Thanks very much for your response. You're right that our device is behind a NAT. Full log is as follows.    [IKEv1]IP = 8.8.8.8, IKE Initiator: New Phase 1, Intf outside, IKE Peer 8.8.8.8 local Proxy Address 10.2.0.0, remote Proxy Address 10.1.0.0, Crypto map (outside_map) [IKEv1 DEBUG]IP = 8.8.8.8, constructing ISAKMP SA payload [IKEv1 DEBUG]IP = 8.8.8.8, constructing NAT-Traversal VID ver 02 payload [IKEv1 DEBUG]IP = 8.8.8.8, constructing NAT-Traversal VID ver 03 payload [IKEv1 DEBUG]IP = 8.8.8.8, constructing NAT-Traversal VID ver RFC payload [IKEv1 DEBUG]IP = 8.8.8.8, constructing Fragmentation VID + extended capabilities payload [IKEv1]IP = 8.8.8.8, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 324 SENDING PACKET to 8.8.8.8 RECV PACKET from 8.8.8.8 ISAKMP Header Initiator COOKIE: Responder COOKIE: Next Payload: Security Association Version: 1.0 Exchange Type: Identity Protection (Main Mode) Flags: (none) MessageID: 00000000 Length: 132 Payload Security Association Next Payload: Vendor ID Reserved: 00 Payload Length: 60 DOI: IPsec Situation:(SIT_IDENTITY_ONLY) Payload Proposal Next Payload: None Reserved: 00 Payload Length: 48 Proposal #: 1 Protocol-Id: PROTO_ISAKMP SPI Size: 0 # of transforms: 1 Payload Transform Next Payload: None Reserved: 00 Payload Length: 40 Transform #: 1 Transform-Id: KEY_IKE Reserved2: 0000 Group Description: Group 2 Encryption Algorithm: AES-CBC Key Length: 256 Hash Algorithm: SHA1 Authentication Method: Preshared key Life Type: seconds Life Duration (Hex): 00 01 51 80 Payload Vendor ID Next Payload: Vendor ID Reserved: 00 Payload Length: 24 Data (In Hex): Payload Vendor ID Next Payload: None Reserved: 00 Payload Length: 20 Data (In Hex): [IKEv1]IP = 8.8.8.8, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 132 [IKEv1 DEBUG]IP = 8.8.8.8, processing SA payload [IKEv1 DEBUG]IP = 8.8.8.8, Oakley proposal is acceptable [IKEv1 DEBUG]IP = 8.8.8.8, processing VID payload [IKEv1 DEBUG]IP = 8.8.8.8, Received Fragmentation VID [IKEv1 DEBUG]IP = 8.8.8.8, IKE Peer included IKE fragmentation capability flags: Main Mode: True Aggressive Mode: False [IKEv1 DEBUG]IP = 8.8.8.8, processing VID payload [IKEv1 DEBUG]IP = 8.8.8.8, constructing ke payload [IKEv1 DEBUG]IP = 8.8.8.8, constructing nonce payload [IKEv1 DEBUG]IP = 8.8.8.8, constructing Cisco Unity VID payload [IKEv1 DEBUG]IP = 8.8.8.8, constructing xauth V6 VID payload [IKEv1 DEBUG]IP = 8.8.8.8, Send IOS VID [IKEv1 DEBUG]IP = 8.8.8.8, Constructing ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001) [IKEv1 DEBUG]IP = 8.8.8.8, constructing VID payload [IKEv1 DEBUG]IP = 8.8.8.8, Send Altiga/Cisco VPN3000/Cisco ASA GW VID [IKEv1]IP = 8.8.8.8, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 256 SENDING PACKET to 8.8.8.8 RECV PACKET from 8.8.8.8 ISAKMP Header Initiator COOKIE: Responder COOKIE: Next Payload: Key Exchange Version: 1.0 Exchange Type: Identity Protection (Main Mode) Flags: (none) MessageID: 00000000 Length: 180 Payload Key Exchange Next Payload: Nonce Reserved: 00 Payload Length: 132 Data: Payload Nonce Next Payload: None Reserved: 00 Payload Length: 20 Data: [IKEv1]IP = 8.8.8.8, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + NONE (0) total length : 180 [IKEv1 DEBUG]IP = 8.8.8.8, processing ke payload [IKEv1 DEBUG]IP = 8.8.8.8, processing ISA_KE payload [IKEv1 DEBUG]IP = 8.8.8.8, processing nonce payload [IKEv1]IP = 8.8.8.8, Connection landed on tunnel_group 8.8.8.8 [IKEv1 DEBUG]Group = 8.8.8.8, IP = 8.8.8.8, Generating keys for Initiator... [IKEv1 DEBUG]Group = 8.8.8.8, IP = 8.8.8.8, constructing ID payload [IKEv1 DEBUG]Group = 8.8.8.8, IP = 8.8.8.8, constructing hash payload [IKEv1 DEBUG]Group = 8.8.8.8, IP = 8.8.8.8, Computing hash for ISAKMP [IKEv1 DEBUG]Group = 8.8.8.8, IP = 8.8.8.8, constructing dpd vid payload [IKEv1]IP = 8.8.8.8, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + VENDOR (13) + NONE (0) total length : 84 BEFORE ENCRYPTION ISAKMP Header Initiator COOKIE: Responder COOKIE: Next Payload: Identification Version: 1.0 Exchange Type: Identity Protection (Main Mode) Flags: (none) MessageID: 00000000 Length: 469762048 Payload Identification Next Payload: Hash Reserved: 00 Payload Length: 12 ID Type: IPv4 Address (1) Protocol ID (UDP/TCP, etc...): 17 Port: 500 ID Data: 10.100.1.10 Payload Hash Next Payload: Vendor ID Reserved: 00 Payload Length: 24 Data: Payload Vendor ID Next Payload: None Reserved: 00 Payload Length: 20 Data (In Hex): SENDING PACKET to 8.8.8.8 RECV PACKET from 8.8.8.8 ISAKMP Header Initiator COOKIE: Responder COOKIE: Next Payload: Key Exchange Version: 1.0 Exchange Type: Identity Protection (Main Mode) Flags: (none) MessageID: 00000000 Length: 180 Payload Key Exchange Next Payload: Nonce Reserved: 00 Payload Length: 132 Data: Payload Nonce Next Payload: None Reserved: 00 Payload Length: 20 Data: [IKEv1]Group = 8.8.8.8, IP = 8.8.8.8, Duplicate Phase 1 packet detected. Retransmitting last packet. [IKEv1]Group = 8.8.8.8, IP = 8.8.8.8, P1 Retransmit msg dispatched to MM FSM RECV PACKET from 8.8.8.8 ISAKMP Header Initiator COOKIE: Responder COOKIE: Next Payload: Key Exchange Version: 1.0 Exchange Type: Identity Protection (Main Mode) Flags: (none) MessageID: 00000000 Length: 180 Payload Key Exchange Next Payload: Nonce Reserved: 00 Payload Length: 132 Data: Payload Nonce Next Payload: None Reserved: 00 Payload Length: 20 Data: [IKEv1]Group = 8.8.8.8, IP = 8.8.8.8, Duplicate Phase 1 packet detected. Retransmitting last packet. [IKEv1]Group = 8.8.8.8, IP = 8.8.8.8, P1 Retransmit msg dispatched to MM FSM RECV PACKET from 8.8.8.8 ISAKMP Header Initiator COOKIE: Responder COOKIE: Next Payload: Key Exchange Version: 1.0 Exchange Type: Identity Protection (Main Mode) Flags: (none) MessageID: 00000000 Length: 180 Payload Key Exchange Next Payload: Nonce Reserved: 00 Payload Length: 132 Data: Payload Nonce Next Payload: None Reserved: 00 Payload Length: 20 Data: [IKEv1]Group = 8.8.8.8, IP = 8.8.8.8, Duplicate Phase 1 packet detected. Retransmitting last packet. [IKEv1]Group = 8.8.8.8, IP = 8.8.8.8, P1 Retransmit msg dispatched to MM FSM [IKEv1 DEBUG]Group = 8.8.8.8, IP = 8.8.8.8, IKE MM Initiator FSM error history (struct &0x0000) <state>, <event>: MM_DONE, EV_ERROR-->MM_WAIT_MSG6, EV_PROB_AUTH_FAIL-->MM_WAIT_MSG6, EV_TIMEOUT-->MM_WAIT_MSG6, NullEvent-->MM_SND_MSG5, EV_SND_MSG-->MM_SND_MSG5, EV_START_TMR-->MM_SND_MSG5, EV_RESEND_MSG-->MM_WAIT_MSG6, EV_RESEND_MSG [IKEv1 DEBUG]Group = 8.8.8.8, IP = 8.8.8.8, IKE SA MM:a6trfnf21 terminating: flags 0x01000022, refcnt 0, tuncnt 0 [IKEv1 DEBUG]Group = 8.8.8.8, IP = 8.8.8.8, sending delete/delete with reason message [IKEv1 DEBUG]Group = 8.8.8.8, IP = 8.8.8.8, constructing blank hash payload [IKEv1 DEBUG]Group = 8.8.8.8, IP = 8.8.8.8, constructing IKE delete payload [IKEv1 DEBUG]Group = 8.8.8.8, IP = 8.8.8.8, constructing qm hash payload [IKEv1]IP = 8.8.8.8, IKE_DECODE SENDING Message (msgid=dc834529) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 80 BEFORE ENCRYPTION ISAKMP Header Initiator COOKIE: Responder COOKIE: Next Payload: Hash Version: 1.0 Exchange Type: Informational Flags: (none) MessageID: 35673567DC Length: 469762048 Payload Hash Next Payload: Delete Reserved: 00 Payload Length: 24 Data: Payload Delete Next Payload: None Reserved: 00 Payload Length: 28 DOI: IPsec Protocol-ID: PROTO_ISAKMP Spi Size: 16 # of SPIs: 1 SPI (Hex dump): RECV PACKET from 8.8.8.8 ISAKMP Header Initiator COOKIE: Responder COOKIE: Next Payload: Key Exchange Version: 1.0 Exchange Type: Identity Protection (Main Mode) Flags: (none) MessageID: 00000000 Length: 180 Payload Key Exchange Next Payload: Nonce Reserved: 00 Payload Length: 132 Data: Payload Nonce Next Payload: None Reserved: 00 Payload Length: 20 Data: [IKEv1]IP = 8.8.8.8, Header invalid, missing SA payload! (next payload = 4) ... View more