1

I cannot get a IPsec tunnel up and run between a Perle IOLAN SCS 32 with firmware 4.5 and Cisco ASR 1001 with IOS XE 15.3 - it fails in phase 2 with invalid proposals

Has some out there a sample for getting this right - defining a useable IPsec transform-set which can be accepted by the IOLAN?

See - the IOLAN supports this IKE1 & 2 proposals:

IKE Phase 1 Proposals
The following IKE Phase 1 proposals are supported by the IOLAN VPN gateway:
Ciphers—3DES, AES
Hashes—MD5, SHA1
Diffie-Hellman Groups—2 (MODP1024), 5 (MODP1536), 14 (MODP2048), 15 (MODP3072), 16 (MODP4096), 17 (MODP6144), 18 (MODP8192)
ESP Phase 2 Proposals
The following ESP Phase 2 proposals are supported by the IOLAN VPN gateway:
Ciphers—3DES, AES
Authentication Algorithms—MD5, SHA1, SHA2

and the vpn tunnel must be in "tunnel mode" 
perfect forward secrecy: no
protocol: ESP
mode: tunnel (not transport)
opportunistic encryption: no
aggressive mode: no

I have a ASR 1001 with a dedicated fvrf and ivrf for the clients - it comes in to a shared internet vrf and is put into a separate vrf (dmz_iolan)

The ike pase 1 seems to be negotiated correct but the ike phase 2 doesn't - here is the cryptomap:

crypto map IPSECMAP2 3003 ipsec-isakmp 
 set peer 195.41.107.40
 set transform-set IOLAN-STD 
 set reverse-route distance 100
 set isakmp-profile IOLAN-PROF
 match address iolan01-acl
 reverse-route static
!

crypto isakmp profile IOLAN-PROF
   vrf DMZ_SCS
   keyring IPSEC-KEY2
   match identity address 195.41.107.40 255.255.255.255 INTERNET2

and my current IPsec proposals

crypto ipsec transform-set IOLAN-STD esp-3des 
 mode tunnel
!

and a bit of debug

ec 15 14:11:48.907: ISAKMP (45255): received packet from 195.41.107.40 dport 500 sport 500 INTERNET2 (R) QM_IDLE
Dec 15 14:11:48.907: ISAKMP: set new node 2045930127 to QM_IDLE
Dec 15 14:11:48.908: ISAKMP:(45255): processing HASH payload. message ID = 2045930127
Dec 15 14:11:48.908: ISAKMP:(45255): processing SA payload. message ID = 2045930127
Dec 15 14:11:48.908: ISAKMP:(45255):Checking IPSec proposal 0
Dec 15 14:11:48.908: ISAKMP: transform 0, ESP_AES
Dec 15 14:11:48.908: ISAKMP:   attributes in transform:
Dec 15 14:11:48.908: ISAKMP:      encaps is 1 (Tunnel)
Dec 15 14:11:48.908: ISAKMP:      SA life type in seconds
Dec 15 14:11:48.908: ISAKMP:      SA life duration (basic) of 28800
Dec 15 14:11:48.908: ISAKMP:      authenticator is HMAC-SHA
Dec 15 14:11:48.908: ISAKMP:(45255):atts are acceptable.
Dec 15 14:11:48.908: ISAKMP:(45255):Checking IPSec proposal 0
Dec 15 14:11:48.908: ISAKMP: transform 1, ESP_AES
Dec 15 14:11:48.908: ISAKMP:   attributes in transform:
Dec 15 14:11:48.908: ISAKMP:      encaps is 1 (Tunnel)
Dec 15 14:11:48.908: ISAKMP:      SA life type in seconds
Dec 15 14:11:48.908: ISAKMP:      SA life duration (basic) of 28800
Dec 15 14:11:48.908: ISAKMP:      authenticator is HMAC-MD5
Dec 15 14:11:48.908: ISAKMP:(45255):atts are acceptable.
Dec 15 14:11:48.908: ISAKMP:(45255):Checking IPSec proposal 0
Dec 15 14:11:48.908: ISAKMP: transform 2, ESP_3DES
Dec 15 14:11:48.908: ISAKMP:   attributes in transform:
Dec 15 14:11:48.908: ISAKMP:      encaps is 1 (Tunnel)
Dec 15 14:11:48.908: ISAKMP:      SA life type in seconds
Dec 15 14:11:48.908: ISAKMP:      SA life duration (basic) of 28800
Dec 15 14:11:48.908: ISAKMP:      authenticator is HMAC-SHA
Dec 15 14:11:48.908: ISAKMP:(45255):atts are acceptable.
Dec 15 14:11:48.908: ISAKMP:(45255):Checking IPSec proposal 0
Dec 15 14:11:48.908: ISAKMP: transform 3, ESP_3DES
Dec 15 14:11:48.908: ISAKMP:   attributes in transform:
Dec 15 14:11:48.908: ISAKMP:      encaps is 1 (Tunnel)
Dec 15 14:11:48.908: ISAKMP:      SA life type in seconds
Dec 15 14:11:48.908: ISAKMP:      SA life duration (basic) of 28800
Dec 15 14:11:48.908: ISAKMP:      authenticator is HMAC-MD5
Dec 15 14:11:48.908: ISAKMP:(45255):atts are acceptable.
Dec 15 14:11:48.908: ISAKMP:(45255): IPSec policy invalidated proposal with error 256
Dec 15 14:11:48.910: ISAKMP:(45255): IPSec policy invalidated proposal with error 256
Dec 15 14:11:48.912: IPSEC(ipsec_process_proposal): transform proposal not supported for identity:
  • Please provide more info about the problem (current config, what have you tired, etc.) – pajaja Dec 4 '14 at 20:38
  • hi again sorry for the delay - been busy elsewhere - see the iolan supports this: – tiwang Dec 15 '14 at 13:59
  • I have tried to put a bit details on but do you have a proposal for a setup like this: – tiwang Dec 15 '14 at 14:15
  • IKE Phase 1 Proposals The following IKE Phase 1 proposals are supported by the IOLAN VPN gateway: Ciphers—3DES, AES Hashes—MD5, SHA1 Diffie-Hellman Groups—2 (MODP1024), 5 (MODP1536), 14 (MODP2048), 15 (MODP3072), 16 (MODP4096), 17 (MODP6144), 18 (MODP8192) ESP Phase 2 Proposals The following ESP Phase 2 proposals are supported by the IOLAN VPN gateway: Ciphers—3DES, AES Authentication Algorithms—MD5, SHA1, SHA2 – tiwang Dec 15 '14 at 14:16
  • here a little more debug: – tiwang Dec 15 '14 at 20:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.