved: 0x0, length: 264
Auth method RSA, reserved: 0x0, reserved 0x0
SA Next payload: TSi, reserved: 0x0, length: 44
last proposal: 0x0, reserved: 0x0, length: 40
Proposal: 1, Protocol id: ESP, SPI size: 4, #trans: 3 last transform: 0x3, reserved: 0x0: length: 12
type: 1, reserved: 0x0, id: AES-CBC
last transform: 0x3, reserved: 0x0: length: 8
type: 3, reserved: 0x0, id: SHA96
last transform: 0x0, reserved: 0x0: length: 8
type: 5, reserved: 0x0, id: Don't use ESN
TSi Next payload: TSr, reserved: 0x0, length: 24
Num of TSs: 1, reserved 0x0, reserved 0x0
TS type: TS_IPV4_ADDR_RANGE, proto id: 0, length: 16
start port: 0, end port: 65535
start addr: 192.168.34.0, end addr: 192.168.34.15
TSr Next payload: NOTIFY, reserved: 0x0, length: 24
Num of TSs: 1, reserved 0x0, reserved 0x0
TS type: TS_IPV4_ADDR_RANGE, proto id: 0, length: 16
start port: 0, end port: 65535
start addr: 192.168.211.0, end addr: 192.168.211.15
*May 23 05:27:12.486: IKEv2-INTERNAL:Parse Notify Payload: Unknown - 16417 NOTIFY(Unknown - 16417) Next payload: NONE, reserved: 0x0, length: 8
Security protocol id: Unknown - 0, spi size: 0, type: Unknown - 0
*May 23 05:27:12.486: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):SM Trace-> SA: I_SPI=0E4072C2DD4A6542 R_SPI=7F99B96F1A6D2949 (R) MsgID = 1 CurState: R_WAIT_AUTH Event: EV_RECV_AUTH
*May 23 05:27:12.486: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):SM Trace-> SA: I_SPI=0E4072C2DD4A6542 R_SPI=7F99B96F1A6D2949 (R) MsgID = 1 CurState: R_WAIT_AUTH Event: EV_CHK_NAT_T
*May 23 05:27:12.486: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):SM Trace-> SA: I_SPI=0E4072C2DD4A6542 R_SPI=7F99B96F1A6D2949 (R) MsgID = 1 CurState: R_WAIT_AUTH Event: EV_PROC_ID
*May 23 05:27:12.486: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):Received valid parameteres in process id
*May 23 05:27:12.491: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):SM Trace-> SA: I_SPI=0E4072C2DD4A6542 R_SPI=7F99B96F1A6D2949 (R) MsgID = 1 CurState: AUTH_DONE Event: EV_FAIL
*May 23 05:27:12.491: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):SM Trace-> SA: I_SPI=0E4072C2DD4A6542 R_SPI=7F99B96F1A6D2949 (R) MsgID = 1 CurState: EXIT Event: EV_ABORT
*May 23 05:27:12.491: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):SM Trace-> SA: I_SPI=0E4072C2DD4A6542 R_SPI=7F99B96F1A6D2949 (R) MsgID = 1 CurState: EXIT Event: EV_CHK_PENDING_ABORT
*May 23 05:27:12.491: IKEv2-INTERNAL:Negotiating SA request deleted
*May 23 05:27:12.491: IKEv2-INTERNAL:Decrement count for incoming negotiating
*May 23 05:27:12.492: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):SM Trace-> SA: I_SPI=0E4072C2DD4A6542 R_SPI=7F99B96F1A6D2949 (R) MsgID = 1 CurState: EXIT Event: EV_CHK_GKM
*May 23 05:27:12.492: IKEv2-INTERNAL:(SESSION ID = 6,SA ID = 2):SM Trace-> SA: I_SPI=0E4072C2DD4A6542 R_SPI=7F99B96F1A6D2949 (R) MsgID = 1 CurState: EXIT Event: EV_UPDATE_CAC_STATS
*May 23 05:27:12.492: CRYPTO_PKI: Rcvd request to end PKI session 9000F.
*May 23 05:27:12.492: CRYPTO_PKI: PKI session 9000F has ended. Freeing all resources.
*May 23 05:27:14.201: [] -> [ACL VPN_340]: message ACL notify RP
*May 23 05:27:14.201: [ACL VPN_340]: message = ACL notify RP
*May 23 05:27:14.201: [ACL VPN_340]: state = ACL notify RP action
*May 23 05:27:14.201: IPSEC:(SESSION ID = 1) (MESSAGE) crypto_ipsec_construct_sa_request request already in progress
*May 23 05:27:15.477: IKEv2-INTERNAL:Got a packet from dispatcher
*May 23 05:27:15.478: IKEv2-INTERNAL:Processing an item off the pak queue
*May 23 05:27:15.480: IKEv2-INTERNAL:Couldn't find matching SA
*May 23 05:27:15.480: IKEv2-PAK:(SESSION ID = 0,SA ID = 0):Next payload: ENCR, version: 2.0 Exchange type: INFORMATIONAL, flags: RESPONDER Message id: 0, length: 76
*May 23 05:27:16.487: IKEv2-INTERNAL:Got a packet from dispatcher
*May 23 05:27:16.488: IKEv2-INTERNAL:Processing an item off the pak queue
*May 23 05:27:16.490: IKEv2-INTERNAL:Couldn't find matching SA
*May 23 05:27:16.490: IKEv2-PAK:(SESSION ID = 0,SA ID = 0):Next payload: ENCR, version: 2.0 Exchange type: IKE_AUTH, flags: INITIATOR Message id: 1, length: 1324 This log output, besides being horrendously unreadable, shows no useful information as to why the tunnel is failing. In fact, the only failure I see is the line "CurState: AUTH_DONE Event: EV_FAIL", which tells me nothing as to why it failed. What is going on here?
... View more
Labels:
04-24-2019
01:07 AM
I can't find any specific configuration guide for this firmware release. As far as I can tell, the command should be the same everywhere. Here is my show license: Cisco4321#show license Index 1 Feature: appxk9 Period left: Not Activated Period Used: 0 minute 0 second License Type: EvalRightToUse License State: Active, Not in Use, EULA not accepted License Count: Non-Counted License Priority: None Index 2 Feature: uck9 Period left: Not Activated Period Used: 0 minute 0 second License Type: EvalRightToUse License State: Active, Not in Use, EULA not accepted License Count: Non-Counted License Priority: None Index 3 Feature: securityk9 Period left: Life time License Type: Permanent License State: Active, In Use License Count: Non-Counted License Priority: Medium Index 4 Feature: ipbasek9 Period left: Life time License Type: Permanent License State: Active, In Use License Count: Non-Counted License Priority: Medium Index 5 Feature: FoundationSuiteK9 Period left: Not Activated Period Used: 0 minute 0 second License Type: EvalRightToUse License State: Active, Not in Use, EULA not accepted License Count: Non-Counted License Priority: None Index 6 Feature: AdvUCSuiteK9 Period left: Not Activated Period Used: 0 minute 0 second License Type: EvalRightToUse License State: Active, Not in Use, EULA not accepted License Count: Non-Counted License Priority: None Index 7 Feature: cme-srst Period left: Not Activated Period Used: 0 minute 0 second License Type: EvalRightToUse License State: Active, Not in Use, EULA not accepted License Count: 0/0 (In-use/Violation) License Priority: None Index 8 Feature: hseck9 Index 9 Feature: throughput Period left: Life time License Type: Permanent License State: Active, In Use License Count: Non-Counted License Priority: Medium Index 10 Feature: internal_service
... View more
04-15-2019
11:59 PM
I am having the same problem as the post here: https://community.cisco.com/t5/ipv6/quot-ipv6-dhcp-client-quot-missing-from-ios-xe-15-4/td-p/2734416 I have a 4321 that I am trying to configure IPv6 prefix delegation. The 4321 is the client to the ISP who provides IPv6 via prefix delegation. In IOS I would configure this by entering the interface subconfig and then running "ipv6 dhcp client pd <NAME>". This option is unavailable. There is no client option available at all..... : Cisco4321(config-if)#ipv6 dhcp ?
framed Framed-IPv6-Prefix allocation
relay Act as an IPv6 DHCP relay agent
server Act as an IPv6 DHCP server
Cisco4321(config-if)# What's going on? Does the device support client prefix delegation? Have the commands changed in IOS-XE?
... View more
Labels:
Created by
train_wreck
in Small Business Switches
in Small Business Switches
03-25-2019
03:01 PM
03-25-2019
03:01 PM
I am trying to generate a CSR using the web interface on the SG300-10PP, but I am unable to copy the certificate request from the dialog box. The area where the data is has been greyed out. What's going on?
... View more
Labels:
Created by
train_wreck
in Small Business Routers
in Small Business Routers
03-16-2019
04:49 PM
03-16-2019
04:49 PM
Bump
... View more
08-27-2019
I have a RV340W with the latest firmware 1.0.03.16. It is configured for
DHCP IPv6 prefix delegation...
Created by
train_wreck
in Small Business Routers
07-08-2019
07-08-2019
@chamel123 wrote:I'm not as familiar with certificate and openssl as I'd
like. Since my certificate ...
Created by
train_wreck
in Small Business Routers
07-08-2019
07-08-2019
Jo - where is the option you are talking about with regards to "Firewall
=ON" ? If you mean the chec...
Created by
train_wreck
in Small Business Routers
07-08-2019
07-08-2019
Yes, the values should remain after a firmware upgrade. And you're right
that %any works in the fiel...
Created by
train_wreck
in Small Business Routers
06-13-2019
06-13-2019
I've seen this exact kind of issue on a ZyXel device, because the config
page was trying to redirect...
Created by
train_wreck
in Routing
05-25-2019
05-25-2019
I have narrowed this down to a problem with the RV340 router. I have
since added 2 more additional c...
Created by
train_wreck
in Routing
05-24-2019
05-24-2019
Also, I tried adding a second ikev2 profile, with a second certmap and a
second ipsec profile linked...
Created by
train_wreck
in Routing
05-24-2019
05-24-2019
@Giuseppe Larosa wrote:From the log messages of your first post we
see:that there are NAT issues.Is ...
Created by
train_wreck
in Routing
05-23-2019
05-23-2019
@Georg Pauwen wrote:Hello, assuming that you are running router firmware
version 1.0.02.16 (which wa...
05-22-2019
I have a 4321 ver. 15.5 that has a certificate authentication IKEv2 site
to site tunnel setup to an ...
Created by
train_wreck
in IPv6
04-24-2019
04-24-2019
I can't find any specific configuration guide for this firmware release.
As far as I can tell, the c...
Created by
train_wreck
in IPv6
04-17-2019
04-17-2019
So you're saying I need to be on version 15.5.3.S7b ?
Created by
train_wreck
in IPv6
04-15-2019
04-15-2019
I am having the same problem as the post here:
https://community.cisco.com/t5/ipv6/quot-ipv6-dhcp-cl...
Created by
train_wreck
in Small Business Switches
03-25-2019
03-25-2019
I am trying to generate a CSR using the web interface on the SG300-10PP,
but I am unable to copy the...
Public Statistics
| Date Registered | 03-04-2016 11:27 PM |
| Date Last Visited | 09-18-2019 10:35 PM |
| Total Messages Posted | 95 |
| Total Helpful Votes Received | 25 |
.jpg "VIP Advisor"){kind=icon}
