ASA 5510 not recognizing/responding to incoming IKE

[dino55088]

HI we have an ASA 5510 with 8.4(7)  with many working IPsec VPNS.

We have one new peer we are trying to connect but when they initiate VPN we do n ot respond.

I can see incoming IKE with destination UDP port 500 but SOURCE PORT is a high port eq 50223.

This is the only thing I can see differently from other VPNs that are working.

We see this IKE traffic come in via capture but debug ikev1 255 or any other crypto debug outputs nothing from this peer indicating ASA is not triggering IKE negotiation (crypto map setup correctly with peer etc) .

Do both incoming UDP ports need to be 500 for initial communication to work?

[Flavio Miranda]

Hello @dino55088

Should be 500 source and destination. However, if there is as PAT in place, the source port is changed to a random port.

 Make sure you don't have PAT acting on the VPN flow.

-If I helped you somehow, please, rate it as useful.-

[dino55088]

OK the remote end does have PAT- their VPN device is sitting behind a router 

[Patrick Moubarak]

From memory UDP source and destination are both 500. But then what about NAT-Traversal...

Looked up the RFC :

https://tools.ietf.org/html/rfc3947#section-3

The detection of support for NAT-Traversal and detection of NAT along
   the path between the two IKE peers occurs in IKE [RFC2409] Phase 1.

   The NAT may change the IKE UDP source port, and recipients MUST be
   able to process IKE packets whose source port is different from 500.

Do you support nat-t on your ASA? Enabled by default as of 8.0(2)

crypto isakmp nat-traversal

Hope that helps! Patrick

[dino55088]

hi Patrick,

thanks for your responses.

Yes we turned on crypto isakmp nat-t last week. I thought that was going to fix but did not.

I saw this bug below but our match address is a public IP and matched vpn traffic acl are 192.168 addresses so not sure if it applies...

crypto map with match address command cause IKE negotiation failure

CSCsm35737

Description

Symptom:
ASA may not process received IKE packet with dynamic source port if crypto map configuration contains match address command.

Conditions:
-crypto map with match address command
-access-list for the match address command matches IKE traffic
-received IKE packet uses other than 500 as source port

Workaround:
remove match address command