0

I'm trying to move a site-to-site IPsec tunnel from a Cisco ASA 5505 and a BIG-IP LTM+AFM version 12.1.0. The tunnel was up and traffic flowed properly when the tunnel was terminated on ASA but not any longer. I have configured IKE phase 1 and IPsec phase 2 and traffic selectors with same parameters that were configured on the ASA and I have also configured a forwardning virtual server but my BIG-IP seems to drop ISAKMP traffic, it answers back to the peer with ICMP port 500 unreachable. What can be wrong? Am I missing something in Network Firewall? I have added ESP and ISAKMP to the Global rule and I can see Count increasing. But phase 1 doesn't work anyway.

I have followed https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/bigip-tmos-tunnels-ipsec-12-1-0/10.html

Best regards, Andreas

Improve this question
4
  • "it answers back to the peer with ICMP port 500 unreachable." Please include the exact messages. This doesn't make any sense because ICMP doesn't use ports (layer-4 addresses) the way TCP and UDP do.
    – Ron Maupin ♦
    Oct 27, 2017 at 15:31
  • An example (the F5 is 1.1.1.1, the Cisco ASA is 2.2.2.2): 07:00:30.781207 IP 2.2.2.2.isakmp > 1.1.1.1.isakmp: isakmp: phase 1 I ident in slot1/tmm0 lis= 07:00:30.781263 IP 1.1.1.1 > 2.2.2.2: ICMP 1.1.1.1 udp port isakmp unreachable, length 36 out slot1/tmm0 lis=
    – andbos
    Oct 30, 2017 at 7:01
  • Problem solved by changing mode in the IPsec profile first to IPsec interface and then back to Tunnel again... After this "change" the tunnel got up and I was able to reach the private network on the other side of the tunnel.
    – andbos
    Oct 30, 2017 at 9:55
  • You should post an answer and accept it so that the question doesn't keep popping up forever, looking for an answer.
    – Ron Maupin ♦
    Oct 30, 2017 at 13:56

1 Answer 1

Reset to default
0

Problem solved by changing mode in the IPsec profile first to IPsec interface and then back to Tunnel again... After this "change" the tunnel got up and I was able to reach the private network on the other side of the tunnel.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.