Re: Phase 2 fails [NO_PROP_CHOSEN]

Lybra1983 · ‎01-12-2011

Hello,

I was testing a particular configuration with dynamic maps for soho routers and it worked well... see this post for the conf: https://supportforums.cisco.com/message/3265755

Since a few days I'm trying to port this configuration on a productive appliance (ASA5510 - v8.22) and it's not working.

The only difference is that the ASA5510 is already configured to allow access to users with vpn client.

The Zyxel router is telling this: (read it from bottom to up)

Send<:[HASH][DEL]>
Recv<:[HASH][NOTFY:NO_PROP_CHOSEN]>
Send<:[HASH][SA][NONCE][ID][ID]>
Start Phase 2: Quick Mode
Phase 1 IKE SA process done

The show isa sa on the ASA it telling this:

IKE Peer: ***.***.***.***
Type : L2L Role : responder
Rekey : no State : AM_WAIT_MSG3

And this is a piece of the conf:

crypto ipsec transform-set trmset1 esp-aes-256 esp-sha-hmac

crypto ipsec transform-set dynset esp-3des esp-md5-hmac

crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000

crypto dynamic-map map2 10 set transform-set trmset1
crypto dynamic-map map2 10 set security-association lifetime seconds 28800
crypto dynamic-map map2 10 set security-association lifetime kilobytes 4608000

crypto dynamic-map DN3710 2 match address ST_3710
crypto dynamic-map DN3710 2 set transform-set dynset

crypto map yyymap 10 ipsec-isakmp dynamic map2
crypto map yyymap 11 ipsec-isakmp dynamic DN3710

crypto map yyymap interface outside

crypto isakmp enable outside
crypto isakmp policy 1
authentication pre-share
encryption 3des
hash md5
group 1
lifetime 86400

crypto isakmp policy 2
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400

crypto isakmp policy 10
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400

crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400

I can't figure out where the problem is. Any idea will be appreciated!!!

Thanks in advance for a help.

Regards,

Luca

Federico Coto Fajardo · ‎01-12-2011

Hi,

Seems like a phase 2 mismatch or problems in the negotiation of phase 2.

Can you post the complete ''debug cry ips 127'' from the ASA when attempting the connection?

Federico.

Lybra1983 · ‎01-13-2011

Hi Federico,

actually I'm not so keen with debug commands; I know that the simpler way to see the debug output is to connect to the asa via console, so I did it, but the command "debug cry ips 127" isn't showing anything. Maybe I have to enable something else in order to see the output?

While I was launching this command on the asa I was also checking that the zyxel was trying to connect and it was doing it... the messages are always the same.

Maybe there is something I'm mistaking.

Thanks again for the answer and the help.

Regards,

Luca

Federico Coto Fajardo · ‎01-13-2011

Luca,

The ASA should log debug messages to the console by default.

If you're connected via the console, just enable ''debug crypto ipsec 127'' to receive the messages when bringing up the tunnel.

If not receiving any, make sure to clear the SAs first

clear cry isa sa

clear cry ips sa

And do it again.

Federico.

Lybra1983 · ‎01-13-2011

Hi Federico,

I did as you said, and I don't know why but the "debug crypto ipsec 127" isn't showing anything; I tried then the "debug crypto isakmp 127" and logs started to appear...

I've bolded the interesting part, but actually I cannot guess how to solve it.

The only group 1 and group 2 that I know about are the DH, and they are correctly specified into the crypto isakmp policy, I also tried to invert policy 1 and 2 but nothing changed.

Any idea? Thanks for a help.

Luca

____________

ASA-Remote-User# Jan 13 16:11:10 [IKEv1]: IP = yyy.yyy.yyy.yyy, IKE_DECODE RECEIVED

Message (msgid=0) with payloads : HDR + SA (1) + KE (4) + NONCE (10) + ID (5) +

VENDOR (13) + NONE (0) total length : 280

Jan 13 16:11:10 [IKEv1 DEBUG]: IP = yyy.yyy.yyy.yyy, processing SA payload

Jan 13 16:11:10 [IKEv1 DEBUG]: IP = yyy.yyy.yyy.yyy, processing ke payload

Jan 13 16:11:10 [IKEv1 DEBUG]: IP = yyy.yyy.yyy.yyy, processing ISA_KE payload

Jan 13 16:11:10 [IKEv1 DEBUG]: IP = yyy.yyy.yyy.yyy, processing nonce payload

Jan 13 16:11:10 [IKEv1 DEBUG]: IP = yyy.yyy.yyy.yyy, processing ID payload

Jan 13 16:11:10 [IKEv1 DECODE]: IP = yyy.yyy.yyy.yyy, ID_FQDN ID received, len 60000: 54473337 3130 TG3710

Jan 13 16:11:10 [IKEv1 DEBUG]: IP = yyy.yyy.yyy.yyy, processing VID payload

Jan 13 16:11:10 [IKEv1]: IP = yyy.yyy.yyy.yyy, Connection landed on tunnel_group TG3710

Jan 13 16:11:10 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, processing IKESA payload

Jan 13 16:11:10 [IKEv1]: Phase 1 failure: Mismatched attribute types for classGroup Description: Rcv'd: Group 2 Cfg'd: Group 1

Jan 13 16:11:10 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, IKE SA Proposal # 1, Transform # 1 acceptable Matches global IKE entry # 6

Jan 13 16:11:10 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, constructing ISAKMP SA payload

Jan 13 16:11:10 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, constructing ke payload

Jan 13 16:11:10 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, constructing nonce payload

Jan 13 16:11:10 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, Generating keys for Responder...

Jan 13 16:11:10 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, constructing ID payload

Jan 13 16:11:10 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, constructing hash payload

Jan 13 16:11:10 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, Computing hashfor ISAKMP

Jan 13 16:11:10 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, constructing Cisco Unity VID payload

Jan 13 16:11:10 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, constructing xauth V6 VID payload

Jan 13 16:11:10 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, constructing dpd vid payload

Jan 13 16:11:10 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, constructing Fragmentation VID + extended capabilities payload

Jan 13 16:11:10 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, constructing VID payload

Jan 13 16:11:10 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, Send Altiga/Cisco VPN3000/Cisco ASA GW VID

Jan 13 16:11:10 [IKEv1]: IP = yyy.yyy.yyy.yyy, IKE_DECODE SENDING Message (msgid=0)

with payloads : HDR + SA (1) + KE (4) + NONCE (10) + ID (5) + HASH (8) + VENDOR

(13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 368

Jan 13 16:11:11 [IKEv1]: IP = yyy.yyy.yyy.yyy, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 76

Jan 13 16:11:11 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, processing hash payload

Jan 13 16:11:11 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, Computing hashfor ISAKMP

Jan 13 16:11:11 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, processing notify payload

Jan 13 16:11:11 [IKEv1]: Group = TG3710, IP = yyy.yyy.yyy.yyy, PHASE 1 COMPLETED

Jan 13 16:11:11 [IKEv1]: IP = yyy.yyy.yyy.yyy, Keep-alive type for this connection:None

Jan 13 16:11:11 [IKEv1]: IP = yyy.yyy.yyy.yyy, Keep-alives configured on but peer does not support keep-alives (type = None)

Jan 13 16:11:11 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, Starting P1 rekey timer: 64800 seconds.

Jan 13 16:11:11 [IKEv1 DECODE]: IP = yyy.yyy.yyy.yyy, IKE Responder starting QM: msg id = ed3ecdde

Jan 13 16:11:11 [IKEv1]: IP = yyy.yyy.yyy.yyy, IKE_DECODE RECEIVED Message (msgid=ed3ecdde) with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + ID (5) + ID (5)+ NONE (0) total length : 156

Jan 13 16:11:11 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, processing hash payload

Jan 13 16:11:11 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, processing SApayload

Jan 13 16:11:11 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, processing nonce payload

Jan 13 16:11:11 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, processing IDpayload

Jan 13 16:11:11 [IKEv1 DECODE]: Group = TG3710, IP = yyy.yyy.yyy.yyy, ID_IPV4_ADDR_SUBNET ID received--10.51.10.0--255.255.255.0

Jan 13 16:11:11 [IKEv1]: Group = TG3710, IP = yyy.yyy.yyy.yyy, Received remote IP Proxy Subnet data in ID Payload: Address 10.51.10.0, Mask 255.255.255.0, Protocol 0, Port 0

Jan 13 16:11:11 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, processing IDpayload

Jan 13 16:11:11 [IKEv1 DECODE]: Group = TG3710, IP = yyy.yyy.yyy.yyy, ID_IPV4_ADDR_SUBNET ID received--10.1.0.0--255.255.248.0

Jan 13 16:11:11 [IKEv1]: Group = TG3710, IP = yyy.yyy.yyy.yyy, Received local IP Proxy Subnet data in ID Payload: Address 10.1.0.0, Mask 255.255.248.0, Protocol0, Port 0

Jan 13 16:11:11 [IKEv1]: Group = TG3710, IP = yyy.yyy.yyy.yyy, QM IsRekeyed old sanot found by addr

Jan 13 16:11:11 [IKEv1]: Group = TG3710, IP = yyy.yyy.yyy.yyy, IKE Remote Peer configured for crypto map: map2

Jan 13 16:11:11 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, processing IPSec SA payload

Jan 13 16:11:11 [IKEv1]: Group = TG3710, IP = yyy.yyy.yyy.yyy, All IPSec SA proposals found unacceptable!

Jan 13 16:11:11 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, sending notifymessage

Jan 13 16:11:11 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, constructing blank hash payload

Jan 13 16:11:11 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, constructing ipsec notify payload for msg id ed3ecdde

Jan 13 16:11:11 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, constructing qm hash payload

Jan 13 16:11:11 [IKEv1]: IP = yyy.yyy.yyy.yyy, IKE_DECODE SENDING Message (msgid=c6529f66) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80

Jan 13 16:11:11 [IKEv1]: Group = TG3710, IP = yyy.yyy.yyy.yyy, QM FSM error (P2 struct &0xd82eeed8, mess id 0xed3ecdde)!

Jan 13 16:11:11 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, IKE QM Responder FSM error history (struct &0xd82eeed8) , : QM_DONE, EV_ERROR-->QM_BLD_MSG2, EV_NEGO_SA-->QM_BLD_MSG2, EV_IS_REKEY-->QM_BLD_MSG2, EV_CONFIRM_SA-->QM_BLD_MSG2, EV_PROC_MSG-->QM_BLD_MSG2, EV_HASH_OK-->QM_BLD_MSG2, NullEvent-->QM_BLD_MSG2, EV_COMP_HASH

Jan 13 16:11:11 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, sending delete/delete with reason message

Jan 13 16:11:11 [IKEv1]: Group = TG3710, IP = yyy.yyy.yyy.yyy, Removing peer from correlator table failed, no match!

Jan 13 16:11:11 [IKEv1]: Group = TG3710, IP = yyy.yyy.yyy.yyy, Deleting static route for L2L peer that came in on a dynamic map. address: 10.51.10.0, mask: 255.255.255.0

Jan 13 16:11:11 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, IKE SA AM:85855edc rcv'd Terminate: state AM_ACTIVE flags 0x00010041, refcnt 1, tuncnt 0

Jan 13 16:11:11 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, IKE SA AM:85855edc terminating: flags 0x01010001, refcnt 0, tuncnt 0

Jan 13 16:11:11 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, sending delete/delete with reason message

Jan 13 16:11:11 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, constructing blank hash payload

Jan 13 16:11:11 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, constructing IKE delete payload

Jan 13 16:11:11 [IKEv1 DEBUG]: Group = TG3710, IP = yyy.yyy.yyy.yyy, constructing qm hash payload

Jan 13 16:11:11 [IKEv1]: IP = yyy.yyy.yyy.yyy, IKE_DECODE SENDING Message (msgid=7f14e439) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 76

Jan 13 16:11:11 [IKEv1]: Group = TG3710, IP = yyy.yyy.yyy.yyy, Session is being torn down. Reason: Phase 2 Mismatch

Jan 13 16:11:11 [IKEv1]: Ignoring msg to mark SA with dsID 52559872 dead becauseSA deleted

Jan 13 16:11:11 [IKEv1]: IP = yyy.yyy.yyy.yyy, Received encrypted packet with no matching SA, dropping

Federico Coto Fajardo · ‎01-13-2011

Can I ask you why you have more than one dynamic crypto map?
I would do this:

no crypto dynamic-map map2
no crypto dynamic-map DN3710
no crypto map yyymap 10 ipsec-isakmp dynamic map2
no crypto map yyymap 11 ipsec-isakmp dynamic DN3710

crypto map yyymap 10 ipsec-isakmp dynamic DN3710

Clear the SAs and try again.

Federico.

Lybra1983 · ‎01-13-2011

I can't do it.

map2 is used with "esp-aes-256 esp-sha-hmac" for vpn client users.
DN3710 is used with "esp-3des esp-md5-hmac" for a SOHO router with dynamic IP.

Federico Coto Fajardo · ‎01-13-2011

I think that since you have two dynamic crypto maps, everything matches the first and the second is not used.

crypto map yyymap 10 ipsec-isakmp dynamic map2

crypto map yyymap 11 ipsec-isakmp dynamic DN3710

Can you try this?

no crypto map yyymap 11 ipsec-isakmp dynamic DN3710

crypto map yyymap 9 ipsec-isakmp dynamic DN3710

The idea is for the dynamic DN3710 to take precende and see if it works.

Federico.

Lybra1983 · ‎01-13-2011

It's one of the trial I did this morning... actually at the moment these two lines are:

crypto map yyymap 2 ipsec-isakmp dynamic DN3710

crypto map yyymap 10 ipsec-isakmp dynamic map2

...but nothing changes!!!

Luca

Federico Coto Fajardo · ‎01-13-2011

Something is not matching in phase 2 and has to be the transform-set!
What if you change the Zyxel to use AES-256 and SHA just as you have the map2??

Federico.

cadet alain · ‎01-13-2011

Hi Federico,

Something is not matching in phase 2 and has to be the transform-set!

but in his first post the OP said:

The show isa sa on the ASA it telling this:

IKE Peer: ***.***.***.***
Type : L2L Role : responder
Rekey : no State : AM_WAIT_MSG3

AM is Aggressive Mode and so is ike phase 1

So don't you think this is a phase 1 problem?

Regards.

Alain.

Don't forget to rate helpful posts.

Federico Coto Fajardo · ‎01-13-2011

But later on it says phase 1 complete?

Yudong Wu · ‎01-13-2011

I think Federico is correct.

Phase 1 is up.

Jan 13 16:11:11 [IKEv1]: Group = TG3710, IP = yyy.yyy.yyy.yyy, PHASE 1 COMPLETED

Phase 2 has the problem

Jan 13 16:11:11 [IKEv1]: Group = TG3710, IP = yyy.yyy.yyy.yyy, All IPSec SA proposals found unacceptable!

You should use the following crypto order (more specific one on top)

crypto map yyymap 2 ipsec-isakmp dynamic DN3710

crypto map yyymap 10 ipsec-isakmp dynamic map2

After the above change, remove "crypto map yyymap interface outside" and then apply it back.

If it is still not working, capture "debug crypto ipsec 255".

Lybra1983 · ‎01-14-2011

I did it, nothing changed, at this point I have to try the "debug crypto ipsec 255" as you suggested.

hitesh lodhi · ‎02-07-2017

Seems post id very old but I faced the same issue on IPSEC.

my pc was able to connect to ASA but when i tried through apple mobile did not work.However I added 2 more transform set and it works fine.

crypto ipsec ikev1 transform-set Trans-Test esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set Trans-Test1 esp-3des esp-md5-hmac