Site-to-Site VPN between Cisco ASA and Microsoft Azure Virtual Network with IKEV2

[ermionline]

Hi Guys,

I just wanted to establish a site-to -site VPN from my ASA to a remote AZURE Virtual network using IKEV2 but i failed to do so. When i run debug crypto ikev2 platfrorm 127, i saw  

Crypto Map: No proxy match on map outside_map seq 1

Please Help

[rasmus.elmholt]

Hi

I had the same problem once.
Have you followed the guide from MS: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-3rdparty-device-config-cisco-asa

And used a Route-Based VPN Gateway, and PolicyBased Traffic Selectors?

[ermionline]

Yeah, but still same problem

[GioGonza]

Hello @ermionline,

Can you post the complete debug so I can check further, pls.

Have a good one!

Gio

[ermionline]

Thank You.

I attached the deubg file

[GioGonza]

Hey, 

I checked the debugs and found this: 

IKEv2-PLAT-2: (1772): Crypto Map: No proxy match on map outside_map seq 1
IKEv2-PLAT-2: (1772): Crypto map outside_map seq 22 is incomplete
IKEv2-PROTO-1: (1772): Failed to find a matching policy
IKEv2-PROTO-1: (1772): Received Policies:
ESP: Proposal 1: AES-GCM-256 Don't use ESN

ESP: Proposal 2: AES-CBC-256 SHA96 Don't use ESN

ESP: Proposal 3: 3DES SHA96 Don't use ESN

ESP: Proposal 4: AES-CBC-256 SHA256 Don't use ESN

ESP: Proposal 5: AES-CBC-128 SHA96 Don't use ESN

ESP: Proposal 6: 3DES SHA256 Don't use ESN

The ASA is trying to match the SA with the ACL and it doesn´t find anything related to land in the proper crypto map sequence, also there are the IPSec proposals from the other side. 

You need to check the ACL for that particular tunnel and try to match the ESP configuration, after you verify that, try again and if it doesn´t work, upload the debugs one more time. 

Have a good one!

Gio

[PJ]

I am seeing the same issues on the Cisco ASA Version 9.1(6)4 to Microsoft Azure VPN. Any updates on this issue?

Thanks

[jan_chrillesen]

I had the same issue and changing the ESP encryption protocol worked

# old config - from Azure template

crypto ipsec ikev2 ipsec-proposal AES-256
protocol esp encryption aes-256
protocol esp integrity sha-1

# new config

crypto ipsec ikev2 ipsec-proposal AES-GCM-256
protocol esp encryption aes-gcm-256
protocol esp integrity sha-256

# We accept both old and new proposals in case something is changed on the Azure side

crypto map vpn-crypto-map 1 set ikev2 ipsec-proposal AES-256 AES-GCM-256

Software 9.8(1) on ASAv