cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
6596
Views
25
Helpful
39
Replies
Highlighted

Tunnel to Microsoft Azure fails to come up

I was asked to put a second set of eyes on this tunnel for Microsoft Azure and was told that the tunnel could not be established.  It sounded as if Microsoft could see the request, but would be followed by an immediate message from the ASA to close the connection.  I ran a debug and have attached the output.  Any help would be greatly appreciated.

39 REPLIES 39
Highlighted
Cisco Employee

Hi chance gearhart

Hi chance gearhart


Couple of relevant points:

  • Feb 29 17:08:50 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, PHASE 1 COMPLETED
  • Rejecting IPSec tunnel: no matching crypto map entry for remote proxy 10.1.0.0/255.255.254.0/0/0 local proxy 192.168.0.0/255.255.0.0/0/0 on interface outside
  • QM FSM error 
  • IKE QM Responder FSM error history

Initially the phase 1 proposals are matching and thus the phase 1 comes up.
After this , ASA does not find any crypto map entry pertaining to the proxy IDs being sent by remote side.

The last 2 messages are seen if the phase 2 parameters are not matching on both sides. Please make sure you have correct proxy ids, transform set, PFS setting on both the sides.


Regards,
Dinesh Moudgil

P.S. Please rate helpful posts.

Highlighted
Cisco Employee

Hi,

Hi,

This seems to be an issue with the Crypto ACL configuration.

Feb 29 17:08:50 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, Static Crypto Map check, map = partner-map, seq = 1, ACL does not match proxy IDs src:10.1.0.0 dst:192.168.0.0
Feb 29 17:08:50 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, Skipping dynamic map cisco sequence 1: cannot match peerless map when peer found in previous map entry.
Feb 29 17:08:50 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, Rejecting IPSec tunnel: no matching crypto map entry for remote proxy 10.1.0.0/255.255.254.0/0/0 local proxy 192.168.0.0/255.255.0.0/0/0 on interface outside

Could you verify if you have matched the correct access-list for this VPN tunnel ?

Regards,

Aditya

Please rate helpful posts.

Highlighted

I also found something that

I also found something that ght be problematic.  The debug says that the source is a 10.1.0.0 and the destination is a 192.168.0.0 address.  Is this NAT statement backwards?  The onprem-networks object group is for the 192.168.0.0 networks and the azure-networks object group is for the 10.1.0.0 networks.

nat (inside,outside) source static onprem-networks onprem-networks destination static azure-networks azure-networks

Highlighted
Cisco Employee

Hi,

Hi,

The NAT statement is fine.

As requested please check the remote end logs.

Regards,

Aditya

Please rate helpful posts.

Highlighted

I am having issues finding

I am having issues finding problems with the transform sets and the proxy IDs.  I figured uploading the running config would probably be helpful.  I apologize for how long it is.  Somebody configured the firewall using ASDM, so it's very wordy.

Highlighted
Cisco Employee

In the configuration,

In the configuration,

The transform set is "crypto ipsec ikev1 transform-set azure-ipsec-proposal-set esp-aes-256 esp-sha-hmac "
and the proxy IDs are object-group named "onprem-networks " on your side and "azure-networks " on remote side.

proxy IDs are defined in the crypto acl as the following:
access-list azure-vpn-acl extended permit ip object-group onprem-networks object-group azure-networks 


I do not see any object-group configuration for the above-mentioned entities so you might want to configure them and define the subnets that need to traverse over the VPN tunnel.

Regards,
Dinesh Moudgil

P.S. Please rate helpful posts.

Highlighted

Are these the ones that I'm

Are these the ones that I'm looking for?  Looks like the onprom-networks object is specifying the 192.168.0.0/16 networks twice.

object network Azure
subnet 10.1.0.0 255.255.255.0

object network On-prem
subnet 192.168.0.0 255.255.0.0

object-group network azure-networks
description Azure-Virtual-Network
network-object object Azure

object-group network onprem-networks
description On-premises Network
network-object 192.168.0.0 255.255.0.0
network-object object On-prem

Highlighted
Cisco Employee

Can you modify the access

Can you modify the access-list "azure-vpn-acl " to just call the objects "On-prem" and "Azure" instead of object-groups "onprem-networks" and "azure-networks" ?

Object-group "onprem-networks" indeed looks to be configured incorrectly.

Regards,
Dinesh Moudgil

P.S. Please rate helpful posts.

Highlighted

OK I modified the ACL to use

OK I modified the ACL to use the network objects:

ccess-list azure-vpn-acl line 1 extended permit ip object On-prem object Azure log informational interval 300 (hitcnt=0)
access-list azure-vpn-acl line 1 extended permit ip 192.168.0.0 255.255.0.0 10.1.0.0 255.255.255.0 log informational interval 300

What would be the next step?

Highlighted
Cisco Employee

Can you try to initiate the

Can you try to initiate the tunnel and let me know how it fares?

Regards,
Dinesh Moudgil

P.S. Please rate helpful posts.

Highlighted

Looks like the same result:

Looks like the same result:

Mar 01 10:57:11 [IKEv1]IP = 104.42.185.111, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 372
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, processing SA payload
Mar 01 10:57:11 [IKEv1]Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Group 2 Cfg'd: Group 1
Mar 01 10:57:11 [IKEv1]Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Group 2 Cfg'd: Group 1
Mar 01 10:57:11 [IKEv1]Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Group 2 Cfg'd: Group 1
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, Oakley proposal is acceptable
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, processing VID payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, processing VID payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, processing VID payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, Received NAT-Traversal RFC VID
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, processing VID payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, Received NAT-Traversal ver 02 VID
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, processing VID payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, Received Fragmentation VID
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, processing VID payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, processing VID payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, processing VID payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, processing IKE SA payload
Mar 01 10:57:11 [IKEv1]Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Group 2 Cfg'd: Group 1
Mar 01 10:57:11 [IKEv1]Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Group 2 Cfg'd: Group 1
Mar 01 10:57:11 [IKEv1]Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Group 2 Cfg'd: Group 1
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, IKE SA Proposal # 1, Transform # 2 acceptable Matches global IKE entry # 9
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, constructing ISAKMP SA payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, constructing NAT-Traversal VID ver RFC payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, constructing Fragmentation VID + extended capabilities payload
Mar 01 10:57:11 [IKEv1]IP = 104.42.185.111, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 128
Mar 01 10:57:11 [IKEv1]IP = 104.42.185.111, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + NAT-D (20) + NAT-D (20) + NONE (0) total length : 260
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, processing ke payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, processing ISA_KE payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, processing nonce payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, processing NAT-Discovery payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, computing NAT Discovery hash
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, processing NAT-Discovery payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, computing NAT Discovery hash
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, constructing ke payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, constructing nonce payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, constructing Cisco Unity VID payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, constructing xauth V6 VID payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, Send IOS VID
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, Constructing ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, constructing VID payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, Send Altiga/Cisco VPN3000/Cisco ASA GW VID
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, constructing NAT-Discovery payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, computing NAT Discovery hash
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, constructing NAT-Discovery payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, computing NAT Discovery hash
Mar 01 10:57:11 [IKEv1]IP = 104.42.185.111, Connection landed on tunnel_group 104.42.185.111
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, Generating keys for Responder...
Mar 01 10:57:11 [IKEv1]IP = 104.42.185.111, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NAT-D (20) + NAT-D (20) + NONE (0) total length : 304
Mar 01 10:57:11 [IKEv1]IP = 104.42.185.111, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + NONE (0) total length : 64
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, processing ID payload
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, processing hash payload
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, Computing hash for ISAKMP
Mar 01 10:57:11 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, Automatic NAT Detection Status: Remote end is NOT behind a NAT device This end is NOT behind a NAT device
Mar 01 10:57:11 [IKEv1]IP = 104.42.185.111, Connection landed on tunnel_group 104.42.185.111
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, constructing ID payload
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, constructing hash payload
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, Computing hash for ISAKMP
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, constructing dpd vid payload
Mar 01 10:57:11 [IKEv1]IP = 104.42.185.111, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + VENDOR (13) + NONE (0) total length : 84
Mar 01 10:57:11 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, PHASE 1 COMPLETED
Mar 01 10:57:11 [IKEv1]IP = 104.42.185.111, Keep-alive type for this connection: None
Mar 01 10:57:11 [IKEv1]IP = 104.42.185.111, Keep-alives configured on but peer does not support keep-alives (type = None)
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, Starting P1 rekey timer: 21600 seconds.
Mar 01 10:57:11 [IKEv1]IP = 104.42.185.111, IKE_DECODE RECEIVED Message (msgid=1) with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + ID (5) + ID (5) + NONE (0) total length : 368
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, processing hash payload
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, processing SA payload
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, processing nonce payload
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, processing ID payload
Mar 01 10:57:11 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, Received remote IP Proxy Subnet data in ID Payload: Address 10.1.0.0, Mask 255.255.254.0, Protocol 0, Port 0
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, processing ID payload
Mar 01 10:57:11 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, Received local IP Proxy Subnet data in ID Payload: Address 192.168.0.0, Mask 255.255.0.0, Protocol 0, Port 0
Mar 01 10:57:11 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, QM IsRekeyed old sa not found by addr
Mar 01 10:57:11 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, Static Crypto Map check, checking map = partner-map, seq = 1...
Mar 01 10:57:11 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, Static Crypto Map check, map = partner-map, seq = 1, ACL does not match proxy IDs src:10.1.0.0 dst:192.168.0.0
Mar 01 10:57:11 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, Skipping dynamic map cisco sequence 1: cannot match peerless map when peer found in previous map entry.
Mar 01 10:57:11 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, Rejecting IPSec tunnel: no matching crypto map entry for remote proxy 10.1.0.0/255.255.254.0/0/0 local proxy 192.168.0.0/255.255.0.0/0/0 on interface outside
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, sending notify message
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, constructing blank hash payload
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, constructing qm hash payload
Mar 01 10:57:11 [IKEv1]IP = 104.42.185.111, IKE_DECODE SENDING Message (msgid=18d8f58b) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 432
Mar 01 10:57:11 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, QM FSM error (P2 struct &0x00007fff34e360d0, mess id 0x1)!
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, IKE QM Responder FSM error history (struct &0x00007fff34e360d0) <state>, <event>: QM_DONE, EV_ERROR-->QM_BLD_MSG2, EV_NEGO_SA-->QM_BLD_MSG2, EV_IS_REKEY-->QM_BLD_MSG2, EV_CONFIRM_SA-->QM_BLD_MSG2, EV_PROC_MSG-->QM_BLD_MSG2, EV_HASH_OK-->QM_BLD_MSG2, NullEvent-->QM_BLD_MSG2, EV_COMP_HASH
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, sending delete/delete with reason message
Mar 01 10:57:11 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, Removing peer from correlator table failed, no match!
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, IKE SA MM:623c8d92 rcv'd Terminate: state MM_ACTIVE flags 0x00000042, refcnt 1, tuncnt 0
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, IKE SA MM:623c8d92 terminating: flags 0x01000002, refcnt 0, tuncnt 0
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, sending delete/delete with reason message
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, constructing blank hash payload
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, constructing IKE delete payload
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, constructing qm hash payload
Mar 01 10:57:11 [IKEv1]IP = 104.42.185.111, IKE_DECODE SENDING Message (msgid=4593a8b6) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 80
Mar 01 10:57:11 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, Session is being torn down. Reason: crypto map policy not found
Mar 01 10:57:11 [IKEv1]Ignoring msg to mark SA with dsID 101265408 dead because SA deleted

Highlighted
Cisco Employee

Check this

Check this

Mar 01 10:57:11 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, Received remote IP Proxy Subnet data in ID Payload: Address 10.1.0.0, Mask 255.255.254.0, Protocol 0, Port 0
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, processing ID payload
Mar 01 10:57:11 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, Received local IP Proxy Subnet data in ID Payload: Address 192.168.0.0, Mask 255.255.0.0, Protocol 0, Port 0

whereas what you configured in access-list "azure-vpn-acl " is from 192.168.0.0 255.255.0.0 to 10.1.0.0 255.255.255.0.


Regards,
Dinesh Moudgil

P.S. Please rate helpful posts.

Highlighted

OK I reconfigured the ACLs to

OK I reconfigured the ACLs to the following, but still getting the same results:

Rinchem-AB3-ASAFW/pri/act(config)# sh access-list azure-vpn-acl
access-list azure-vpn-acl; 4 elements; name hash: 0xeb3387d1
access-list azure-vpn-acl line 1 extended permit ip object On-prem object Azure log informational interval 300 (hitcnt=0) 0x23d11024
access-list azure-vpn-acl line 1 extended permit ip 192.168.0.0 255.255.0.0 10.1.0.0 255.255.255.0 log informational interval 300 (hitcnt=0) 0x23d11024
access-list azure-vpn-acl line 2 extended permit ip object Azure object On-prem log informational interval 300 (hitcnt=0) 0x71300f9e
access-list azure-vpn-acl line 2 extended permit ip 10.1.0.0 255.255.255.0 192.168.0.0 255.255.0.0 log informational interval 300 (hitcnt=0) 0x71300f9e
access-list azure-vpn-acl line 3 extended permit ip object-group onprem-networks object-group azure-networks (hitcnt=0) 0x1fb8e592
access-list azure-vpn-acl line 3 extended permit ip 192.168.0.0 255.255.0.0 10.1.0.0 255.255.255.0 (hitcnt=0) 0xb63db3e1
access-list azure-vpn-acl line 3 extended permit ip 192.168.0.0 255.255.0.0 10.1.0.0 255.255.255.0 (hitcnt=0) 0xb63db3e1
Rinchem-AB3-ASAFW/pri/act(config)# sh access-list outside_cryptomap_1
access-list outside_cryptomap_1; 3 elements; name hash: 0x759febfa
access-list outside_cryptomap_1 line 1 extended permit ip object Azure object On-prem log informational interval 300 (hitcnt=0) 0x1046802c
access-list outside_cryptomap_1 line 1 extended permit ip 10.1.0.0 255.255.255.0 192.168.0.0 255.255.0.0 log informational interval 300 (hitcnt=0) 0x1046802c
access-list outside_cryptomap_1 line 2 extended permit ip object-group onprem-networks object-group azure-networks (hitcnt=0) 0x8398a637
access-list outside_cryptomap_1 line 2 extended permit ip 192.168.0.0 255.255.0.0 10.1.0.0 255.255.255.0 (hitcnt=0) 0x89230c35
access-list outside_cryptomap_1 line 2 extended permit ip 192.168.0.0 255.255.0.0 10.1.0.0 255.255.255.0 (hitcnt=0) 0x89230c35

Highlighted
Cisco Employee

Can you please share the

Can you please share the debug outputs again ?

Regards,
Dinesh Moudgil

P.S. Please rate helpful posts.