Hello,
I have an issue with an IPSEC LAN to LAN between an ASA5505 and a UC520.
The LAN behind the ASA is 192.168.1.0 and the LAN behind the UC520 is 172.17.1.0.
When I try to ping from 192.168.1.10 to 172.17.1.254, the ASA shows that the IKE phase 1 is running but it never goes to the next step :
FW137# show crypto isakmp sa
Active SA: 1
Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1
1 IKE Peer: IP_Publique_Epernay
Type : user Role : initiator
Rekey : no State : MM_WAIT_MSG2
On the UC520 there is no IKE SA:
Bergere-uc520#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id slot status
IPv6 Crypto ISAKMP SA
Here is the configuration on the UC520 :
crypto isakmp policy 5
encr 3des
authentication pre-share
group 2
crypto isakmp key *** address 46.*.*.*
!
crypto ipsec security-association lifetime seconds 28800
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
!
crypto map EPERNAY-FEREBRIANGES 10 ipsec-isakmp
set peer 46.*.*.*
set security-association lifetime seconds 3600
set transform-set ESP-3DES-SHA
set pfs group2
match address 110
!
access-list 1 remark SDM_ACL Category=2
access-list 1 permit 172.17.1.0 0.0.0.255
access-list 1 permit 172.17.2.0 0.0.0.255
access-list 1 permit 172.17.3.0 0.0.0.255
access-list 1 permit 172.17.4.0 0.0.0.255
access-list 1 permit 172.17.5.0 0.0.0.255
access-list 1 permit 172.17.6.0 0.0.0.255
access-list 100 remark auto generated by SDM firewall configuration##NO_ACES_10##
access-list 100 remark SDM_ACL Category=1
access-list 100 remark Auto generated by SDM for NTP (123) 194.2.0.58
access-list 100 permit udp host 194.2.0.58 eq ntp any eq ntp
(other ACL's)
access-list 110 permit ip 172.17.1.0 0.0.0.255 192.168.1.0 0.0.0.255
(other ACL's)
access-list 120 permit ip 172.17.6.0 0.0.0.255 any
!
route-map NO_NAT_VPN permit 1
match ip address 110
!
Here is the configuration on the ASA5505:
names
name 192.168.1.10 Serveur
name 79.*.*.* OPS_ADSL
name 217.*.*.* OPS_SDSL_2M
name 79.*.*.* OPS_SDSL_4M
name 172.17.1.0 LAN_Epernay
name 193.*.*.* IP_Publique_Epernay
!
access-list inside_access_in extended permit ip 192.168.1.0 255.255.255.0 any
access-list outside_access_in extended permit tcp object-group DM_INLINE_NETWORK_1 interface outside object-group DM_INLINE_TCP_1
access-list outside_1_cryptomap extended permit ip 192.168.1.0 255.255.255.0 LAN_Epernay 255.255.255.0
access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 LAN_Epernay 255.255.255.0
access-list outside_2_cryptomap extended permit ip 192.168.1.0 255.255.255.0 LAN_Epernay 255.255.255.0
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set pfs
crypto map outside_map 1 set peer IP_Publique_Epernay
crypto map outside_map 1 set transform-set ESP-3DES-SHA
crypto map outside_map 1 set nat-t-disable
crypto map outside_map 2 match address outside_2_cryptomap
crypto map outside_map 2 set pfs
crypto map outside_map 2 set peer IP_Publique_Epernay
crypto map outside_map 2 set transform-set ESP-3DES-SHA
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
no crypto isakmp nat-traversal
tunnel-group 193.*.*.* type ipsec-l2l
tunnel-group 193.*.*.* ipsec-attributes
pre-shared-key *****
tunnel-group Epernay-193.*.*.* type ipsec-l2l
tunnel-group Epernay-193.*.*.* ipsec-attributes
pre-shared-key *****
Here is real time log of ASA when trying to establish IKE phase 1 :
6|Mar 19 2014|08:41:52|713219|||||IP = 193.*.*.*, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.
6|Mar 19 2014|08:41:51|302021|IP_Publique_Epernay|0|46.*.*.*|0|Teardown ICMP connection for faddr IP_Publique_Epernay/0 gaddr 46.*.*.*/0 laddr 46.*.*.*/0
6|Mar 19 2014|08:41:51|302020|IP_Publique_Epernay|0|46.*.*.*|0|Built inbound ICMP connection for faddr IP_Publique_Epernay/0 gaddr 46.*.*.*/0 laddr 46.*.*.*/0
6|Mar 19 2014|08:41:50|106015|79.*.*.*|443|46.*.*.*|47122|Deny TCP (no connection) from 79.*.*.*/443 to 46.*.*.*/47122 flags ACK on interface outside
6|Mar 19 2014|08:41:50|302014|79.*.*.*|443|Serveur|58769|Teardown TCP connection 28960 for outside:79.*.*.*/443 to inside:Serveur/58769 duration 0:00:00 bytes 2047 TCP Reset-I
6|Mar 19 2014|08:41:50|302013|Serveur|58770|79.*.*.*|443|Built outbound TCP connection 28961 for outside:79.*.*.*/443 (79.*.*.*/443) to inside:Serveur/58770 (46.*.*.*/57700)
6|Mar 19 2014|08:41:50|305011|Serveur|58770|46.*.*.*|57700|Built dynamic TCP translation from inside:Serveur/58770 to outside:46.*.*.*/57700
6|Mar 19 2014|08:41:49|302014|79.*.*.*|443|Serveur|58531|Teardown TCP connection 28910 for outside:79.*.*.*/443 to inside:Serveur/58531 duration 0:05:00 bytes 26268 TCP FINs
6|Mar 19 2014|08:41:49|302013|Serveur|58769|79.*.*.*|443|Built outbound TCP connection 28960 for outside:79.*.*.*/443 (79.*.*.*/443) to inside:Serveur/58769 (46.*.*.*/47122)
6|Mar 19 2014|08:41:49|305011|Serveur|58769|46.*.*.*|47122|Built dynamic TCP translation from inside:Serveur/58769 to outside:46.*.*.*/47122
6|Mar 19 2014|08:41:47|713219|||||IP = 193.*.*.*, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.
6|Mar 19 2014|08:41:43|302021|IP_Publique_Epernay|0|46.*.*.*|0|Teardown ICMP connection for faddr IP_Publique_Epernay/0 gaddr 46.*.*.*/0 laddr 46.*.*.*/0
6|Mar 19 2014|08:41:43|302020|IP_Publique_Epernay|0|46.*.*.*|0|Built inbound ICMP connection for faddr IP_Publique_Epernay/0 gaddr 46.*.*.*/0 laddr 46.*.*.*/0
6|Mar 19 2014|08:41:43|302015|IP_Publique_Epernay|500|46.*.*.*|500|Built outbound UDP connection 28957 for outside:IP_Publique_Epernay/500 (IP_Publique_Epernay/500) to identity:46.*.*.*/500 (46.*.*.*/500)
5|Mar 19 2014|08:41:43|713041|||||IP = 193.*.*.*, IKE Initiator: New Phase 1, Intf inside, IKE Peer 193.*.*.* local Proxy Address 192.168.1.0, remote Proxy Address 172.17.1.0, Crypto map (outside_map)
I have made other logging tests on the UC520 but unsuccessfully, especially I did not find the real time log option that I have in ASA ASDM java interface.
Do you have any other tests that I could try?
