1

We could not setup the VPN connection between Router C3925 and Firewall Sophos XG210.

Attached files are the logs on both 2 devices. Please revise and suggest, many thanks!

Public IP address of Firewall Sophos XG210: {A}.{B}.{C}.{D}
LAN IP network of Firewall: 172.16.16.0/24

Public IP address of Router C3925: {Q}.{W}.{E}.{R}
LAN IP network of Firewall: 192.168.6.0/24

Here is the log in Cisco router:

Nov 21 10:15:12.570: ISAKMP (1005): received packet from {A}.{B}.{C}.{D} dport 500 sport 500 Global (R) QM_IDLE  
Nov 21 10:15:12.570: ISAKMP: set new node -2018918028 to QM_IDLE  
Nov 21 10:15:12.570: ISAKMP:(1005): processing HASH payload. message ID = 2276049268  
Nov 21 10:15:12.570: ISAKMP:(1005): processing SA payload. message ID = 2276049268  
Nov 21 10:15:12.570: ISAKMP:(1005):Checking IPSec proposal 0  
Nov 21 10:15:12.570: ISAKMP: transform 0, ESP_DES  
Nov 21 10:15:12.570: ISAKMP:   attributes in transform:  
Nov 21 10:15:12.570: ISAKMP:      group is 2  
Nov 21 10:15:12.570: ISAKMP:      encaps is 1 (Tunnel)  
Nov 21 10:15:12.570: ISAKMP:      SA life type in seconds  
Nov 21 10:15:12.570: ISAKMP:      SA life duration (VPI) of  0x0 0x1 0x51 0x80  
Nov 21 10:15:12.570: ISAKMP:      authenticator is HMAC-MD5  
Nov 21 10:15:12.570: ISAKMP:(1005):atts are acceptable.  
Nov 21 10:15:12.570: ISAKMP:(1005):Checking IPSec proposal 0  
Nov 21 10:15:12.570: ISAKMP:(1005):transform 0, IPPCP DEFLATE  
Nov 21 10:15:12.570: ISAKMP:   attributes in transform:  
Nov 21 10:15:12.570: ISAKMP:      encaps is 1 (Tunnel)  
Nov 21 10:15:12.570: ISAKMP:      SA life type in seconds  
Nov 21 10:15:12.570: ISAKMP:      SA life duration (VPI) of  0x0 0x1 0x51 0x80  
Nov 21 10:15:12.570: ISAKMP:(1005):atts are acceptable.  
Nov 21 10:15:12.570: ISAKMP:(1005): IPSec policy invalidated proposal with error 256  
Nov 21 10:15:12.570: ISAKMP:(1005): phase 2 SA policy not acceptable! (local {Q}.{W}.{E}.{R} remote {A}.{B}.{C}.{D})  
Nov 21 10:15:12.570: ISAKMP: set new node 247431745 to QM_IDLE  
Nov 21 10:15:12.570: ISAKMP:(1005):Sending NOTIFY PROPOSAL_NOT_CHOSEN   protocol 3  
        spi 563263588, message ID = 247431745  
Nov 21 10:15:12.570: ISAKMP:(1005): sending packet to {A}.{B}.{C}.{D} my_port 500 peer_port 500 (R) QM_IDLE  
Nov 21 10:15:12.570: ISAKMP:(1005):Sending an IKE IPv4 Packet.  
Nov 21 10:15:12.570: ISAKMP:(1005):purging node 247431745  
Nov 21 10:15:12.570: ISAKMP:(1005):deleting node -2018918028 error TRUE reason "QM rejected"  
Nov 21 10:15:12.570: ISAKMP:(1005):Node 2276049268, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH  
Nov 21 10:15:12.570: ISAKMP:(1005):Old State = IKE_QM_READY  New State = IKE_QM_READY  
Nov 21 10:15:22.524: ISAKMP:(1005):purging node -355390081  
Nov 21 10:15:22.590: ISAKMP (1005): received packet from {A}.{B}.{C}.{D} dport 500 sport 500 Global (R) QM_IDLE  
Nov 21 10:15:22.590: ISAKMP:(1005): phase 2 packet is a duplicate of a previous packet.  
Nov 21 10:15:22.590: ISAKMP:(1005): retransmitting due to retransmit phase 2  
Nov 21 10:15:22.590: ISAKMP:(1005): ignoring retransmission,because phase2 node marked dead -2018918028  
Nov 21 10:15:42.568: ISAKMP (1005): received packet from {A}.{B}.{C}.{D} dport 500 sport 500 Global (R) QM_IDLE  
Nov 21 10:15:42.568: ISAKMP:(1005): phase 2 packet is a duplicate of a previous packet.  
Nov 21 10:15:42.568: ISAKMP:(1005): retransmitting due to retransmit phase 2  
Nov 21 10:15:42.570: ISAKMP:(1005): ignoring retransmission,because phase2 node marked dead -2018918028  
Nov 21 10:16:02.570: ISAKMP:(1005):purging node -2018918028  

This is my configuration in Router:

interface GigabitEthernet0/1
 description "ISP 1"
 ip address {Q}.{W}.{E}.{R} 255.255.255.192
 ip access-group SECURITY-IN in
 ip access-group SECURITY-OUT out
 ip flow ingress
 ip nat outside
 ip virtual-reassembly in max-fragments 16 max-reassemblies 64 timeout 5
 duplex auto
 speed auto
 crypto map MYMAP

crypto isakmp policy 10
 hash md5
 authentication pre-share
 group 2
crypto isakmp key 6 password_here address {A}.{B}.{C}.{D}
!
crypto ipsec security-association lifetime seconds 1800
!
crypto ipsec transform-set MYSET esp-des esp-md5-hmac
!

crypto map MYMAP 10 ipsec-isakmp
 set peer {A}.{B}.{C}.{D}
 set transform-set MYSET
 match address 106

access-list 106 permit ip 192.168.6.0 0.0.0.255 172.16.16.0 0.0.0.255

Here are the logs and configurations on Firewall

Firewall Logs

Firewall VPN

Firewall IPSec Profile

Firewall rules

Firewall IP hosts

1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Feb 19 '18 at 20:16
2

This is because of IPSec policy mismatches. You can try with following things:

On Sophos:

  1. Uncheck/disable Pass Data in Compression Format

  2. Phase 2, change PFS Group (DH Group) to None, and change Key Life: 86400 to Key Life: 1800 to match the value on Cisco router C3925 (crypto ipsec security-association lifetime seconds 1800).

On Cisco:

Updated encryption DES and lifetime 86400 under crypto isakmp policy 10 to match the Phase 1 setup on Sophos:

crypto isakmp policy 10
   encr des 
   hash md5
   authentication pre-share
   group 2
   lifetime 86400

=====

I do not see configuration for NAT Exemption (which we often do with VPN tunnel so real source and destination IP addresses would not be translated when they pass through the tunnel) at both ends. Please ensure that you have this part configured as well.

=====

Another thing is: In terms of Transform Sets/Combinations, Cisco no longer recommends using ah-md5-hmac, esp-md5-hmac, esp-des or esp-3des (Link here). Instead, you should use ah-sha-hmac, esp-sha-hmac or esp-aes.

Suggested transform set combinations follow:

  • esp-aes and esp-sha-hmac

  • esp-aes 256 and esp-sha-hmac

=====

You can re-create the VPN tunnel with all points discussed above.

I hope it is helpful and you can solve it.

4
  • Hi, I followed and can connect now but 2 PCs in both ends could not ping to each other. Could you please suggest? What is NAT Exemption? – SpiderlinK Nov 23 '17 at 1:39
  • @SpiderlinK Glad to hear that the VPN tunnel is up. Now, you have to ensure that the ACL rules at both ends allow the traffic between two LAN networks and correct NAT Exemption. NAT Exemption means we keep the IP addresses the same (172.16.16.0/24 and 192.168.6.0/24) when they pass through the tunnel. Follow this link for example on Cisco Router and this link for Sophos (both local subnet and NATted LAN are 172.16.16.0/24) – Hung Tran Nov 23 '17 at 9:50
  • Hi, we changed from Cisco router to pfSense firewall this morning and again, VPN tunnel was up, but this time we could ping from a PC (in pfSense side) to a PC (in Sophos side) but could not in reversed way. Do you have any experience with pfSense? – SpiderlinK Nov 23 '17 at 16:21
  • @SpiderlinK No, I am not familiar with Pfsense. I think you need to check the log (denied/dropped packets) rules and NAT at both ends. The issue is likely at Sophos side. – Hung Tran Nov 23 '17 at 16:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.