0

I am trying to configure a ikev2 vpn between asa and router using tunnel interface. I have encountered the problem of it not even establishing the connection. There is no problem in the connectivity between the ASA and the router, ping no problem.

Note that I am also using CA encryption with Windows Server Certification Authority, however I don't think it is the problem in the first place.

  • ASA - 65.32.147.253 -> 192.168.2.2
  • RTR - 132.87.2.253 -> 192.168.2.1

ROUTER DEBUG

Mar  4 12:31:26.069: [] -> [Crypto-SS-SM(8000002A)]: message LISTEN START
Mar  4 12:31:26.069: [Crypto-SS-SM(8000002A)]: message = LISTEN START
Mar  4 12:31:26.069: [Crypto-SS-SM(8000002A)] -> [Listen-SM-(8000007A)]: message Create Listener Map
Mar  4 12:31:26.069: [Listen-SM-(8000007A)]: message = Create Listener Map
Mar  4 12:31:26.073: IPSEC:(SESSION ID = 1) (MESSAGE) INTF_SM (interface_sm_create_aux_msg_data) called
Mar  4 12:31:26.073: [Listen-SM-(8000007A)] -> [Intf Tunnel1]: message Interface CLI modified
Mar  4 12:31:26.073: [Intf Tunnel1]: message = Interface CLI modified
Mar  4 12:31:26.073: IPSEC:(SESSION ID = 1) (MESSAGE) INTF_SM (interface_sm_extract_data) idb:Tunnel1 map:Tunnel1-head-0 protection:PROTECTION_CLASS_TUNNEL
Mar  4 12:31:26.073: [Intf Tunnel1] -> [SADB Tunnel1-head-0:132.87.2.25]: message SADB root in use [SADB Tunnel1-head-0:132.87.2.25] : busy in Initialize state
Mar  4 12:31:26.073: [] -> [Crypto-SS-SM(8000002A)]: message SS OPEN [Crypto-SS-SM(8000002A)] : busy in Listen State machine not found state
Mar  4 12:31:26.073: [SADB Tunnel1-head-0:132.87.2.25]: message = SADB root in use
Mar  4 12:31:26.073: [Intf Tunnel1] -> [SADB Tunnel1-head-0:132.87.2.25]: message SADB Root attached to interface [SADB Tunnel1-head-0:132.87.2.25] : busy in SADB root in use state
Mar  4 12:31:26.073: [SADB Tunnel1-head-0:132.87.2.25]: message = SADB Root attached to interface
Mar  4 12:31:26.073: [Crypto-SS-SM(8000002A)]: message = SS OPEN
Mar  4 12:31:26.073: [Crypto-SS-SM(8000002A)] -> [Conn-SM-(8000007D)]: message Open Socket
Mar  4 12:31:26.073: [Conn-SM-(8000007D)]: message = Open Socket
Mar  4 12:31:26.073: [Conn-SM-(8000007D)] -> [SADB Tunnel1-head-0:132.87.2.25]: message CM state change [SADB Tunnel1-head-0:132.87.2.25] : busy in SADB Root attached to interface state
Mar  4 12:31:26.073: insert of map into mapdb AVL failed, map + ace pair already exists on the mapdb
Mar  4 12:31:26.073: [Conn-SM-(8000007D)] -> [SADB Tunnel1-head-0:132.87.2.25]: message CM state change [SADB Tunnel1-head-0:132.87.2.25] : busy in SADB Root attached to interface state
Mar  4 12:31:26.073: [SADB Tunnel1-head-0:132.87.2.25]: message = CM state change
Mar  4 12:31:26.073: [SADB Tunnel1-head-0:132.87.2.25] -> [ACL automatic]: message ACL check change [ACL automatic] : busy in ACL create TCAM state
Mar  4 12:31:26.073: IPSEC(MESSAGE): SADB_ROOT_SM (print_message_to_acl_state_machine) Sent MSG_ACL_CHANGED message to ACL, static seqno 65537, dynamic seqno 0
Mar  4 12:31:26.073: [ACL automatic] -> [ACL automatic]: delayed (60000 msec) message ACL for always up maps
Mar  4 12:31:26.073: [ACL automatic]: message = ACL check change
Mar  4 12:31:26.073: [SADB Tunnel1-head-0:132.87.2.25]: message = CM state change
Mar  4 12:31:28.069: %LINK-3-UPDOWN: Interface Tunnel1, changed state to up
Mar  4 12:31:35.621: IPSEC(ipsec_get_crypto_session_id):
Invalid Payload Id
Mar  4 12:31:35.621: [] -> [SADB Tunnel0-head-0:132.87.2.25]: message SADB root KMI message processing
Mar  4 12:31:35.621: [SADB Tunnel0-head-0:132.87.2.25]: message = SADB root KMI message processing
Mar  4 12:31:35.621: [SADB Tunnel0-head-0:132.87.2.25] -> [ACL automatic]: message ACL KMI create SA
Mar  4 12:31:35.621: [ACL automatic]: message = ACL KMI create SA
Mar  4 12:31:35.621: [ACL automatic] -> [KMI Forward]: message Forward KMI message
Mar  4 12:31:35.621: [KMI Forward]: message = Forward KMI message
Mar  4 12:31:35.621: [KMI Forward] -> [Ident 80000003]: message Ping
Mar  4 12:31:35.621: [Ident 80000003]: message = Ping
Mar  4 12:31:35.621: [KMI Forward] -> [Ident 80000003]: message Message - Create SA
Mar  4 12:31:35.621: [Ident 80000003]: message = Message - Create SA
Mar  4 12:31:35.621: [Ident 80000003] -> [Session]: message Session Inserting Peer
Mar  4 12:31:35.621: [Session]: message = Session Inserting Peer
Mar  4 12:31:35.621: [Ident 80000003] -> [Sibling]: message Message - Create Inbound SA
Mar  4 12:31:35.621: [Sibling]: message = Message - Create Inbound SA
Mar  4 12:31:35.621: [Sibling] -> [Session]: message Message - In Use
Mar  4 12:31:35.621: [Session]: message = Message - In Use
Mar  4 12:31:35.625: IPSEC(MESSAGE): SADB_ROOT_SM (print_message_to_acl_state_machine) Sent MSG_ACL_CREATE_PTOP_SA message to ACL, static seqno 65538, dynamic seqno 0
Mar  4 12:31:35.637: IPSEC(ipsec_get_crypto_session_id):
Invalid Payload Id
Mar  4 12:31:35.637: [] -> [Ident 80000003]: message Message - Enable Outbound SA
Mar  4 12:31:35.637: [Ident 80000003]: message = Message - Enable Outbound SA  busy in SADB Root attached to interface state
Enter TEXT message.  End with the character 'S'.

Mar  4 12:32:05.832: [Delete SA] -> [Sibling B86A4388]: message Message - Delete Sibling
Mar  4 12:32:05.832: [Sibling B86A4388]: message = Message - Delete Sibling
Mar  4 12:32:05.832: IPSEC(send_delete_notify_kmi): not sending KEY_ENGINE_DELETE_SAS
Mar  4 12:32:05.832: [Sibling B86A4388] -> [Ident 80000003]: message Message - Delete SA
Mar  4 12:32:05.832: [Ident 80000003]: message = Message - Delete SA
Mar  4 12:32:05.832: [Ident 80000003] -> [Sibling B86A4388]: message Message - Delete Sibling [Sibling B86A4388] : busy in Notify Ident state
Mar  4 12:32:05.832: [Sibling B86A4388] -> [Session]: message Message - Not In Use
Mar  4 12:32:05.836: [Session]: message = Message - Not In Use
Mar  4 12:32:05.836: [Sibling B86A4388]: discarding message Message - Delete Sibling
Mar  4 12:32:05.836: IPSEC(ERROR): [ident_update_final_flow_stats] Peer index node NULL for peer index 0  when corresponding flow id 0x34000003 was completed

Mar  4 12:32:26.196: [] -> [ACL automatic]: message ACL for always up maps
Mar  4 12:32:26.196: [ACL automatic]: message = ACL for always up maps
Mar  4 12:32:26.196: [ACL automatic] -> [ACL automatic]: delayed (60000 msec) message ACL for always up maps  Delete Sibling [Sibling B86A4388] : busy in Notify Ident state
Mar  4 12:33:26.708: [] -> [ACL automatic]: message ACL for always up maps
Mar  4 12:33:26.708: [ACL automatic]: message = ACL for always up maps
Mar  4 12:33:26.708: [ACL automatic] -> [ACL automatic]: delayed (60000 msec) message ACL for always up maps
Mar  4 12:34:27.123: [] -> [ACL automatic]: message ACL for always up maps
Mar  4 12:34:27.123: [ACL automatic]: message = ACL for always up maps
Mar  4 12:34:27.123: [ACL automatic] -> [ACL automatic]: delayed (60000 msec) message ACL for always up maps
Mar  4 12:35:27.539: [] -> [ACL automatic]: message ACL for always up maps
Mar  4 12:35:27.539: [ACL automatic]: message = ACL for always up maps
Mar  4 12:35:27.539: [ACL automatic] -> [ACL automatic]: delayed (60000 msec) message ACL for always up maps
Mar  4 12:36:28.050: [] -> [ACL automatic]: message ACL for always up maps
Mar  4 12:36:28.050: [ACL automatic]: message = ACL for always up maps
Mar  4 12:36:28.050: [ACL automatic] -> [ACL automatic]: delayed (60000 msec) message ACL for always up maps
Mar  4 12:37:16.690: [] -> [Sibling FBF0F922]: message Message - Sibling pull flow stats
Mar  4 12:37:16.690: [Sibling FBF0F922]: message = Message - Sibling pull flow stats
Mar  4 12:37:16.690: [] -> [Sibling FBF0F922]: message Message - Soft Lifetime
Mar  4 12:37:16.690: [Sibling FBF0F922]: message = Message - Soft Lifetime
Mar  4 12:37:16.690: [Sibling FBF0F922] -> [Ident 80000004]: message Message - Rekey request
Mar  4 12:37:16.690: [Ident 80000004]: message = Message - Rekey request
Mar  4 12:37:16.694: IPSEC(ipsec_get_crypto_session_id):
Invalid Payload Id
Mar  4 12:37:16.694: [] -> [SADB Tunnel0-head-0:132.87.2.25]: message SADB root KMI message processing
Mar  4 12:37:16.694: [SADB Tunnel0-head-0:132.87.2.25]: message = SADB root KMI message processing
Mar  4 12:37:16.694: [SADB Tunnel0-head-0:132.87.2.25] -> [ACL automatic]: message ACL KMI create SA
Mar  4 12:37:16.694: [ACL automatic]: message = ACL KMI create SA
Mar  4 12:37:16.694: [ACL automatic] -> [KMI Forward]: message Forward KMI message
Mar  4 12:37:16.694: [KMI Forward]: message = Forward KMI message
Mar  4 12:37:16.694: [KMI Forward] -> [Ident 80000004]: message Ping
Mar  4 12:37:16.694: [Ident 80000004]: message = Ping
Mar  4 12:37:16.694: [KMI Forward] -> [Ident 80000004]: message Message - Create SA
Mar  4 12:37:16.694: [Ident 80000004]: message = Message - Create SA
Mar  4 12:37:16.694: [Ident 80000004] -> [Session]: message Session Inserting Peer
Mar  4 12:37:16.694: [Session]: message = Session Inserting Peer
Mar  4 12:37:16.694: [Ident 80000004] -> [Sibling]: message Message - Create Inbound SA
Mar  4 12:37:16.694: [Sibling]: message = Message - Create Inbound SA
Mar  4 12:37:16.694: [Sibling] -> [Session]: message Message - In Use
Mar  4 12:37:16.694: [Session]: message = Message - In Use
Mar  4 12:37:16.698: IPSEC(MESSAGE): SADB_ROOT_SM (print_message_to_acl_state_machine) Sent MSG_ACL_CREATE_PTOP_SA message to ACL, static seqno 65539, dynamic seqno 0
Mar  4 12:37:28.466: [] -> [ACL automatic]: message ACL for always up maps
Mar  4 12:37:28.466: [ACL automatic]: message = ACL for always up maps
Mar  4 12:37:28.466: [ACL automatic] -> [ACL automatic]: delayed (60000 msec) message ACL for always up maps

ASA DEBUG

IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=0, saddr=65.32.147.253, sport=1, daddr=132.87.2.253, dport=1

ROUTER CONFIG

crypto pki certificate map CA 1
 issuer-name co ***

crypto ikev2 proposal IKEV2-PROP
 encryption 3des
 integrity sha1
 group 2 5

crypto ikev2 policy IKEV2-POL
 proposal IKEV2-PROP

crypto ikev2 profile IKEV2-PROF
 match certificate CA
 match identity remote address 65.32.147.253 255.255.255.255
 authentication local rsa-sig
 authentication remote rsa-sig
 pki trustpoint CA
 no config-exchange request

crypto ipsec transform-set IKEV2-TS esp-3des esp-sha-hmac 
 mode tunnel

crypto ipsec profile IKEV2-PROFILE
 set transform-set IKEV2-TS
 set ikev2-profile IKEV2-PROF

int tun 1
 ip add 192.168.2.1 255.255.255.252
 tun source g0/1
 tun des 65.32.147.253
 tun mode ipsec ipv4
 tun pro ipsec pro IKEV2-PROFILE
 zone security inside

no crypto ikev2 http-url cert

ASA CONFIG

crypto ikev2 policy 1
 encryption 3des
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 enable outside

crypto ipsec ikev2 ipsec-proposal IPSEC-PROP
 protocol esp encryption aes
 protocol esp integrity sha-1

crypto ipsec profile IPSEC-PROF
 set ikev2 ipsec-proposal IPSEC-PROP

int tun 1
 nameif tunnel
 ip add 192.168.2.2 255.255.255.252
 tun sou int outside
 tun des 132.87.2.253
 tun mod ipsec ipv4
 tun pro ipsec pro IPSEC-PROF

tunnel-group 132.87.2.253 type ipsec-l2l
tunnel-group 132.87.2.253 ipsec-attributes
 ikev2 remote-authentication certificate
 ikev2 local-authentication certificate CA

Appreciate anyone could help me with this issue as this problem bugs me for 3 days already

Improve this question
4
  • What commands did you use to run this debug?
    – Abu Zaid
    Commented Mar 4, 2020 at 20:58
  • ASA debug crypto ipsec 255 Router debug crypto ipsec message debug crypto ipsec states debug crypto ipsec error @AbuZaid
    – chiajw1
    Commented Mar 6, 2020 at 1:57
  • 1
    You should have a lot more messages with these debugs. But anyway, just looking at the config, see if your ikev2 proposals match, you have 'prf sha' on the ASA but I don't see anything on the Router. Depending on version you are running, it may or may not be sha. And secondly on IPSec, you have 3des / sha on the router and on the ASA you have aes/sha
    – Abu Zaid
    Commented Mar 6, 2020 at 14:43
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Commented Dec 17, 2020 at 16:11

1 Answer 1

Reset to default
1

You have, on your router config, the IKEv2 policy set to aes-sha with dh 2, 5. On the ASA, the policy is for 3des-sha and group 5, 2. Also note that you have not set lifetime nor prf settings on the router. Not setting something would use the default. To find out exactly what is being used, including defaults, use the show running-config all crypto ikev2 and filter it using something like | include protocol if you wish.

The most obvious reason I can see that this would not work is because of the policy mismatch. Change one or the other so that both are equal, make sure to explicitly add things like lifetime, prf, etc. If you don't, chances are the actual config will differ from your intended config because of differences in your explicit inputs on one device and not the other or differences in software versions, hardware, etc.

I have a few more suggestions for you, but I think this should get the tunnel established. If you want me to addend this post with some extra advice, please just let me know!

Hope this helps!

sietecFAST™

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.