Solved: Re: Site-to-Site phase 2 failure

bbaker@cccahealth.com · ‎08-23-2018

Been working on a new site-to-site using a asa 5505 from a remote site my company purchased. My ASA cli is rusty and i've gotten stuck after phase one. Site A my my primary was setup via asdm and Site B the new remote i configured via remote ssh.

I'm sure I am missing something small just wanted to get fresh eyes on it.

These are the debugs i get from debug ikev1 7

-- [IKEv1]Group = Site A, IP = Site A, PHASE 1 COMPLETED
-- [IKEv1]IP = Site A, Keep-alive type for this connection: DPD
-- [IKEv1 DEBUG]Group = Site A, IP = Site A, Starting P1 rekey timer: 73440 seconds.
-- [IKEv1]IKE Receiver: Packet received on Site B:500 from Site A:500
-- [IKEv1]IP = Site A, IKE_DECODE RECEIVED Message (msgid=3b8ae495) with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + ID (5) + ID (5) + NOTIFY (11) + NONE (0) total length : 648
-- [IKEv1 DEBUG]Group = Site A, IP = Site A, processing hash payload
-- [IKEv1 DEBUG]Group = Site A, IP = Site A, processing SA payload
-- [IKEv1 DEBUG]Group = Site A, IP = Site A, processing nonce payload
-- [IKEv1 DEBUG]Group = Site A, IP = Site A, processing ID payload
-- [IKEv1]Group = Site A, IP = Site A, Received remote IP Proxy Subnet data in ID Payload:   Address 10.100.0.0, Mask 255.255.0.0, Protocol 0, Port 0
-- [IKEv1 DEBUG]Group = Site A, IP = Site A, processing ID payload
-- [IKEv1]Group = Site A, IP = Site A, Received local IP Proxy Subnet data in ID Payload:   Address 10.1.1.0, Mask 255.255.255.0, Protocol 0, Port 0
-- [IKEv1 DEBUG]Group = Site A, IP = Site A, processing notify payload
-- [IKEv1]Group = Site A, IP = Site A, QM IsRekeyed old sa not found by addr
-- [IKEv1]Group = Site A, IP = Site A, Static Crypto Map check, checking map = OUTSIDE_MAP, seq = 20...
-- [IKEv1]Group = Site A, IP = Site A, Static Crypto Map check, map OUTSIDE_MAP, seq = 20 is a successful match
-- [IKEv1]Group = Site A, IP = Site A, IKE Remote Peer configured for crypto map: OUTSIDE_MAP
-- [IKEv1 DEBUG]Group = Site A, IP = Site A, processing IPSec SA payload
-- [IKEv1]Group = Site A, IP = Site A, All IPSec SA proposals found unacceptable!
-- [IKEv1 DEBUG]Group = Site A, IP = Site A, sending notify message
-- [IKEv1 DEBUG]Group = Site A, IP = Site A, constructing blank hash payload
-- [IKEv1 DEBUG]Group = Site A, IP = Site A, constructing ipsec notify payload for msg id 3b8ae495
-- [IKEv1 DEBUG]Group = Site A, IP = Site A, constructing qm hash payload
-- [IKEv1]IP = Site A, IKE_DECODE SENDING Message (msgid=d9cf55a6) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
-- [IKEv1]Group = Site A, IP = Site A, QM FSM error (P2 struct &0xcc9d1fb8, mess id 0x3b8ae495)!
-- [IKEv1 DEBUG]Group = Site A, IP = Site A, IKE QM Responder FSM error history (struct &0xcc9d1fb8) <state>, <event>: QM_DONE, EV_ERROR-->QM_BLD_MSG2, EV_NEGO_SA-->QM_BLD_MSG2, EV_IS_REKEY-->QM_BLD_MSG2, EV_CONFIRM_SA-->QM_BLD_MSG2, EV_PROC_MSG-->QM_BLD_MSG2, EV_HASH_OK-->QM_BLD_MSG2, NullEvent-->QM_BLD_MSG2, EV_COMP_HASH
-- [IKEv1 DEBUG]Group = Site A, IP = Site A, sending delete/delete with reason message
-- [IKEv1]Group = Site A, IP = Site A, Removing peer from correlator table failed, no match!
-- [IKEv1 DEBUG]Group = Site A, IP = Site A, IKE SA MM:797689c6 rcv'd Terminate: state MM_ACTIVE flags 0x0001c042, refcnt 1, tuncnt 0
-- [IKEv1 DEBUG]Group = Site A, IP = Site A, IKE SA MM:797689c6 terminating: flags 0x0101c002, refcnt 0, tuncnt 0
-- [IKEv1 DEBUG]Group = Site A, IP = Site A, sending delete/delete with reason message
-- [IKEv1 DEBUG]Group = Site A, IP = Site A, constructing blank hash payload
-- [IKEv1 DEBUG]Group = Site A, IP = Site A, constructing IKE delete payload
-- [IKEv1 DEBUG]Group = Site A, IP = Site A, constructing qm hash payload
-- [IKEv1]IP = Site A, IKE_DECODE SENDING Message (msgid=9287bbfc) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 76
-- [IKEv1]Group = Site A, IP = Site A, Session is being torn down. Reason: Phase 2 Mismatch
-- [IKEv1]Ignoring msg to mark SA with dsID 5808128 dead because SA deleted
-- [IKEv1]IKE Receiver: Packet received on Site B:500 from Site A:500
-- [IKEv1]IP = Site A, Received encrypted packet with no matching SA, dropping

Site A

object network Site B
subnet 10.1.1.0 255.255.255.0
object network Site A
subnet 10.100.0.0 255.255.0.0

nat (Inside,Outside) source static Site A Site A destination static Site B Site B

access-list Outside_cryptomap_3 extended permit ip object Site A object Site B

crypto map Outside_map 4 set peer Site B
crypto map Outside_map 4 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

crypto ikev2 policy 1
encryption aes-256
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 10
encryption aes-192
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 20
encryption aes
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 30
encryption 3des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 40
encryption des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 enable Outside
crypto ikev1 enable Outside
crypto ikev1 ipsec-over-tcp port 10000
crypto ikev1 policy 5
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 6
authentication pre-share
encryption 3des
hash md5
group 1
lifetime 86400
crypto ikev1 policy 7
authentication pre-share
encryption aes-192
hash sha
group 1
lifetime 86400
crypto ikev1 policy 8
authentication pre-share
encryption aes-192
hash md5
group 1
lifetime 86400
crypto ikev1 policy 9
authentication pre-share
encryption aes-256
hash sha
group 1
lifetime 86400
crypto ikev1 policy 10
authentication pre-share
encryption 3des
hash sha
group 1
lifetime 86400
crypto ikev1 policy 30
authentication pre-share
encryption aes-256
hash sha
group 5
lifetime 86400
crypto ikev1 policy 50
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400

Site B

Site B(config)# show run
: Saved
:
: Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz
:
ASA Version 9.1(5)21
!
terminal width 180
hostname Site B
domain-name
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
passwd ctbWX11WtXUn1T/X encrypted
names
dns-guard
ip local pool RA_VPN 10.1.200.1-10.1.200.2 mask 255.255.255.252
ip local pool DAVLONG_RA 10.1.200.5-10.1.200.6 mask 255.255.255.252
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
nameif inside
security-level 100
ip address 10.1.50.254 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address Site B 255.255.255.252
!
boot system disk0:/asa915-21-k8.bin
ftp mode passive
clock timezone CST -6
clock summer-time CDT recurring
dns server-group DefaultDNS
domain-name bailey.local
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network RA_VPN_Network
subnet 10.1.200.0 255.255.255.0
object network INSIDE_Network
subnet 10.1.50.0 255.255.255.0
object network Site A
subnet 10.100.0.0 255.255.0.0
description CandC Remote network
object network Site B
subnet 10.1.1.0 255.255.255.0
description Dr Bailey Clinic
object-group network INSIDE_Networks
network-object 10.1.50.0 255.255.255.0
network-object 10.1.99.0 255.255.255.0
network-object 192.168.4.0 255.255.255.0
network-object 192.168.5.0 255.255.255.0
network-object 10.1.3.0 255.255.255.0
network-object 10.1.1.0 255.255.255.0
access-list no_nat extended permit ip 192.168.4.0 255.255.255.0 10.1.200.0 255.255.255.0
access-list no_nat extended permit ip 10.1.50.0 255.255.255.0 10.1.200.0 255.255.255.0
access-list no_nat extended permit ip 10.1.99.0 255.255.255.0 10.1.200.0 255.255.255.0
access-list no_nat extended permit ip 10.1.1.0 255.255.255.0 10.1.200.0 255.255.255.0
access-list no_nat extended permit ip 192.168.5.0 255.255.255.0 10.1.200.0 255.255.255.0
access-list no_nat extended permit ip object Site B object Site A
access-list split_tunnel standard permit 192.168.4.0 255.255.255.0
access-list split_tunnel standard permit 10.1.50.0 255.255.255.0
access-list split_tunnel standard permit 10.1.99.0 255.255.255.0
access-list split_tunnel standard permit 10.1.1.0 255.255.255.0
access-list 100 extended permit ip object Site B object Site A
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 1440
no arp permit-nonconnected
nat (inside,outside) source static INSIDE_Network INSIDE_Network destination static RA_VPN_Network RA_VPN_Network no-proxy-arp route-lookup
nat (inside,outside) source static INSIDE_Networks INSIDE_Networks destination static RA_VPN_Network RA_VPN_Network no-proxy-arp route-lookup
nat (inside,outside) source static Site B Site B destination static Site A Site A
!
object network obj_any
nat (inside,outside) dynamic interface
!
nat (inside,outside) after-auto source dynamic any interface
route outside 0.0.0.0 0.0.0.0 96.18.58.217 1
route inside 10.1.1.0 255.255.255.0 10.1.50.1 1
route inside 10.1.3.0 255.255.255.0 10.1.50.1 1
route inside 10.1.99.0 255.255.255.0 10.1.50.1 1
route inside 192.168.4.0 255.255.255.0 10.1.50.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
http server enable
http 192.168.4.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec ikev1 transform-set myset esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map outside_dyn_map 10 set ikev1 transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 10 set security-association lifetime seconds 288000
crypto dynamic-map outside_dyn_map 10 set reverse-route
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map OUTSIDE_MAP 20 match address 100
crypto map OUTSIDE_MAP 20 set pfs
crypto map OUTSIDE_MAP 20 set peer Site A
crypto map OUTSIDE_MAP 20 set ikev1 transform-set myset ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map OUTSIDE_MAP 20 set security-association lifetime seconds 28800
crypto map OUTSIDE_MAP interface outside
crypto ca trustpool policy
crypto ikev1 enable outside
crypto ikev1 policy 1
authentication pre-share
encryption 3des
hash md5
group 1
lifetime 86400
crypto ikev1 policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh stricthostkeycheck
ssh 192.168.4.0 255.255.255.0 inside
ssh 0.0.0.0 0.0.0.0 inside
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 5
ssh version 2
ssh key-exchange group dh-group14-sha1
console timeout 0

dhcpd auto_config outside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 129.6.15.28 source outside
group-policy CANDC internal
group-policy CANDC attributes
vpn-tunnel-protocol ikev1
group-policy RA_VPN internal
group-policy RA_VPN attributes
wins-server value 192.168.4.4
dns-server value 192.168.4.4
vpn-tunnel-protocol ikev1
split-tunnel-policy tunnelspecified
split-tunnel-network-list value split_tunnel
default-domain value bailey.local
split-dns value bailey.local
address-pools value RA_VPN
group-policy DAVLONG_RA internal
group-policy DAVLONG_RA attributes
dns-server value 192.168.4.4
vpn-tunnel-protocol ikev1
split-tunnel-policy tunnelspecified
split-tunnel-network-list value split_tunnel
split-dns value bailey.local
address-pools value DAVLONG_RA
tunnel-group RA_VPN type remote-access
tunnel-group RA_VPN general-attributes
address-pool RA_VPN
default-group-policy RA_VPN
tunnel-group RA_VPN ipsec-attributes
ikev1 pre-shared-key *****
tunnel-group DAVLONG_RA type remote-access
tunnel-group DAVLONG_RA general-attributes
address-pool DAVLONG_RA
default-group-policy DAVLONG_RA
tunnel-group DAVLONG_RA ipsec-attributes
ikev1 pre-shared-key *****
tunnel-group Site A type ipsec-l2l
tunnel-group Site A ipsec-attributes
ikev1 pre-shared-key *****
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect icmp
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:27a605538e30d628f6e7a53206c4a737

Rahul Govindan · ‎08-23-2018

Key message in the debug is:

-- [IKEv1]Group = Site A, IP = Site A, All IPSec SA proposals found unacceptable!

On your Site B you have:

crypto map OUTSIDE_MAP 20 match address 100
crypto map OUTSIDE_MAP 20 set pfs
crypto map OUTSIDE_MAP 20 set peer Site A
crypto map OUTSIDE_MAP 20 set ikev1 transform-set myset ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map OUTSIDE_MAP 20 set security-association lifetime seconds 28800
crypto map OUTSIDE_MAP interface outside

On your site A, I only see a partial config:

crypto map Outside_map 4 set peer Site B
crypto map Outside_map 4 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

I am assuming the "crypto map Outside_map 4 match Outside_cryptomap_3" and "crypto map Outside_map 4 interface outside" commands are also present. Can you check if PFS is enabled? You should have the following commands on Site A as well:

crypto map Outside_map 4 set pfs

crypto map Outside_map 4 set security-association lifetime seconds 28800

View solution in original post

Rahul Govindan · ‎08-23-2018