VPN IKev2 with NAT Config Help

[m.s.rees1]

Hi, I am trying to establish a VPN connection with Ikev2 and just wanted to check if my config is looking correct. I don't have access to the other side of the VPN unfortunaly so just want to check this side is at least not missing anything important, there is also a NAT in place:

name 1.1.1.1 test

object-group network test
network-object host test

object network test_nat
host 192.168.2.1

Object network test_local
Subnet 0.0.0.0 0.0.0.0

Object network test_remote
Subnet 192.168.1.0 255.255.255.224

access-list acl_test extended permit tcp any host 192.168.1.10 eq ssh
access-list acl_test extended permit tcp any host 192.168.1.2 eq https

access-group acl_test interface outside control-plane

route outside 192.168.1.0 255.255.255.252 180.180.180.126

crypto ipsec ikev2 ipsec-proposal p1
protocol esp encryption aes-256
protocol esp integrity sha-256

crypto ikev2 policy 1
encryption aes-256
integrity sha
group 14
prf sha256
lifetime seconds 86400
Crypto ikev2 enable outside

crypto map outside_tunnels 141 match address acl_test
crypto map outside_tunnels 141 set peer test
crypto map outside_tunnels 141 set ikev2 ipsec-proposal p1
crypto map outside_tunnels 141 set pfs group14

tunnel-group 1.1.1.1 type ipsec-l2l
tunnel-group 1.1.1.1 ipsec-attributes
ikev2 remote-authentication pre-shared-key xxxxxxx
ikev2 local-authentication pre-shared-key xxxxxxx

nat (inside,outside) source static test_local test_nat destination static test_remote test_remote

[m.s.rees1]

Here is the debug info. Config matches @MHM Cisco World above.

[Rob Ingram]

@m.s.rees1 "no proposal chosen notify" check your IKEv2 settings with the peer device match.

[m.s.rees1]

Just spotted that myself, thanks for the help here. Appreciate it. This is where I wanted to get to, just to make sure my side isn't causing the problem. I will have to clarify the details with the 3rd party and hopefully get somewhere. Looks like a mismatch.

[MHM Cisco World]

crypto ikev2 policy 1
encryption aes-256 <<- add more algorithm
integrity sha <<- add more  algorithm 
group 14 <<- add more group 
prf sha256
lifetime seconds 86400

[m.s.rees1]

Could you explain this? - would this not work as it is, if it was correct both sides...?

Thanks.

[MHM Cisco World]

type: 1, reserved: 0x0, id: AES-CBC
(47):     last transform: 0x3, reserved: 0x0: length: 8
    type: 2, reserved: 0x0, id: SHA256
(47):     last transform: 0x3, reserved: 0x0: length: 8
    type: 3, reserved: 0x0, id: SHA96
(47):     last transform: 0x0, reserved: 0x0: length: 8
    type: 4, reserved: 0x0, id: DH_GROUP_2048_MODP/Group 14
(47):  KE(47):   Next payload: N, reserved: 0x0, length: 264
(47):     DH group: 14, Reserved: 0x0
(47): 

The answer here 

This what peer use 

Dh group 14 

Prf sha 256

Integrity sha256

Encrypt aes-cbs <<- this 128 not 256 

[m.s.rees1]

so like this?
crypto ikev2 policy 1
encryption aes
integrity sha256 sha
group 14  (they specified this as the group)
prf sha256
lifetime seconds 86400

[MHM Cisco World]

crypto ikev2 policy 1
encryption aes-cbs
integrity sha256 sha
group 14  (they specified this as the group)
prf sha256
lifetime seconds 86400

[m.s.rees1]

ah I only the get the following options:

[MHM Cisco World]

OK, 
select aes and aes-192 
hope it work. 
thanks 

[m.s.rees1]

Thanks, unfortnuately not I did notive this is the debug though:

IKEv2-PLAT-2: (110): IKEv2 protocol not allowed by policy set for vpn-tunnel-protocol
IKEv2-PLAT-2: (110): Connection is not authorized based on configured attributes

[Rob Ingram]

@m.s.rees1

IKEv2-PLAT-2: (110): IKEv2 protocol not allowed by policy set for vpn-tunnel-protocol

...that implies IKEv2 is not an allowed protocol, as mentioned before - Is IKEv2 protocol enabled under the group-policy (possibly DfltGrpPolicy if you do not have a specific policy)

Check:-

group-policy DfltGrpPolicy attributes
 vpn-tunnel-protocol ikev2

[m.s.rees1]

I managed to create a new policy and this error has gone away now an no longer in the debug, so I assume it fixed it. I feel like I am nearly there! I am now getting the following in the debug:

IKEv2-PLAT-4: (92): IKEv2 session deregistered from session manager. Reason: 8
IKEv2-PLAT-4: (92): session manager killed ikev2 tunnel. Reason: Internal Error

[MHM Cisco World]

crypto isakmp identity address

Add above 

Clear crypto isakmp 

Clear crypto sa 

And check again 

[m.s.rees1]

Looks like the same log:

This is the latest.