SA520 esp-3des esp-md5-hmac

[thomas.neil]

We need to create a site-to-site VPN with a very large customer. They provided the following list of pre-requisites on our side (they will only use pre-defined configurations)

•PSK for Internet Security Association and Key Management Protocol (ISAKMP)/IKE

•3DES Encryption for ISAKMP/IKE

•MD5 Encryption for IPSec

•3DES Encryption for IPSec

I am new to VPNs and we don't have a large budget for this project (since it is only a test and will never enter production). Using their list of pre-requisites I purchased an SA520-K9. Unfortunately they have since informed us their IPSec requirements are actually:

• ESP-3DES for encryption and data integrity

• a hash algorithm of ESP-MD5 for data integrity

Looking at their configuration file (which they sent us) it appears they are using esp-3des esp-md5-hmac.

I have configured the SA520 according to their initial specification and I get past Phase 1 ok, but get an error on Phase 2 (items in Bold obviously sanitised):

2011-06-14 10:59:34: INFO:  accept a request to establish IKE-SA: xxx.xxx.xxx.xxx

2011-06-14 10:59:34: INFO:  Configuration found for xxx.xxx.xxx.xxx.

2011-06-14 10:59:34: INFO:  Initiating new phase 2 negotiation: xxx.xxx.xxx.xxx[500]<=>xxx.xxx.xxx.xxx[0]

2011-06-14 10:59:34: INFO:  Adjusting encryption mode to use UDP encapsulation

2011-06-14 11:00:34: ERROR:  Phase 2 negotiation failed due to time up. <16digitHexNumber>:<25digitHexNumber>

2011-06-14 11:00:34: INFO:  an undead schedule has been deleted: 'quick_i1prep'.

My questions are:

- can the SA520-K9 support this configuration?

- if so how do i configure it?

- does anyone have a view on whether the requirement of esp-3des esp-md5-hmac is what is causing the problem?

- if i need a different device can anyone recommend an affordable Cisco device?

Thanks in advance.

[thomas.neil]

I have upgraded the firmware on the SA520 (now 2.1.18), deleted and rebuilt the IKE and VPN policies. I now get the following in the VPN log:

2000-01-01 00:39:16: [Cisco] [IKE] INFO:  Using IPsec SA configuration: anonymous

2000-01-01 00:39:16: [Cisco] [IKE] INFO:  Configuration found for xxx.xxx.xxx.xxx.

2000-01-01 00:39:16: [Cisco] [IKE] INFO:  Initiating new phase 2 negotiation: yyy.yyy.yyy.yyy[0]<=>xxx.xxx.xxx.xxx[0]

2000-01-01 00:39:16: [Cisco] [IKE] INFO:  Adjusting encryption mode to use UDP encapsulation

2000-01-01 00:39:16: [Cisco] [IKE] ERROR:  Unknown notify message from xxx.xxx.xxx.xxx[4500].No phase2 handle found.

I could really use some help, I have been struggling with this on and off for a couple of weeks.

[fgasimzade]

Can you post configs please

[thomas.neil]

@fgasimzade

I am not quite sure which configs you are looking for (as I say I am a bit new to VPNs). I have included the SA520.txt from a Backup of the device (with some sanitising) and also the config our customer sent us, i.e. how they have configured their end on a Cisco 7206 VXR .

Cheers

Hope this helps.

[praprama]

Hi neil,

Posting this question in the Small Business comunity might give you better responses since SA 520 is a small business product.

At the same time, there seems to be some incompatibility here, either in the config or in the operation. COuld you get the output of debug cry isa and debug cry ipsec from the 7206 router?

Regards,

Prapanch

[jeevan.koganti]

Hi Thomas,

May be i can answer this question..

Firstly ur router should support VPN connectivity..

Secondly check the sample config below and do accordingly..

1. crypto ipsec transform-set (password/or keyword) esp-3des esp-md5-hmac

2. create a policy for vpn as below

crypto isakmp policy 10

encr 3des

hash md5

authentication pre-share

group 2

lifetime 28800

3. create authentication to publi ip site

crypto isakmp key lagosho address xxx.xxx.xxx.xxx(public ip of far end router) no-xauth

4. create ipsec

crypto map (Password/or keyword)_map 1 ipsec-isakmp

set peer xxx.xxx.xxx.xxx(public ip of far end router)

set transform-set mumscm

match address 103

5. create access-list for the above ipsec

access-list 103 permit ip Local ipof your router(xxx.xxx.xxx.xxx) wildcard mask(xxx.xxx.xxx.xxx) far end router local ip (xxx.xxx.xxx.xxx) wild card mas(xxx.xxx.xxx.xxx)

Now the VPN conncetivity for site to site is ready..reply if u face any issues.

Thanks,

Jeevan.