Site-to-Site VPN not taking the configured proposal

Josh Green · ‎03-12-2019

Hi all,

Bit of a strange one. Hoping someone may be able to advise.

I'm configuring a new Ikev2 site-to-site VPN on a Cisco 2921 to a customer/3rd party Cisco ASA, we're running both Ikev1 + Ikev2 vpns on here at the moment. It seems like the newly configured VPN isn't using the configured ikev2 policy/proposal and looks like it's defaulting to the 'Smart Default' settings. as per the debug output below:

IKEv2 IKE_SA_INIT Exchange REQUEST
Mar 12 10:51:06.637: IKEv2-PAK:(SESSION ID = 476817,SA ID = 1):Next payload: SA, version: 2.0 Exchange type: IKE_SA_
Payload contents:

Proposal: 1, Protocol id: IKE, SPI size: 0, #trans: 4 last transform: 0x3, reserved: 0x0: length: 12

type: 1, reserved: 0x0, id: AES-CBC

last transform: 0x3, reserved: 0x0: length: 8

type: 2, reserved: 0x0, id: SHA1

last transform: 0x3, reserved: 0x0: length: 8

type: 3, reserved: 0x0, id: SHA96

last transform: 0x0, reserved: 0x0: length: 8

type: 4, reserved: 0x0, id: DH_GROUP_1024_MODP/Group

KE Next payload: N, reserved: 0x0, length: 136
DH group: 2, Reserved: 0x0
N Next payload: VID, reserved: 0x0, length: 36
VID Next payload: VID, reserved: 0x0, length: 23
VID Next payload: NOTIFY, reserved: 0x0, length: 21
NOTIFY(NAT_DETECTION_SOURCE_IP) Next payload: NOTIFY, reserved: 0x0, length: 28
Security protocol id: Unknown - 0, spi size: 0, type: NAT_DETECTION_SOURCE_IP
NOTIFY(NAT_DETECTION_DESTINATION_IP) Next payload: NONE, reserved: 0x0, length: 28
Security protocol id: Unknown - 0, spi size: 0, type: NAT_DETECTION_DESTINATION_IP

Mar 12 10:51:06.637: IKEv2-INTERNAL:(SESSION ID = 476817,SA ID = 1):SM Trace-> SA: I_SPI=A7B3A162BD1F8B21 R_SPI=0000
Mar 12 10:51:06.637: IKEv2:(SESSION ID = 476817,SA ID = 1):Insert SA
Mar 12 10:51:06.637: IKEv2-INTERNAL:(SESSION ID = 476817,SA ID = 1):SM Trace-> SA: I_SPI=A7B3A162BD1F8B21 R_SPI=0000

Mar 12 10:51:06.645: IKEv2:(SESSION ID = 476817,SA ID = 1):Received Packet [From <peer>:500/To <me>
Initiator SPI : A7B3A162BD1F8B21 - Responder SPI : A5C59A29D3E3BB9A Message id: 0
IKEv2 IKE_SA_INIT Exchange RESPONSE
Mar 12 10:51:06.645: IKEv2-PAK:(SESSION ID = 476817,SA ID = 1):Next payload: NOTIFY, version: 2.0 Exchange type: IKE
Payload contents:
NOTIFY(NO_PROPOSAL_CHOSEN) Next payload: NONE, reserved: 0x0, length: 8
Security protocol id: IKE, spi size: 0, type: NO_PROPOSAL_CHOSEN

The 'no proposal chosen' error is the one that's causing me a bit of a headache..

My config is as follows:

crypto ikev2 proposal 1
encryption aes-cbc-256
integrity sha256
group 19

crypto ikev2 policy 1
proposal 1

crypto ipsec transform-set <TS-Name> esp-aes 256 esp-sha256-hmac
mode tunnel

crypto ikev2 profile <3rd party>-Profile
match address local <xyz>
match identity remote address <peer ip> 255.255.255.255
identity local address <xyz>
authentication local pre-share
authentication remote pre-share
keyring local <3rd party>-PSK

crypto map vpn 59 ipsec-isakmp

description <3rd party crypto map>
set peer <peer ip>
set security-association lifetime seconds 86400
set transform-set <3rd party TS>
set pfs group19
set ikev2-profile <3rd party>-Profile
match address <3rd party> - ACL

Is there anything missing? I feel like i'm chasing shadows with this one at the moment. The customer has sent me their config and it looks like it matches mine. Seems like the router is just ignoring the proposal/policy?

Cheers,

Josh

Rob Ingram · ‎03-12-2019

Hi,
Can you post the configuration of the ASA?
You shouldn't need "match address local <xyz>" under the IKEv2 profile.
Can you provide the full IKEv2 debug from the router

Josh Green · ‎03-12-2019

Hi,

Thanks for the quick response.

ASA Config:

crypto ikev2 policy 5
encryption aes-256
integrity sha256
group 19
prf sha256
lifetime seconds 86400

crypto ipsec ikev2 ipsec-proposal 5
protocol esp encryption aes-256
protocol esp integrity sha-256

crypto map outside_map 10 set pfs group19
crypto map outside_map 10 set peer <Router peer ip>
crypto map outside_map 10 set ikev2 ipsec-proposal 5

crypto map outside_map 10 match address Enc_Domain

I'm happy the encryption domain/crypto ACLs are ok but i can share them if you like?

Full debug output:

Mar 12 11:59:14.007: IKEv2-INTERNAL:(SESSION ID = 476829,SA ID = 1):SM Trace-> SA: I_SPI=69F88680A54D9AD0 R_SPI=0000000000000000 (I) MsgID = 0 CurState: IDLE Event: EV_INIT_SA
Mar 12 11:59:14.007: IKEv2-INTERNAL:(SESSION ID = 476829,SA ID = 1):SM Trace-> SA: I_SPI=69F88680A54D9AD0 R_SPI=0000000000000000 (I) MsgID = 0 CurState: I_BLD_INIT Event: EV_GET_IKE_POLICY
Mar 12 11:59:14.007: IKEv2-INTERNAL:(SESSION ID = 476829,SA ID = 1):SM Trace-> SA: I_SPI=69F88680A54D9AD0 R_SPI=0000000000000000 (I) MsgID = 0 CurState: I_BLD_INIT Event: EV_SET_POLICY
Mar 12 11:59:14.007: IKEv2-INTERNAL:(SESSION ID = 476829,SA ID = 1):Setting configured policies
Mar 12 11:59:14.007: IKEv2-INTERNAL:(SESSION ID = 476829,SA ID = 1):SM Trace-> SA: I_SPI=69F88680A54D9AD0 R_SPI=0000000000000000 (I) MsgID = 0 CurState: I_BLD_INIT Event: EV_CHK_AUTH4PKI
Mar 12 11:59:14.007: IKEv2-INTERNAL:(SESSION ID = 476829,SA ID = 1):SM Trace-> SA: I_SPI=69F88680A54D9AD0 R_SPI=0000000000000000 (I) MsgID = 0 CurState: I_BLD_INIT Event: EV_GEN_DH_KEY
Mar 12 11:59:14.007: IKEv2:(SESSION ID = 476829,SA ID = 1):[IKEv2 -> Crypto Engine] Computing DH public key, DH Group 2
Mar 12 11:59:14.007: IKEv2:(SESSION ID = 476829,SA ID = 1):Request queued for computation of DH key
Mar 12 11:59:14.007: IKEv2-INTERNAL:(SESSION ID = 476829,SA ID = 1):SM Trace-> SA: I_SPI=69F88680A54D9AD0 R_SPI=0000000000000000 (I) MsgID = 0 CurState: I_BLD_INIT Event: EV_NO_EVENT
Mar 12 11:59:14.007: IKEv2-INTERNAL:(SESSION ID = 476829,SA ID = 1):SM Trace-> SA: I_SPI=69F88680A54D9AD0 R_SPI=0000000000000000 (I) MsgID = 0 CurState: I_BLD_INIT Event: EV_OK_RECD_DH_PUBKEY_RESP
Mar 12 11:59:14.007: IKEv2-INTERNAL:(SESSION ID = 476829,SA ID = 1):Action: Action_Null
Mar 12 11:59:14.007: IKEv2-INTERNAL:(SESSION ID = 476829,SA ID = 1):SM Trace-> SA: I_SPI=69F88680A54D9AD0 R_SPI=0000000000000000 (I) MsgID = 0 CurState: I_BLD_INIT Event: EV_GET_CONFIG_MODE
Mar 12 11:59:14.007: IKEv2-INTERNAL:(SESSION ID = 476829,SA ID = 1):SM Trace-> SA: I_SPI=69F88680A54D9AD0 R_SPI=0000000000000000 (I) MsgID = 0 CurState: I_BLD_INIT Event: EV_BLD_MSG
Mar 12 11:59:14.007: IKEv2:(SESSION ID = 476829,SA ID = 1):Generating IKE_SA_INIT message
Mar 12 11:59:14.007: IKEv2:(SESSION ID = 476829,SA ID = 1):IKE Proposal: 1, SPI size: 0 (initial negotiation),
Num. transforms: 4
AES-CBC SHA1 SHA96 DH_GROUP_1024_MODP/Group 2

Mar 12 11:59:14.007: IKEv2:(SESSION ID = 476829,SA ID = 1):Sending Packet [To <ASA>:500/From <Router>:500/VRF i0:f0]
Initiator SPI : 69F88680A54D9AD0 - Responder SPI : 0000000000000000 Message id: 0
IKEv2 IKE_SA_INIT Exchange REQUEST
Mar 12 11:59:14.007: IKEv2-PAK:(SESSION ID = 476829,SA ID = 1):Next payload: SA, version: 2.0 Exchange type: IKE_SA_INIT, flags: INITIATOR Message id: 0, length: 348
Payload contents:
SA Next payload: KE, reserved: 0x0, length: 48
last proposal: 0x0, reserved: 0x0, length: 44
Proposal: 1, Protocol id: IKE, SPI size: 0, #trans: 4 last transform: 0x3, reserved: 0x0: length: 12
type: 1, reserved: 0x0, id: AES-CBC
last transform: 0x3, reserved: 0x0: length: 8
type: 2, reserved: 0x0, id: SHA1
last transform: 0x3, reserved: 0x0: length: 8
type: 3, reserved: 0x0, id: SHA96
last transform: 0x0, reserved: 0x0: length: 8
type: 4, reserved: 0x0, id: DH_GROUP_1024_MODP/Group 2
KE Next payload: N, reserved: 0x0, length: 136
DH group: 2, Reserved: 0x0
N Next payload: VID, reserved: 0x0, length: 36
VID Next payload: VID, reserved: 0x0, length: 23
VID Next payload: NOTIFY, reserved: 0x0, length: 21
NOTIFY(NAT_DETECTION_SOURCE_IP) Next payload: NOTIFY, reserved: 0x0, length: 28
Security protocol id: Unknown - 0, spi size: 0, type: NAT_DETECTION_SOURCE_IP
NOTIFY(NAT_DETECTION_DESTINATION_IP) Next payload: NONE, reserved: 0x0, length: 28
Security protocol id: Unknown - 0, spi size: 0, type: NAT_DETECTION_DESTINATION_IP

Mar 12 11:59:14.011: IKEv2-INTERNAL:(SESSION ID = 476829,SA ID = 1):SM Trace-> SA: I_SPI=69F88680A54D9AD0 R_SPI=0000000000000000 (I) MsgID = 0 CurState: I_BLD_INIT Event: EV_INSERT_SA
Mar 12 11:59:14.011: IKEv2:(SESSION ID = 476829,SA ID = 1):Insert SA
Mar 12 11:59:14.011: IKEv2-INTERNAL:(SESSION ID = 476829,SA ID = 1):SM Trace-> SA: I_SPI=69F88680A54D9AD0 R_SPI=0000000000000000 (I) MsgID = 0 CurState: I_WAIT_INIT Event: EV_NO_EVENT

Mar 12 11:59:14.015: IKEv2:(SESSION ID = 476829,SA ID = 1):Received Packet [From <ASA>:500/To <Router>:500/VRF i0:f0]
Initiator SPI : 69F88680A54D9AD0 - Responder SPI : 00F0A8B3EB4ABE56 Message id: 0
IKEv2 IKE_SA_INIT Exchange RESPONSE
Mar 12 11:59:14.015: IKEv2-PAK:(SESSION ID = 476829,SA ID = 1):Next payload: NOTIFY, version: 2.0 Exchange type: IKE_SA_INIT, flags: RESPONDER MSG-RESPONSE Message id: 0, length: 36
Payload contents:
NOTIFY(NO_PROPOSAL_CHOSEN) Next payload: NONE, reserved: 0x0, length: 8
Security protocol id: IKE, spi size: 0, type: NO_PROPOSAL_CHOSEN

Mar 12 11:59:14.019: IKEv2-INTERNAL:(SESSION ID = 476829,SA ID = 1):SM Trace-> SA: I_SPI=69F88680A54D9AD0 R_SPI=00F0A8B3EB4ABE56 (I) MsgID = 0 CurState: I_WAIT_INIT Event: EV_RECV_INIT
Mar 12 11:59:14.019: IKEv2-INTERNAL:(SESSION ID = 476829,SA ID = 1):Processing IKE_SA_INIT message
Mar 12 11:59:14.019: IKEv2-INTERNAL:(SESSION ID = 476829,SA ID = 1):SM Trace-> SA: I_SPI=69F88680A54D9AD0 R_SPI=00F0A8B3EB4ABE56 (I) MsgID = 0 CurState: I_PROC_INIT Event: EV_CHK4_NOTIFY
Mar 12 11:59:14.019: IKEv2:(SESSION ID = 476829,SA ID = 1):Processing IKE_SA_INIT message
Mar 12 11:59:14.019: IKEv2-ERROR:(SESSION ID = 476829,SA ID = 1):: Received no proposal chosen notify
Mar 12 11:59:14.019: IKEv2-INTERNAL:(SESSION ID = 476829,SA ID = 1):SM Trace-> SA: I_SPI=69F88680A54D9AD0 R_SPI=00F0A8B3EB4ABE56 (I) MsgID = 0 CurState: INIT_DONE Event: EV_FAIL
Mar 12 11:59:14.019: IKEv2:(SESSION ID = 476829,SA ID = 1):Failed SA init exchange
Mar 12 11:59:14.019: IKEv2-ERROR:(SESSION ID = 476829,SA ID = 1):Initial exchange failed: Initial exchange failed
Mar 12 11:59:14.019: IKEv2-INTERNAL:(SESSION ID = 476829,SA ID = 1):SM Trace-> SA: I_SPI=69F88680A54D9AD0 R_SPI=00F0A8B3EB4ABE56 (I) MsgID = 0 CurState: EXIT Event: EV_ABORT
Mar 12 11:59:14.019: IKEv2-INTERNAL:(SESSION ID = 476829,SA ID = 1):SM Trace-> SA: I_SPI=69F88680A54D9AD0 R_SPI=00F0A8B3EB4ABE56 (I) MsgID = 0 CurState: EXIT Event: EV_CHK_PENDING_ABORT
Mar 12 11:59:14.019: IKEv2-INTERNAL:(SESSION ID = 476829,SA ID = 1):SM Trace-> SA: I_SPI=69F88680A54D9AD0 R_SPI=00F0A8B3EB4ABE56 (I) MsgID = 0 CurState: EXIT Event: EV_CHK_GKM
MAN-MCIR02-MC1#
Mar 12 11:59:14.019: IKEv2-INTERNAL:(SESSION ID = 476829,SA ID = 1):SM Trace-> SA: I_SPI=69F88680A54D9AD0 R_SPI=00F0A8B3EB4ABE56 (I) MsgID = 0 CurState: EXIT Event: EV_UPDATE_CAC_STATS
Mar 12 11:59:14.019: IKEv2:(SESSION ID = 476829,SA ID = 1):Abort exchange
Mar 12 11:59:14.019: IKEv2:(SESSION ID = 476829,SA ID = 1):Deleting SA

Regards,

Josh

Rob Ingram · ‎03-12-2019

Hi,

You have PRF configured on the ASA but not the router

ROUTER

crypto ikev2 proposal 1
encryption aes-cbc-256
integrity sha256
group 19

ASA

crypto ikev2 policy 5
encryption aes-256
integrity sha256
group 19
prf sha256
lifetime seconds 86400

Add it to the router configuration and try again

HTH

Josh Green · ‎03-12-2019

Hi,

I've added the config:
# sh crypto ikev2 proposal 1
IKEv2 proposal: 1
Encryption : AES-CBC-256
Integrity : SHA256
PRF : SHA256
DH Group : DH_GROUP_256_ECP/Group 19

Still no joy. Can't help but this this may be some kind of IOS bug? There's no reason as to why it shouldn't be choosing the created policy.. (That i can see)

Rob Ingram · ‎03-12-2019

What is the PSK Keyring configuration on the router?
What is the ASA tunnel group configuration?

The "identity local address" configured on the router is the external interface IP address of the router?

Increase the debug level of IKEv2 and upload the output:-
debug crypto ikev2 platform 100
debug crypto ikev2 protocol 100

Josh Green · ‎03-12-2019

Hi,
Router:

crypto ikev2 keyring <3rd party>
peer <3rd party ASA>
address <3rd party ASA IP>
pre-shared-key local <xyz>
pre-shared-key remote <abc>

The "identity local address" configured on the router is the external interface IP address of the router? - Yes it is.

ASA:
tunnel-group <Router IP> type ipsec-l2l
tunnel-group <Router IP> ipsec-attributes
ikev2 remote-authentication pre-shared-key <xyz>
ikev2 local-authentication pre-shared-key <abc>

I cannot fetch the debugs from the 3rd party it's been difficult to get hold of them.. will request.

Cheers,

Rob Ingram · ‎03-12-2019

Ok, was just checking, the rest of the configuration looks ok.

Re-checking the posts, from the logs it definately looks like it's sending the following:-
AES-CBC SHA1 SHA96 DH_GROUP_1024_MODP/Group 2

...which is probably the smart default proposals, you could disable the smart defaults - assuming they aren't using them already?

no crypto ikev2 policy default
no crypto ikev2 proposal default

See if it tries to use your IKEv2 Proposal. It should always use a custom Proposal rather than the smart defaults, it certainly does in my lab.

What IOS version are you running?

Josh Green · ‎03-14-2019

Hi,

Sorry the delayed response.

Yes i believe it is defaulting to the smart default proposals. This seems to be the case for another 2 Ikev2 S2S VPNs that we have configured despite them having their own proposals configured too. I amended the default proposal with the additional hashing/encryption ciphers but it still refuses to take them when it offers it's policy to the peer.

IOS version is - Version 15.5(3)M5 -