ciscoasa1

Tormod Macleod · ‎06-19-2013

Hello,

I'm trying to set up a site to site VPN. I've never done this before and can't get it to work. I've watched training vids online and thought it looked straight forward enough. My problem appears to be that th ASA is not trying to create a tunnel. It doesn't seem to know that this traffic should be sent over the tunnel. Both the outside interfaces can ping one another and are on the same subnet.

I've pasted the two configs below. They're just base configs with all the VPN commands having been created by the wizard. I've not put any routes in as the two devices are on the same subnet. If you can see my mistake I'd be very grateful to you if you could point it out or even point me in the right direction.

Cheers,

Tormod

ciscoasa1

: Saved

: Written by enable_15 at 05:11:30.489 UTC Wed Jun 19 2013

!

ASA Version 8.2(5)13

!

hostname ciscoasa1

enable password 8Ry2YjIyt7RRXU24 encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

!

interface GigabitEthernet0/0

nameif outside

security-level 0

ip address 1.1.1.1 255.255.255.0

!

interface GigabitEthernet0/1

nameif inside

security-level 100

ip address 10.1.1.1 255.255.255.0

!

interface GigabitEthernet0/2

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet0/3

shutdown

no nameif

no security-level

no ip address

!

interface Management0/0

shutdown

no nameif

no security-level

no ip address

!

ftp mode passive

access-list outside_1_cryptomap extended permit ip 10.1.1.0 255.255.255.0 10.1.2.0 255.255.255.0

access-list inside_nat0_outbound extended permit ip 10.1.1.0 255.255.255.0 10.1.2.0 255.255.255.0

pager lines 24

logging enable

logging asdm informational

mtu outside 1500

mtu inside 1500

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

nat (inside) 0 access-list inside_nat0_outbound

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

http server enable

http 0.0.0.0 0.0.0.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto map outside_map 1 match address outside_1_cryptomap

crypto map outside_map 1 set pfs group1

crypto map outside_map 1 set peer 1.1.1.2

crypto map outside_map 1 set transform-set ESP-3DES-SHA

crypto map outside_map interface outside

crypto isakmp enable outside

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

crypto isakmp policy 65535

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

telnet timeout 5

ssh 0.0.0.0 0.0.0.0 inside

ssh timeout 5

console timeout 0

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

username cisco password 3USUcOPFUiMCO4Jk encrypted privilege 15

tunnel-group 1.1.1.2 type ipsec-l2l

tunnel-group 1.1.1.2 ipsec-attributes

pre-shared-key ciscocisco

!

class-map inspection_default

match default-inspection-traffic

!

policy-map type inspect dns preset_dns_map

parameters

message-length maximum client auto

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect ip-options

inspect netbios

inspect rsh

inspect rtsp

inspect skinny

inspect esmtp

inspect sqlnet

inspect sunrpc

inspect tftp

inspect sip

inspect xdmcp

!

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

call-home

profile CiscoTAC-1

no active

destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

destination address email callhome@cisco.com

destination transport-method http

subscribe-to-alert-group diagnostic

subscribe-to-alert-group environment

subscribe-to-alert-group inventory periodic monthly

subscribe-to-alert-group configuration periodic monthly

subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:29e3cdb2d704736b7fbbc477e8418d65

: end

ciscoasa2

: Saved

: Written by enable_15 at 15:40:31.509 UTC Wed Jun 19 2013

!

ASA Version 8.2(5)13

!

hostname ciscoasa2

enable password 8Ry2YjIyt7RRXU24 encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

!

interface Ethernet0/0

nameif outside

security-level 0

ip address 1.1.1.2 255.255.255.0

!

interface Ethernet0/1

nameif inside

security-level 100

ip address 10.1.2.1 255.255.255.0

!

interface Ethernet0/2

shutdown

no nameif

no security-level

no ip address

!

interface Ethernet0/3

shutdown

no nameif

no security-level

no ip address

!

interface Management0/0

shutdown

no nameif

no security-level

no ip address

!

ftp mode passive

access-list outside_1_cryptomap extended permit ip 10.1.2.0 255.255.255.0 10.1.1.0 255.255.255.0

access-list inside_nat0_outbound extended permit ip 10.1.2.0 255.255.255.0 10.1.1.0 255.255.255.0

pager lines 24

logging enable

logging asdm informational

mtu outside 1500

mtu inside 1500

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

nat (inside) 0 access-list inside_nat0_outbound

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

http server enable

http 0.0.0.0 0.0.0.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto map outside_map 1 match address outside_1_cryptomap

crypto map outside_map 1 set pfs group1

crypto map outside_map 1 set peer 1.1.1.1

crypto map outside_map 1 set transform-set ESP-3DES-SHA

crypto map outside_map interface outside

crypto isakmp enable outside

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

crypto isakmp policy 65535

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

telnet timeout 5

ssh 0.0.0.0 0.0.0.0 inside

ssh timeout 5

console timeout 0

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

username cisco password 3USUcOPFUiMCO4Jk encrypted privilege 15

tunnel-group 1.1.1.1 type ipsec-l2l

tunnel-group 1.1.1.1 ipsec-attributes

pre-shared-key ciscocisco

!

class-map inspection_default

match default-inspection-traffic

!

policy-map type inspect dns preset_dns_map

parameters

message-length maximum client auto

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect ip-options

inspect netbios

inspect rsh

inspect rtsp

inspect skinny

inspect esmtp

inspect sqlnet

inspect sunrpc

inspect tftp

inspect sip

inspect xdmcp

!

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

call-home

profile CiscoTAC-1

no active

destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

destination address email callhome@cisco.com

destination transport-method http

subscribe-to-alert-group diagnostic

subscribe-to-alert-group environment

subscribe-to-alert-group inventory periodic monthly

subscribe-to-alert-group configuration periodic monthly

subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:92dca65f5c2cf16486aa7d564732b0e1

: end

Jouni Forss · ‎06-19-2013

Hi,

While your ASAs directly connected by the same network dont need a route to communicate with eachother the VPN traffic still needs a route for the remote network so that the traffic will be forwarded to the L2L VPN connection.

To my understanding the ASA should do a route lookup before anything related to the VPN is done. With this is mind the ASA cant really decide where to forward the traffic as it doesnt even have a default route for the traffic that it doesnt know the specific route for.

So I would imagine that you either need to add this on both ASAs

crypto map outside_map 1 set reverse-route

and/or

Configure a default route on each ASA pointing to the other ASA so they can choose the correct interface for the traffic destined to the other side of the L2L VPN.

Try these and let me know if it works for you.

Hope this helps

Please do remember to mark the reply as the correct answer if it answered your question.

Ask more if needed

- Jouni

View solution in original post

Jouni Forss · ‎06-19-2013

Hi,

While your ASAs directly connected by the same network dont need a route to communicate with eachother the VPN traffic still needs a route for the remote network so that the traffic will be forwarded to the L2L VPN connection.

To my understanding the ASA should do a route lookup before anything related to the VPN is done. With this is mind the ASA cant really decide where to forward the traffic as it doesnt even have a default route for the traffic that it doesnt know the specific route for.

So I would imagine that you either need to add this on both ASAs

crypto map outside_map 1 set reverse-route

and/or

Configure a default route on each ASA pointing to the other ASA so they can choose the correct interface for the traffic destined to the other side of the L2L VPN.

Try these and let me know if it works for you.

Hope this helps

Please do remember to mark the reply as the correct answer if it answered your question.

Ask more if needed

- Jouni

Tormod Macleod · ‎06-20-2013

Thanks very much for your help Jouni. I came in this morning and ran the crypto map outside_map 1 set reverse-route command and everything started to work. I'm surprised the wizard didn't include that command but maybe it's because I didn't have a default route set.

However, I now have a new problem. We're working towards migrating from ASA8.2 to 9.1. In order to prepare for this I've created a mock of our environment and am testing that everything works prior to making the changes. I can't get this site to site VPN to work. (The one I posted yesterday was just to get a basic site to site VPN working so that I could go from there)

I've posted the debug from the ASA to which I'm trying to connect. To my undtrained eye it looks like it completes phase one but fails to match a vpn tunnel map. I'm coming from 10.99.99.99 going to 10.1.1.57

Hope you can help as I'm going nuts here. Although I will of course understand if you've something better to do with your time than bail me out.

access-list 1111_cryptomap extended permit ip 10.1.1.0 255.255.255.0 Private1 255.255.255.0

access-list 1111_cryptomap extended permit ip 10.99.99.0 255.255.255.0 10.1.1.0 255.255.255.0

crypto map vpntunnelmap 1 match address 1111_cryptomap

crypto map vpntunnelmap 1 set pfs

crypto map vpntunnelmap 1 set peer 1.1.1.1

crypto map vpntunnelmap 1 set transform-set ESP-3DES-MD5

ciscoasa# debug crypto isakmp 255

IKE Recv RAW packet dump

db 86 ce 3f 3a a9 e7 0a 00 00 00 00 00 00 00 00 | ...?:...........

01 10 02 00 00 00 00 00 00 00 00 f4 0d 00 00 84 | ................

00 00 00 01 00 00 00 01 00 00 00 78 01 01 00 03 | ...........x....

03 00 00 24 01 01 00 00 80 04 00 02 80 01 00 05 | ...$............

80 02 00 02 80 03 00 01 80 0b 00 01 00 0c 00 04 | ................

00 00 70 80 03 00 00 28 02 01 00 00 80 04 00 02 | ..p....(........

80 01 00 07 80 0e 00 c0 80 02 00 02 80 03 00 01 | ................

80 0b 00 01 00 0c 00 04 00 00 70 80 00 00 00 24 | ..........p....$

03 01 00 00 80 04 00 02 80 01 00 05 80 02 00 01 | ................

80 03 00 01 80 0b 00 01 00 0c 00 04 00 01 51 80 | ..............Q.

0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 81 b5 | ........>.in.c..

ec 42 7b 1f 0d 00 00 14 7d 94 19 a6 53 10 ca 6f | .B{.....}...S..o

2c 17 9d 92 15 52 9d 56 0d 00 00 14 4a 13 1c 81 | ,....R.V....J...

07 03 58 45 5c 57 28 f2 0e 95 45 2f 00 00 00 18 | ..XE\W(...E/....

40 48 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 c2 d3 | @H..n...%.....

c0 00 00 00 | ....

RECV PACKET from 1.1.1.2

ISAKMP Header

Initiator COOKIE: db 86 ce 3f 3a a9 e7 0a

Responder COOKIE: 00 00 00 00 00 00 00 00

Next Payload: Security Association

Version: 1.0

Exchange Type: Identity Protection (Main Mode)

Flags: (none)

MessageID: 00000000

Length: 244

Payload Security Association

Next Payload: Vendor ID

Reserved: 00

Payload Length: 132

DOI: IPsec

Situation:(SIT_IDENTITY_ONLY)

Payload Proposal

Next Payload: None

Reserved: 00

Payload Length: 120

Proposal #: 1

Protocol-Id: PROTO_ISAKMP

SPI Size: 0

# of transforms: 3

Payload Transform

Next Payload: Transform

Reserved: 00

Payload Length: 36

Transform #: 1

Transform-Id: KEY_IKE

Reserved2: 0000

Group Description: Group 2

Encryption Algorithm: 3DES-CBC

Hash Algorithm: SHA1

Authentication Method: Preshared key

Life Type: seconds

Life Duration (Hex): 00 00 70 80

Payload Transform

Next Payload: Transform

Reserved: 00

Payload Length: 40

Transform #: 2

Transform-Id: KEY_IKE

Reserved2: 0000

Group Description: Group 2

Encryption Algorithm: AES-CBC

Key Length: 192

Hash Algorithm: SHA1

Authentication Method: Preshared key

Life Type: seconds

Life Duration (Hex): 00 00 70 80

Payload Transform

Next Payload: None

Reserved: 00

Payload Length: 36

Transform #: 3

Transform-Id: KEY_IKE

Reserved2: 0000

Group Description: Group 2

Encryption Algorithm: 3DES-CBC

Hash Algorithm: MD5

Authentication Method: Preshared key

Life Type: seconds

Life Duration (Hex): 00 01 51 80

Payload Vendor ID

Next Payload: Vendor ID

Reserved: 00

Payload Length: 20

Data (In Hex):

90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 7b 1f

Payload Vendor ID

Next Payload: Vendor ID

Reserved: 00

Payload Length: 20

Data (In Hex):

7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56

Payload Vendor ID

Next Payload: Vendor ID

Reserved: 00

Payload Length: 20

Data (In Hex):

4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f

Payload Vendor ID

Next Payload: None

Reserved: 00

Payload Length: 24

Data (In Hex):

40 48 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 c2 d3

c0 00 00 00

Jun 20 16:29:42 [IKEv1]: IP = 1.1.1.2, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 244

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing SA payload

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Oakley proposal is acceptable

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing VID payload

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Received NAT-Traversal ver 02 VID

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing VID payload

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Received NAT-Traversal ver 03 VID

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing VID payload

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Received NAT-Traversal RFC VID

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing VID payload

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Received Fragmentation VID

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, IKE Peer included IKE fragmentation capability flags: Main Mode: True Aggressive Mode: True

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing IKE SA payload

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, IKE SA Proposal # 1, Transform # 1 acceptable Matches global IKE entry # 1

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, constructing ISAKMP SA payload

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, constructing Fragmentation VID + extended capabilities payload

Jun 20 16:29:42 [IKEv1]: IP = 1.1.1.2, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 104

SENDING PACKET to 1.1.1.2

ISAKMP Header

Initiator COOKIE: db 86 ce 3f 3a a9 e7 0a

Responder COOKIE: 6c 4d 2c ce 68 03 55 58

Next Payload: Security Association

Version: 1.0

Exchange Type: Identity Protection (Main Mode)

Flags: (none)

MessageID: 00000000

Length: 104

Payload Security Association

Next Payload: Vendor ID

Reserved: 00

Payload Length: 52

DOI: IPsec

Situation:(SIT_IDENTITY_ONLY)

Payload Proposal

Next Payload: None

Reserved: 00

Payload Length: 40

Proposal #: 1

Protocol-Id: PROTO_ISAKMP

SPI Size: 0

# of transforms: 1

Payload Transform

Next Payload: None

Reserved: 00

Payload Length: 32

Transform #: 1

Transform-Id: KEY_IKE

Reserved2: 0000

Encryption Algorithm: 3DES-CBC

Hash Algorithm: SHA1

Group Description: Group 2

Authentication Method: Preshared key

Life Type: seconds

Life Duration (Hex): 70 80

Payload Vendor ID

Next Payload: None

Reserved: 00

Payload Length: 24

Data (In Hex):

40 48 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 c2 d3

c0 00 00 00

IKE Recv RAW packet dump

db 86 ce 3f 3a a9 e7 0a 6c 4d 2c ce 68 03 55 58 | ...?:...lM,.h.UX

04 10 02 00 00 00 00 00 00 00 01 00 0a 00 00 84 | ................

00 c8 2a 4d bf 63 9f 5c d3 b6 e9 fb 1e c9 61 b3 | ..*M.c.\......a.

f9 09 19 75 63 23 3f 59 ef c2 57 4b 59 9f 60 53 | ...uc#?Y..WKY.`S

0d d2 b5 2b b5 31 e8 75 46 57 ed 5b 4c f3 96 aa | ...+.1.uFW.[L...

a5 c9 4a e7 62 68 e3 55 4c 54 ac 79 73 be ba f0 | ..J.bh.ULT.ys...

09 fe d0 5a 3f 9c 9c 2e 90 88 4d db b0 7b 7c f4 | ...Z?.....M..{|.

cc b4 07 1a 11 30 5b 2f 4f bd 56 b5 07 a3 9a cb | .....0[/O.V.....

b3 e3 c8 10 20 a5 41 3a f9 fe 1b ed f0 d7 fa 05 | .... .A:........

fa df ef 8a 03 e9 4a 1c 09 ad 05 e6 02 f1 0a fa | ......J.........

0d 00 00 18 bc d2 18 cc 37 f5 cb 77 b6 e2 0a 04 | ........7..w....

de c9 d3 1a b0 6f ee a8 0d 00 00 14 12 f5 f2 8c | .....o..........

45 71 68 a9 70 2d 9f e2 74 cc 01 00 0d 00 00 0c | Eqh.p-..t.......

09 00 26 89 df d6 b7 12 0d 00 00 14 2e 41 69 22 | ..&..........Ai"

3a a8 e7 0a cd 38 ba 43 ed f2 db 2c 00 00 00 14 | :....8.C...,....

1f 07 f7 0e aa 65 14 d3 b0 fa 96 54 2a 50 01 00 | .....e.....T*P..

RECV PACKET from 1.1.1.2

ISAKMP Header

Initiator COOKIE: db 86 ce 3f 3a a9 e7 0a

Responder COOKIE: 6c 4d 2c ce 68 03 55 58

Next Payload: Key Exchange

Version: 1.0

Exchange Type: Identity Protection (Main Mode)

Flags: (none)

MessageID: 00000000

Length: 256

Payload Key Exchange

Next Payload: Nonce

Reserved: 00

Payload Length: 132

Data:

00 c8 2a 4d bf 63 9f 5c d3 b6 e9 fb 1e c9 61 b3

f9 09 19 75 63 23 3f 59 ef c2 57 4b 59 9f 60 53

0d d2 b5 2b b5 31 e8 75 46 57 ed 5b 4c f3 96 aa

a5 c9 4a e7 62 68 e3 55 4c 54 ac 79 73 be ba f0

09 fe d0 5a 3f 9c 9c 2e 90 88 4d db b0 7b 7c f4

cc b4 07 1a 11 30 5b 2f 4f bd 56 b5 07 a3 9a cb

b3 e3 c8 10 20 a5 41 3a f9 fe 1b ed f0 d7 fa 05

fa df ef 8a 03 e9 4a 1c 09 ad 05 e6 02 f1 0a fa

Payload Nonce

Next Payload: Vendor ID

Reserved: 00

Payload Length: 24

Data:

bc d2 18 cc 37 f5 cb 77 b6 e2 0a 04 de c9 d3 1a

b0 6f ee a8

Payload Vendor ID

Next Payload: Vendor ID

Reserved: 00

Payload Length: 20

Data (In Hex):

12 f5 f2 8c 45 71 68 a9 70 2d 9f e2 74 cc 01 00

Payload Vendor ID

Next Payload: Vendor ID

Reserved: 00

Payload Length: 12

Data (In Hex): 09 00 26 89 df d6 b7 12

Payload Vendor ID

Next Payload: Vendor ID

Reserved: 00

Payload Length: 20

Data (In Hex):

2e 41 69 22 3a a8 e7 0a cd 38 ba 43 ed f2 db 2c

Payload Vendor ID

Next Payload: None

Reserved: 00

Payload Length: 20

Data (In Hex):

1f 07 f7 0e aa 65 14 d3 b0 fa 96 54 2a 50 01 00

Jun 20 16:29:42 [IKEv1]: IP = 1.1.1.2, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 256

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing ke payload

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing ISA_KE payload

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing nonce payload

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing VID payload

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Received Cisco Unity client VID

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing VID payload

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Received xauth V6 VID

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing VID payload

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Processing VPN3000/ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing VID payload

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Received Altiga/Cisco VPN3000/Cisco ASA GW VID

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, constructing ke payload

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, constructing nonce payload

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, constructing Cisco Unity VID payload

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, constructing xauth V6 VID payload

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Send IOS VID

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Constructing ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, constructing VID payload

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Send Altiga/Cisco VPN3000/Cisco ASA GW VID

Jun 20 16:29:42 [IKEv1]: IP = 1.1.1.2, Connection landed on tunnel_group 1.1.1.2

Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, Generating keys for Responder...

Jun 20 16:29:42 [IKEv1]: IP = 1.1.1.2, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 256

SENDING PACKET to 1.1.1.2

ISAKMP Header

Initiator COOKIE: db 86 ce 3f 3a a9 e7 0a

Responder COOKIE: 6c 4d 2c ce 68 03 55 58

Next Payload: Key Exchange

Version: 1.0

Exchange Type: Identity Protection (Main Mode)

Flags: (none)

MessageID: 00000000

Length: 256

Payload Key Exchange

Next Payload: Nonce

Reserved: 00

Payload Length: 132

Data:

27 62 7f 00 84 06 59 07 28 a1 05 9f 2a 13 ad ff

47 10 99 27 68 01 2a c8 06 52 b8 55 0c 7d 82 3d

31 94 0d 68 aa 98 5e 60 ee 2b 37 a5 0f ca 06 5c

2a f7 83 bb 2e 8b 53 13 49 8b 4e 4c bf d1 34 67

df ff 50 5b ab e9 f2 12 cb bd c2 0c ab 95 3a 39

ca 60 31 7a d4 80 80 b6 0c 85 3e f5 16 fb f5 f8

27 5d 28 b9 b1 2e b3 35 79 1a 9e f7 fd 13 8f f4

5f 5d 53 93 74 6d d1 60 97 ca d2 bc b3 b4 e6 03

Payload Nonce

Next Payload: Vendor ID

Reserved: 00

Payload Length: 24

Data:

a7 f8 48 c1 98 b4 cb 02 79 de ae 6e 59 3d 23 cb

4c a1 7b 44

Payload Vendor ID

Next Payload: Vendor ID

Reserved: 00

Payload Length: 20

Data (In Hex):

12 f5 f2 8c 45 71 68 a9 70 2d 9f e2 74 cc 01 00

Payload Vendor ID

Next Payload: Vendor ID

Reserved: 00

Payload Length: 12

Data (In Hex): 09 00 26 89 df d6 b7 12

Payload Vendor ID

Next Payload: Vendor ID

Reserved: 00

Payload Length: 20

Data (In Hex):

99 8a 8b d3 68 02 55 58 44 16 79 1c 51 be 23 8f

Payload Vendor ID

Next Payload: None

Reserved: 00

Payload Length: 20

Data (In Hex):

1f 07 f7 0e aa 65 14 d3 b0 fa 96 54 2a 50 01 00

IKE Recv RAW packet dump

db 86 ce 3f 3a a9 e7 0a 6c 4d 2c ce 68 03 55 58 | ...?:...lM,.h.UX

05 10 02 01 00 00 00 00 00 00 00 64 8f a8 6e 03 | ...........d..n.

81 b9 24 e5 f0 ba ca 1a 0f fa 5a a1 3c 2d 61 1a | ..$.......Z.<-a.

7d 48 b0 0c 7f 09 bc 82 9b b1 25 b4 f6 04 45 a0 | }H......%...E.

13 12 27 ff 7a 41 9f e9 8e 96 c2 80 b9 59 b0 ec | ..'.zA.......Y..

40 e3 95 4d 96 ef eb ce e2 fb d9 45 83 50 0d e7 | @..M.......E.P..

9c c7 70 7f | ..

RECV PACKET from 1.1.1.2

ISAKMP Header

Initiator COOKIE: db 86 ce 3f 3a a9 e7 0a

Responder COOKIE: 6c 4d 2c ce 68 03 55 58

Next Payload: Identification

Version: 1.0

Exchange Type: Identity Protection (Main Mode)

Flags: (Encryption)

MessageID: 00000000

Length: 100

AFTER DECRYPTION

ISAKMP Header

Initiator COOKIE: db 86 ce 3f 3a a9 e7 0a

Responder COOKIE: 6c 4d 2c ce 68 03 55 58

Next Payload: Identification

Version: 1.0

Exchange Type: Identity Protection (Main Mode)

Flags: (Encryption)

MessageID: 00000000

Length: 100

Payload Identification

Next Payload: Hash

Reserved: 00

Payload Length: 12

ID Type: IPv4 Address (1)

Protocol ID (UDP/TCP, etc...): 17

Port: 500

ID Data: 1.1.1.2

Payload Hash

Next Payload: IOS Proprietary Keepalive or CHRE

Reserved: 00

Payload Length: 24

Data:

f4 40 eb 6b 55 f0 19 cd 10 81 e6 53 cf 23 75 c5

45 ab 7f 3d

Payload IOS Proprietary Keepalive or CHRE

Next Payload: Vendor ID

Reserved: 00

Payload Length: 12

Default Interval: 32767

Retry Interval: 32767

Payload Vendor ID

Next Payload: None

Reserved: 00

Payload Length: 20

Data (In Hex):

af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00

Jun 20 16:29:42 [IKEv1]: IP = 1.1.1.2, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + IOS KEEPALIVE (128) + VENDOR (13) + NONE (0) total length : 96

Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing ID payload

Jun 20 16:29:42 [IKEv1 DECODE]: Group = 1.1.1.2, IP = 1.1.1.2, ID_IPV4_ADDR ID received

1.1.1.2

Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing hash payload

Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, Computing hash for ISAKMP

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Processing IOS keep alive payload: proposal=32767/32767 sec.

Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing VID payload

Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, Received DPD VID

Jun 20 16:29:42 [IKEv1]: IP = 1.1.1.2, Connection landed on tunnel_group 1.1.1.2

Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, constructing ID payload

Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, constructing hash payload

Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, Computing hash for ISAKMP

Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Constructing IOS keep alive payload: proposal=32767/32767 sec.

Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, constructing dpd vid payload

Jun 20 16:29:42 [IKEv1]: IP = 1.1.1.2, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + IOS KEEPALIVE (128) + VENDOR (13) + NONE (0) total length : 96

BEFORE ENCRYPTION

RAW PACKET DUMP on SEND

db 86 ce 3f 3a a9 e7 0a 6c 4d 2c ce 68 03 55 58 | ...?:...lM,.h.UX

05 10 02 00 00 00 00 00 1c 00 00 00 08 00 00 0c | ................

01 11 01 f4 c2 9f 09 02 80 00 00 18 58 00 80 06 | ............X...

e9 66 ba 20 1e ba 79 c8 16 85 2d 2f a0 96 b4 e5 | .f. ..y...-/....

0d 00 00 0c 80 00 7f ff 80 00 7f ff 00 00 00 14 | ............

af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 | ....h...k...wW..

ISAKMP Header

Initiator COOKIE: db 86 ce 3f 3a a9 e7 0a

Responder COOKIE: 6c 4d 2c ce 68 03 55 58

Next Payload: Identification

Version: 1.0

Exchange Type: Identity Protection (Main Mode)

Flags: (none)

MessageID: 00000000

Length: 469762048

Payload Identification

Next Payload: Hash

Reserved: 00

Payload Length: 12

ID Type: IPv4 Address (1)

Protocol ID (UDP/TCP, etc...): 17

Port: 500

ID Data: 1.1.1.1

Payload Hash

Next Payload: IOS Proprietary Keepalive or CHRE

Reserved: 00

Payload Length: 24

Data:

58 00 80 06 e9 66 ba 20 1e ba 79 c8 16 85 2d 2f

a0 96 b4 e5

Payload IOS Proprietary Keepalive or CHRE

Next Payload: Vendor ID

Reserved: 00

Payload Length: 12

Default Interval: 32767

Retry Interval: 32767

Payload Vendor ID

Next Payload: None

Reserved: 00

Payload Length: 20

Data (In Hex):

af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00

SENDING PACKET to 1.1.1.2

ISAKMP Header

Initiator COOKIE: db 86 ce 3f 3a a9 e7 0a

Responder COOKIE: 6c 4d 2c ce 68 03 55 58

Next Payload: Identification

Version: 1.0

Exchange Type: Identity Protection (Main Mode)

Flags: (Encryption)

MessageID: 00000000

Length: 100

Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, PHASE 1 COMPLETED

Jun 20 16:29:42 [IKEv1]: IP = 1.1.1.2, Keep-alive type for this connection: DPD

Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, Starting P1 rekey timer: 27360 seconds.

IKE Recv RAW packet dump

db 86 ce 3f 3a a9 e7 0a 6c 4d 2c ce 68 03 55 58 | ...?:...lM,.h.UX

08 10 20 01 56 e5 a4 1e 00 00 01 4c d2 44 3e 24 | .. .V......L.D>$

87 96 a1 fe d1 a3 d3 a3 ed 59 45 2d 53 be 17 9f | .........YE-S...

42 72 2b a3 5f f8 5e 41 5a 62 25 0c 5d bf 6c 2a | Br+._.^AZb%.].l*

e6 e0 1f 77 d5 ed c8 1c 06 cb ef f2 58 07 1d 35 | ...w........X..5

a9 d5 7b 86 24 05 88 32 e7 33 6f f2 f7 9d 70 07 | ..{.$..2.3o...p.

18 40 51 77 7d 7e 6c 77 55 d9 18 7a 57 5d b9 88 | .@Qw}~lwU..zW]..

6c a6 d5 f3 60 5e 14 4f da cb 42 65 88 d6 75 0e | l...`^.O..Be..u.

22 1c bb 89 1f 57 bd c2 f2 46 30 31 30 9c 63 e6 | "....W...F010.c.

e2 e9 5b 68 71 f2 ed 69 f1 eb a7 65 2d b2 31 85 | ..[hq..i...e-.1.

31 93 0a c1 21 44 57 de ad 8b 79 5e 3d 36 5c 44 | 1...!DW...y^=6\D

88 23 a8 44 76 2c d6 c2 ed 31 2d 69 b1 50 26 9f | .#.Dv,...1-i.P&.

ee 48 3e c4 dd 0d 40 8f 65 d2 fb 82 19 42 b7 0f | .H>...@.e....B..

a0 74 b3 e6 df dd 16 c4 fa ca bf d2 b6 33 b0 5f | .t...........3._

d6 59 4f 6a 84 9e 0d 76 a4 d6 d3 94 67 bc 9c df | .YOj...v....g...

33 20 48 61 d7 80 b6 97 0d a9 32 48 7d 5b 79 8b | 3 Ha......2H}[y.

7b bc e0 9b b4 5d ed 49 04 6b 5d 72 d7 5b 82 90 | {....].I.k]r.[..

47 e5 65 64 a9 25 ce 2f 3f a2 ca 98 b1 0b ff 01 | G.ed.%./?.......

9c 32 64 5c dd 9c 26 71 c4 59 cd 52 da 1f b9 23 | .2d\..&q.Y.R...#

32 dd d8 a5 d1 1c 2a d0 0f ef 2b 26 66 c0 14 48 | 2.....*...+&f..H

52 35 3a ee 36 a6 00 df a5 d6 6b 42 | R5:.6.....kB

RECV PACKET from 1.1.1.2

ISAKMP Header

Initiator COOKIE: db 86 ce 3f 3a a9 e7 0a

Responder COOKIE: 6c 4d 2c ce 68 03 55 58

Next Payload: Hash

Version: 1.0

Exchange Type: Quick Mode

Flags: (Encryption)

MessageID: 56E5A41E

Length: 332

Jun 20 16:29:42 [IKEv1 DECODE]: IP = 1.1.1.2, IKE Responder starting QM: msg id = 56e5a41e

AFTER DECRYPTION

ISAKMP Header

Initiator COOKIE: db 86 ce 3f 3a a9 e7 0a

Responder COOKIE: 6c 4d 2c ce 68 03 55 58

Next Payload: Hash

Version: 1.0

Exchange Type: Quick Mode

Flags: (Encryption)

MessageID: 56E5A41E

Length: 332

Payload Hash

Next Payload: Security Association

Reserved: 00

Payload Length: 24

Data:

78 09 81 d2 54 22 37 a1 b0 a8 53 cf df d4 1e fb

4a 7b 99 f7

Payload Security Association

Next Payload: Nonce

Reserved: 00

Payload Length: 64

DOI: IPsec

Situation:(SIT_IDENTITY_ONLY)

Payload Proposal

Next Payload: None

Reserved: 00

Payload Length: 52

Proposal #: 1

Protocol-Id: PROTO_IPSEC_ESP

SPI Size: 4

# of transforms: 1

SPI: b2 c1 66 6e

Payload Transform

Next Payload: None

Reserved: 00

Payload Length: 40

Transform #: 1

Transform-Id: ESP_3DES

Reserved2: 0000

Life Type: Seconds

Life Duration (Hex): 70 80

Life Type: Kilobytes

Life Duration (Hex): 00 46 50 00

Encapsulation Mode: Tunnel

Authentication Algorithm: MD5

Group Description: Group 2

Payload Nonce

Next Payload: Key Exchange

Reserved: 00

Payload Length: 24

Data:

1e 43 34 fa cc 9f 77 65 45 7c b6 18 2f 18 fd a9

86 e6 58 42

Payload Key Exchange

Next Payload: Identification

Reserved: 00

Payload Length: 132

Data:

3c 26 4c 94 68 33 4b 2d ce 37 4a d2 8c 62 ab 6b

e6 d4 d2 8a df 70 bc 67 62 ca 96 8c 3b 30 cd 58

54 55 71 0f 9e bc da 63 a9 68 86 fd ba 7a 13 f3

e9 51 e9 a4 13 b0 b0 20 45 cf 1f 36 1e 95 95 c9

dd 92 c9 cd 2b 33 2d 4b 7e bd ed d4 ec bf 54 b9

6e 13 7f 17 dc 28 61 5d 46 fe 1d ba 88 e5 ca 70

40 59 12 c1 0c 3a 51 7f ae 5f e2 95 73 bc c9 16

67 ce 38 82 e7 b3 1b 6a 39 05 46 71 b8 da c3 57

Payload Identification

Next Payload: Identification

Reserved: 00

Payload Length: 16

ID Type: IPv4 Subnet (4)

Protocol ID (UDP/TCP, etc...): 0

Port: 0

ID Data: 10.99.99.0/255.255.255.0

Payload Identification

Next Payload: Notification

Reserved: 00

Payload Length: 16

ID Type: IPv4 Subnet (4)

Protocol ID (UDP/TCP, etc...): 0

Port: 0

ID Data: 10.1.1.0/255.255.255.0

Payload Notification

Next Payload: None

Reserved: 00

Payload Length: 28

DOI: IPsec

Protocol-ID: PROTO_ISAKMP

Spi Size: 16

Notify Type: STATUS_INITIAL_CONTACT

SPI:

db 86 ce 3f 3a a9 e7 0a 6c 4d 2c ce 68 03 55 58

Jun 20 16:29:42 [IKEv1]: IP = 1.1.1.2, IKE_DECODE RECEIVED Message (msgid=56e5a41e) with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + KE (4) + ID (5) + ID (5) + NOTIFY (11) + NONE (0) total length : 332

Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing hash payload

Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing SA payload

Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing nonce payload

Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing ke payload

Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing ISA_KE for PFS in phase 2

Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing ID payload

Jun 20 16:29:42 [IKEv1 DECODE]: Group = 1.1.1.2, IP = 1.1.1.2, ID_IPV4_ADDR_SUBNET ID received--10.99.99.0--255.255.255.0

Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Received remote IP Proxy Subnet data in ID Payload: Address 10.99.99.0, Mask 255.255.255.0, Protocol 0, Port 0

Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing ID payload

Jun 20 16:29:42 [IKEv1 DECODE]: Group = 1.1.1.2, IP = 1.1.1.2, ID_IPV4_ADDR_SUBNET ID received--10.1.1.0--255.255.255.0

Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Received local IP Proxy Subnet data in ID Payload: Address 10.1.1.0, Mask 255.255.255.0, Protocol 0, Port 0

Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing notify payload

Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, QM IsRekeyed old sa not found by addr

Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, checking map = vpntunnelmap, seq = 1...

Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, map = vpntunnelmap, seq = 1, ACL does not match proxy IDs src:10.99.99.0 dst:10.1.1.0

Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, checking map = vpntunnelmap, seq = 2...

Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, map = vpntunnelmap, seq = 2, ACL does not match proxy IDs src:10.99.99.0 dst:10.1.1.0

Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, checking map = vpntunnelmap, seq = 3...

Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, map = vpntunnelmap, seq = 3, ACL does not match proxy IDs src:10.99.99.0 dst:10.1.1.0

Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, checking map = vpntunnelmap, seq = 35...

Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, map = vpntunnelmap, seq = 35, ACL does not match proxy IDs src:10.99.99.0 dst:10.1.1.0

Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, checking map = vpntunnelmap, seq = 40...

Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, map = vpntunnelmap, seq = 40, ACL does not match proxy IDs src:10.99.99.0 dst:10.1.1.0

Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, checking map = vpntunnelmap, seq = 41...

Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, map = vpntunnelmap, seq = 41, ACL does not match proxy IDs src:10.99.99.0 dst:10.1.1.0

Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Rejecting IPSec tunnel: no matching crypto map entry for remote proxy 10.99.99.0/255.255.255.0/0/0 local proxy 10.1.1.0/255.255.255.0/0/0 on interface thus

Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, sending notify message

Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, constructing blank hash payload

Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, constructing qm hash payload

Jun 20 16:29:42 [IKEv1]: IP = 1.1.1.2, IKE_DECODE SENDING Message (msgid=7ecccf15) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 384

BEFORE ENCRYPTION

RAW PACKET DUMP on SEND

db 86 ce 3f 3a a9 e7 0a 6c 4d 2c ce 68 03 55

IKE Recv RAW packet dump

Site to Site VPN on Cisco ASA

ciscoasa1

ciscoasa2