Solved: Morning Ken (although it's - Page 2

Ken Mackay · ‎02-27-2015

I can't seem to get by the error's. Phase 1 completes, then the errors start, 7.0.0.2 recieved non-routine notify message no proposal choosen, connection terminated for peer 7.0.0.2 reason peer terminate remote proxy N/A local Proxy N/A, 7.0.0.2 removing peer from correlator table failed, no match, seesion being torn down reason user requested, group 7.0.0.2 automatic NAT detection status remote end is not behind NAT device, this end is not behind NAT device. The other end the ASA5512 I get IP 7.1.0.2 no valid authentication type found for the tunnel group, Remote end is not behind NAT device, the DAP records were selected for connection DfltAccessPolicy, Phase 1 completed, All IPSEC SA proposals found unacceptable, IP 7.1.0.2 QM FSM error, removing peer from correlator table failed no match, 7.1.0.2 session being torn down reason Phase 2 Mismatch, 7.1.0.2 session disconnected type IKEV1, recevied encrypted packet with no matchin SA dropping.

I have searched internet and found many results however as changes implemented I always end back at this point. Any HELP would be greatly appreciated. Lost two days in the LAB. I will post configs. This a test soon to go into production. Thanks

Ken

ASA1# sho run
: Saved
:
ASA Version 9.1(2)
!
hostname ASA1
domain-name TEST1.CA
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface GigabitEthernet0/0
nameif Outside
security-level 100
ip address 7.0.0.2 255.255.255.0
!
interface GigabitEthernet0/1
nameif AS1toR1
security-level 50
ip address 1.0.0.2 255.255.255.0
!
interface GigabitEthernet0/2
nameif AS1toR2
security-level 50
ip address 3.0.0.2 255.255.255.0
!
interface GigabitEthernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/4
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/5
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
management-only
nameif management
security-level 0
ip address 192.168.1.1 255.255.255.0
!
ftp mode passive
dns domain-lookup Outside
dns domain-lookup AS1toR1
dns domain-lookup AS1toR2
dns domain-lookup management
dns server-group DefaultDNS
name-server 201.201.201.201
domain-name TEST1.CA
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network obj-1.0.0.0
object network 2.0.0.0
subnet 2.0.0.0 255.255.255.0
object network 6.0.0.0
subnet 6.0.0.0 255.255.255.0
object network 7.1.0.0
subnet 7.1.0.0 255.255.255.0
object network 8.0.0.0
subnet 8.0.0.0 255.255.255.0
object network 9.0.0.0
subnet 9.0.0.0 255.255.255.0
object-group network DM_INLINE_NETWORK_3
network-object 1.0.0.0 255.255.255.0
network-object 3.0.0.0 255.255.255.0
network-object object 2.0.0.0
network-object object 8.0.0.0
object-group network DM_INLINE_NETWORK_4
network-object object 6.0.0.0
network-object object 9.0.0.0
object-group network DM_INLINE_NETWORK_1
network-object object 6.0.0.0
network-object object 9.0.0.0
object-group network DM_INLINE_NETWORK_2
network-object 1.0.0.0 255.255.255.0
network-object 3.0.0.0 255.255.255.0
network-object object 2.0.0.0
network-object object 8.0.0.0
object-group network DM_INLINE_NETWORK_5
network-object 1.0.0.0 255.255.255.0
network-object 3.0.0.0 255.255.255.0
network-object object 2.0.0.0
network-object object 8.0.0.0
object-group network DM_INLINE_NETWORK_6
network-object object 6.0.0.0
network-object object 9.0.0.0
access-list HEADEND extended permit ip any any
access-list hq-to-vpnend extended permit ip object-group DM_INLINE_NETWORK_3 object-group DM_INLINE_NETWORK_4
access-list vpnend-to-hq extended permit ip object-group DM_INLINE_NETWORK_1 object-group DM_INLINE_NETWORK_2
access-list Outside_cryptomap_15 extended permit ip object-group DM_INLINE_NETWORK_5 object-group DM_INLINE_NETWORK_6
access-list Outside_access_in extended permit ip any any
access-list Outside_access_in extended permit icmp any4 any4
access-list AS1toR2_access_in extended permit icmp any4 any4
access-list AS1toR2_access_in extended permit ip any any
access-list AS1toR1_access_in extended permit ip any any
access-list AS1toR1_access_in extended permit icmp any4 any4
pager lines 24
logging enable
logging asdm informational
mtu Outside 1500
mtu AS1toR1 1500
mtu AS1toR2 1500
mtu management 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
access-group Outside_access_in in interface Outside
access-group AS1toR1_access_in in interface AS1toR1
access-group AS1toR2_access_in in interface AS1toR2
!
router ospf 1
network 1.0.0.0 255.255.255.0 area 0
network 3.0.0.0 255.255.255.0 area 0
network 7.0.0.0 255.255.255.0 area 0
log-adj-changes
!
route Outside 0.0.0.0 0.0.0.0 7.0.0.1 125
route Outside 6.0.0.0 255.255.255.0 7.0.0.1 125
route Outside 9.0.0.0 255.255.255.0 7.0.0.1 125
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
eou allow none
http server enable
http 192.168.1.2 255.255.255.255 management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
sysopt connection preserve-vpn-flows
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set MAP-VPN1 esp-3des esp-md5-hmac
crypto ipsec ikev2 ipsec-proposal AES256
protocol esp encryption aes-256
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
protocol esp encryption aes-192
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
protocol esp encryption aes
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
protocol esp encryption 3des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal DES
protocol esp encryption des
protocol esp integrity sha-1 md5
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 5 match address Outside_cryptomap_15
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 5 set pfs
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 5 set ikev1 transform-set MAP-VPN1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 5 set reverse-route
crypto dynamic-map DYNMAP 10 set pfs
crypto dynamic-map DYNMAP 10 set ikev1 transform-set MAP-VPN1
crypto dynamic-map DYNMAP 10 set reverse-route
crypto map Outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map HQ2REMOTE 10 ipsec-isakmp dynamic DYNMAP
crypto map HQ2REMOTE interface Outside
crypto ca trustpool policy
crypto ikev1 enable Outside
crypto ikev1 policy 1
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 28800
telnet timeout 5
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
vpn-addr-assign local reuse-delay 30
vpn load-balancing
interface lbpublic Outside
interface lbprivate AS1toR1
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
enable Outside
no anyconnect-essentials
group-policy DfltGrpPolicy attributes
wins-server value 10.10.10.10
dns-server value 201.201.201.201
vpn-idle-timeout none
vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-clientless
split-tunnel-network-list value HEADEND
default-domain value TEST1.CA
webvpn
activex-relay disable
tunnel-group DefaultL2LGroup ipsec-attributes
ikev1 pre-shared-key *****
tunnel-group DefaultRAGroup general-attributes
secondary-authentication-server-group LOCAL
authorization-server-group LOCAL
nat-assigned-to-public-ip Outside
tunnel-group DefaultRAGroup ipsec-attributes
ikev1 pre-shared-key *****
peer-id-validate nocheck
ikev1 user-authentication none
tunnel-group DefaultWEBVPNGroup general-attributes
secondary-authentication-server-group LOCAL
tunnel-group DefaultWEBVPNGroup ipsec-attributes
ikev1 pre-shared-key *****
peer-id-validate nocheck
ikev1 user-authentication none
tunnel-group-map default-group DefaultL2LGroup
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly 24
subscribe-to-alert-group configuration periodic monthly 24
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:022709234965ad8943628e790ed5ed1f
: end
ASA1#

ASA2# sho run
: Saved
:
ASA Version 8.2(5)
!
hostname ASA2
domain-name TEST2.CA
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Ethernet0/0
switchport access vlan 14
!
interface Ethernet0/1
switchport access vlan 24
!
interface Ethernet0/2
shutdown
!
interface Ethernet0/3
shutdown
!
interface Ethernet0/4
shutdown
!
interface Ethernet0/5
shutdown
!
interface Ethernet0/6
shutdown
!
interface Ethernet0/7
switchport access vlan 4
!
interface Vlan1
no nameif
no security-level
no ip address
!
interface Vlan4
nameif management.
security-level 0
ip address 192.168.1.101 255.255.255.0
management-only
!
interface Vlan14
nameif Outside
security-level 100
ip address dhcp setroute
!
interface Vlan24
nameif Inside
security-level 50
ip address 6.0.0.2 255.255.255.0
!
ftp mode passive
dns domain-lookup management.
dns domain-lookup Outside
dns domain-lookup Inside
dns server-group DefaultDNS
domain-name TEST2.CA
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object-group network DM_INLINE_NETWORK_1
network-object 1.0.0.0 255.255.255.0
network-object 2.0.0.0 255.255.255.0
network-object 3.0.0.0 255.255.255.0
network-object 8.0.0.0 255.255.255.0
object-group network DM_INLINE_NETWORK_2
network-object 6.0.0.0 255.255.255.0
network-object 9.0.0.0 255.255.255.0
object-group network DM_INLINE_NETWORK_5
network-object 1.0.0.0 255.255.255.0
network-object 2.0.0.0 255.255.255.0
network-object 3.0.0.0 255.255.255.0
network-object 8.0.0.0 255.255.255.0
object-group network DM_INLINE_NETWORK_6
network-object 6.0.0.0 255.255.255.0
network-object 9.0.0.0 255.255.255.0
access-list vpnend-to-hq extended permit ip object-group DM_INLINE_NETWORK_1 object-group DM_INLINE_NETWORK_2
access-list REMOTEEND extended permit ip any any
access-list hq-to-vpnend extended permit ip object-group DM_INLINE_NETWORK_5 object-group DM_INLINE_NETWORK_6
access-list Outside_access_in extended permit ip any any
access-list Outside_access_in extended permit icmp any any
access-list Inside_access_in extended permit ip any any
access-list Inside_access_in extended permit icmp any any
pager lines 24
logging enable
logging asdm informational
mtu management. 1500
mtu Outside 1500
mtu Inside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
access-group Outside_access_in in interface Outside
access-group Inside_access_in in interface Inside
!
router ospf 1
network 6.0.0.0 255.255.255.0 area 0
network 7.1.0.0 255.255.255.0 area 0
log-adj-changes
!
route Outside 1.0.0.0 255.255.255.0 7.0.0.2 125
route Outside 2.0.0.0 255.255.255.0 7.0.0.2 125
route Outside 3.0.0.0 255.255.255.0 7.0.0.2 125
route Outside 8.0.0.0 255.255.255.0 7.0.0.2 125
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
network-acl REMOTEEND
eou allow none
http server enable
http 0.0.0.0 0.0.0.0 management.
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set MAP-VPN1 esp-3des esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set MAP-VPN1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set reverse-route
crypto map HQ2REMOTE 15 match address vpnend-to-hq
crypto map HQ2REMOTE 15 set pfs
crypto map HQ2REMOTE 15 set connection-type originate-only
crypto map HQ2REMOTE 15 set peer 7.0.0.2
crypto map HQ2REMOTE 15 set transform-set MAP-VPN1
crypto map HQ2REMOTE 15 set security-association lifetime seconds 28800
crypto map HQ2REMOTE 15 set security-association lifetime kilobytes 4608000
crypto map HQ2REMOTE 15 set reverse-route
crypto map HQ2REMOTE 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map HQ2REMOTE interface Outside
crypto isakmp enable Outside
crypto isakmp policy 15
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 28800
crypto isakmp ipsec-over-tcp port 10000
vpn-addr-assign local reuse-delay 5
telnet timeout 5
ssh timeout 5
console timeout 0
dhcp-client client-id interface Outside

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ssl encryption 3des-sha1
webvpn
enable Outside
group-policy DfltGrpPolicy attributes
wins-server value 10.10.10.10
dns-server value 201.201.201.201
vpn-idle-timeout none
vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
split-tunnel-network-list value REMOTEEND
default-domain value TEST2.CA
smartcard-removal-disconnect disable
tunnel-group DefaultL2LGroup ipsec-attributes
pre-shared-key *****
tunnel-group DefaultRAGroup general-attributes
authorization-server-group LOCAL
tunnel-group DefaultRAGroup ipsec-attributes
pre-shared-key *****
tunnel-group DefaultWEBVPNGroup ipsec-attributes
pre-shared-key *****
tunnel-group 7.0.0.2 type ipsec-l2l
tunnel-group 7.0.0.2 ipsec-attributes
pre-shared-key *****
peer-id-validate nocheck
tunnel-group-map default-group 7.0.0.2
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:0d04273f55e788e2a4ad4d025084d33d
: end
ASA2#

Ken Mackay · ‎03-02-2015

Jon,

The tunnel remains up however can't ping across it? Any ideas?

Thanks,

Ken

Jon Marshall · ‎03-02-2015

Ken

What are the source and destination IPs for the ping.

What does a "sh crypto ipsec sa" show ?

I still think it would be better to have the tunnel negotiate using the right group but if it is up we can work with that.

Jon

Ken Mackay · ‎03-02-2015

Jon

Trying to ping from 9.0.0.2 over to 8.0.0.1 was able this morning when we began. However since cleaned up access lists.

ASA1# sho crypto ipsec sa
interface: Outside
    Crypto map tag: DYNMAP, seq num: 10, local addr: 7.0.0.2

      local ident (addr/mask/prot/port): (7.0.0.2/255.255.255.255/0/0)
      remote ident (addr/mask/prot/port): (7.1.0.2/255.255.255.255/0/0)
      current_peer: 7.1.0.2, username: DefaultRAGroup
      dynamic allocated peer ip: 0.0.0.0

      #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
      #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #TFC rcvd: 0, #TFC sent: 0
      #Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 7.0.0.2/0, remote crypto endpt.: 7.1.0.2/0
      path mtu 1500, ipsec overhead 58(36), media mtu 1500
      PMTU time remaining (sec): 0, DF policy: copy-df
      ICMP error validation: disabled, TFC packets: disabled
      current outbound spi: 17B63300
      current inbound spi : 1CA63FF3

    inbound esp sas:
      spi: 0x1CA63FF3 (480657395)
         transform: esp-3des esp-md5-hmac no compression
         in use settings ={RA, Tunnel, IKEv1, }
         slot: 0, conn_id: 2457600, crypto-map: DYNMAP
         sa timing: remaining key lifetime (sec): 28715
         IV size: 8 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00000001
    outbound esp sas:
      spi: 0x17B63300 (397816576)
         transform: esp-3des esp-md5-hmac no compression
         in use settings ={RA, Tunnel, IKEv1, }
         slot: 0, conn_id: 2457600, crypto-map: DYNMAP
         sa timing: remaining key lifetime (sec): 28715
         IV size: 8 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00000001

ASA1#
ASA2#
ASA2#
ASA2# sho crypto ipsec sa
interface: Outside
    Crypto map tag: HQ2REMOTE, seq num: 15, local addr: 7.1.0.2

      access-list OO_temp_HQ2REMOTE15 extended permit ip host 7.1.0.2 host 7.0.0.2
      local ident (addr/mask/prot/port): (7.1.0.2/255.255.255.255/0/0)
      remote ident (addr/mask/prot/port): (7.0.0.2/255.255.255.255/0/0)
      current_peer: 7.0.0.2

      #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
      #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 7.1.0.2, remote crypto endpt.: 7.0.0.2

      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: 1CA63FF3
      current inbound spi : 17B63300

    inbound esp sas:
      spi: 0x17B63300 (397816576)
         transform: esp-3des esp-md5-hmac no compression
         in use settings ={L2L, Tunnel, }
         slot: 0, conn_id: 12288, crypto-map: HQ2REMOTE
         sa timing: remaining key lifetime (kB/sec): (4374000/28653)
         IV size: 8 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00000001
    outbound esp sas:
      spi: 0x1CA63FF3 (480657395)
         transform: esp-3des esp-md5-hmac no compression
         in use settings ={L2L, Tunnel, }
         slot: 0, conn_id: 12288, crypto-map: HQ2REMOTE
         sa timing: remaining key lifetime (kB/sec): (4374000/28653)
         IV size: 8 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00000001

ASA2#

Thanks,

Ken

Jon Marshall · ‎03-02-2015

Ken

Sorry to keep going on about this but from the output your SAs are using the DefaultRAGroup which I think could be causing problems.

I'm not saying it definitely is but it should not be using a remote access group for a L2L tunnel.

I really would advise trying to get that sorted before troubleshooting anything else.

Jon

Ken Mackay · ‎03-02-2015

Jon,

Okay changed password on both ASA's for DefaultL2LGroup to XXX the tunnel remains up. Below is the copy of the sho crypto ipsec sa's

ASA1# sho crypto ipsec sa
interface: Outside
    Crypto map tag: DYNMAP, seq num: 10, local addr: 7.0.0.2

      local ident (addr/mask/prot/port): (7.0.0.2/255.255.255.255/0/0)
      remote ident (addr/mask/prot/port): (7.1.0.2/255.255.255.255/0/0)
      current_peer: 7.1.0.2, username: DefaultRAGroup
      dynamic allocated peer ip: 0.0.0.0

      #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
      #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #TFC rcvd: 0, #TFC sent: 0
      #Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 7.0.0.2/0, remote crypto endpt.: 7.1.0.2/0
      path mtu 1500, ipsec overhead 58(36), media mtu 1500
      PMTU time remaining (sec): 0, DF policy: copy-df
      ICMP error validation: disabled, TFC packets: disabled
      current outbound spi: 17B63300
      current inbound spi : 1CA63FF3

    inbound esp sas:
      spi: 0x1CA63FF3 (480657395)
         transform: esp-3des esp-md5-hmac no compression
         in use settings ={RA, Tunnel, IKEv1, }
         slot: 0, conn_id: 2457600, crypto-map: DYNMAP
         sa timing: remaining key lifetime (sec): 26304
         IV size: 8 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00000001
    outbound esp sas:
      spi: 0x17B63300 (397816576)
         transform: esp-3des esp-md5-hmac no compression
         in use settings ={RA, Tunnel, IKEv1, }
         slot: 0, conn_id: 2457600, crypto-map: DYNMAP
         sa timing: remaining key lifetime (sec): 26304
         IV size: 8 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00000001

ASA1#
ASA2# sho crypto ipsec sa
interface: Outside
    Crypto map tag: HQ2REMOTE, seq num: 15, local addr: 7.1.0.2

      access-list OO_temp_HQ2REMOTE15 extended permit ip host 7.1.0.2 host 7.0.0.2
      local ident (addr/mask/prot/port): (7.1.0.2/255.255.255.255/0/0)
      remote ident (addr/mask/prot/port): (7.0.0.2/255.255.255.255/0/0)
      current_peer: 7.0.0.2

      #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
      #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
      #pkts compressed: 0, #pkts decompressed: 0DefaultL2LGroup
      #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 7.1.0.2, remote crypto endpt.: 7.0.0.2

      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: 1CA63FF3
      current inbound spi : 17B63300

    inbound esp sas:
      spi: 0x17B63300 (397816576)
         transform: esp-3des esp-md5-hmac no compression
         in use settings ={L2L, Tunnel, }
         slot: 0, conn_id: 12288, crypto-map: HQ2REMOTE
         sa timing: remaining key lifetime (kB/sec): (4374000/26143)
         IV size: 8 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00000001
    outbound esp sas:
      spi: 0x1CA63FF3 (480657395)
         transform: esp-3des esp-md5-hmac no compression
         in use settings ={L2L, Tunnel, }
         slot: 0, conn_id: 12288, crypto-map: HQ2REMOTE
         sa timing: remaining key lifetime (kB/sec): (4374000/26143)
         IV size: 8 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00000001

ASA2#

Thanks,

Ken

Jon Marshall · ‎03-02-2015

Ken

Before or after you changed the key did you bring the tunnels down and then let them renegotiate ?

If not can you then post same output.

Jon

Ken Mackay · ‎03-02-2015

Jon,

Sorry about that. Powered down ASA2, tunnel is back up. Here is the output.

ASA1# sho crypto ipsec sa
interface: Outside
    Crypto map tag: DYNMAP, seq num: 10, local addr: 7.0.0.2

      local ident (addr/mask/prot/port): (7.0.0.2/255.255.255.255/0/0)
      remote ident (addr/mask/prot/port): (7.1.0.2/255.255.255.255/0/0)
      current_peer: 7.1.0.2, username: DefaultRAGroup
      dynamic allocated peer ip: 0.0.0.0

      #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
      #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #TFC rcvd: 0, #TFC sent: 0
      #Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 7.0.0.2/0, remote crypto endpt.: 7.1.0.2/0
      path mtu 1500, ipsec overhead 58(36), media mtu 1500
      PMTU time remaining (sec): 0, DF policy: copy-df
      ICMP error validation: disabled, TFC packets: disabled
      current outbound spi: 2816B983
      current inbound spi : 3C1BCE7D

    inbound esp sas:
      spi: 0x3C1BCE7D (1008455293)
         transform: esp-3des esp-md5-hmac no compression
         in use settings ={RA, Tunnel, IKEv1, }
         slot: 0, conn_id: 2457600, crypto-map: DYNMAP
         sa timing: remaining key lifetime (sec): 28504
         IV size: 8 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00000001
    outbound esp sas:
      spi: 0x2816B983 (672577923)
         transform: esp-3des esp-md5-hmac no compression
         in use settings ={RA, Tunnel, IKEv1, }
         slot: 0, conn_id: 2457600, crypto-map: DYNMAP
         sa timing: remaining key lifetime (sec): 28504
         IV size: 8 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00000001

ASA1#
ASA2>
ASA2> ena
Password:
ASA2#
ASA2#
ASA2# sho crypto ipsec sa
interface: Outside
    Crypto map tag: HQ2REMOTE, seq num: 15, local addr: 7.1.0.2

      access-list OO_temp_HQ2REMOTE15 extended permit ip host 7.1.0.2 host 7.0.0.2
      local ident (addr/mask/prot/port): (7.1.0.2/255.255.255.255/0/0)
      remote ident (addr/mask/prot/port): (7.0.0.2/255.255.255.255/0/0)
      current_peer: 7.0.0.2

      #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
      #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 7.1.0.2, remote crypto endpt.: 7.0.0.2

      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: 3C1BCE7D
      current inbound spi : 2816B983

    inbound esp sas:
      spi: 0x2816B983 (672577923)
         transform: esp-3des esp-md5-hmac no compression
         in use settings ={L2L, Tunnel, }
         slot: 0, conn_id: 4096, crypto-map: HQ2REMOTE
         sa timing: remaining key lifetime (kB/sec): (4374000/28460)
         IV size: 8 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00000001
    outbound esp sas:
      spi: 0x3C1BCE7D (1008455293)
         transform: esp-3des esp-md5-hmac no compression
         in use settings ={L2L, Tunnel, }
         slot: 0, conn_id: 4096, crypto-map: HQ2REMOTE
         sa timing: remaining key lifetime (kB/sec): (4374000/28460)
         IV size: 8 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00000001

ASA2#

Thanks,

Ken

Jon Marshall · ‎03-02-2015

Ken

local ident (addr/mask/prot/port): (7.0.0.2/255.255.255.255/0/0)
remote ident (addr/mask/prot/port): (7.1.0.2/255.255.255.255/0/0)

unless v9.1 does things differently this is the problem. What you should see is an entry per acl entry in your crypto map and the local and remote idents would be the subnets you defined in your crypto map.

For some reason your ASA is using the wrong group and it is not setting up the SAs properly so I can't see how traffic would be allowed across.

I thought changing the key would make it use the other group but it doesn't seem to have.

Sorry to keep asking for outputs but can you run the "debug crypto isakmp 127" again ie. you need to bring the tunnel down then initiate it again.

If we can get it to use the correct group then even if it still doesn't work we have ruled out that as an issue.

Jon

Ken Mackay · ‎03-02-2015

Jon,

Powered down ASA1 this time. After power restored tunnel came back up. Below is the debug.

ASA1# debug crypto isakmp 127
ASA1# Mar 02 15:52:56 [IKEv1]IP = 7.1.0.2, IKE_DECODE RECEIVED Message (msgid=eee657d1) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 15:52:56 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, processing hash payload
Mar 02 15:52:56 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, processing notify payload
Mar 02 15:52:56 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, Received keep-alive of type DPD R-U-THERE (seq number 0x37279f0c)
Mar 02 15:52:56 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, Sending keep-alive of type DPD R-U-THERE-ACK (seq number 0x37279f0c)
Mar 02 15:52:56 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, constructing blank hash payload
Mar 02 15:52:56 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, constructing qm hash payload
Mar 02 15:52:56 [IKEv1]IP = 7.1.0.2, IKE_DECODE SENDING Message (msgid=f4a4f063) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 15:53:06 [IKEv1]IP = 7.1.0.2, IKE_DECODE RECEIVED Message (msgid=8345ec57) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 15:53:06 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, processing hash payload
Mar 02 15:53:06 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, processing notify payload
Mar 02 15:53:06 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, Received keep-alive of type DPD R-U-THERE (seq number 0x37279f0d)
Mar 02 15:53:06 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, Sending keep-alive of type DPD R-U-THERE-ACK (seq number 0x37279f0d)
Mar 02 15:53:06 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, constructing blank hash payload
Mar 02 15:53:06 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, constructing qm hash payload
Mar 02 15:53:06 [IKEv1]IP = 7.1.0.2, IKE_DECODE SENDING Message (msgid=7c2fad9c) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 15:53:16 [IKEv1]IP = 7.1.0.2, IKE_DECODE RECEIVED Message (msgid=ac7c9fa1) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 15:53:16 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, processing hash payload
Mar 02 15:53:16 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, processing notify payload
Mar 02 15:53:16 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, Received keep-alive of type DPD R-U-THERE (seq number 0x37279f0e)
Mar 02 15:53:16 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, Sending keep-alive of type DPD R-U-THERE-ACK (seq number 0x37279f0e)
Mar 02 15:53:16 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, constructing blank hash payload
Mar 02 15:53:16 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, constructing qm hash payload
Mar 02 15:53:16 [IKEv1]IP = 7.1.0.2, IKE_DECODE SENDING Message (msgid=fe0ba8f4) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 15:53:26 [IKEv1]IP = 7.1.0.2, IKE_DECODE RECEIVED Message (msgid=71fae23c) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 15:53:26 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, processing hash payload
Mar 02 15:53:26 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, processing notify payload
Mar 02 15:53:26 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, Received keep-alive of type DPD R-U-THERE (seq number 0x37279f0f)
Mar 02 15:53:26 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, Sending keep-alive of type DPD R-U-THERE-ACK (seq number 0x37279f0f)
Mar 02 15:53:26 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, constructing blank hash payload
Mar 02 15:53:26 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, constructing qm hash payload
Mar 02 15:53:26 [IKEv1]IP = 7.1.0.2, IKE_DECODE SENDING Message (msgid=fb31803d) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 15:53:36 [IKEv1]IP = 7.1.0.2, IKE_DECODE RECEIVED Message (msgid=55ac7cf7) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 15:53:36 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, processing hash payload
Mar 02 15:53:36 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, processing notify payload
Mar 02 15:53:36 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, Received keep-alive of type DPD R-U-THERE (seq number 0x37279f10)
Mar 02 15:53:36 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, Sending keep-alive of type DPD R-U-THERE-ACK (seq number 0x37279f10)
Mar 02 15:53:36 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, constructing blank hash payload
Mar 02 15:53:36 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, constructing qm hash payload
Mar 02 15:53:36 [IKEv1]IP = 7.1.0.2, IKE_DECODE SENDING Message (msgid=702b43e4) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 15:53:46 [IKEv1]IP = 7.1.0.2, IKE_DECODE RECEIVED Message (msgid=d49f1ea5) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 15:53:46 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, processing hash payload
Mar 02 15:53:46 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, processing notify payload
Mar 02 15:53:46 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, Received keep-alive of type DPD R-U-THERE (seq number 0x37279f11)
Mar 02 15:53:46 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, Sending keep-alive of type DPD R-U-THERE-ACK (seq number 0x37279f11)
Mar 02 15:53:46 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, constructing blank hash payload
Mar 02 15:53:46 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, constructing qm hash payload
Mar 02 15:53:46 [IKEv1]IP = 7.1.0.2, IKE_DECODE SENDING Message (msgid=1fef72ad) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 15:53:56 [IKEv1]IP = 7.1.0.2, IKE_DECODE RECEIVED Message (msgid=6dc7f0e0) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 15:53:56 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, processing hash payload
Mar 02 15:53:56 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, processing notify payload
Mar 02 15:53:56 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, Received keep-alive of type DPD R-U-THERE (seq number 0x37279f12)
Mar 02 15:53:56 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, Sending keep-alive of type DPD R-U-THERE-ACK (seq number 0x37279f12)
Mar 02 15:53:56 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, constructing blank hash payload
Mar 02 15:53:56 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, constructing qm hash payload
Mar 02 15:53:56 [IKEv1]IP = 7.1.0.2, IKE_DECODE SENDING Message (msgid=72dd7bec) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 15:54:06 [IKEv1]IP = 7.1.0.2, IKE_DECODE RECEIVED Message (msgid=2ea877ef) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 15:54:06 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, processing hash payload
Mar 02 15:54:06 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, processing notify payload
Mar 02 15:54:06 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, Received keep-alive of type DPD R-U-THERE (seq number 0x37279f13)
Mar 02 15:54:06 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, Sending keep-alive of type DPD R-U-THERE-ACK (seq number 0x37279f13)
Mar 02 15:54:06 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, constructing blank hash payload
Mar 02 15:54:06 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, constructing qm hash payload
Mar 02 15:54:06 [IKEv1]IP = 7.1.0.2, IKE_DECODE SENDING Message (msgid=27d7bd2e) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 15:54:16 [IKEv1]IP = 7.1.0.2, IKE_DECODE RECEIVED Message (msgid=aecf2e05) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 15:54:16 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, processing hash payload
Mar 02 15:54:16 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, processing notify payload
Mar 02 15:54:16 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, Received keep-alive of type DPD R-U-THERE (seq number 0x37279f14)
Mar 02 15:54:16 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, Sending keep-alive of type DPD R-U-THERE-ACK (seq number 0x37279f14)
Mar 02 15:54:16 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, constructing blank hash payload
Mar 02 15:54:16 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, constructing qm hash payload
Mar 02 15:54:16 [IKEv1]IP = 7.1.0.2, IKE_DECODE SENDING Message (msgid=80c61a24) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 15:54:26 [IKEv1]IP = 7.1.0.2, IKE_DECODE RECEIVED Message (msgid=7f089c14) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 15:54:26 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, processing hash payload
Mar 02 15:54:26 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, processing notify payload
Mar 02 15:54:26 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, Received keep-alive of type DPD R-U-THERE (seq number 0x37279f15)
Mar 02 15:54:26 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, Sending keep-alive of type DPD R-U-THERE-ACK (seq number 0x37279f15)
Mar 02 15:54:26 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, constructing blank hash payload
Mar 02 15:54:26 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, constructing qm hash payload
Mar 02 15:54:26 [IKEv1]IP = 7.1.0.2, IKE_DECODE SENDING Message (msgid=d22a857a) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 15:54:36 [IKEv1]IP = 7.1.0.2, IKE_DECODE RECEIVED Message (msgid=5b2fe0af) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 15:54:36 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, processing hash payload
Mar 02 15:54:36 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, processing notify payload
Mar 02 15:54:36 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, Received keep-alive of type DPD R-U-THERE (seq number 0x37279f16)
Mar 02 15:54:36 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, Sending keep-alive of type DPD R-U-THERE-ACK (seq number 0x37279f16)
Mar 02 15:54:36 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, constructing blank hash payload
Mar 02 15:54:36 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, constructing qm hash payload
Mar 02 15:54:36 [IKEv1]IP = 7.1.0.2, IKE_DECODE SENDING Message (msgid=947064e8) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 15:54:46 [IKEv1]IP = 7.1.0.2, IKE_DECODE RECEIVED Message (msgid=d0d3c528) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 15:54:46 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, processing hash payload
Mar 02 15:54:46 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, processing notify payload
Mar 02 15:54:46 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, Received keep-alive of type DPD R-U-THERE (seq number 0x37279f17)
Mar 02 15:54:46 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, Sending keep-alive of type DPD R-U-THERE-ACK (seq number 0x37279f17)
Mar 02 15:54:46 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, constructing blank hash payload
Mar 02 15:54:46 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, constructing qm hash payload
Mar 02 15:54:46 [IKEv1]IP = 7.1.0.2, IKE_DECODE SENDING Message (msgid=69f2b15f) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 15:54:56 [IKEv1]IP = 7.1.0.2, IKE_DECODE RECEIVED Message (msgid=e0777dd4) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 15:54:56 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, processing hash payload
Mar 02 15:54:56 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, processing notify payload
Mar 02 15:54:56 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, Received keep-alive of type DPD R-U-THERE (seq number 0x37279f18)
Mar 02 15:54:56 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, Sending keep-alive of type DPD R-U-THERE-ACK (seq number 0x37279f18)
Mar 02 15:54:56 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, constructing blank hash payload
Mar 02 15:54:56 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, constructing qm hash payload
Mar 02 15:54:56 [IKEv1]IP = 7.1.0.2, IKE_DECODE SENDING Message (msgid=f096edca) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 15:55:06 [IKEv1]IP = 7.1.0.2, IKE_DECODE RECEIVED Message (msgid=96c2a605) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 15:55:06 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, processing hash payload
Mar 02 15:55:06 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, processing notify payload
Mar 02 15:55:06 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, Received keep-alive of type DPD R-U-THERE (seq number 0x37279f19)
Mar 02 15:55:06 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, Sending keep-alive of type DPD R-U-THERE-ACK (seq number 0x37279f19)
Mar 02 15:55:06 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, constructing blank hash payload
Mar 02 15:55:06 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, constructing qm hash payload
Mar 02 15:55:06 [IKEv1]IP = 7.1.0.2, IKE_DECODE SENDING Message (msgid=608684c5) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80

ASA1# undebMar 02 15:55:16 [IKEv1]IP = 7.1.0.2, IKE_DECODE RECEIVED Message (msgid=6ec4812c) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 15:55:16 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, processing hash payload
Mar 02 15:55:16 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, processing notify payload
Mar 02 15:55:16 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, Received keep-alive of type DPD R-U-THERE (seq number 0x37279f1a)
Mar 02 15:55:16 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, Sending keep-alive of type DPD R-U-THERE-ACK (seq number 0x37279f1a)
Mar 02 15:55:16 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, constructing blank hash payload
Mar 02 15:55:16 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 7.1.0.2, constructing qm hash payload
Mar 02 15:55:16 [IKEv1]IP = 7.1.0.2, IKE_DECODE SENDING Message (msgid=d0c859c2) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
INFO: % Type "undebug ?" for a list of subcommands
ASA1#
ASA1#
ASA1# undebug all
ASA1#
ASA1#
ASA1#
ASA1#
ASA1#
ASA1#
ASA1# debug crypto isakmp 127
ASA2# Mar 02 11:34:11 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, Sending keep-alive of type DPD R-U-THERE (seq number 0x37279f20)
Mar 02 11:34:11 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, constructing blank hash payload
Mar 02 11:34:11 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, constructing qm hash payload
Mar 02 11:34:11 [IKEv1]: IP = 7.0.0.2, IKE_DECODE SENDING Message (msgid=636b6a1) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 11:34:11 [IKEv1]: IP = 7.0.0.2, IKE_DECODE RECEIVED Message (msgid=2ffda972) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 11:34:11 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, processing hash payload
Mar 02 11:34:11 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, processing notify payload
Mar 02 11:34:11 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, Received keep-alive of type DPD R-U-THERE-ACK (seq number 0x37279f20)
Mar 02 11:34:21 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, Sending keep-alive of type DPD R-U-THERE (seq number 0x37279f21)
Mar 02 11:34:21 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, constructing blank hash payload
Mar 02 11:34:21 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, constructing qm hash payload
Mar 02 11:34:21 [IKEv1]: IP = 7.0.0.2, IKE_DECODE SENDING Message (msgid=b7a0da32) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 11:34:21 [IKEv1]: IP = 7.0.0.2, IKE_DECODE RECEIVED Message (msgid=c36f7fe9) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 11:34:21 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, processing hash payload
Mar 02 11:34:21 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, processing notify payload
Mar 02 11:34:21 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, Received keep-alive of type DPD R-U-THERE-ACK (seq number 0x37279f21)

ASA2# Mar 02 11:34:31 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, Sending keep-alive of type DPD R-U-THERE (seq number 0x37279f22)
Mar 02 11:34:31 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, constructing blank hash payload
Mar 02 11:34:31 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, constructing qm hash payload
Mar 02 11:34:31 [IKEv1]: IP = 7.0.0.2, IKE_DECODE SENDING Message (msgid=a32b903f) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 11:34:31 [IKEv1]: IP = 7.0.0.2, IKE_DECODE RECEIVED Message (msgid=c70a428f) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 11:34:31 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, processing hash payload
Mar 02 11:34:31 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, processing notify payload
Mar 02 11:34:31 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, Received keep-alive of type DPD R-U-THERE-ACK (seq number 0x37279f22)
Mar 02 11:34:41 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, Sending keep-alive of type DPD R-U-THERE (seq number 0x37279f23)
Mar 02 11:34:41 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, constructing blank hash payload
Mar 02 11:34:41 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, constructing qm hash payload
Mar 02 11:34:41 [IKEv1]: IP = 7.0.0.2, IKE_DECODE SENDING Message (msgid=a01d0ec) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 11:34:41 [IKEv1]: IP = 7.0.0.2, IKE_DECODE RECEIVED Message (msgid=3635ec97) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 11:34:41 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, processing hash payload
Mar 02 11:34:41 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, processing notify payload
Mar 02 11:34:41 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, Received keep-alive of type DPD R-U-THERE-ACK (seq number 0x37279f23)
Mar 02 11:34:50 [IKEv1]: IKE port 10000 for IPSec UDP already reserved on interface management.
Mar 02 11:34:51 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, Sending keep-alive of type DPD R-U-THERE (seq number 0x37279f24)
Mar 02 11:34:51 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, constructing blank hash payload
Mar 02 11:34:51 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, constructing qm hash payload
Mar 02 11:34:51 [IKEv1]: IP = 7.0.0.2, IKE_DECODE SENDING Message (msgid=c03c24f0) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 11:34:51 [IKEv1]: IP = 7.0.0.2, IKE_DECODE RECEIVED Message (msgid=3cda3153) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 11:34:51 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, processing hash payload
Mar 02 11:34:51 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, processing notify payload
Mar 02 11:34:51 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, Received keep-alive of type DPD R-U-THERE-ACK (seq number 0x37279f24)
Mar 02 11:35:01 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, Sending keep-alive of type DPD R-U-THERE (seq number 0x37279f25)
Mar 02 11:35:01 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, constructing blank hash payload
Mar 02 11:35:01 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, constructing qm hash payload
Mar 02 11:35:01 [IKEv1]: IP = 7.0.0.2, IKE_DECODE SENDING Message (msgid=3aad6cbd) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 11:35:01 [IKEv1]: IP = 7.0.0.2, IKE_DECODE RECEIVED Message (msgid=b5ea2cc9) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 11:35:01 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, processing hash payload
Mar 02 11:35:01 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, processing notify payload
Mar 02 11:35:01 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, Received keep-alive of type DPD R-U-THERE-ACK (seq number 0x37279f25)
Mar 02 11:35:11 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, Sending keep-alive of type DPD R-U-THERE (seq number 0x37279f26)
Mar 02 11:35:11 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, constructing blank hash payload
Mar 02 11:35:11 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, constructing qm hash payload
Mar 02 11:35:11 [IKEv1]: IP = 7.0.0.2, IKE_DECODE SENDING Message (msgid=f326c228) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 11:35:11 [IKEv1]: IP = 7.0.0.2, IKE_DECODE RECEIVED Message (msgid=b6993e59) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 11:35:11 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, processing hash payload
Mar 02 11:35:11 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, processing notify payload
Mar 02 11:35:11 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, Received keep-alive of type DPD R-U-THERE-ACK (seq number 0x37279f26)
Mar 02 11:35:21 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, Sending keep-alive of type DPD R-U-THERE (seq number 0x37279f27)
Mar 02 11:35:21 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, constructing blank hash payload
Mar 02 11:35:21 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, constructing qm hash payload
Mar 02 11:35:21 [IKEv1]: IP = 7.0.0.2, IKE_DECODE SENDING Message (msgid=59bbb2af) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 11:35:21 [IKEv1]: IP = 7.0.0.2, IKE_DECODE RECEIVED Message (msgid=d03bdecc) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 11:35:21 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, processing hash payload
Mar 02 11:35:21 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, processing notify payload
Mar 02 11:35:21 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, Received keep-alive of type DPD R-U-THERE-ACK (seq number 0x37279f27)

ASA2#
ASA2#
ASA2#
ASA2# Mar 02 11:35:31 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, Sending keep-alive of type DPD R-U-THERE (seq number 0x37279f28)
Mar 02 11:35:31 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, constructing blank hash payload
Mar 02 11:35:31 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, constructing qm hash payload
Mar 02 11:35:31 [IKEv1]: IP = 7.0.0.2, IKE_DECODE SENDING Message (msgid=6b1e0c1d) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 11:35:31 [IKEv1]: IP = 7.0.0.2, IKE_DECODE RECEIVED Message (msgid=d270a39a) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 02 11:35:31 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, processing hash payload
Mar 02 11:35:31 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, processing notify payload
Mar 02 11:35:31 [IKEv1 DEBUG]: Group = 7.0.0.2, IP = 7.0.0.2, Received keep-alive of type DPD R-U-THERE-ACK (seq number 0x37279f28)

Thanks,

Ken

Jon Marshall · ‎03-02-2015

Ken

Don't know whether you saw my last post.

I don't know why your ASA is not falling back to the DefaultL2LGroup because with a different key it should not be able to authenticate with the DefaultRAGroup.

Do you use the ASA 9.1 for any remote access VPNs ?

Presumably you do but can you confirm.

Jon

Ken Mackay · ‎03-03-2015

Jon ,

I did see your last post. The key was only changed on DefaultL2LGroup. The DfltGroupPolicy, and the DefaultWEBVPNGroup tunnel groups the key was not changed. What if we set the key for DefaultL2LGroup and change it for DfltGroupPolicy, and the DefaultWEBVPNGroup? Bring the tunnel down and test? What's your take Jon?

Thanks,

Ken

Jon Marshall · ‎03-03-2015

I'm not sure that will make a difference because I don't think those groups are used for L2L tunnels.

There is a command you can use to tell the ASA to make the DefaultL2LGroup the first one to try but I don't know what effect that would have on any remote access VPNs you have.

I think we do need to get the ASA using the DefaultL2LGroup somehow before we can make any progress.

Jon

Ken Mackay · ‎03-03-2015

Good morning Jon,

Yes your right I couldn't get the tunnel back up. I'll go back to original config. I agree that DefaultL2LGroup should be the profile we want to use. Do your require any show commands?

Jon Marshall · ‎03-03-2015

Morning Ken (although it's afternoon here)

Do you have remote access VPNs on this ASA ?

Jon

Ken Mackay · ‎03-03-2015

Jon,

Yes, thats what it would be. The ASA1 is setup as remote access vpn over to ASA2 which is using site to site vpn. The ASA2 is DHCP fed, and it uses the static ip of 7.0.0.2 back to ASA1.

Ken

HUB & SPOKE environment with ASA5512 as the HUB and ASA5505 as spoke.