Buy or Renew
Buy or Renew
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
812
Views
0
Helpful
2
Replies

VPN site to site

dgentle01
Level 1
Level 1

‎05-11-2016 03:05 PM

Hi I been trying to establish a VPN site to site connection, however I keep getting below error. Do you have any insights on below problem. 

May 11 15:57:26 [IKEv1]: IP = 52.x.x.x, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.
May 11 15:57:27 [IKEv1]: IP = 205.x.x.x, Header invalid, missing SA payload! (next payload = 4)
May 11 15:57:28 [IKEv1]: Group = 205.x.x.x, IP = 205.x.x.x, Duplicate Phase 1 packet detected. Retransmitting last packet.
May 11 15:57:28 [IKEv1]: Group = 205.x.x.x, IP = 205.x.x.x, P1 Retransmit msg dispatched to MM FSM
May 11 15:57:29 [IKEv1]: IP = 52.x.x.x, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.
May 11 15:57:30 [IKEv1 DEBUG]: IP = 52.24.34.231, IKE MM Initiator FSM error history (struct &0x7259e218) <state>, <event>: MM_DONE, EV_ERROR-->MM_WAIT_MSG2, EV_RETRY-->MM_WAIT_MSG2, EV_TIMEOUT-->MM_WAIT_MSG2, NullEvent-->MM_SND_MSG1, EV_SND_MSG-->MM_SND_MSG1, EV_START_TMR-->MM_SND_MSG1, EV_RESEND_MSG-->MM_WAIT_MSG2, EV_RETRY
May 11 15:57:30 [IKEv1 DEBUG]: IP = 52.x.x.x, IKE SA MM:acd543d0 terminating: flags 0x01000022, refcnt 0, tuncnt 0
May 11 15:57:30 [IKEv1 DEBUG]: IP = 52.x.x.x, sending delete/delete with reason message
May 11 15:57:35 [IKEv1]: IP = 52.x.x.x, IKE Initiator: New Phase 1, Intf ServiceNetwork, IKE Peer 52.x.x.x local Proxy Address 10.x.x.x, remote Proxy Address 10.x.x.x, Crypto map (SMARTINTERNET_CRYPTO_MAP)
May 11 15:57:35 [IKEv1 DEBUG]: IP = 52.x.x.x, constructing ISAKMP SA payload
May 11 15:57:35 [IKEv1 DEBUG]: IP = 52.x.x.x, constructing NAT-Traversal VID ver 02 payload
May 11 15:57:35 [IKEv1 DEBUG]: IP = 52.x.x.x, constructing NAT-Traversal VID ver 03 payload
May 11 15:57:35 [IKEv1 DEBUG]: IP = 52.x.x.x, constructing NAT-Traversal VID ver RFC payload
May 11 15:57:35 [IKEv1 DEBUG]: IP = 52.x.x.x, constructing Fragmentation VID + extended capabilities payload
May 11 15:57:35 [IKEv1]: IP = 52.x.x.x, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 228
May 11 15:57:37 [IKEv1]: IP = 205.x.x.x, Header invalid, missing SA payload! (next payload = 4)
May 11 15:57:38 [IKEv1]: Group = 205.x.x.x, IP = 205.x.x.x, Duplicate Phase 1 packet detected. Retransmitting last packet.
May 11 15:57:38 [IKEv1]: Group = 205.x.x.x, IP = 205.x.x.x, P1 Retransmit msg dispatched to MM FSM
May 11 15:57:38 [IKEv1 DEBUG]: Group = 205.x.x.x, IP = 205.x.x.x, IKE MM Initiator FSM error history (struct &0x716d5688) <state>, <event>: MM_DONE, EV_ERROR-->MM_WAIT_MSG6, EV_PROB_AUTH_FAIL-->MM_WAIT_MSG6, EV_RESEND_MSG-->MM_WAIT_MSG6, NullEvent-->MM_SND_MSG5, EV_SND_MSG-->MM_SND_MSG5, EV_START_TMR-->MM_SND_MSG5, EV_RESEND_MSG-->MM_WAIT_MSG6, EV_TIMEOUT
May 11 15:57:38 [IKEv1 DEBUG]: Group = 205.x.x.x, IP = 205.x.x.x, IKE SA MM:131be973 terminating: flags 0x01000022, refcnt 0, tuncnt 0
May 11 15:57:38 [IKEv1 DEBUG]: Group = 205.x.x.x, IP = 205.x.x.x, sending delete/delete with reason message
May 11 15:57:38 [IKEv1 DEBUG]: Group = 205.x.x.x, IP = 205.x.x.x, constructing blank hash payload
May 11 15:57:38 [IKEv1 DEBUG]: Group = 205.x.x.x, IP = 205.x.x.x, constructing IKE delete payload
May 11 15:57:38 [IKEv1 DEBUG]: Group = 205.x.x.x, IP = 205.x.x.x, constructing qm hash payload
May 11 15:57:38 [IKEv1]: IP = 205.x.x.x, IKE_DECODE SENDING Message (msgid=864e8e29) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 80
May 11 15:57:43 [IKEv1]: IP = 52.x.x.x, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 228

Labels:
0 Helpful
2 Replies 2

Aditya Ganjoo
Cisco Employee
Cisco Employee

‎05-11-2016 05:06 PM

Hi,

It seems the issue with the Phase 2 settings.

Could you check whether your Phase 2 settings on both the peers are matching each other ?

Phase 2 will include the crypto ACL(interesting traffic), transform-set, PFS ( if enabled).

Regards,

Aditya

Please rate helpful posts and mark correct answers.

0 Helpful

David Castro F.
Spotlight
Spotlight

‎06-04-2016 07:15 AM

Hello,

Checking on this debugs, I see the Phase 1 gets to the MSG6EV and is getting timed out, please check the tunnel groups (Make sure the Pre-shared key defined is the same in both sides), also the crypto IKEv1 policies. I can´t see any QM FSM error that would indicate a mismatch of phase 2, but as Aditya mentioned please take a look to that as well,

Please proceed to rate and mark as correct the helpful post! 

David Castro,

0 Helpful
Customers Also Viewed These Support Documents