Solved: Re: IKEv2 SA drops immediately

rolfd · ‎05-03-2024

Hello,

I want to set up a IPSec IKEv2 VPN to a central ASA. On my side we have a cisco 897.

First I tried a crypto map configuration. Didn't work because the IKEv2 SA goes UP and immediately goes DOWN with the error message "IKEv2:(SESSION ID = 1,SA ID = 1):Queuing IKE SA delete request reason: unknown".

Afterwards I tried a VTI configuration, but the IKEv2 SA was dropped immediately with the same error.

Below you find my configuration:

Building configuration...

Current configuration : 3177 bytes
!
! Last configuration change at 05:42:42 UTC Thu Feb 7 2036
!
version 15.5
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname XXXXXXXXX
!
boot-start-marker
boot-end-marker
!
no aaa new-model
ethernet lmi ce
!
ip domain name XXXXX.XX
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
license udi pid C897VA-M-K9 sn FCZ1905C0ZJ
!
vtp mode transparent
username admin
!
crypto ikev2 proposal aes-cbc-256-proposal
encryption aes-cbc-256
integrity sha256
group 14
!
crypto ikev2 policy policy1
match fvrf any
match address local 193.29.25.88
proposal aes-cbc-256-proposal
!
crypto ikev2 keyring KEYRING
peer 81.14.167.232
address 81.14.167.232
pre-shared-key yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy
!
peer 10.10.245.22
address 10.10.245.22
pre-shared-key yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy
!
crypto ikev2 profile profile1
description IKEv2 profile
match identity remote address 81.14.167.232 255.255.255.255
match identity remote address 10.10.245.22 255.255.255.255
authentication local pre-share
authentication remote pre-share
keyring local KEYRING
lifetime 3600
no config-exchange request
!
controller VDSL 0
!
vlan 2
lldp run
!
crypto logging ikev2
crypto isakmp invalid-spi-recovery
!
crypto ipsec transform-set ESP-AES-SHA esp-null esp-sha-hmac
mode tunnel
crypto ipsec fragmentation after-encryption
!
crypto ipsec profile profile1
set security-policy limit 1
set transform-set ESP-AES-SHA
set ikev2-profile profile1
!
interface Tunnel0
ip unnumbered GigabitEthernet8
tunnel source GigabitEthernet8
tunnel mode ipsec ipv4
tunnel destination 81.14.167.232
tunnel protection ipsec profile profile1 ikev2-profile profile1
!
interface ATM0
no ip address
no atm ilmi-keepalive
!
interface Ethernet0
no ip address
shutdown
!
interface GigabitEthernet0
switchport access vlan 2
no ip address
!
interface GigabitEthernet1
no ip address
!
interface GigabitEthernet2
no ip address
!
interface GigabitEthernet3
no ip address
!
interface GigabitEthernet4
no ip address
!
interface GigabitEthernet5
no ip address
!
interface GigabitEthernet6
no ip address
!
interface GigabitEthernet7
no ip address
!
interface GigabitEthernet8
ip address 193.29.25.88 255.255.255.240
duplex auto
speed auto
!
interface Vlan1
no ip address
!
interface Vlan2
ip address 193.29.25.78 255.255.255.240
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
ip route 0.0.0.0 0.0.0.0 193.29.25.94
ip route 192.168.1.0 255.255.255.0 193.29.25.65
!
route-map XXX permit 1
match ip address 101
!
access-list 101 permit ip 193.29.25.64 0.0.0.15 192.168.0.0 0.0.255.255
access-list 101 permit ip 193.29.25.64 0.0.0.15 172.16.0.0 0.0.255.255
!
control-plane
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
line con 0
no modem enable
line aux 0
!
scheduler allocate 20000 1000
!
end

Now the logfile from "debug crypto ikev2"

*Feb 7 06:04:26.731: IKEv2:% Getting preshared key from profile keyring KEYRING
*Feb 7 06:04:26.731: IKEv2:% Matched peer block '81.14.167.232'
*Feb 7 06:04:26.731: IKEv2:Searching Policy with fvrf 0, local address 193.29.25.88
*Feb 7 06:04:26.731: IKEv2:Found Policy 'policy1'
*Feb 7 06:04:26.731: %IKEV2-5-OSAL_INITIATE_TUNNEL: Received request to establish an IPsec tunnel; local traffic selector = Address Ra

*Feb 7 06:04:26.731: IKEv2:(SESSION ID = 1,SA ID = 1):[IKEv2 -> Crypto Engine] Computing DH public key, DH Group 14
*Feb 7 06:04:26.731: IKEv2:(SA ID = 1):[Crypto Engine -> IKEv2] DH key Computation PASSED
*Feb 7 06:04:26.731: IKEv2:(SESSION ID = 1,SA ID = 1):Request queued for computation of DH key
*Feb 7 06:04:26.731: IKEv2:IKEv2 initiator - no config data to send in IKE_SA_INIT exch
*Feb 7 06:04:26.731: IKEv2:(SESSION ID = 1,SA ID = 1):Generating IKE_SA_INIT message
*Feb 7 06:04:26.731: IKEv2:(SESSION ID = 1,SA ID = 1):IKE Proposal: 1, SPI size: 0 (initial negotiation),
Num. transforms: 4
AES-CBC SHA256 SHA256 DH_GROUP_2048_MODP/Group 14

*Feb 7 06:04:26.731: IKEv2:(SESSION ID = 1,SA ID = 1):Sending Packet [To 81.14.167.232:500/From 193.29.25.88:500/VRF i0:f0]
Initiator SPI : 327D7DBC17FFE20E - Responder SPI : 0000000000000000 Message id: 0
IKEv2 IKE_SA_INIT Exchange REQUEST
Payload contents:
SA KE N VID VID NOTIFY(NAT_DETECTION_SOURCE_IP) NOTIFY(NAT_DETECTION_DESTINATION_IP)

*Feb 7 06:04:26.731: IKEv2:(SESSION ID = 1,SA ID = 1):Insert SA

*Feb 7 06:04:26.763: IKEv2:(SESSION ID = 1,SA ID = 1):Received Packet [From 81.14.167.232:500/To 193.29.25.88:500/VRF i0:f0]
Initiator SPI : 327D7DBC17FFE20E - Responder SPI : B65909F3CF6A3B3A Message id: 0
IKEv2 IKE_SA_INIT Exchange RESPONSE
Payload contents:
SA KE N VID VID NOTIFY(NAT_DETECTION_SOURCE_IP) NOTIFY(NAT_DETECTION_DESTINATION_IP) CERTREQ NOTIFY(IKEV2_FRAGMENTATION_SUPPORTED) VID

*Feb 7 06:04:26.763: IKEv2:(SESSION ID = 1,SA ID = 1):Processing IKE_SA_INIT message
*Feb 7 06:04:26.763: IKEv2:(SESSION ID = 1,SA ID = 1):Verify SA init message
*Feb 7 06:04:26.763: IKEv2:(SESSION ID = 1,SA ID = 1):Processing IKE_SA_INIT message
*Feb 7 06:04:26.763: IKEv2:(SESSION ID = 1,SA ID = 1):Checking NAT discovery
*Feb 7 06:04:26.763: IKEv2:(SESSION ID = 1,SA ID = 1):NAT OUTSIDE found
*Feb 7 06:04:26.763: IKEv2:(SESSION ID = 1,SA ID = 1):NAT detected float to init port 4500, resp port 4500
*Feb 7 06:04:26.763: IKEv2:(SESSION ID = 1,SA ID = 1):[IKEv2 -> Crypto Engine] Computing DH secret key, DH Group 14
*Feb 7 06:04:26.763: IKEv2:(SESSION ID = 1,SA ID = 1):Request queued for computation of DH secret
*Feb 7 06:04:26.775: IKEv2:(SA ID = 1):[Crypto Engine -> IKEv2] DH key Computation PASSED
*Feb 7 06:04:26.775: IKEv2:(SA ID = 1):[IKEv2 -> Crypto Engine] Calculate SKEYSEED and create rekeyed IKEv2 SA
*Feb 7 06:04:26.775: IKEv2:(SA ID = 1):[Crypto Engine -> IKEv2] SKEYSEED calculation and creation of rekeyed IKEv2 SA PASSED
*Feb 7 06:04:26.775: IKEv2:(SESSION ID = 1,SA ID = 1):Completed SA init exchange
*Feb 7 06:04:26.779: IKEv2:(SESSION ID = 1,SA ID = 1):Check for EAP exchange
*Feb 7 06:04:26.779: IKEv2:(SESSION ID = 1,SA ID = 1):Generate my authentication data
*Feb 7 06:04:26.779: IKEv2:(SESSION ID = 1,SA ID = 1):Use preshared key for id 193.29.25.88, key len 32
*Feb 7 06:04:26.779: IKEv2:[IKEv2 -> Crypto Engine] Generate IKEv2 authentication data
*Feb 7 06:04:26.779: IKEv2:[Crypto Engine -> IKEv2] IKEv2 authentication data generation PASSED
*Feb 7 06:04:26.779: IKEv2:(SESSION ID = 1,SA ID = 1):Get my authentication method
*Feb 7 06:04:26.779: IKEv2:(SESSION ID = 1,SA ID = 1):My authentication method is 'PSK'
*Feb 7 06:04:26.779: IKEv2:(SESSION ID = 1,SA ID = 1):Check for EAP exchange
*Feb 7 06:04:26.779: IKEv2:(SESSION ID = 1,SA ID = 1):Generating IKE_AUTH message
*Feb 7 06:04:26.779: IKEv2:(SESSION ID = 1,SA ID = 1):Constructing IDi payload: '193.29.25.88' of type 'IPv4 address'
*Feb 7 06:04:26.779: IKEv2:(SESSION ID = 1,SA ID = 1):ESP Proposal: 1, SPI size: 4 (IPSec negotiation),
Num. transforms: 3
NULL SHA96 Don't use ESN
*Feb 7 06:04:26.779: IKEv2:(SESSION ID = 1,SA ID = 1):Building packet for encryption.
Payload contents:
VID IDi AUTH SA TSi TSr NOTIFY(INITIAL_CONTACT) NOTIFY(SET_WINDOW_SIZE) NOTIFY(ESP_TFC_NO_SUPPORT) NOTIFY(NON_FIRST_FRAGS)

*Feb 7 06:04:26.779: IKEv2:(SESSION ID = 1,SA ID = 1):Sending Packet [To 81.14.167.232:4500/From 193.29.25.88:4500/VRF i0:f0]
Initiator SPI : 327D7DBC17FFE20E - Responder SPI : B65909F3CF6A3B3A Message id: 1
IKEv2 IKE_AUTH Exchange REQUEST
Payload contents:
ENCR

*Feb 7 06:04:26.807: IKEv2:(SESSION ID = 1,SA ID = 1):Received Packet [From 81.14.167.232:4500/To 193.29.25.88:4500/VRF i0:f0]
Initiator SPI : 327D7DBC17FFE20E - Responder SPI : B65909F3CF6A3B3A Message id: 1
IKEv2 IKE_AUTH Exchange RESPONSE
Payload contents:
VID IDr AUTH NOTIFY(TS_UNACCEPTABLE)

*Feb 7 06:04:26.807: IKEv2:(SESSION ID = 1,SA ID = 1):Process auth response notify
*Feb 7 06:04:26.807: IKEv2-ERROR:(SESSION ID = 1,SA ID = 1):
*Feb 7 06:04:26.807: IKEv2:(SESSION ID = 1,SA ID = 1):Searching policy based on peer's identity '10.10.245.22' of type 'IPv4 address'
*Feb 7 06:04:26.807: IKEv2:Searching Policy with fvrf 0, local address 193.29.25.88
*Feb 7 06:04:26.807: IKEv2:Found Policy 'policy1'
*Feb 7 06:04:26.807: IKEv2:(SESSION ID = 1,SA ID = 1):Verify peer's policy
*Feb 7 06:04:26.807: IKEv2:(SESSION ID = 1,SA ID = 1):Peer's policy verified
*Feb 7 06:04:26.807: IKEv2:(SESSION ID = 1,SA ID = 1):Get peer's authentication method
*Feb 7 06:04:26.807: IKEv2:(SESSION ID = 1,SA ID = 1):Peer's authentication method is 'PSK'
*Feb 7 06:04:26.807: IKEv2:(SESSION ID = 1,SA ID = 1):Get peer's preshared key for 10.10.245.22
*Feb 7 06:04:26.807: IKEv2:(SESSION ID = 1,SA ID = 1):Verify peer's authentication data
*Feb 7 06:04:26.807: IKEv2:(SESSION ID = 1,SA ID = 1):Use preshared key for id 10.10.245.22, key len 32
*Feb 7 06:04:26.807: IKEv2:[IKEv2 -> Crypto Engine] Generate IKEv2 authentication data
*Feb 7 06:04:26.807: IKEv2:[Crypto Engine -> IKEv2] IKEv2 authentication data generation PASSED
*Feb 7 06:04:26.807: IKEv2:(SESSION ID = 1,SA ID = 1):Verification of peer's authenctication data PASSED
*Feb 7 06:04:26.807: IKEv2:(SESSION ID = 1,SA ID = 1):Check for EAP exchange
*Feb 7 06:04:26.807: IKEv2:(SESSION ID = 1,SA ID = 1):IKEV2 SA created; inserting SA into database. SA lifetime timer (3600 sec) startd
*Feb 7 06:04:26.807: %IKEV2-5-SA_UP: SA UP

*Feb 7 06:04:26.807: IKEv2:(SESSION ID = 1,SA ID = 1):Session with IKE ID PAIR (10.10.245.22, 193.29.25.88) is UP
*Feb 7 06:04:26.807: IKEv2:IKEv2 MIB tunnel started, tunnel index 1
*Feb 7 06:04:26.807: IKEv2:(SESSION ID = 1,SA ID = 1):Checking for duplicate IKEv2 SA
*Feb 7 06:04:26.807: IKEv2:(SESSION ID = 1,SA ID = 1):No duplicate IKEv2 SA found
*Feb 7 06:04:26.807: IKEv2:(SESSION ID = 1,SA ID = 1):Queuing IKE SA delete request reason: unknown
*Feb 7 06:04:26.807: IKEv2:(SESSION ID = 1,SA ID = 1):Sending DELETE INFO message for IPsec SA [SPI: 0xF2415CCB]
*Feb 7 06:04:26.807: IKEv2:(SESSION ID = 1,SA ID = 1):Building packet for encryption.
Payload contents:
DELETE
*Feb 7 06:04:26.807: IKEv2:(SESSION ID = 1,SA ID = 1):Checking if request will fit in peer window

*Feb 7 06:04:26.807: IKEv2:(SESSION ID = 1,SA ID = 1):Sending Packet [To 81.14.167.232:4500/From 193.29.25.88:4500/VRF i0:f0]
Initiator SPI : 327D7DBC17FFE20E - Responder SPI : B65909F3CF6A3B3A Message id: 2
IKEv2 INFORMATIONAL Exchange REQUEST
Payload contents:
ENCR

*Feb 7 06:04:26.811: IKEv2:(SESSION ID = 1,SA ID = 1):Check for existing IPSEC SA
*Feb 7 06:04:26.811: IKEv2:(SESSION ID = 1,SA ID = 1):Delete all IKE SAs
*Feb 7 06:04:26.811: IKEv2:(SESSION ID = 1,SA ID = 1):Sending DELETE INFO message for IKEv2 SA [ISPI: 0x327D7DBC17FFE20E RSPI: 0xB6590]
*Feb 7 06:04:26.811: IKEv2:(SESSION ID = 1,SA ID = 1):Building packet for encryption.
Payload contents:
DELETE
*Feb 7 06:04:26.811: IKEv2:(SESSION ID = 1,SA ID = 1):Checking if request will fit in peer window
*Feb 7 06:04:26.811: IKEv2:(SESSION ID = 1,SA ID = 1):Check for existing active SA
*Feb 7 06:04:26.811: IKEv2:(SESSION ID = 1,SA ID = 1):Delete all IKE SAs

*Feb 7 06:04:26.835: IKEv2:(SESSION ID = 1,SA ID = 1):Received Packet [From 81.14.167.232:4500/To 193.29.25.88:4500/VRF i0:f0]
Initiator SPI : 327D7DBC17FFE20E - Responder SPI : B65909F3CF6A3B3A Message id: 2
IKEv2 INFORMATIONAL Exchange RESPONSE
Payload contents:

*Feb 7 06:04:26.835: IKEv2:(SESSION ID = 1,SA ID = 1):Processing ACK to informational exchange
*Feb 7 06:04:26.835: IKEv2:(SESSION ID = 1,SA ID = 1):Check for existing IPSEC SA
*Feb 7 06:04:26.835: IKEv2:(SESSION ID = 1,SA ID = 1):Delete all IKE SAs

*Feb 7 06:04:26.835: IKEv2:(SESSION ID = 1,SA ID = 1):Sending Packet [To 81.14.167.232:4500/From 193.29.25.88:4500/VRF i0:f0]
Initiator SPI : 327D7DBC17FFE20E - Responder SPI : B65909F3CF6A3B3A Message id: 3
IKEv2 INFORMATIONAL Exchange REQUEST
Payload contents:
ENCR

*Feb 7 06:04:26.859: IKEv2:(SESSION ID = 1,SA ID = 1):Received Packet [From 81.14.167.232:4500/To 193.29.25.88:4500/VRF i0:f0]
Initiator SPI : 327D7DBC17FFE20E - Responder SPI : B65909F3CF6A3B3A Message id: 3
IKEv2 INFORMATIONAL Exchange RESPONSE
Payload contents:
DELETE

*Feb 7 06:04:26.859: IKEv2:(SESSION ID = 1,SA ID = 1):Processing ACK to informational exchange
*Feb 7 06:04:26.859: IKEv2:(SESSION ID = 1,SA ID = 1):Deleting SA
*Feb 7 06:04:26.859: %IKEV2-5-SA_DOWN: SA DOWN

Does anybody has an idea, why the ikev2 sa will be dropped?

Many thanks in advance for support.

Regards

Rolf

rolfd · ‎05-11-2024

Many thanks. When I wanted to change the transform-set I see the following message from the router:

ras-kbs01(config)#crypto ipsec trans TS esp-aes-256 esp-sha256-hmac
^
% Invalid input detected at '^' marker.

ras-kbs01(config)#crypto ipsec trans TS esp-ae
ras-kbs01(config)#crypto ipsec trans TS ?
ah-md5-hmac AH-HMAC-MD5 transform
ah-sha-hmac AH-HMAC-SHA transform
ah-sha256-hmac AH-HMAC-SHA256 transform
ah-sha384-hmac AH-HMAC-SHA384 transform
ah-sha512-hmac AH-HMAC-SHA512 transform
comp-lzs IP Compression using the LZS compression algorithm
esp-3des ESP transform using 3DES(EDE) cipher (168 bits)
esp-aes ESP transform using AES cipher
esp-des ESP transform using DES cipher (56 bits)
esp-gcm ESP transform using GCM cipher
esp-gmac ESP transform using GMAC cipher
esp-md5-hmac ESP transform using HMAC-MD5 auth
esp-null ESP transform w/o cipher
esp-seal ESP transform using SEAL cipher (160 bits)
esp-sha-hmac ESP transform using HMAC-SHA auth
esp-sha256-hmac ESP transform using HMAC-SHA256 auth
esp-sha384-hmac ESP transform using HMAC-SHA384 auth
esp-sha512-hmac ESP transform using HMAC-SHA512 auth

ras-kbs01(config)#crypto ipsec trans TS

So the router does not accept this transform-set. I changed the transform-set to

crypto ipsec transform-set TS esp-aes esp-sha256-hmac
mode tunnel

But no luck.

Ater that I changed the transform-set to

crypto ipsec transform-set TS esp-aes 256 esp-sha256-hmac

and now I have an ikev2 sa ready.

ras-kbs01#show crypto ikev2 sa
IPv4 Crypto IKEv2 SA

Tunnel-id Local Remote fvrf/ivrf Status
1 193.29.25.88/4500 81.14.167.232/4500 none/none READY
Encr: AES-CBC, keysize: 256, PRF: SHA256, Hash: SHA256, DH Grp:14, Auth sign: PSK, Auth verify: PSK
Life/Active Time: 86400/137 sec

IPv6 Crypto IKEv2 SA

ras-kbs01#

I do not see he tunnel, because teh routing after the ASA is not in place. This will be checked on mondaay.

So I think the new transform-set is the solution.

Thousand thanks to you and

best regards

Rolf

View solution in original post

MHM Cisco World · ‎05-03-2024

In router

Show crypto session

Share this

MHM

rolfd · ‎05-03-2024

Hi,

below the reslt of show crypro session

ras-kbs01#show crypto session
Crypto session current status

Interface: Tunnel0
Session status: DOWN
Peer: 81.14.167.232 port 500
IPSEC FLOW: permit ip 0.0.0.0/0.0.0.0 0.0.0.0/0.0.0.0
Active SAs: 0, origin: crypto map

ras-kbs01#

Regards

Rolf

MHM Cisco World · ‎05-03-2024

Tunnel source and tunnel ip unnumbered use same interface' can you add IP to tunnel instead of use unnumbered

MHM

rolfd · ‎05-03-2024

Hello,
debug crypro ikev2 packets schows:

*Jan 1 01:21:24.379: IKEv2-PAK:(SESSION ID = 1,SA ID = 1):Next payload: ENCR, version: 2.0 Exchange type: IKE_AUTH, flags: INITIATOR Message id: 1, length: 272
Payload contents:
ENCR Next payload: VID, reserved: 0x0, length: 244

*Jan 1 01:21:24.407: IKEv2-PAK:(SESSION ID = 1,SA ID = 1):Next payload: ENCR, version: 2.0 Exchange type: IKE_AUTH, flags: RESPONDER MSG-RESPONSE Message id: 1, length: 160
Payload contents:
VID Next payload: IDr, reserved: 0x0, length: 20
IDr Next payload: AUTH, reserved: 0x0, length: 12
Id type: IPv4 address, Reserved: 0x0 0x0
AUTH Next payload: NOTIFY, reserved: 0x0, length: 40
Auth method PSK, reserved: 0x0, reserved 0x0
NOTIFY(TS_UNACCEPTABLE) Next payload: NONE, reserved: 0x0, length: 8
Security protocol id: IKE, spi size: 0, type: TS_UNACCEPTABLE

regards

Rolf

rolfd · ‎05-03-2024

do you mean?

interface Tunnel0
ip address 193.29.25.88 255.255.255.240
tunnel source GigabitEthernet8
tunnel mode ipsec ipv4
tunnel destination 81.14.167.232
tunnel protection ipsec profile profile1 ikev2-profile profile1

and

interface GigabitEthernet8
no ip address
duplex auto
speed auto

If yes, I los the connection

ras-kbs01#ping 193.29.25.88
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 193.29.25.88, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
ras-kbs01#

regards

Rolf

MHM Cisco World · ‎05-03-2024

interface Tunnel0
ip add 192.168.1.1 255.255.255.0 <-that what I meaning
tunnel source GigabitEthernet8
tunnel mode ipsec ipv4
tunnel destination 81.14.167.232
tunnel protection ipsec profile profile1 ikev2-profile profile1

!

interface GigabitEthernet8
ip address 193.29.25.88 255.255.255.240
duplex auto
speed auto

MHM

rolfd · ‎05-03-2024

okay, I changed it

interface Tunnel0
ip address 193.29.25.33 255.255.255.240
tunnel source GigabitEthernet8
tunnel mode ipsec ipv4
tunnel destination 81.14.167.232
tunnel protection ipsec profile profile1 ikev2-profile profile1

interface GigabitEthernet8
ip address 193.29.25.88 255.255.255.240
duplex auto
speed auto

same problem, no change

regards

Rolf

MHM Cisco World · ‎05-03-2024

Why you use tunnel IP same as G0 IP sunbet?

You need to use different subnet for tunnel IP

Also the crypto ipsec transform have esp-null ? Why that ?

MHM

rolfd · ‎05-03-2024

193.29.25.33/28 is different to 193.29.25.88/28

I changed already esp-null to

crypto ipsec transform-set ESP-AES-SHA esp-aes 256 esp-sha-hmac

but no change. I have to stop for today and will start again tommorow.

Many thanks for your support today.

regards

Rolf

MHM Cisco World · ‎05-03-2024

until tomorrow friend

MHM

rolfd · ‎05-05-2024

Hello, unfortunately I haven't been able to take care of the VPN problem yet. I'll get back to you in the next few days.

MHM Cisco World · ‎05-06-2024

take your time

MHM

rolfd · ‎05-07-2024

Hello, today morning I have some time for the problem.

I chnaged the configuration back to crypto map (feeling me better)

crypto ikev2 proposal default
encryption aes-cbc-256
prf sha256
integrity sha256 sha1
group 14
!
crypto ikev2 policy policy1
proposal default
!
crypto ikev2 keyring KEYRING
peer 81.14.167.232
address 81.14.167.232
pre-shared-key local YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY
pre-shared-key remote YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY
!
peer 10.10.245.22
address 10.10.245.22
pre-shared-key local YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY
pre-shared-key remote YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY
!
crypto ikev2 profile profile1
description IKEv2 profile
match fvrf any
match identity remote address 81.14.167.232 255.255.255.255
match identity remote address 10.10.245.22 255.255.255.255
identity local address 193.29.25.88
authentication local pre-share
authentication remote pre-share
keyring local KEYRING
!
crypto ikev2 diagnose error 10
!
crypto ipsec transform-set default esp-aes 256 esp-sha-hmac
mode tunnel
crypto ipsec transform-set IPSEC esp-aes 256 esp-sha-hmac
mode tunnel
crypto ipsec transform-set aesset esp-aes esp-sha-hmac
mode tunnel
!
crypto map SDM_CMAP_1 1 ipsec-isakmp
set peer 81.14.167.232
set transform-set TS
set pfs group14
set ikev2-profile profile1
match address 101
!
interface GigabitEthernet0
switchport access vlan 2
no ip address
!
interface GigabitEthernet4
switchport access vlan 32
no ip address
!
interface GigabitEthernet8
ip address 193.29.25.88 255.255.255.240
duplex auto
speed auto
crypto map SDM_CMAP_1
!
interface Vlan2
ip address 193.29.25.78 255.255.255.240
!
interface Vlan32
ip address 193.29.25.33 255.255.255.240

I changed also the access-list, because on the ASA the net 193.29.25.32/28 are routed into the tunnel.

access-list 101 permit ip 193.29.25.32 0.0.0.15 192.168.0.0 0.0.255.255

I did som investigations via

debug crypro ikev2
debug crypro ikev2 internal
debug crypro ikev2 paket

and I see the foolwing messages:

May 7 09:49:39.639: IKEv2-INTERNAL:Construct Vendor Specific Payload: CISCO-GRANITE
May 7 09:49:39.639: IKEv2:(SESSION ID = 1,SA ID = 1):Constructing IDi payload: '193.29.25.88' of type 'IPv4 address'
May 7 09:49:39.639: IKEv2:(SESSION ID = 1,SA ID = 1):ESP Proposal: 1, SPI size: 4 (IPSec negotiation),
Num. transforms: 3
AES-CBC SHA96 Don't use ESN
May 7 09:49:39.643: IKEv2-INTERNAL:Construct Notify Payload: INITIAL_CONTACT
May 7 09:49:39.643: IKEv2-INTERNAL:Construct Notify Payload: SET_WINDOW_SIZE
May 7 09:49:39.643: IKEv2-INTERNAL:Construct Notify Payload: ESP_TFC_NO_SUPPORT
May 7 09:49:39.643: IKEv2-INTERNAL:Construct Notify Payload: NON_FIRST_FRAGS
May 7 09:49:39.643: IKEv2:(SESSION ID = 1,SA ID = 1):Building packet for encryption.
Payload contents:
VID Next payload: IDi, reserved: 0x0, length: 20
IDi Next payload: AUTH, reserved: 0x0, length: 12
Id type: IPv4 address, Reserved: 0x0 0x0
AUTH Next payload: SA, reserved: 0x0, length: 40
Auth method PSK, reserved: 0x0, reserved 0x0
SA Next payload: TSi, reserved: 0x0, length: 44
last proposal: 0x0, reserved: 0x0, length: 40
Proposal: 1, Protocol id: ESP, SPI size: 4, #trans: 3 last transform: 0x3, reserved: 0x0: length: 12
type: 1, reserved: 0x0, id: AES-CBC
last transform: 0x3, reserved: 0x0: length: 8
type: 3, reserved: 0x0, id: SHA96
last transform: 0x0, reserved: 0x0: length: 8
type: 5, reserved: 0x0, id: Don't use ESN
TSi Next payload: TSr, reserved: 0x0, length: 40
Num of TSs: 2, reserved 0x0, reserved 0x0
TS type: TS_IPV4_ADDR_RANGE, proto id: 1, length: 16
start port: 0, end port: 65535
start addr: 193.29.25.34, end addr: 193.29.25.34
TS type: TS_IPV4_ADDR_RANGE, proto id: 0, length: 16
start port: 0, end port: 65535
start addr: 193.29.25.32, end addr: 193.29.25.47
TSr Next payload: NOTIFY, reserved: 0x0, length: 40
Num of TSs: 2, reserved 0x0, reserved 0x0
TS type: TS_IPV4_ADDR_RANGE, proto id: 1, length: 16
start port: 0, end port: 65535
start addr: 192.168.245.18, end addr: 192.168.245.18
TS type: TS_IPV4_ADDR_RANGE, proto id: 0, length: 16
start port: 0, end port: 65535
start addr: 192.168.0.0, end addr: 192.168.255.255
NOTIFY(INITIAL_CONTACT) Next payload: NOTIFY, reserved: 0x0, length: 8
Security protocol id: Unknown - 0, spi size: 0, type: INITIAL_CONTACT
NOTIFY(SET_WINDOW_SIZE) Next payload: NOTIFY, reserved: 0x0, length: 12
Security protocol id: Unknown - 0, spi size: 0, type: SET_WINDOW_SIZE
NOTIFY(ESP_TFC_NO_SUPPORT) Next payload: NOTIFY, reserved: 0x0, length: 8
Security protocol id: Unknown - 0, spi size: 0, type: ESP_TFC_NO_SUPPORT
NOTIFY(NON_FIRST_FRAGS) Next payload: NONE, reserved: 0x0, length: 8
Security protocol id: Unknown - 0, spi size: 0, type: NON_FIRST_FRAGS

May 7 09:49:39.643: IKEv2:(SESSION ID = 1,SA ID = 1):Sending Packet [To 81.14.167.232:4500/From 193.29.25.88:4500/VRF i0:f0]
Initiator SPI : 73065D8F9E29AFD0 - Responder SPI : D43C0DE6E3D66D22 Message id: 1
IKEv2 IKE_AUTH Exchange REQUEST
May 7 09:49:39.643: IKEv2-PAK:(SESSION ID = 1,SA ID = 1):Next payload: ENCR, version: 2.0 Exchange type: IKE_AUTH, flags: INITIATOR Message id: 1, length: 304
Payload contents:
ENCR Next payload: VID, reserved: 0x0, length: 276

May 7 09:49:39.643: IKEv2-INTERNAL:(SESSION ID = 1,SA ID = 1):SM Trace-> SA: I_SPI=73065D8F9E29AFD0 R_SPI=D43C0DE6E3D66D22 (I) MsgID = 1 CurState: I_WAIT_AUTH Event: EV_NO_EVENT
May 7 09:49:39.667: IKEv2-INTERNAL:Got a packet from dispatcher

May 7 09:49:39.667: IKEv2-INTERNAL:Processing an item off the pak queue

May 7 09:49:39.671: IKEv2:(SESSION ID = 1,SA ID = 1):Received Packet [From 81.14.167.232:4500/To 193.29.25.88:4500/VRF i0:f0]
Initiator SPI : 73065D8F9E29AFD0 - Responder SPI : D43C0DE6E3D66D22 Message id: 1
IKEv2 IKE_AUTH Exchange RESPONSE
May 7 09:49:39.671: IKEv2-PAK:(SESSION ID = 1,SA ID = 1):Next payload: ENCR, version: 2.0 Exchange type: IKE_AUTH, flags: RESPONDER MSG-RESPONSE Message id: 1, length: 160
Payload contents:

May 7 09:49:39.671: IKEv2-INTERNAL:Parse Vendor Specific Payload: (CUSTOM) VID Next payload: IDr, reserved: 0x0, length: 20
IDr Next payload: AUTH, reserved: 0x0, length: 12
Id type: IPv4 address, Reserved: 0x0 0x0
AUTH Next payload: NOTIFY, reserved: 0x0, length: 40
Auth method PSK, reserved: 0x0, reserved 0x0

May 7 09:49:39.671: IKEv2-INTERNAL:Parse Notify Payload: NO_PROPOSAL_CHOSEN NOTIFY(NO_PROPOSAL_CHOSEN) Next payload: NONE, reserved: 0x0, length: 8
Security protocol id: IKE, spi size: 0, type: NO_PROPOSAL_CHOSEN

From my understanding the transform set is the problem, because it offer AES-CBC SHA96. This would not be accepted from the ASA, so I got no proposal chosen. I changed several times the transform set, but I see every time the above message.

Could it be a problem with the IOS release 15.5? I do not have any idea to go further.

Regards

Rolf

MHM Cisco World · ‎05-09-2024

Sorry for late reply

Can you share both IOS and ASA config

MHM