Problem between ASA and Strongswan in L2L configuration

[dfariborz]

We are using ASA 5510 with 8.2(5)  and trying to have a L2L session with Strongswan at the other side.

We get phase 1 established but ASA rejects phase 2 due to crypto match policy not found. We expect them to hide under their public address and whenever they try to do that phase 2 fails (they seem to come under their private address) but their VPN administrator says the Strongswan is configured to hide behind the public address. Is this a known problem between ASA & Strongswan?

Thank you

Darius.Fariborz@cgi.com

[SANTHOSHKUMAR SARAVANAN]

Hi Darius , 

 Below URL should support your requirement .

http://www.cisco.com/c/en/us/support/docs/ip/internet-key-exchange-ike/117258-config-l2l.html

StrongSwan ipsec.conf:
config setup
charonstart=yes
plutostart=yes
conn %default
keyexchange=ikev2
ike=aes256-sha1-modp1536

conn siteA
left=3.3.3.3
leftsubnet=10.179.128.0/19
leftid=3.3.3.3
leftauth=psk
right=2.2.2.2
rightsubnet=10.10.0.0/16
rightid=2.2.2.2
rightauth=psk
auto=add

include /var/lib/strongswan/ipsec.conf.inc

StrongSwan ipsec.secrets:

include /var/lib/strongswan/ipsec.secrets.inc
2.2.2.2 : PSK "12345"
3.3.3.3 : PSK "12345"

ASA Config:
crypto map Outside_map 8 match address Outside_cryptomap_10
crypto map Outside_map 8 set pfs group5
crypto map Outside_map 8 set peer 3.3.3.3
crypto map Outside_map 8 set ikev2 ipsec-proposal AES256
crypto map Outside_map 8 set ikev2 pre-shared-key 12345

tunnel-group 3.3.3.3 type ipsec-l2l
tunnel-group 3.3.3.3 general-attributes
default-group-policy policy-3.3.3.3
tunnel-group 3.3.3.3 ipsec-attributes
ikev2 remote-authentication pre-shared-key 12345
ikev2 local-authentication pre-shared-key 12345

group-policy policy-3.3.3.3 internal
group-policy policy-3.3.3.3
vpn-tunnel-protocol ikev2

crypto ikev2 policy 1
encryption aes-256
integrity sha
group 5
prf sha
lifetime seconds 86400

Let me know if you need further help . 

HTH

Sandy

[nkarthikeyan]

Hi Darius,

What is the error you are getting on ASA end? What is the crypto ACL you have defined @ your ASA end??? what is the crypto rules or encryption domain @ strongswan end??

If possible provide your end configs as well as strongswan end configs that are related to vpn....

Regards

Karthik