0

I'm trying to move a site-to-site IPsec tunnel from a Cisco ASA 5505 and a BIG-IP LTM+AFM version 12.1.0. The tunnel was up and traffic flowed properly when the tunnel was terminated on ASA but not any longer. I have configured IKE phase 1 and IPsec phase 2 and traffic selectors with same parameters that were configured on the ASA and I have also configured a forwardning virtual server but my BIG-IP seems to drop ISAKMP traffic, it answers back to the peer with ICMP port 500 unreachable. What can be wrong? Am I missing something in Network Firewall? I have added ESP and ISAKMP to the Global rule and I can see Count increasing. But phase 1 doesn't work anyway.

I have followed https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/bigip-tmos-tunnels-ipsec-12-1-0/10.html

Best regards, Andreas

4
  • "it answers back to the peer with ICMP port 500 unreachable." Please include the exact messages. This doesn't make any sense because ICMP doesn't use ports (layer-4 addresses) the way TCP and UDP do. – Ron Maupin Oct 27 '17 at 15:31
  • An example (the F5 is 1.1.1.1, the Cisco ASA is 2.2.2.2): 07:00:30.781207 IP 2.2.2.2.isakmp > 1.1.1.1.isakmp: isakmp: phase 1 I ident in slot1/tmm0 lis= 07:00:30.781263 IP 1.1.1.1 > 2.2.2.2: ICMP 1.1.1.1 udp port isakmp unreachable, length 36 out slot1/tmm0 lis= – andbos Oct 30 '17 at 7:01
  • Problem solved by changing mode in the IPsec profile first to IPsec interface and then back to Tunnel again... After this "change" the tunnel got up and I was able to reach the private network on the other side of the tunnel. – andbos Oct 30 '17 at 9:55
  • You should post an answer and accept it so that the question doesn't keep popping up forever, looking for an answer. – Ron Maupin Oct 30 '17 at 13:56
0

Problem solved by changing mode in the IPsec profile first to IPsec interface and then back to Tunnel again... After this "change" the tunnel got up and I was able to reach the private network on the other side of the tunnel.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.