I'm encountering an issue with an IKEv2 setup where the authentication exchange fails and I receive the error message: "Response is outside of window received 0x1, expect 0x2 <= mess_id < 0x2 : Received an IKE msg id outside supported window".
I am trying to establish an IPSEC VPN tunnel between AWS and a Cisco C1111-8PLTEEA running Cisco IOS XE Software, Version 17.03.04a.
**Please note, I can establish a VPN between this router and AWS when using the standard shared secret authentication method. I only have these problems when using certificate authentication. AWS Support states the authentication is working (noted below).**
I have been reading about IKEv2 and trying out different things in the Cisco configuration related to IKEv2 and IPSEC fragmentation, but I have had no luck.
Any assistance is greatly appreciated!
**Cisco Debug Output**
```
Jun 12 09:49:24.788: IKEv2-ERROR:(SESSION ID = 1,SA ID = 5):Response is outside of window received 0x1, expect 0x2 <= mess_id < 0x2
: Received an IKE msg id outside supported window
Jun 12 09:49:24.788: IKEv2:(SESSION ID = 0,SA ID = 0):Received Packet [From 18.218.X.X:4500/To 24.106.X.X:4500/VRF i0:f0]
Initiator SPI : A47449A2BD1AE71A - Responder SPI : 5A1E2DF2291B6E9D Message id: 1
IKEv2 IKE_AUTH Exchange RESPON
C12345R1#SE
Jun 12 09:49:24.788: IKEv2-PAK:(SESSION ID = 0,SA ID = 0):Next payload: ENCR, version: 2.0 Exchange type: IKE_AUTH, flags: RESPONDER MSG-RESPONSE Message id: 1, length: 2556
Jun 12 09:49:26.559: IKEv2-INTERNAL:(SESSION ID = 1,SA ID = 5):SM Trace-> SA: I_SPI=A47449A2BD1AE71A R_SPI=5A1E2DF2291B6E9D (I) MsgID = 1 CurState: I_WAIT_AUTH Event: EV_RE_XMT
Jun 12 09:49:26.560: IKEv2:(SESSION ID = 1,SA ID = 5):Retransmitting packet
Jun 12 09:49:26.560: IKEv2:(SESSION ID = 1,SA ID = 5):Sending Packet [To 18.218.X.X:4500/From 24.106.X.X:4500/VRF i0:f0]
Initiator SPI : A47449A2BD1AE71A - Responder SPI : 5A1E2DF2291B6E9D Message id: 1
IKEv2 IKE_AUTH Exchange REQUEST
Jun 12 09:49:26.560: IKEv2-PAK:(SESSION ID = 1,SA ID = 5):Next payload: ENCR, version: 2.0 Exchange type: IKE_AUTH, flags: INITIATOR Message id: 1, length: 1820
Payload contents:
ENCR Next payload: VID, reserved: 0x0, length: 1792
Jun 12 09:49:26.561: IKE
C12345R1#v2-INTERNAL:(SESSION ID = 1,SA ID = 5):SM Trace-> SA: I_SPI=A47449A2BD1AE71A R_SPI=5A1E2DF2291B6E9D (I) MsgID = 1 CurState: I_WAIT_AUTH Event: EV_NO_EVENT
Jun 12 09:49:26.649: IKEv2-ERROR:(SESSION ID = 1,SA ID = 5):Response is outside of window received 0x1, expect 0x2 <= mess_id < 0x2
: Received an IKE msg id outside supported window
Jun 12 09:49:26.650: IKEv2:(SESSION ID = 0,SA ID = 0):Received Packet [From 18.218.X.X:4500/To 24.106.X.X:4500/VRF i0:f0]
Initiator SPI : A47449A2BD1AE71A - Responder SPI : 5A1E2DF2291B6E9D Message id: 1
IKEv2 IKE_AUTH Exchange RESPONSE
Jun 12 09:49:26.650: IKEv2-PAK:(SESSION ID = 0,SA ID = 0):Next payload: ENCR, version: 2.0 Exchange type: IKE_AUTH, flags: RESPONDER MSG-RESPONSE Message id: 1, length: 2556
Jun 12 09:49:29.372: IKEv2-INTERNAL:(SESSION ID = 1,SA ID = 1):SM Trace-> SA: I_SPI=08C6AFB6BCC3F41A R_SPI=714EC031D5EDCEB3 (I) MsgID = 1 CurState: I_WAIT_AUTH Event: EV_RE_XMT
Jun 12
C12345R1# 09:49:29.372: IKEv2-INTERNAL:(SESSION ID = 1,SA ID = 1):SM Trace-> SA: I_SPI=08C6AFB6BCC3F41A R_SPI=714EC031D5EDCEB3 (I) MsgID = 1 CurState: I_WAIT_AUTH Event: EV_RE_XMT_EXCEED
Jun 12 09:49:29.372: IKEv2-ERROR:(SESSION ID = 1,SA ID = 1):: Maximum number of retransmissions reached
Jun 12 09:49:29.372: IKEv2-INTERNAL:(SESSION ID = 1,SA ID = 1):SM Trace-> SA: I_SPI=08C6AFB6BCC3F41A R_SPI=714EC031D5EDCEB3 (I) MsgID = 1 CurState: AUTH_DONE Event: EV_FAIL
Jun 12 09:49:29.372: IKEv2:(SESSION ID = 1,SA ID = 1):Auth exchange failed
Jun 12 09:49:29.372: IKEv2-ERROR:(SESSION ID = 1,SA ID = 1):: Auth exchange failed
Jun 12 09:49:29.373: IKEv2-INTERNAL:(SESSION ID = 1,SA ID = 1):SM Trace-> SA: I_SPI=08C6AFB6BCC3F41A R_SPI=714EC031D5EDCEB3 (I) MsgID = 1 CurState: EXIT Event: EV_ABORT
Jun 12 09:49:29.373: IKEv2-INTERNAL:(SESSION ID = 1,SA ID = 1):SM Trace-> SA: I_SPI=08C6AFB6BCC3F41A R_SPI=714EC031D5EDCEB3 (I) MsgID = 1 CurState: EXIT Event: E
C12345R1#V_CHK_PENDING_ABORT
Jun 12 09:49:29.373: IKEv2-INTERNAL:(SESSION ID = 1,SA ID = 1):SM Trace-> SA: I_SPI=08C6AFB6BCC3F41A R_SPI=714EC031D5EDCEB3 (I) MsgID = 1 CurState: EXIT Event: EV_CHK_GKM
Jun 12 09:49:29.373: IKEv2-INTERNAL:(SESSION ID = 1,SA ID = 1):SM Trace-> SA: I_SPI=08C6AFB6BCC3F41A R_SPI=714EC031D5EDCEB3 (I) MsgID = 1 CurState: EXIT Event: EV_UPDATE_CAC_STATS
Jun 12 09:49:29.373: IKEv2:(SESSION ID = 1,SA ID = 1):Abort exchange
Jun 12 09:49:29.373: IKEv2:(SESSION ID = 1,SA ID = 1):Deleting SA
```
**AWS DEBUG (Provided by AWS Support Team)**
```
2023-06-12 21:53:22.890 24.106.X.X is initiating an IKE_SA
2023-06-12 21:53:22.892 sending cert request for <CERT REDACTED>
2023-06-12 21:53:22.892 sending cert request for <CERT REDACTED>
2023-06-12 21:53:22.892 sending packet to 24.106.X.X[500]
2023-06-12 21:53:22.985 received end entity cert "CN=X.io"
2023-06-12 21:53:22.985 looking for peer configs matching 24.106.X.X[X.io]
2023-06-12 21:53:22.985 using certificate "CN=X.io"
2023-06-12 21:53:22.985 using trusted intermediate ca certificate <CERT REDACTED>
2023-06-12 21:53:22.985 checking certificate status of "CN=X.io"
2023-06-12 21:53:22.985 reached self-signed root ca with a path length of 1
2023-06-12 21:53:22.985 authentication of 'X.io' with RSA signature successful
2023-06-12 21:53:22.986 authentication of 'CN=vpn-X.endpoint-0' (myself) with RSA signature successful
2023-06-12 21:53:22.986 destroying duplicate IKE_SA for peer 'X.io', received INITIAL_CONTACT
2023-06-12 21:53:23.231 IKE_SA established between [CN=vpn-X.endpoint-0]...24.106.X.X[X.io] <== Phase-1 established
2023-06-12 21:53:23.232 sending end entity cert "CN=vpn-X.endpoint-0"
2023-06-12 21:53:23.232 sending issuer cert <CERT REDACTED>
2023-06-12 21:53:23.232 selected proposal: ESP:AES_CBC_128/HMAC_SHA1_96/NO_EXT_SEQ
2023-06-12 21:53:23.233 CHILD_SA established with SPIs cacf4f07_i a8b7c369_o and TS 0.0.0.0/0 === 0.0.0.0/0 <== Phase-2 established
2023-06-12 21:53:23.495 received retransmit of request with ID 1 <=== IKE_AUTH request 1
2023-06-12 21:53:23.495 sending packet to 24.106.X.X[4500] <=== resent the IKE_AUTH
2023-06-12 21:53:25.375 received retransmit of request with ID 1
2023-06-12 21:53:25.375 sending packet to 24.106.X.X[4500]
2023-06-12 21:53:29.248 received retransmit of request with ID 1
2023-06-12 21:53:29.248 sending packet to 24.106.X.X[4500]
2023-06-12 21:53:36.681 received retransmit of request with ID 1
2023-06-12 21:53:36.681 sending packet to 24.106.X.X[4500]
2023-06-12 21:53:42.892 sending keep alive to 24.106.X.X[4500]
2023-06-12 21:53:47.232 sending DPD request
2023-06-12 21:53:47.232 generating INFORMATIONAL request 0 [ ]
2023-06-12 21:53:47.232 sending packet to 24.106.X.X[4500]
2023-06-12 21:53:51.334 received retransmit of request with ID 1
2023-06-12 21:53:51.334 sending packet to 24.106.X.X[4500]
2023-06-12 21:53:52.889 received Cisco Delete Reason vendor ID <=== CGW bring down the Tunnel
2023-06-12 21:53:52.889 received unknown vendor ID: 43:49:53:43:4f:56:50:4e:2d:52:45:56:2d:30:32
2023-06-12 21:53:52.889 received unknown vendor ID: 43:49:53:43:4f:2d:44:59:4e:41:4d:49:43:2d:52:4f:55:54:45
2023-06-12 21:53:52.889 received Cisco FlexVPN Supported vendor ID
```
**AWS Notes**
I can see that authentication was successful but the CGW keep request to resend the Phase-1 Authentication, after awhile, the CGW torn
Can you please check why the CGW request to retransmiss the Phase-1 authentication? I also believe the cert setup is correct as we do not see issue with Authentication Failed.
**Cisco Configuration (Relevant Sections)**
```
crypto pki trustpoint AWSVPNCert
enrollment pkcs12
usage ike
fqdn X.io
subject-name CN=X.io
subject-alt-name X.io
revocation-check none
rsakeypair AWSVPNCert
!
crypto pki trustpoint AWSVPNCert-rrr1
revocation-check none
!
!
!
crypto pki certificate map AWSVPNCert 10
subject-name co vpn-X.endpoint-0
!
crypto pki certificate chain AWSVPNCert
certificate 00BB42667CDD1117BED5D136A8221FAE2A
308203C3
...
certificate ca 543539C4284EBA5D13C1FEC18665700A
3082041A
...
crypto pki certificate chain AWSVPNCert-rrr1
certificate ca 3FD703D2A83CF19C25B2CED41D9425A4
308203F4
...
crypto ikev2 proposal PROPOSAL1
encryption aes-cbc-128
integrity sha1
group 2
!
crypto ikev2 policy POLICY1
match fvrf any
proposal PROPOSAL1
!
!
crypto ikev2 profile IKEV2-PROFILE
match certificate AWSVPNCert
identity local fqdn X.io
authentication remote rsa-sig
authentication local rsa-sig
pki trustpoint AWSVPNCert
lifetime 28800
dpd 10 10 periodic
!
crypto ipsec security-association replay window-size 128
!
crypto ipsec transform-set awsvpntransform esp-aes esp-sha-hmac
mode tunnel
crypto ipsec df-bit clear
!
!
crypto ipsec profile ipsec-vpn-X-0
set transform-set awsvpntransform
set pfs group2
set ikev2-profile IKEV2-PROFILE
!
interface Tunnel1
ip address 169.254.221.170 255.255.255.252
ip tcp adjust-mss 1379
tunnel source GigabitEthernet0/0/0
tunnel mode ipsec ipv4
tunnel destination 18.218.X.X
tunnel protection ipsec profile ipsec-vpn-X-0
ip virtual-reassembly
!
interface GigabitEthernet0/0/0
ip address 24.106.X.X 255.255.X.X
negotiation auto
!
```
