Hello Team,
I am stucking since an entire week now to figure out what's wrong on my configuration.
I am using a Router (R3) with a ASAv firewall (ASA1) and would like to enable IKEV2 on a Site-to-Site VPN with Certificate authentication.
"The same configuration works perfectly fine between 2 Routers with certificates"
ERROR I am seeing from ASAv:
%ASA-7-717038: Tunnel group match found. Tunnel Group: 12.0.0.2, Peer certificate: serial number: 0C, subject name: serialNumber=9N6036MZI6CWCJXNKH99C+unstructuredName=R3.test.com,CN=R3.test.com, issuer_name: CN=R1-CA.
%ASA-4-750003: Local:11.0.0.1:500 Remote:12.0.0.2:500 Username:12.0.0.2 IKEv2 Negotiation aborted due to
ERROR: Auth exchange failed
**
*Beginning of Router config:
Using "default" proposal and policy
crypto ikev2 profile Profile1
match certificate CMAP1
identity local dn
authentication remote rsa-sig
authentication local rsa-sig
pki trustpoint VPN
crypto pki certificate map CMAP1 10
subject-name co asa1.test.com
Certificate configuration of Router:
Status: Available
Certificate Serial Number (hex): 0C
Certificate Usage: General Purpose
Issuer:
cn=R1-CA
Subject:
Name: R3.test.com
Serial Number: 9N6036MZI6CWCJXNKH99C
hostname=R3.test.com+serialNumber=9N6036MZI6CWCJXNKH99C
cn=R3.test.com
Validity Date:
start date: 15:35:34 UTC Feb 25 2022
end date: 15:35:34 UTC Feb 25 2023
Associated Trustpoints: VPN
Storage: nvram:R1-CA#C.cer
crypto ipsec transform-set SET1 esp-aes esp-sha-hmac
mode tunnel
crypto map MAP1 10 ipsec-isakmp
set peer 11.0.0.1
set transform-set SET1
set ikev2-profile Profile1
match address VPN-2
crypto map MAP1
Extended IP access list VPN-2
10 permit ip 192.168.2.0 0.0.0.255 192.168.5.0 0.0.0.255 (707 matches)
*end of configuration for Router
***************
*Beginning of ASAv Configuration:
crypto ikev2 policy 10
encryption aes-192
integrity sha256
group 5
prf sha256
lifetime seconds 86400
crypto ikev2 enable outisde
crypto ipsec ikev2 ipsec-proposal IPSEC_Proposal1
protocol esp encryption aes
protocol esp integrity sha-1
tunnel-group-map enable rules
tunnel-group-map CMAP1 10 12.0.0.2
crypto ca certificate map CMAP1 10
subject-name co r3.test.com
tunnel-group 12.0.0.2 type ipsec-l2l
tunnel-group 12.0.0.2 general-attributes
default-group-policy GPO
tunnel-group 12.0.0.2 ipsec-attributes
peer-id-validate nocheck
ikev2 remote-authentication certificate
ikev2 local-authentication certificate VPN
crypto map MAP1 10 match address VPN-2
crypto map MAP1 10 set peer 12.0.0.2
crypto map MAP1 10 set ikev2 ipsec-proposal IPSEC_Proposal1
crypto map MAP1 10 set trustpoint VPN
crypto map MAP1 interface outisde
access-list VPN-2 line 1 extended permit ip 192.168.5.0 255.255.255.0 192.168.2.0 255.255.255.0 (hitcnt=8)
Certificate
Status: Available
Certificate Serial Number: 0b
Certificate Usage: General Purpose
Public Key Type: RSA (1024 bits)
Signature Algorithm: SHA256 with RSA Encryption
Issuer Name:
cn=R1-CA
Subject Name:
hostname=ASA1
serialNumber=9ARPJCBCUBS
cn=ASA1.test.com
Validity Date:
start date: 21:56:18 UTC Feb 17 2022
end date: 21:56:18 UTC Feb 17 2023
Storage: config
Associated Trustpoints: VPN
*end of configuration
I would appreciate your help to understand what I am doing wrong.
Also I am unable to find some documentation to configure ASA-Router with IKEV2 for L2L with certificate.
Thanks for your help!
