Hello,
I'm having trouble with a VPN tunnel. I need the ASA to negotiate DH14 but it appears to be offering only DH5. I have configured both Phase-1 and Phase-2 with DH14. Any ideas what I'm missing here?
Phase 1 – IKEv1 Properties
ISAKMP SA Authentication Method: Pre-Shared Key
ISAKMP Pre-Shared Key: XXXXX
ISAKMP SA Hash Algorithm: SHA1
ISAKMP SA Encryption Algorithm: AES-256
ISAKMP SA Diffie-Hellman Group: DH14
ISAKMP SA Lifetime: 86400 seconds
Phase 2 – IPSec Properties
IPSec SA – IPSec Protocol: ESP
IPSec SA – Mode: Tunnel
IPSec SA – Hash Algorithm: SHA-1
IPSec SA – Encryption Algorithm: AES-256
IPSec SA – Lifetime: 3600 seconds
PFS : Yes
DH: DH14
Mode: Main Mode
%ASA-7-713906: IKE Receiver: Packet received on 11.11.11.11:500 from 10.10.10.10:500
%ASA-7-713236: IP = 10.10.10.10, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 324
%ASA-7-715047: IP = 10.10.10.10, processing SA payload
%ASA-5-713257: Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Group 14 Cfg'd: Group 5
%ASA-5-713257: Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Group 14 Cfg'd: Group 5
%ASA-5-713257: Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Group 14 Cfg'd: Group 5
%ASA-5-713257: Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Group 14 Cfg'd: Group 5
%ASA-7-713236: IP = 10.10.10.10, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + NOTIFY (11) + NONE (0) total length : 108
%ASA-7-713906: IP = 10.10.10.10, All SA proposals found unacceptable
%ASA-3-713048: IP = 10.10.10.10, Error processing payload: Payload ID: 1
%ASA-7-715065: IP = 10.10.10.10, IKE MM Responder FSM error history (struct &0x00007f2a88c1fb00) <state>, <event>: MM_DONE, EV_ERROR-->MM_START, EV_RCV_MSG-->MM_START, EV_START_MM-->MM_START, EV_START_MM-->MM_START, EV_START_MM-->MM_START, EV_START_MM-->MM_START, EV_START_MM-->MM_START, EV_START_MM
%ASA-7-713906: IP = 10.10.10.10, IKE SA MM:e13a60eb terminating: flags 0x01000002, refcnt 0, tuncnt 0
%ASA-7-713906: IP = 10.10.10.10, sending delete/delete with reason message
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto map outside_map 50 match address outside_cryptomap_50
crypto map outside_map 50 set pfs group14
crypto map outside_map 50 set peer 10.10.10.10
crypto map outside_map 50 set ikev1 transform-set ESP-AES-256-SHA
crypto map outside_map 50 set security-association lifetime seconds 3600
crypto map outside_map 50 set security-association lifetime kilobytes unlimited
crypto ikev1 policy 10
authentication pre-share
encryption aes
hash sha
group 14
lifetime 86400
