VPN Site to Site Connection ASA 5508X to Juniper SRX

[Kevin Sampson]

This is driving me insane. I have been trying and trying to get this stupid Site to Site VPN connection up and running. 

Confirmed that both sides have the Outside/Inside interface matching and correctly configured. Proposal is confirmed to match as ESP-DES-SHA with DH-Group 1 & pre-shared key and ESP-AES128-SHA with DH-Group 2 & pre-shared key. 

Their inside interface is 192.168.0.0/16. 

My inside interface is 10.3.2.0/24.

No other inside networks have been added to the VPN connection and both sides match on everything you see above. 

ASA5508X-FW1(config)# sh run crypto map
crypto map outside_map 1 match address outside_cryptomap
crypto map outside_map 1 set peer XXX.XXX.XXX.XXX
crypto map outside_map 1 set ikev1 transform-set ESP-DES-SHA ESP-AES-128-SHA
crypto map outside_map interface outside

The other site is in Japan, so I can't physically go there. They're using what appears to be a pretty old Juniper firewall. They're also not open to the idea of changing many of their settings (hence the use of DES and DH-1 and 2) and looks like everything is IKEv1. When I suggested a change to their proposal, they said no, so any changes are pretty much going to have to be on my side. 

Tunnel is Up but not passing traffic: 

ASA5508X-FW1(config)# show crypto isakmp sa

IKEv1 SAs:

Active SA: 1
Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1

1 IKE Peer: XXX.XXX.XXX.XXX
Type : L2L Role : responder
Rekey : no State : MM_ACTIVE

There are no IKEv2 SAs

Here's the Errors I keep getting: 

4 Dec 15 2017 03:14:57 210.138.219.67 50.204.254.115 IPSEC: Received an ESP packet (SPI= 0xFBDB975B, sequence number= 0x1D2) from XXX.138.219.67 (user= XXX.138.219.67) to XXX.204.254.115. The decapsulated inner packet doesn't match the negotiated policy in the SA. The packet specifies its destination as 1ae9:75b:1f68:3cd5:db92:ab74:9f8d:b467, its source as 64fa:642f:7d35:4251:e71a:294f:fe9b:61d8, and its protocol as 255. The SA specifies its local proxy as 10.3.2.0/255.255.255.0/ip/0 and its remote_proxy as 192.168.0.0/255.2

4 Dec 15 2017 03:18:37 210.138.219.67 50.204.254.115 IPSEC: Received an ESP packet (SPI= 0xFBDB975B, sequence number= 0x214) from XXX.138.219.67 (user= XXX.138.219.67) to XXX.204.254.115. The decapsulated inner packet doesn't match the negotiated policy in the SA. The packet specifies its destination as 23aa:b7c1:73e6:ab35:2c5b:8ffb:52c9:a7e2, its source as 251c:ffe2:f50b:78df:3aab:5056:2a79:18bb, and its protocol as 255. The SA specifies its local proxy as 10.3.2.0/255.255.255.0/ip/0 and its remote_proxy as 192.168.0.0/255.

6 Dec 15 2017 05:26:04 192.168.221.36 3 Failed to locate egress interface for ICMP from outside:192.168.221.36/3 to 10.3.2.1/0

It's strange that the decapsulated ESP packet would contain IPv6 source and destination using 255 protocol (a reserved and never used tcp/udp port). Since these do not match the settings they set on their end, the thought was that something on my side was mangling things. 

One suggestion from a Juniper support forum was to disable VPN Monitoring. Truth be told, I don't know how to do. It sounds like a bad idea, but I'll try anything at this point. Also Japan is saying their setting is "policy based VPN" which I thought was kind of obvious, but maybe I'm missing something. In Juniper speak, does that mean something that I'm not quite comprehending? 

Help!!!

[Kevin Sampson]

Yeah another thing I forgot to add to the new firewall. Modified my ACL to:

nat (inside,outside) source static GSI GSI destination static Nissha Nissha no-proxy-arp route-lookup

Resulting access lists: 

GSI-ASA5508X-FW1(config)# show access-list

access-list cached ACL log flows: total 0, denied 0 (deny-flow-max 4096)
alert-interval 300
access-list outside_cryptomap; 1 elements; name hash: 0x39bea18f
access-list outside_cryptomap line 1 extended permit ip object-group GSI object-group Nissha (hitcnt=2) 0xb429b5fb
access-list outside_cryptomap line 1 extended permit ip 10.3.2.0 255.255.255.0 192.168.0.0 255.255.0.0 (hitcnt=2) 0x35490439
access-list inside_access_in; 1 elements; name hash: 0x433a1af1
access-list inside_access_in line 1 extended permit ip any any (hitcnt=4) 0xa925365e
access-list outside_access_in; 8 elements; name hash: 0x6892a938
access-list outside_access_in line 1 extended permit icmp any 50.204.254.112 255.255.255.248 echo-reply (hitcnt=0) 0x05f514ac
access-list outside_access_in line 2 extended permit icmp any any source-quench (hitcnt=0) 0x0a60d28d
access-list outside_access_in line 3 extended permit icmp any any time-exceeded (hitcnt=0) 0x03690eb3
access-list outside_access_in line 4 extended permit icmp any any unreachable (hitcnt=0) 0x5c2fa603
access-list outside_access_in line 5 extended permit icmp object Comcast any echo-reply (hitcnt=0) 0x9e8454b9
access-list outside_access_in line 5 extended permit icmp 50.204.254.192 255.255.255.248 any echo-reply (hitcnt=0) 0x9e8454b9
access-list outside_access_in line 6 extended permit icmp object Comcast any source-quench (hitcnt=0) 0x5dce85eb
access-list outside_access_in line 6 extended permit icmp 50.204.254.192 255.255.255.248 any source-quench (hitcnt=0) 0x5dce85eb
access-list outside_access_in line 7 extended permit icmp object Comcast any time-exceeded (hitcnt=0) 0x315c62b2
access-list outside_access_in line 7 extended permit icmp 50.204.254.192 255.255.255.248 any time-exceeded (hitcnt=0) 0x315c62b2
access-list outside_access_in line 8 extended permit icmp object Comcast any unreachable (hitcnt=0) 0x3dbe319b
access-list outside_access_in line 8 extended permit icmp 50.204.254.192 255.255.255.248 any unreachable (hitcnt=0) 0x3dbe319b
GSI-ASA5508X-FW1(config)#

And Packet Tracer detailed looks like this:

GSI-ASA5508X-FW1(config)# packet-tracer input inside icmp 10.3.2.110 0 0 192.168.223.251 detailed

Phase: 1
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop 50.204.254.113 using egress ifc outside

Phase: 2
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
nat (inside,outside) source static GSI GSI destination static Nissha Nissha no-proxy-arp route-lookup
Additional Information:
NAT divert to egress interface outside
Untranslate 192.168.223.251/0 to 192.168.223.251/0

Phase: 3
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group inside_access_in in interface inside
access-list inside_access_in extended permit ip any any
Additional Information:
Forward Flow based lookup yields rule:
in id=0x2aaad9048cd0, priority=13, domain=permit, deny=false
hits=3, user_data=0x2aaacdd1df00, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
input_ifc=inside, output_ifc=any

Phase: 4
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (inside,outside) source static GSI GSI destination static Nissha Nissha no-proxy-arp route-lookup
Additional Information:
Static translate 10.3.2.110/0 to 10.3.2.110/0
Forward Flow based lookup yields rule:
in id=0x2aaad9067d80, priority=6, domain=nat, deny=false
hits=1, user_data=0x2aaad8fedc20, cs_id=0x0, flags=0x0, protocol=0
src ip/id=10.3.2.0, mask=255.255.255.0, port=0, tag=any
dst ip/id=192.168.0.0, mask=255.255.0.0, port=0, tag=any, dscp=0x0
input_ifc=inside, output_ifc=outside

Phase: 5
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x2aaad82c0420, priority=0, domain=nat-per-session, deny=true
hits=10, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
input_ifc=any, output_ifc=any

Phase: 6
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x2aaad906d850, priority=0, domain=inspect-ip-options, deny=true
hits=3, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
input_ifc=inside, output_ifc=any

Phase: 7
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x2aaad906d060, priority=66, domain=inspect-icmp-error, deny=false
hits=2, user_data=0x2aaad906c5d0, cs_id=0x0, use_real_addr, flags=0x0, protocol=1
src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, tag=any, dscp=0x0
input_ifc=inside, output_ifc=any

Phase: 8
Type: VPN
Subtype: encrypt
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
out id=0x2aaad9c0df80, priority=70, domain=encrypt, deny=false
hits=2, user_data=0x2c9c, cs_id=0x2aaad9711fc0, reverse, flags=0x0, protocol=0
src ip/id=10.3.2.0, mask=255.255.255.0, port=0, tag=any
dst ip/id=192.168.0.0, mask=255.255.0.0, port=0, tag=any, dscp=0x0
input_ifc=any, output_ifc=outside

Phase: 9
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
nat (inside,outside) source static GSI GSI destination static Nissha Nissha no-proxy-arp route-lookup
Additional Information:
Forward Flow based lookup yields rule:
out id=0x2aaad8feed40, priority=6, domain=nat-reverse, deny=false
hits=2, user_data=0x2aaad8fedd30, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
src ip/id=10.3.2.0, mask=255.255.255.0, port=0, tag=any
dst ip/id=192.168.0.0, mask=255.255.0.0, port=0, tag=any, dscp=0x0
input_ifc=inside, output_ifc=outside

Phase: 10
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 102, packet dispatched to next module
Module information for forward flow ...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_inspect_icmp
snp_fp_translate
snp_fp_adjacency
snp_fp_encrypt
snp_fp_fragment
snp_ifc_stat

Module information for reverse flow ...

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: allow

[Kevin Sampson]

Any problems? Anything at all? Looks good to me, but I'm the one with the IPSEC VPN Tunnel that can't seem to connect. 

[GioGonza]

Hello @Kevin Sampson, 

The way I see it, everything should be working as expected since the ASA is finally sending the traffic through the VPN tunnel so the traffic should working as per now, can you verify with "show crypto ipsec sa" and verify if you have any encaps?

Gio

[Kevin Sampson]

Don't seem to be getting much. The IT firewall guy in Japan changed a setting on his Juniper. Source Translation: None, use Egress Interface IP. Then he pinged and says he got no response. 

GSI-ASA5508X-FW1(config)# sh crypto ipsec sa
interface: outside
Crypto map tag: outside_map, seq num: 1, local addr: 50.204.254.115

access-list outside_cryptomap extended permit ip 10.3.2.0 255.255.255.0 19 2.168.0.0 255.255.0.0
local ident (addr/mask/prot/port): (10.3.2.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.0.0/255.255.0.0/0/0)
current_peer: 210.138.219.67

#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 8014, #pkts decrypt: 5334, #pkts verify: 5334
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#TFC rcvd: 0, #TFC sent: 0
#Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
#send errors: 0, #recv errors: 2679

local crypto endpt.: 50.204.254.115/0, remote crypto endpt.: 210.138.219.6 7/0
path mtu 1500, ipsec overhead 58(36), media mtu 1500
PMTU time remaining (sec): 0, DF policy: copy-df
ICMP error validation: disabled, TFC packets: disabled
current outbound spi: CDDE8C01
current inbound spi : 149B7233

inbound esp sas:
spi: 0x149B7233 (345731635)
SA State: active
transform: esp-des esp-sha-hmac no compression
in use settings ={L2L, Tunnel, IKEv1, }
slot: 0, conn_id: 137093120, crypto-map: outside_map
sa timing: remaining key lifetime (sec): 3231
IV size: 8 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
outbound esp sas:
spi: 0xCDDE8C01 (3453914113)
SA State: active
transform: esp-des esp-sha-hmac no compression
in use settings ={L2L, Tunnel, IKEv1, }
slot: 0, conn_id: 137093120, crypto-map: outside_map
sa timing: remaining key lifetime (sec): 3227
IV size: 8 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001

GSI-ASA5508X-FW1(config)#

Now there was some traffic captured by the original firewall, but that was after many late nights monkeying with it with Japan. They're not available for me to talk to them right now apparently. But my error message is essentially the same as it was. 

4 Dec 18 2017 20:11:54 210.138.219.67 50.204.254.115 IPSEC: Received an ESP packet (SPI= 0x149B7233, sequence number= 0x9F) from 210.138.219.67 (user= 210.138.219.67) to 50.204.254.115. The decapsulated inner packet doesn't match the negotiated policy in the SA. The packet specifies its destination as 7dc9:3881:a9bc:1611:aa1:d434:fff1:e702, its source as 5c75:c29c:fe22:16f8:321c:de49:b8b7:990, and its protocol as 255. The SA specifies its local proxy as 10.3.2.0/255.255.255.0/ip/0 and its remote_proxy as 192.168.0.0/255.255

So other than proving out that my side is doing exactly what it's supposed ot be doing, nothing much has changed.