Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About broadleon
Stats
Member since
03-20-2014
38
Posts
0
Helpful
1
Solution
Created by
broadleon
in VPN and AnyConnect
in VPN and AnyConnect
12-28-2018
05:15 AM
12-28-2018
05:15 AM
Hi
Im looking to build a Windows Server Certification Authority that is in accordance with RFC 5759 (NSA Suite B cryptography).
I will be using IKEV2 and looking at using cetificates that are:
CSP: ECDSA_P384#Microsoft Software Key Storage Provider Key Length: 384 Hash Algorithm: SHA-384
RFC 5759 requirements:
The RFC states that the following extensions must be present: subjectKeyIdentifier (SKI), keyUsage, and basicConstraints. Furthermore it states that the keyUsage extension must be marked as critical, and that the keyCertSign and CRLSign bits must be set. All other bits (except for digital signature and non-repudiation, which may be set) must not be set.
Will these certificates work for Ikev2 in a mixed platform of IOS Routers (2951 sec +) and ASA's (5506 Sec +) ?
... View more
Labels:
11-18-2018
11:37 PM
Hi
Now it's possible to setup VTI's on a ASA when using IkeV2, can you setup the asa like a iOS router and set a zone based firewall with ACL's?
I would preferably like to use zones, but when I try and keep it simple and just add a ACL to a vti in the asdm, it appears on the outside interface when clicking apply. And the vti group disappears in the ACL manager.
... View more
Labels:
Created by
broadleon
in VPN and AnyConnect
in VPN and AnyConnect
11-14-2018
06:40 AM
11-14-2018
06:40 AM
Can you give me a configuration example ?
... View more
Created by
broadleon
in VPN and AnyConnect
in VPN and AnyConnect
11-14-2018
06:16 AM
11-14-2018
06:16 AM
But would not matching on a local address for both policies cause the same conflict when the local interface address is the same ?
... View more
Created by
broadleon
in VPN and AnyConnect
in VPN and AnyConnect
11-14-2018
03:03 AM
11-14-2018
03:03 AM
I have found, removing:
match fvrf any
from Policy 127 will cause a match, however I feel there will be config issues with policy 236.
... View more
Created by
broadleon
in VPN and AnyConnect
in VPN and AnyConnect
11-13-2018
10:36 AM
11-13-2018
10:36 AM
crypto ikev2 proposal 236
encryption aes-cbc-256
integrity sha512
group 24
!
crypto ikev2 proposal 127
encryption aes-gcm-256
prf sha512
group 24
!
crypto ikev2 policy 236
match fvrf any
proposal 236
!
crypto ikev2 policy 127
match fvrf any
proposal 127
!
crypto ikev2 keyring 236
peer 236
address 195.xxx.xxx.xxx
pre-shared-key <----Key----->
!
crypto ikev2 keyring 127
peer 127
address 94.xxx.xxx.xxx
pre-shared-key local <----Key----->
pre-shared-key remote <----Key----->
!
crypto ikev2 profile 236
match identity remote fqdn xxxxxxxxxxxxx
identity local fqdn xxxxxxxxxxxxx
authentication local pre-share
authentication remote pre-share
keyring local 236
dpd 1000 2 periodic
!
crypto ikev2 profile 127
match identity remote address 94.xxx.xxx.xxx 255.255.255.248
identity local address 192.168.1.2
authentication local pre-share
authentication remote pre-share
keyring local 127
dpd 1000 2 periodic
!
crypto ipsec transform-set 236 esp-aes esp-sha512-hmac
mode tunnel
crypto ipsec transform-set 127 esp-gcm 256
mode tunnel
!
crypto ipsec profile 236
set transform-set 236
set ikev2-profile 236
!
crypto ipsec profile 127
set transform-set 127
set ikev2-profile 127
!
interface Tunnel127
ip address 172.16.4.1 255.255.255.252
ip mtu 1400
ip tcp adjust-mss 1360
tunnel source GigabitEthernet0/1
tunnel mode ipsec ipv4
tunnel destination 94.xxx.xxx.xxx
tunnel protection ipsec profile 127
!
interface Tunnel236
ip address 172.16.3.1 255.255.255.252
ip mtu 1400
zone-member security 236
ip tcp adjust-mss 1360
ip ospf 1 area 0
tunnel source GigabitEthernet0/1
tunnel mode ipsec ipv4
tunnel destination 195.xxx.xxx.xxx
tunnel protection ipsec profile 236
!
... View more
Created by
broadleon
in VPN and AnyConnect
in VPN and AnyConnect
11-13-2018
05:43 AM
11-13-2018
05:43 AM
Hi
I'm trying to add another Site to site vpn in a ikev2 configuration. However the debug on the router shows that the second connection coming in is matching against the first proposal.
GMT: IKEv2-ERROR:(SESSION ID = 588,SA ID = 1):Received Policies: : Failed to find a matching policyProposal 1: AES-GCM-256 SHA512 DH_GROUP_
--More-- 2048_256_MODP/Group 24
091495: *Nov 13 13:06:59.969 GMT:
091496: *Nov 13 13:06:59.969 GMT: Proposal 2: AES-CBC-128 SHA1 SHA512 DH_GROUP_2048_256_MODP/Group 24
091497: *Nov 13 13:06:59.973 GMT:
091498: *Nov 13 13:06:59.973 GMT:
091499: *Nov 13 13:06:59.973 GMT: IKEv2-ERROR:(SESSION ID = 588,SA ID = 1):Expected Policies: : Failed to find a matching policyProposal 1: AES-CBC-256 SHA512 SHA512 DH_GROUP_2048_256_MODP/Group 24
I think the issue is:
:Searching Policy with fvrf 0, local address 192.168.1.2
091697: *Nov 13 13:09:35.260 GMT: IKEv2:Found Policy '236'
This is the wrong policy, it should be '127' but the fvrf is 0, and the local address will always be 192.168.1.2, this is because the ASA address attached to the router is where the incoming connection for the vpn is PASSING THROUGH, not coming from.
i think its to do with the match fvrf any, but im no expert on this matter
crypto ikev2 policy 236
match fvrf any
proposal 236
crypto ikev2 policy 127
match fvrf any
proposal 127
edit: Just clarify im behind a firewall (NAT-T)
... View more
Labels:
09-17-2018
10:29 AM
Hi
I was missing "ip tcp adjust-mss 1360" on the tunnel interface, this has now resolved my issue..
Many Thanks
... View more
09-17-2018
09:26 AM
Hi
Im having issues with microsoft server replication across site to site vpn using a pair of cisco 2951 routers, I have one server either end of the tunnel and whilst they can ping each other just fine, when it come to RPC Replication i can see the length of the packet is 1514
24482 2244.579587 10.150.240.101 10.150.236.2 TCP 1514 [TCP Retransmission] 49670 → 64485 [ACK] Seq=352 Ack=2861 Win=261888 Len=1460
I also believe it is an issue with MTU, when trying a ping from the windows server using a mtu of 1500.
C:\Users\Administrator>ping 10.150.236.2 -f -l 1500
Pinging 10.150.236.2 with 1500 bytes of data: Packet needs to be fragmented but DF set. Packet needs to be fragmented but DF set. Packet needs to be fragmented but DF set. Packet needs to be fragmented but DF set.
but a MTU of
C:\Users\Administrator>ping 10.150.236.2 -f -l 1376
Pinging 10.150.236.2 with 1376 bytes of data: Reply from 10.150.236.2: bytes=1376 time=16ms TTL=126 Reply from 10.150.236.2: bytes=1376 time=16ms TTL=126 Reply from 10.150.236.2: bytes=1376 time=16ms TTL=126
I have also seen the occasional this message from the Cisco Router:
Sep 17 16:31:46.608 GMT: ICMP: dst (10.150.240.101) frag. needed and DF set unreachable sent to 10.150.236.2
As a novice Im not sure how to address the issue, I want the tunnel to handle the MTU
I also have ZBF in use but don't see the issue of replication failing between interfaces on the same router, so ruling out dcerpc.
... View more
Labels:
09-16-2018
05:02 AM
Hi
I would like to know how to pass traffic (No Inspect) between zones matching an acl.
If one zone security is Corporate_Lan and the other is Retail_LAN.
The reason is because servers passing traffic need to use the DCERPC , and whilst i can set the inspect up to pass the traffic accordingly depending on dynamic ports, I trust the servers to communicate to each other and the fact the pass action uses less resources..
... View more
Labels:
Created by
broadleon
in VPN and AnyConnect
in VPN and AnyConnect
08-28-2018
03:13 AM
08-28-2018
03:13 AM
Hi
Found adding to the policy match fvrf any on both side works:
038032: *Aug 28 09:47:39.815 GMT: IKEv2:Searching Policy with fvrf 0, local address 192.168.1.2 038033: *Aug 28 09:47:39.815 GMT: IKEv2:Found Policy 'SITE1'
But my policy's still don't match, i feel this enough to drive anyone up the wall!.
... View more
Created by
broadleon
in VPN and AnyConnect
in VPN and AnyConnect
08-28-2018
02:30 AM
08-28-2018
02:30 AM
adding the self to internet and vice versa, has not worked. I still get the same error just slightly different:
033842: *Aug 28 08:57:09.852 GMT: IPSEC(key_engine): failed to process KMI message 42
033843: *Aug 28 08:57:09.852 GMT: IKEv2-ERROR:(SESSION ID = 214,SA ID = 1):Received Policies: : Failed to find a matching policyESP: Proposal 1: AES-CBC-128 SHA512 Don't use ESN
033844: *Aug 28 08:57:09.852 GMT:
033845: *Aug 28 08:57:09.852 GMT:
033846: *Aug 28 08:57:09.856 GMT: IKEv2-ERROR:(SESSION ID = 214,SA ID = 1):Expected Policies: : Failed to find a matching policy
033847: *Aug 28 08:57:09.856 GMT: IKEv2-ERROR:(SESSION ID = 214,SA ID = 1):: Failed to find a matching policy
033848: *Aug 28 08:57:09.856 GMT: IKEv2:(SESSION ID = 214,SA ID = 1):Sending no proposal chosen notify
033849: *Aug 28 08:57:09.856 GMT: IKEv2:(SESSION ID = 214,SA ID = 1):Get my authentication method
033850: *Aug 28 08:57:09.856 GMT: IKEv2:(SESSION ID = 214,SA ID = 1):My authentication method is 'PSK'
033851: *Aug 28 08:57:09.856 GMT: IKEv2:(SESSION ID = 214,SA ID = 1):Get peer's preshared key for xxxxxxxx.com
033852: *Aug 28 08:57:09.856 GMT: IKEv2:(SESSION ID = 214,SA ID = 1):Generate my authentication data
033853: *Aug 28 08:57:09.856 GMT: IKEv2:(SESSION ID = 214,SA ID = 1):Use preshared key for id xxxxxxxxxx.com, key len 36
033854: *Aug 28 08:57:09.856 GMT: IKEv2:[IKEv2 -> Crypto Engine] Generate IKEv2 authentication data
033855: *Aug 28 08:57:09.856 GMT: crypto_engine: Generate IKEv2 auth
033856: *Aug 28 08:57:09.856 GMT: IKEv2:[Crypto Engine -> IKEv2] IKEv2 authentication data generation PASSED
033857: *Aug 28 08:57:09.856 GMT: IKEv2:(SESSION ID = 214,SA ID = 1):Get my authentication method
033858: *Aug 28 08:57:09.856 GMT: IKEv2:(SESSION ID = 214,SA ID = 1):My authentication method is 'PSK'
033859: *Aug 28 08:57:09.856 GMT: IKEv2:(SESSION ID = 214,SA ID = 1):Generating IKE_AUTH message
033860: *Aug 28 08:57:09.856 GMT: IKEv2:(SESSION ID = 214,SA ID = 1):Constructing IDr payload: 'xxxxxxxx.com' of type 'FQDN'
033861: *Aug 28 08:57:09.856 GMT: IKEv2:(SESSION ID = 214,SA ID = 1):Building packet for encryption.
although the error says: Failed to find a matching policyESP , I have check both router and the policy is the same.
the other router says:
Aug 28 10:19:44.553: No peer struct to get peer description
... View more
Created by
broadleon
in VPN and AnyConnect
in VPN and AnyConnect
08-26-2018
07:19 AM
08-26-2018
07:19 AM
Yes, it did establish before I commited the self and tunnel to the ZBF but I could not ping the other tunnel, this made me realise the ZBF needed more config. I haven't seen any working config on google that shows the ZBF doing a self to the outside zone, but I guess it would make sense if the tunnel is to establish going out. Otherwise I have seen a match address being added to the policy, and the tunnel source being modified, as suggestions from other posters on this forum, but ha e not tested those theorys as yet.
... View more
Created by
broadleon
in VPN and AnyConnect
in VPN and AnyConnect
08-26-2018
05:31 AM
08-26-2018
05:31 AM
This is the recurring message:
029477: *Aug 25 15:11:42.639 GMT: IPSEC(ipsec_process_proposal): invalid local address 192.168.1.2 029478: *Aug 25 15:11:42.639 GMT: IPSEC(key_engine): failed to process KMI message 42 029479: *Aug 25 15:12:12.639 GMT: ISAKMP: (0):peer matches SITE1 profile 029480: *Aug 25 15:12:12.639 GMT: IPSEC(key_engine): got a queue event with 1 KMI message(s) 029481: *Aug 25 15:12:12.639 GMT: IPSEC(validate_proposal_request): proposal part #1 029482: *Aug 25 15:12:12.639 GMT: IPSEC(validate_proposal_request): proposal part #1, (key eng. msg.) INBOUND local= 192.168.1.2:0, remote= 200.224.72.86,
local_proxy= 0.0.0.0/0.0.0.0/256/0, remote_proxy= 0.0.0.0/0.0.0.0/256/0, protocol= ESP, transform= esp-aes esp-sha512-hmac (Tunnel), lifedur= 0s and 0kb, spi= 0x0(0), conn_id= 0, keysize= 128, flags= 0x0
Incidentally i only started getting this message once the ZBF was added to the Tunnel & SELF
... View more
12-28-2018
Hi Im looking to build a Windows Server Certification Authority that is
in accordance with RFC 5759 ...
11-18-2018
Hi Now it's possible to setup VTI's on a ASA when using IkeV2, can you
setup the asa like a iOS rout...
Created by
broadleon
in VPN and AnyConnect
11-14-2018
11-14-2018
Can you give me a configuration example ?
Created by
broadleon
in VPN and AnyConnect
11-14-2018
11-14-2018
But would not matching on a local address for both policies cause the
same conflict when the local i...
Created by
broadleon
in VPN and AnyConnect
11-14-2018
11-14-2018
I have found, removing: match fvrf any from Policy 127 will cause a
match, however I feel there will...
Created by
broadleon
in VPN and AnyConnect
11-13-2018
11-13-2018
crypto ikev2 proposal 236 encryption aes-cbc-256 integrity sha512 group
24 ! crypto ikev2 proposal 1...
Created by
broadleon
in VPN and AnyConnect
11-13-2018
11-13-2018
Hi I'm trying to add another Site to site vpn in a ikev2 configuration.
However the debug on the rou...
09-17-2018
Hi I was missing "ip tcp adjust-mss 1360" on the tunnel interface, this
has now resolved my issue.. ...
09-17-2018
Hi Im having issues with microsoft server replication across site to
site vpn using a pair of cisco ...
09-16-2018
Hi I would like to know how to pass traffic (No Inspect) between zones
matching an acl. If one zone ...
08-28-2018
Hi Found adding to the policy match fvrf any on both side works: 038032:
*Aug 28 09:47:39.815 GMT: I...
08-28-2018
adding the self to internet and vice versa, has not worked. I still get
the same error just slightly...
08-26-2018
Yes, it did establish before I commited the self and tunnel to the ZBF
but I could not ping the othe...
Public Statistics
| Date Registered | 03-20-2014 03:30 PM |
| Date Last Visited | 05-15-2019 12:03 AM |
| Total Messages Posted | 38 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 5 | |
| 10 | |
| 5 |
.jpg "Hall of Fame Guru"){kind=icon}
