l2l vpn Auth exchange failed betweeen Cisco ASA and Huawei router

[Niss.comps]

Hello Guys,

I was trying to configure IKEv2 l2l vpn b/n asa which is at my end and Huawei router which is remote peer. The tunnel will not come up with error "Auth exchange failed".  Below is debug and packet-tracer outputs. please help.

IKEv2-PROTO-4: (1382): Received Packet [From RemotePeerIp:4500/To LocalPeerIp:4500/VRF i0:f0]

(1382): Initiator SPI : A5DD10C2FC4C7696 - Responder SPI : 863E42197DD3FC45 Message id: 1

(1382): IKEv2 IKE_AUTH Exchange RESPONSEIKEv2-PROTO-5: (1382): Next payload: ENCR, version: 2.0 (1382): Exchange type: IKE_AUTH, flags: RESPONDER MSG-RESPONSE (1382): Message id: 1, length: 80(1382):

Payload contents:

(1382):

(1382): Decrypted packet:(1382): Data: 80 bytes

(1382): REAL Decrypted packet:(1382): Data: 8 bytes

IKEv2-PROTO-7: (1382): SM Trace-> SA: I_SPI=A5DD10C2FC4C7696 R_SPI=863E42197DD3FC45 (I) MsgID = 00000001 CurState: I_WAIT_AUTH Event: EV_RECV_AUTH IKEv2-PROTO-7: (1382): Action: Action_Null

IKEv2-PROTO-7: (1382): SM Trace-> SA: I_SPI=A5DD10C2FC4C7696 R_SPI=863E42197DD3FC45 (I) MsgID = 00000001 CurState: I_PROC_AUTH Event: EV_CHK4_NOTIFY IKEv2-PROTO-4: (1382): Process auth response notify

IKEv2-PROTO-7: (1382): SM Trace-> SA: I_SPI=A5DD10C2FC4C7696 R_SPI=863E42197DD3FC45 (I) MsgID = 00000001 CurState: AUTH_DONE Event: EV_FAIL IKEv2-PROTO-4: (1382): Auth exchange failed

IKEv2-PROTO-2: (1382): Auth exchange failed IKEv2-PROTO-2: (1382): Auth exchange failed IKEv2-PROTO-7: (1382): SM Trace-> SA: I_SPI=A5DD10C2FC4C7696 R_SPI=863E42197DD3FC45 (I) MsgID = 00000001 CurState: EXIT Event: EV_ABORT

IKEv2-PROTO-7: (1382): SM Trace-> SA: I_SPI=A5DD10C2FC4C7696 R_SPI=863E42197DD3FC45 (I) MsgID = 00000001 CurState: EXIT Event: EV_CHK_PENDING_ABORT

IKEv2-PROTO-7: (1382): SM Trace-> SA: I_SPI=A5DD10C2FC4C7696 R_SPI=863E42197DD3FC45 (I) MsgID = 00000001 CurState: EXIT Event: EV_UPDATE_CAC_STATS IKEv2-PROTO-4: (1382): Abort exchange

IKEv2-PROTO-4: (1382): Deleting SA

packet tracer output
==================

Phase: 7

Type: VPN

Subtype: encrypt

Result: DROP

Config:

Additional Information:

Forward Flow based lookup yields rule:

out id=0x2b4ea32c5920, priority=70, domain=encrypt, deny=false

hits=8996, user_data=0x0, cs_id=0x2b4e96391760, reverse, flags=0x0, protocol=0

src ip/id=LocalNatIP, mask=255.255.255.255, port=0, tag=any

dst ip/id=RemoteLANIP, mask=255.255.255.255, port=0, tag=any, dscp=0x0

input_ifc=any(vrfid:65535), output_ifc=OUTSIDE_IF

Result: input-interface: INSIDE_IF(vrfid:0)

input-status: up

input-line-status: up

output-interface: OUTSIDE_IF(vrfid:0)

output-status: up

output-line-status: up

Action: drop

Drop-reason: (acl-drop) Flow is denied by configured rule, Drop-location: frame 0x000055d14c10d3b6 flow (need-ike)/snp_sp_action_cb:1575

[MHM Cisco World]

I want to see packet tracer not capture and both way from local to remote LAN and from remote to local LAN

MHM

[Niss.comps]

Attached icmp packet tracer test from my side. will upload the output from the other end too.

Thanks!

[MHM Cisco World]

Do packet-trace again the VPN is down so we need to run packet-tracer twice to make it UP

Do it again and share the second 

MHM

[Niss.comps]

It is the same output, the vpn doesn't come up. I have tried that many times before.

[MHM Cisco World]

But the capture show traffic between ASA abd hauwai with port 500 and 4500.

Can I see 

Show crypto ikev2 sa <<- in asa 

Also try connect any pc and ping from pc (must be in same subnet of local lan) to remote LAN

MHM

[Niss.comps]

As you can see, there is no output for 'show crypto ikev2 sa | in Remote_PeerIPAddress'. I took this output while the ping is run continuously from local real host to remote lan ip address.

[MHM Cisco World]

Dont use include' 

It can the traffic is match other VPN' 

How many vpn you run in router ?

MHM

[Niss.comps]

We have six to seven working vpns with their corresponding phase 1 SAs showing in the output but there is no entry for the Huawei peer only.  I cant display them here for security reason but the traffic isn't matching any other vpn. Is it possible to get the hint from the debug outputs shared so far?

[MHM Cisco World]

Ping 100 times 

Show crypto ipsec sa 

Check which of seven VPN encrypt/decrypt count increase.

It can there is conflict that why the traffic drop

MHM

[Rob Ingram]

@Niss.comps Your ASA is behind NAT and would send it's outside interface IP address as the identity, but the peer is probably matching the pre-shared key on the NAT ip address not on the real IP address of your ASA's outside interface. Get the peer to match on your private/real IP address.

IKEv2-PROTO-7: (1671): Local address not matched
IKEv2-PROTO-7: (1671): Host is located NAT inside