Re: Cisco VPN stuck in IKE_SA_INIT

omera · ‎04-10-2023

Hey,

We have a tunnel set up between Cisco 1kv 16.12.01a and Cisco ASA 5585 Version 9.12(4)24, P1 is stuck on IKE_SA_INIT with nothing showing on #show crypto ikev2 sa remote. P1 and P2 parameters match between the two devices.

debug:

cisco2#
Apr 10 18:40:25.664: IKEv2-PAK:(SESSION ID = 0,SA ID = 0):Next payload: ENCR, version: 2.0 Exchange type: INFORMATIONAL, flags: RESPONDER Message id: 0, length: 80
cisco2#
Apr 10 18:40:27.663: IKEv2-PAK:(SESSION ID = 0,SA ID = 0):Next payload: ENCR, version: 2.0 Exchange type: INFORMATIONAL, flags: RESPONDER Message id: 0, length: 80
cisco2#
Apr 10 18:40:29.663: IKEv2-PAK:(SESSION ID = 0,SA ID = 0):Next payload: ENCR, version: 2.0 Exchange type: INFORMATIONAL, flags: RESPONDER Message id: 0, length: 80
cisco2#
Apr 10 18:40:41.132: IKEv2-INTERNAL:(SESSION ID = 68522745,SA ID = 28):SM Trace-> SA: I_SPI=E0092E092648C361 R_SPI=0000000000000000 (I) MsgID = 0 CurState: IDLE Event: EV_INIT_SA
Apr 10 18:40:41.132: IKEv2-INTERNAL:(SESSION ID = 68522745,SA ID = 28):SM Trace-> SA: I_SPI=E0092E092648C361 R_SPI=0000000000000000 (I) MsgID = 0 CurState: I_BLD_INIT Event: EV_GET_IKE_POLICY
Apr 10 18:40:41.132: IKEv2-INTERNAL:(SESSION ID = 68522745,SA ID = 28):
Apr 10 18:40:41.379: IKEv2-PAK:(SESSION ID = 68522745,SA ID = 28):Next payload: SA, version: 2.0 Exchange type: IKE_SA_INIT, flags: RESPONDER MSG-RESPONSE Message id: 0, length: 531 
Payload contents: 
SA
cisco2# Next payload: KE, reserved: 0x0, length: 48
last proposal: 0x0, reserved: 0x0, length: 44
Proposal: 1, Protocol id: IKE, SPI size: 0, #trans: 4 last transform: 0x3, reserved: 0x0: length: 12
type: 1, reserved: 0x0, id: AES-CBC
last transform: 0x3, reserved: 0x0: length: 8
type: 2, reserved: 0x0, id: SHA256
Apr 10 18:40:55.665: IKEv2-PAK:(SESSION ID = 0,SA ID = 0):Next payload: ENCR, version: 2.0 Exchange type: INFORMATIONAL, flags: RESPONDER Message id: 0, length: 80
cisco2#
Apr 10 18:40:57.664: IKEv2-PAK:(SESSION ID = 0,SA ID = 0):Next payload: ENCR, version: 2.0 Exchange type: INFORMATIONAL, flags: RESPONDER Message id: 0, length: 80
Apr 10 18:41:11.131: IKEv2-INTERNAL:(SESSION ID = 68522745,SA ID = 20):SM Trace-> SA: I_SPI=20B1C792011D4F99 R_SPI=0000000000000000 (I) MsgID = 0 CurState: IDLE Event: EV_INIT_SA
Apr 10 18:41:11.131: IKEv2-INTERNAL:(SESSION ID = 68522745,SA ID = 20):SM Trace-> SA: I_SPI=20B1C792011D4F99 R_SPI=0000000000000000 (I) MsgID = 0 CurState: I_BLD_INIT Event: EV_GET_IKE_POLICY
Apr 10 18:41:11.131: IKEv2-INTERNAL:(SESSION ID = 68522745,SA ID = 20):
Apr 10 18:41:11.380: IKEv2-PAK:(SESSION ID = 68522745,SA ID = 20):Next payload: SA, version: 2.0 Exchange type: IKE_SA_INIT, flags: RESPONDER MSG-RESPONSE Message id: 0, length: 531 
Payload contents: 
SA
cisco2# Next payload: KE, reserved: 0x0, length: 48
last proposal: 0x0, reserved: 0x0, length: 44
Proposal: 1, Protocol id: IKE, SPI size: 0, #trans: 4 last transform: 0x3, reserved: 0x0: length: 12
type: 1, reserved: 0x0, id: AES-CBC
last transform: 0x3, reserved: 0x0: length: 8
type: 2, reserved: 0x0, id: SHA256

MHM Cisco World · ‎04-10-2023

Make sure you config correct

Prf in phase1

Pfs in phase2

omera · ‎04-10-2023

Hey @MHM Cisco World ,

I am only managing the router, and the prf is an asa parameter, for the ASA it's under another company. As I understand Prf generates a pseudo-random number that is used in the rekeying mechanism, but we're not even moving past the INIT state. I can only know that we're negotiating with that peer through debug nothing shows in any show command.

pfs in phase 2: my main focus is to bring phase 1 at the moment.

MHM Cisco World · ‎04-13-2023

Friend prf is in phase1 not in phase2.

Can you share

Debug crypto ikev2 packet

Salman Mahajan · ‎04-13-2023

Hi @omera

Can you share both sides configuration and possible for you to run below debugs on router ( if that is only what you are managing ) .

debug crypto ikev2 error

debug crypto ikev2 internal

debug crypto ikev2 packet

omera · ‎04-24-2023

Hey @Salman Mahajan, this is the output from the debug command:


Apr 24 08:25:48.937: IKEv2-INTERNAL:(SESSION ID = 68522745,SA ID = 25):SM Trace-> SA: I_SPI=DC9BDBCA3698239F R_SPI=0000000000000000 (I) MsgID = 0 CurState: IDLE Event: EV_INIT_SA
Apr 24 08:25:48.937: IKEv2-INTERNAL:(SESSION ID = 68522745,SA ID = 25):SM Trace-> SA: I_SPI=DC9BDBCA3698239F R_SPI=0000000000000000 (I) MsgID = 0 CurState: I_BLD_INIT Event: EV_GET_IKE_POLICY
Apr 24 08:25:48.937: IKEv2-INTERNAL:(SESSION ID = 68522745,SA ID = 25):SM Trace-> SA: I_SPI=DC9BDBCA3698239F R_SPI=0000000000000000 (I) MsgID = 0 CurState: I_BLD_INIT Event: EV_SET_POLICY
Apr 24 08:25:49.471: IKEv2-PAK:(SESSION ID = 68522745,SA ID = 25):Next payload: ENCR, version: 2.0 
cisco2#Exchange type: IKE_AUTH, flags: RESPONDER MSG-RESPONSE Message id: 1, length: 256 
Payload contents: 
VID Next payload: IDr, reserved: 0x0, length: 20
IDr Next payload: AUTH, reserved: 0x0, length: 12
Id type: IPv4 address, Reserved: 0x0 0x0

I have also noticed that the show crypto ikev2 sa remote, shows an output for a mere second then it disappears:

Tunnel-id Local Remote fvrf/ivrf Status 
16 1.1.1.1/500 2.2.2.2/500 none/none IN-NEG 
Encr: Unknown - 0, PRF: Unknown - 0, Hash: None, DH Grp:0, Auth sign: Unknown - 0, Auth verify: Unknown - 0
Life/Active Time: 28800/0 sec

Salman Mahajan · ‎04-24-2023

Hi @omera , debug outputs shared are not complete . Can you share the complete debug outputs ?

omera · ‎04-24-2023

Hey @Salman Mahajan the output keeps looping through the same 9 lines that I have shared. nothing more nothing less.

Salman Mahajan · ‎04-24-2023

@omera these debugs are not concrete . First 3 lines are part of IKE_INIT phase and last 3 indicate IKE_AUTH response . They aren't going to help .

I suggest you share both side configuration and also run the debugs as advised to identify root cause

1. Log putty session 2. If you are logged in as SSH

# terminal monitor -> to display debugging messages

3. Enable Ikev2 and Ipsec debugs

debug crypto ikev2 error

debug crypto ikev2 internal

debug crypto ikev2 packet

debug crypto ipsec

debug crypto ipsec error

4. shut and no shut to trigger the tunnel - If you are using VTI Based tunnel

# int tunnel1

# sh

#no sh

or

Trigger tunnel negotiation by sending traffic from Source to Destination that are part of proxy identity .

omera · ‎04-24-2023

Ok, I will try to asap.