2

I am trying to hook up a VPN between us and a customer. Customer has a Checkpoint FW (not sure which version), I have a 2811.

Symptom: The tunnel (session) comes up, I can ping through, other side cannot communicate with me, I cannot even see a package coming in, but tons of errors when I debug on the crypto

ISAKMP (0:16559): received packet from 2.1.64.189 dport 500 sport 500 Global (R) QM_IDLE
ISAKMP: set new node -1881551979 to QM_IDLE
crypto_engine: Decrypt IKE packet
crypto_engine: Generate IKE hash
ISAKMP:(16559): processing HASH payload. message ID = -1881551979
ISAKMP:(16559): processing SA payload. message ID = -1881551979
ISAKMP:(16559):Checking IPSec proposal 1
ISAKMP: transform 1, ESP_3DES
ISAKMP:   attributes in transform:
ISAKMP:      group is 2
ISAKMP:      SA life type in seconds
ISAKMP:      SA life duration (VPI) of  0x0 0x0 0xE 0x10
ISAKMP:      authenticator is HMAC-MD5
ISAKMP:      encaps is 1 (Tunnel)
ISAKMP:(16559):atts are acceptable.
IPSEC(ipsec_process_proposal): peer address 2.1.64.189 not found
ISAKMP:(16559): IPSec policy invalidated proposal with error 64
ISAKMP:(16559): phase 2 SA policy not acceptable! (local 1.2.226.74 remote 2.1.64.189)
ISAKMP: set new node -1932908402 to QM_IDLE
crypto_engine: Generate IKE hash
ISAKMP:(16559):Sending NOTIFY PROPOSAL_NOT_CHOSEN protocol 3
    spi 120039592, message ID = -1932908402
crypto_engine: Encrypt IKE packet
ISAKMP:(16559): sending packet to 2.1.64.189 my_port 500 peer_port 500 (R) QM_IDLE
ISAKMP:(16559):Sending an IKE IPv4 Packet.
ISAKMP:(16559):purging node -1932908402
ISAKMP:(16559):deleting node -1881551979 error TRUE reason "QM rejected"
ISAKMP:(16559):Node -1881551979, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
ISAKMP:(16559):Old State = IKE_QM_READY  New State = IKE_QM_READY

We have tried different encodings and hashing on phase2 as well as PFS/no PFS, other DH groups too, but got the same error

Relevant part of my config:

crypto isakmp policy 4
encr aes 256
authentication pre-share
group 2
crypto isakmp key ........... address 2.1.64.189
crypto ipsec transform-set C1 esp-3des esp-md5-hmac
crypto map grvpn 4 ipsec-isakmp
set peer 2.1.64.189
set transform-set C1
set pfs group2
match address C1
ip access-list extended C1
permit ip 172.30.130.0 0.0.0.255 192.168.33.160 0.0.0.7
permit ip 192.168.33.160 0.0.0.7 172.30.130.0 0.0.0.255
2
  • also tried w/ different ACL too (host based, wider, smaller subnets) – Gabor Vincze Oct 5 '15 at 20:48
  • Can you post the rest of your crypto maps? There may be a problem with the order. – Ron Trunk Oct 6 '15 at 0:37