4

I'm trying to build an IKEv2/IPSec VPN between a pfSense which uses StrongSWAN 5.2.1 and an ASA 5512 (version 9.1 software.)

When the pfSense starts the connection, everything works fine. When the ASA starts the connection, the SA comes up, but the CHILD_SA fails because the ASA claims it can't find a matching policy. This happens every night, after the CHILD_SA expires so I have to manually restart the tunnel from the pfSense every morning.

The config for the Cisco looks like this:

object network Victoria-network
 subnet 192.168.244.0 255.255.255.0
 description Victoria office subnet
object network NOC-network
 subnet 192.168.242.0 255.255.255.0
 description NOC management subnet

nat (INSIDE,OUTSIDE) source static NOC-network NOC-network destination static Victoria-network Victoria-network no-proxy-arp route-lookup

access-list OUTSIDE_cryptomap extended permit ip 192.168.242.0 255.255.255.0 object Victoria-network 

crypto ipsec ikev2 ipsec-proposal AES256-SHA256
 protocol esp encryption aes-256
 protocol esp integrity sha-512

crypto map OUTSIDE_map 1 match address OUTSIDE_cryptomap
crypto map OUTSIDE_map 1 set pfs group14
crypto map OUTSIDE_map 1 set peer 1.2.3.4 
crypto map OUTSIDE_map 1 set ikev2 ipsec-proposal AES256-SHA256
crypto map OUTSIDE_map interface OUTSIDE
crypto ca trustpool policy

crypto ikev2 policy 2
 encryption aes-256
 integrity sha512
 group 14
 prf sha512
 lifetime seconds 3600

crypto ikev2 enable OUTSIDE

group-policy GroupPolicy_1.2.3.4 internal
group-policy GroupPolicy_1.2.3.4 attributes
 vpn-tunnel-protocol ikev2

tunnel-group 1.2.3.4 type ipsec-l2l
tunnel-group 1.2.3.4 general-attributes
 default-group-policy GroupPolicy_1.2.3.4
tunnel-group 1.2.3.4 ipsec-attributes
 ikev2 remote-authentication pre-shared-key *****
 ikev2 local-authentication pre-shared-key *****

And the strongSwan config looks like this:

conn con1
    fragmentation = yes
    keyexchange = ikev2
    reauth = yes
    forceencaps = no
    rekey = yes
    reqid = 1
    installpolicy = yes
    type = tunnel
    dpdaction = restart
    dpddelay = 10s
    dpdtimeout = 60s
    auto = route
    left = 1.2.3.4
    right = 9.8.7.6
    leftid = 1.2.3.4
    ikelifetime = 28800s
    lifetime = 3600s
    rightsubnet = 192.168.242.0/24
    leftsubnet = 192.168.244.0/24
    ike = aes256-sha512-modp2048!
    esp = aes256-sha512-modp2048,aes256gcm128-sha512-modp2048!
    leftauth = psk
    rightauth = psk
    rightid = 9.8.7.6

Full disclosure: I may be woefully unqualified for this task. That said, I have so far managed to get a Juniper NS5-GT, Fortigate FG-60B, and a pfSense 2.1 box tunneled to this ASA so I must be doing something right! Any assistance will be appreciated.

2

I've seen similar behavior when the Phase 2 SA liftetime settings don't match. You may want to try matching both your Phase 1 and 2 lifetime settings.

This is your Phase 1 lifetime configuration on the ASA:

  crypto ikev2 policy 2
  lifetime seconds 3600

This is your Phase 1 lifetime configuration with StrongSwan:

 ikelifetime = 28800s

The ASA Phase 2 lifetime defaults to 28800 seconds. You can explicitly configure the Phase 2 lifetime globally or on a per crypto map instance. You can configure the latter as follows:

 crypto map OUTSIDE_map 1 set security-association lifetime seconds 28800

The Phase 2 lifetime configuration with StrongSwan:

 lifetime = 3600s

Try changing the StrongSwan lifetime value to 28800 to match the ASA default value.

  • Thanks, I will give this a shot and report back. I actually did change the lifetimes yesterday after reading this post but looks like I got phase 1 and phase 2 backwards. Would be nice if Cisco used the same terms as everyone else. – miken32 Dec 12 '14 at 23:23
  • Looks like this may actually be an error in the pfSense; apparently it will sometimes send an incorrect traffic selector, which results in the Cisco not recognizing it. Marking this as the answer, since it did stabilize the connection and made it easier to diagnose. Thanks! – miken32 Dec 19 '14 at 23:39
  • Thanks for the update. Glad this helped your troubleshooting cause. – James.Birmingham Dec 20 '14 at 18:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.