1

I try to establish a vpn connection but i get this error

IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1, saddr=10.0.100.10, sport=13382, daddr=192.168.128.112, dport=13382
IPSEC(crypto_map_check)-3: Checking crypto map outside_map 10: matched.
Jul 24 07:48:48 [IKE COMMON DEBUG]Tunnel Manager dispatching a KEY_ACQUIRE message to IKEv1.  Map Tag = outside_map.  Map Sequence Number = 10.
IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1, saddr=10.0.100.10, sport=13382, daddr=192.168.128.112, dport=13382
IPSEC(crypto_map_check)-3: Checking crypto map outside_map 10: matched.
IPSEC: Received a PFKey message from IKE
IPSEC: Parsing PFKey GETSPI message
IPSEC: Creating IPsec SA
IPSEC: Getting the inbound SPI
IPSEC: New embryonic SA created @ 0x00007fffa34cbde0,
    SCB: 0xA34AFFC0,
    Direction: inbound
    SPI      : 0xBA3132F1
    Session ID: 0x00A82000
    VPIF num  : 0x00000002
    Tunnel type: l2l
    Protocol   : esp
    Lifetime   : 240 seconds
IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1, saddr=10.0.100.10, sport=13382, daddr=192.168.128.112, dport=13382
IPSEC(crypto_map_check)-3: Checking crypto map outside_map 10: matched.
Jul 24 07:48:49 [IKE COMMON DEBUG]Duplicate entry already in Tunnel Manager
IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1, saddr=10.0.100.10, sport=13382, daddr=192.168.128.112, dport=13382
IPSEC(crypto_map_check)-3: Checking crypto map outside_map 10: matched.
Jul 24 07:48:50 [IKE COMMON DEBUG]Duplicate entry already in Tunnel Manager
IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1, saddr=10.0.100.10, sport=13382, daddr=192.168.128.112, dport=13382
IPSEC(crypto_map_check)-3: Checking crypto map outside_map 10: matched.
Jul 24 07:48:51 [IKE COMMON DEBUG]Duplicate entry already in Tunnel Manager
IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1, saddr=10.0.100.10, sport=13382, daddr=192.168.128.112, dport=13382
IPSEC(crypto_map_check)-3: Checking crypto map outside_map 10: matched.
Jul 24 07:48:52 [IKE COMMON DEBUG]Duplicate entry already in Tunnel Manager
Jul 24 07:49:21 [IKE COMMON DEBUG]IKEv1 was unsuccessful at setting up a tunnel.  Map Tag = outside_map.  Map Sequence Number = 10.
Jul 24 07:49:21 [IKE COMMON DEBUG]Tunnel Manager has failed to establish an L2L SA.  All configured IKE versions failed to establish the tunnel. Map Tag= outside_map.  Map Sequence Number = 10.
Jul 24 07:49:21 [IKE COMMON DEBUG]Tunnel Manager Removed entry.  Map Tag = outside_map.  Map Sequence Number = 10.
IPSEC: Received a PFKey message from IKE

THIS IS MY CONFIG

FW-VPN-IPS# show running-config
: Saved
:
ASA Version 8.6(1)2
!
hostname FW-VPN
domain-name ASAASA
enable password GTu5JQH2TaCdw/WE encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address 192.168.1.2 255.255.255.0
!
interface GigabitEthernet0/1
 nameif inside
 security-level 100
 ip address 10.0.100.254 255.255.255.0
!
interface GigabitEthernet0/2
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/4
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/5
 shutdown
 no nameif
 security-level 100
 no ip address
!
interface Management0/0
 nameif management
 security-level 100
 ip address 192.168.3.1 255.255.255.0
 management-only
!
boot system disk0:/asa861-2-smp-k8.bin
ftp mode passive
dns server-group DefaultDNS
 domain-name asaasa
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network Remote-ASA
 host 217.X.X.X
object network RA-VPN-local
 subnet 10.0.100.0 255.255.255.0
object network Remote-servers
 host 192.168.128.112
access-list Security-ACL extended permit ip 10.0.100.0 255.255.255.0 host 192.168.128.112
access-list Security-ACL extended permit ip host 192.168.128.112 10.0.100.0 255.255.255.0
access-list Interesting-traffic extended permit ip 10.0.100.0 255.255.255.0 host 192.168.128.112
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu management 1500
icmp unreachable rate-limit 10 burst-size 10
icmp permit any outside
icmp permit any inside
asdm image disk0:/asdm-66114.bin
no asdm history enable
arp timeout 14400
nat (outside,outside) source static RA-VPN-local RA-VPN-local destination static Remote-servers Remote-servers no-proxy-arp route-lookup
route outside 0.0.0.0 0.0.0.0 192.168.1.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
http server enable
http 192.168.0.0 255.255.255.0 inside
http 192.168.3.0 255.255.255.0 management
http 0.0.0.0 0.0.0.0 outside
http 10.0.100.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set TRANS1 esp-3des esp-sha-hmac
crypto ipsec ikev2 ipsec-proposal 3DES-SHA
 protocol esp encryption 3des
 protocol esp integrity sha-1
crypto ipsec ikev2 ipsec-proposal DES
 protocol esp encryption des
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
 protocol esp encryption 3des
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
 protocol esp encryption aes
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
 protocol esp encryption aes-192
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES256
 protocol esp encryption aes-256
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal secure
 protocol esp encryption 3des
 protocol esp integrity sha-1
crypto map OUTSIDE_map 10 set security-association lifetime seconds 28800
crypto map map002 3 match address Interesting-traffic
crypto map map002 3 set peer 217.X.X.X
crypto map map002 3 set ikev2 ipsec-proposal 3DES-SHA
crypto map outside_map 10 match address Interesting-traffic
crypto map outside_map 10 set pfs
crypto map outside_map 10 set peer 217.X.X.X
crypto map outside_map 10 set ikev1 transform-set ESP-3DES-SHA
crypto map outside_map 10 set ikev2 ipsec-proposal 3DES-SHA DES 3DES AES AES192 AES256 secure
crypto map outside_map interface outside
crypto isakmp identity address
crypto isakmp disconnect-notify
crypto ikev2 policy 1
 encryption 3des
 integrity sha
 group 2
 prf sha
 lifetime seconds 86400
crypto ikev1 enable outside
crypto ikev1 enable inside
crypto ikev1 policy 1
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
telnet timeout 5
ssh 192.168.0.0 255.255.255.0 outside
ssh 0.0.0.0 0.0.0.0 outside
ssh 192.168.0.0 255.255.255.0 inside
ssh 192.168.3.0 255.255.255.0 inside
ssh 10.0.100.0 255.255.255.0 inside
ssh 192.168.3.0 255.255.255.0 management
ssh timeout 5
ssh version 2
console timeout 0
no threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
group-policy DfltGrpPolicy attributes
 vpn-tunnel-protocol ssl-clientless
group-policy RA-VPN-Group internal
group-policy RA-VPN-Group attributes
 vpn-filter value Security-ACL
 vpn-tunnel-protocol ikev1
 pfs enable
group-policy L2L-policy internal
group-policy L2L-policy attributes
 vpn-filter value Security-ACL
 vpn-tunnel-protocol ikev2
username cisco password XXXXXXXXX encrypted
tunnel-group DefaultL2LGroup ipsec-attributes
 isakmp keepalive disable
tunnel-group 217.X.X.X type ipsec-l2l
tunnel-group 217.X.X.X general-attributes
 default-group-policy L2L-policy
tunnel-group 217.X.X.X ipsec-attributes
 ikev1 pre-shared-key *****
 isakmp keepalive disable
 ikev2 remote-authentication pre-shared-key *****
 ikev2 local-authentication pre-shared-key *****
no tunnel-group-map enable ou
tunnel-group-map default-group 217.X.X.X
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect ip-options
1
  • Could you explain the relationship between this question and your other one; is this the same problem from two sides? I see that the configurations are not the same, but you added the questions at almost the same time. Jul 24, 2014 at 8:56

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.