Looks like the same result:

chance gearhart · ‎02-29-2016

I was asked to put a second set of eyes on this tunnel for Microsoft Azure and was told that the tunnel could not be established. It sounded as if Microsoft could see the request, but would be followed by an immediate message from the ASA to close the connection. I ran a debug and have attached the output. Any help would be greatly appreciated.

Dinesh Moudgil · ‎02-29-2016

Hi chance gearhart

Couple of relevant points:

Feb 29 17:08:50 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, PHASE 1 COMPLETED
Rejecting IPSec tunnel: no matching crypto map entry for remote proxy 10.1.0.0/255.255.254.0/0/0 local proxy 192.168.0.0/255.255.0.0/0/0 on interface outside
QM FSM error
IKE QM Responder FSM error history

Initially the phase 1 proposals are matching and thus the phase 1 comes up.
After this , ASA does not find any crypto map entry pertaining to the proxy IDs being sent by remote side.

The last 2 messages are seen if the phase 2 parameters are not matching on both sides. Please make sure you have correct proxy ids, transform set, PFS setting on both the sides.

Regards,
Dinesh Moudgil

P.S. Please rate helpful posts.

Cisco Network Security Channel - https://www.youtube.com/c/CiscoNetSec/

Aditya Ganjoo · ‎02-29-2016

Hi,

This seems to be an issue with the Crypto ACL configuration.

Feb 29 17:08:50 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, Static Crypto Map check, map = partner-map, seq = 1, ACL does not match proxy IDs src:10.1.0.0 dst:192.168.0.0
Feb 29 17:08:50 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, Skipping dynamic map cisco sequence 1: cannot match peerless map when peer found in previous map entry.
Feb 29 17:08:50 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, Rejecting IPSec tunnel: no matching crypto map entry for remote proxy 10.1.0.0/255.255.254.0/0/0 local proxy 192.168.0.0/255.255.0.0/0/0 on interface outside

Could you verify if you have matched the correct access-list for this VPN tunnel ?

Regards,

Aditya

Please rate helpful posts.

chance gearhart · ‎03-01-2016

I also found something that ght be problematic. The debug says that the source is a 10.1.0.0 and the destination is a 192.168.0.0 address. Is this NAT statement backwards? The onprem-networks object group is for the 192.168.0.0 networks and the azure-networks object group is for the 10.1.0.0 networks.

nat (inside,outside) source static onprem-networks onprem-networks destination static azure-networks azure-networks

Aditya Ganjoo · ‎03-01-2016

Hi,

The NAT statement is fine.

As requested please check the remote end logs.

Regards,

Aditya

Please rate helpful posts.

chance gearhart · ‎02-29-2016

I am having issues finding problems with the transform sets and the proxy IDs. I figured uploading the running config would probably be helpful. I apologize for how long it is. Somebody configured the firewall using ASDM, so it's very wordy.

Dinesh Moudgil · ‎02-29-2016

In the configuration,

The transform set is "crypto ipsec ikev1 transform-set azure-ipsec-proposal-set esp-aes-256 esp-sha-hmac "
and the proxy IDs are object-group named "onprem-networks " on your side and "azure-networks " on remote side.

proxy IDs are defined in the crypto acl as the following:
access-list azure-vpn-acl extended permit ip object-group onprem-networks object-group azure-networks

I do not see any object-group configuration for the above-mentioned entities so you might want to configure them and define the subnets that need to traverse over the VPN tunnel.

Regards,
Dinesh Moudgil

P.S. Please rate helpful posts.

Cisco Network Security Channel - https://www.youtube.com/c/CiscoNetSec/

chance gearhart · ‎03-01-2016

Are these the ones that I'm looking for? Looks like the onprom-networks object is specifying the 192.168.0.0/16 networks twice.

object network Azure
subnet 10.1.0.0 255.255.255.0

object network On-prem
subnet 192.168.0.0 255.255.0.0

object-group network azure-networks
description Azure-Virtual-Network
network-object object Azure

object-group network onprem-networks
description On-premises Network
network-object 192.168.0.0 255.255.0.0
network-object object On-prem

Dinesh Moudgil · ‎03-01-2016

Can you modify the access-list "azure-vpn-acl " to just call the objects "On-prem" and "Azure" instead of object-groups "onprem-networks" and "azure-networks" ?

Object-group "onprem-networks" indeed looks to be configured incorrectly.

Regards,
Dinesh Moudgil

P.S. Please rate helpful posts.

Cisco Network Security Channel - https://www.youtube.com/c/CiscoNetSec/

chance gearhart · ‎03-01-2016

OK I modified the ACL to use the network objects:

ccess-list azure-vpn-acl line 1 extended permit ip object On-prem object Azure log informational interval 300 (hitcnt=0)
access-list azure-vpn-acl line 1 extended permit ip 192.168.0.0 255.255.0.0 10.1.0.0 255.255.255.0 log informational interval 300

What would be the next step?

Dinesh Moudgil · ‎03-01-2016

Can you try to initiate the tunnel and let me know how it fares?

Regards,
Dinesh Moudgil

P.S. Please rate helpful posts.

Cisco Network Security Channel - https://www.youtube.com/c/CiscoNetSec/

chance gearhart · ‎03-01-2016

Looks like the same result:

Mar 01 10:57:11 [IKEv1]IP = 104.42.185.111, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 372
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, processing SA payload
Mar 01 10:57:11 [IKEv1]Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Group 2 Cfg'd: Group 1
Mar 01 10:57:11 [IKEv1]Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Group 2 Cfg'd: Group 1
Mar 01 10:57:11 [IKEv1]Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Group 2 Cfg'd: Group 1
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, Oakley proposal is acceptable
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, processing VID payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, processing VID payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, processing VID payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, Received NAT-Traversal RFC VID
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, processing VID payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, Received NAT-Traversal ver 02 VID
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, processing VID payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, Received Fragmentation VID
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, processing VID payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, processing VID payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, processing VID payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, processing IKE SA payload
Mar 01 10:57:11 [IKEv1]Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Group 2 Cfg'd: Group 1
Mar 01 10:57:11 [IKEv1]Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Group 2 Cfg'd: Group 1
Mar 01 10:57:11 [IKEv1]Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Group 2 Cfg'd: Group 1
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, IKE SA Proposal # 1, Transform # 2 acceptable Matches global IKE entry # 9
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, constructing ISAKMP SA payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, constructing NAT-Traversal VID ver RFC payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, constructing Fragmentation VID + extended capabilities payload
Mar 01 10:57:11 [IKEv1]IP = 104.42.185.111, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 128
Mar 01 10:57:11 [IKEv1]IP = 104.42.185.111, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + NAT-D (20) + NAT-D (20) + NONE (0) total length : 260
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, processing ke payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, processing ISA_KE payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, processing nonce payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, processing NAT-Discovery payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, computing NAT Discovery hash
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, processing NAT-Discovery payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, computing NAT Discovery hash
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, constructing ke payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, constructing nonce payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, constructing Cisco Unity VID payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, constructing xauth V6 VID payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, Send IOS VID
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, Constructing ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, constructing VID payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, Send Altiga/Cisco VPN3000/Cisco ASA GW VID
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, constructing NAT-Discovery payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, computing NAT Discovery hash
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, constructing NAT-Discovery payload
Mar 01 10:57:11 [IKEv1 DEBUG]IP = 104.42.185.111, computing NAT Discovery hash
Mar 01 10:57:11 [IKEv1]IP = 104.42.185.111, Connection landed on tunnel_group 104.42.185.111
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, Generating keys for Responder...
Mar 01 10:57:11 [IKEv1]IP = 104.42.185.111, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NAT-D (20) + NAT-D (20) + NONE (0) total length : 304
Mar 01 10:57:11 [IKEv1]IP = 104.42.185.111, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + NONE (0) total length : 64
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, processing ID payload
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, processing hash payload
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, Computing hash for ISAKMP
Mar 01 10:57:11 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, Automatic NAT Detection Status: Remote end is NOT behind a NAT device This end is NOT behind a NAT device
Mar 01 10:57:11 [IKEv1]IP = 104.42.185.111, Connection landed on tunnel_group 104.42.185.111
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, constructing ID payload
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, constructing hash payload
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, Computing hash for ISAKMP
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, constructing dpd vid payload
Mar 01 10:57:11 [IKEv1]IP = 104.42.185.111, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + VENDOR (13) + NONE (0) total length : 84
Mar 01 10:57:11 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, PHASE 1 COMPLETED
Mar 01 10:57:11 [IKEv1]IP = 104.42.185.111, Keep-alive type for this connection: None
Mar 01 10:57:11 [IKEv1]IP = 104.42.185.111, Keep-alives configured on but peer does not support keep-alives (type = None)
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, Starting P1 rekey timer: 21600 seconds.
Mar 01 10:57:11 [IKEv1]IP = 104.42.185.111, IKE_DECODE RECEIVED Message (msgid=1) with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + ID (5) + ID (5) + NONE (0) total length : 368
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, processing hash payload
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, processing SA payload
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, processing nonce payload
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, processing ID payload
Mar 01 10:57:11 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, Received remote IP Proxy Subnet data in ID Payload: Address 10.1.0.0, Mask 255.255.254.0, Protocol 0, Port 0
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, processing ID payload
Mar 01 10:57:11 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, Received local IP Proxy Subnet data in ID Payload: Address 192.168.0.0, Mask 255.255.0.0, Protocol 0, Port 0
Mar 01 10:57:11 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, QM IsRekeyed old sa not found by addr
Mar 01 10:57:11 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, Static Crypto Map check, checking map = partner-map, seq = 1...
Mar 01 10:57:11 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, Static Crypto Map check, map = partner-map, seq = 1, ACL does not match proxy IDs src:10.1.0.0 dst:192.168.0.0
Mar 01 10:57:11 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, Skipping dynamic map cisco sequence 1: cannot match peerless map when peer found in previous map entry.
Mar 01 10:57:11 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, Rejecting IPSec tunnel: no matching crypto map entry for remote proxy 10.1.0.0/255.255.254.0/0/0 local proxy 192.168.0.0/255.255.0.0/0/0 on interface outside
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, sending notify message
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, constructing blank hash payload
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, constructing qm hash payload
Mar 01 10:57:11 [IKEv1]IP = 104.42.185.111, IKE_DECODE SENDING Message (msgid=18d8f58b) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 432
Mar 01 10:57:11 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, QM FSM error (P2 struct &0x00007fff34e360d0, mess id 0x1)!
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, IKE QM Responder FSM error history (struct &0x00007fff34e360d0) <state>, <event>: QM_DONE, EV_ERROR-->QM_BLD_MSG2, EV_NEGO_SA-->QM_BLD_MSG2, EV_IS_REKEY-->QM_BLD_MSG2, EV_CONFIRM_SA-->QM_BLD_MSG2, EV_PROC_MSG-->QM_BLD_MSG2, EV_HASH_OK-->QM_BLD_MSG2, NullEvent-->QM_BLD_MSG2, EV_COMP_HASH
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, sending delete/delete with reason message
Mar 01 10:57:11 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, Removing peer from correlator table failed, no match!
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, IKE SA MM:623c8d92 rcv'd Terminate: state MM_ACTIVE flags 0x00000042, refcnt 1, tuncnt 0
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, IKE SA MM:623c8d92 terminating: flags 0x01000002, refcnt 0, tuncnt 0
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, sending delete/delete with reason message
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, constructing blank hash payload
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, constructing IKE delete payload
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, constructing qm hash payload
Mar 01 10:57:11 [IKEv1]IP = 104.42.185.111, IKE_DECODE SENDING Message (msgid=4593a8b6) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 80
Mar 01 10:57:11 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, Session is being torn down. Reason: crypto map policy not found
Mar 01 10:57:11 [IKEv1]Ignoring msg to mark SA with dsID 101265408 dead because SA deleted

Dinesh Moudgil · ‎03-01-2016

Check this

Mar 01 10:57:11 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, Received remote IP Proxy Subnet data in ID Payload: Address 10.1.0.0, Mask 255.255.254.0, Protocol 0, Port 0
Mar 01 10:57:11 [IKEv1 DEBUG]Group = 104.42.185.111, IP = 104.42.185.111, processing ID payload
Mar 01 10:57:11 [IKEv1]Group = 104.42.185.111, IP = 104.42.185.111, Received local IP Proxy Subnet data in ID Payload: Address 192.168.0.0, Mask 255.255.0.0, Protocol 0, Port 0

whereas what you configured in access-list "azure-vpn-acl " is from 192.168.0.0 255.255.0.0 to 10.1.0.0 255.255.255.0.

Regards,
Dinesh Moudgil

P.S. Please rate helpful posts.

Cisco Network Security Channel - https://www.youtube.com/c/CiscoNetSec/

chance gearhart · ‎03-01-2016

OK I reconfigured the ACLs to the following, but still getting the same results:

Rinchem-AB3-ASAFW/pri/act(config)# sh access-list azure-vpn-acl
access-list azure-vpn-acl; 4 elements; name hash: 0xeb3387d1
access-list azure-vpn-acl line 1 extended permit ip object On-prem object Azure log informational interval 300 (hitcnt=0) 0x23d11024
access-list azure-vpn-acl line 1 extended permit ip 192.168.0.0 255.255.0.0 10.1.0.0 255.255.255.0 log informational interval 300 (hitcnt=0) 0x23d11024
access-list azure-vpn-acl line 2 extended permit ip object Azure object On-prem log informational interval 300 (hitcnt=0) 0x71300f9e
access-list azure-vpn-acl line 2 extended permit ip 10.1.0.0 255.255.255.0 192.168.0.0 255.255.0.0 log informational interval 300 (hitcnt=0) 0x71300f9e
access-list azure-vpn-acl line 3 extended permit ip object-group onprem-networks object-group azure-networks (hitcnt=0) 0x1fb8e592
access-list azure-vpn-acl line 3 extended permit ip 192.168.0.0 255.255.0.0 10.1.0.0 255.255.255.0 (hitcnt=0) 0xb63db3e1
access-list azure-vpn-acl line 3 extended permit ip 192.168.0.0 255.255.0.0 10.1.0.0 255.255.255.0 (hitcnt=0) 0xb63db3e1
Rinchem-AB3-ASAFW/pri/act(config)# sh access-list outside_cryptomap_1
access-list outside_cryptomap_1; 3 elements; name hash: 0x759febfa
access-list outside_cryptomap_1 line 1 extended permit ip object Azure object On-prem log informational interval 300 (hitcnt=0) 0x1046802c
access-list outside_cryptomap_1 line 1 extended permit ip 10.1.0.0 255.255.255.0 192.168.0.0 255.255.0.0 log informational interval 300 (hitcnt=0) 0x1046802c
access-list outside_cryptomap_1 line 2 extended permit ip object-group onprem-networks object-group azure-networks (hitcnt=0) 0x8398a637
access-list outside_cryptomap_1 line 2 extended permit ip 192.168.0.0 255.255.0.0 10.1.0.0 255.255.255.0 (hitcnt=0) 0x89230c35
access-list outside_cryptomap_1 line 2 extended permit ip 192.168.0.0 255.255.0.0 10.1.0.0 255.255.255.0 (hitcnt=0) 0x89230c35

Dinesh Moudgil · ‎03-01-2016

Can you please share the debug outputs again ?

Regards,
Dinesh Moudgil

P.S. Please rate helpful posts.

Cisco Network Security Channel - https://www.youtube.com/c/CiscoNetSec/

Tunnel to Microsoft Azure fails to come up