I'm trying to build an IKEv2/IPSec VPN between a pfSense which uses StrongSWAN 5.2.1 and an ASA 5512 (version 9.1 software.)
When the pfSense starts the connection, everything works fine. When the ASA starts the connection, the SA comes up, but the CHILD_SA fails because the ASA claims it can't find a matching policy. This happens every night, after the CHILD_SA expires so I have to manually restart the tunnel from the pfSense every morning.
The config for the Cisco looks like this:
object network Victoria-network subnet 192.168.244.0 255.255.255.0 description Victoria office subnet object network NOC-network subnet 192.168.242.0 255.255.255.0 description NOC management subnet nat (INSIDE,OUTSIDE) source static NOC-network NOC-network destination static Victoria-network Victoria-network no-proxy-arp route-lookup access-list OUTSIDE_cryptomap extended permit ip 192.168.242.0 255.255.255.0 object Victoria-network crypto ipsec ikev2 ipsec-proposal AES256-SHA256 protocol esp encryption aes-256 protocol esp integrity sha-512 crypto map OUTSIDE_map 1 match address OUTSIDE_cryptomap crypto map OUTSIDE_map 1 set pfs group14 crypto map OUTSIDE_map 1 set peer 220.127.116.11 crypto map OUTSIDE_map 1 set ikev2 ipsec-proposal AES256-SHA256 crypto map OUTSIDE_map interface OUTSIDE crypto ca trustpool policy crypto ikev2 policy 2 encryption aes-256 integrity sha512 group 14 prf sha512 lifetime seconds 3600 crypto ikev2 enable OUTSIDE group-policy GroupPolicy_18.104.22.168 internal group-policy GroupPolicy_22.214.171.124 attributes vpn-tunnel-protocol ikev2 tunnel-group 126.96.36.199 type ipsec-l2l tunnel-group 188.8.131.52 general-attributes default-group-policy GroupPolicy_184.108.40.206 tunnel-group 220.127.116.11 ipsec-attributes ikev2 remote-authentication pre-shared-key ***** ikev2 local-authentication pre-shared-key *****
And the strongSwan config looks like this:
conn con1 fragmentation = yes keyexchange = ikev2 reauth = yes forceencaps = no rekey = yes reqid = 1 installpolicy = yes type = tunnel dpdaction = restart dpddelay = 10s dpdtimeout = 60s auto = route left = 18.104.22.168 right = 22.214.171.124 leftid = 126.96.36.199 ikelifetime = 28800s lifetime = 3600s rightsubnet = 192.168.242.0/24 leftsubnet = 192.168.244.0/24 ike = aes256-sha512-modp2048! esp = aes256-sha512-modp2048,aes256gcm128-sha512-modp2048! leftauth = psk rightauth = psk rightid = 188.8.131.52
Full disclosure: I may be woefully unqualified for this task. That said, I have so far managed to get a Juniper NS5-GT, Fortigate FG-60B, and a pfSense 2.1 box tunneled to this ASA so I must be doing something right! Any assistance will be appreciated.