2

This is a Cisco ASA 5515-X with software 9.6(3)20.

The remote side didn't tell me what they use, must be Strongswan or something.

Using the following debug commands

debug crypto ipsec 255
debug crypto ikev2 protocol 255
debug crypto ikev2 platform 255

The exchange ends with this:

IKEv2-PLAT-3: (7): SENT PKT [IKE_AUTH] [1.1.1.243]:4500->[2.2.2.195]:4500 InitSPI=0x2607a73b2bbe1574 RespSPI=0xbf1c43e8a9529db1 MID=00000001
IKEv2-PROTO-5: (7): SM Trace-> SA: I_SPI=2607A73B2BBE1574 R_SPI=BF1C43E8A9529DB1 (I) MsgID = 00000001 CurState: I_WAIT_AUTH Event: EV_NO_EVENT
IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1, saddr=10.10.10.10, sport=21927, daddr=11.11.11.1, dport=21927
IPSEC(crypto_map_check)-3: Checking crypto map Internet_map4 1: matched.
IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1, saddr=10.10.10.10, sport=21927, daddr=11.11.11.1, dport=21927
IPSEC(crypto_map_check)-3: Checking crypto map Internet_map4 1: matched.
IKEv2-PROTO-5: (7): SM Trace-> SA: I_SPI=2607A73B2BBE1574 R_SPI=BF1C43E8A9529DB1 (I) MsgID = 00000001 CurState: I_WAIT_AUTH Event: EV_RE_XMT
IKEv2-PROTO-5: (7): SM Trace-> SA: I_SPI=2607A73B2BBE1574 R_SPI=BF1C43E8A9529DB1 (I) MsgID = 00000001 CurState: I_WAIT_AUTH Event: EV_RE_XMT_EXCEED
IKEv2-PROTO-1: (7): Maximum number of retransmissions reached

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

IKEv2-PROTO-1: (7):
IKEv2-PROTO-5: (7): SM Trace-> SA: I_SPI=2607A73B2BBE1574 R_SPI=BF1C43E8A9529DB1 (I) MsgID = 00000001 CurState: AUTH_DONE Event: EV_FAIL
IKEv2-PROTO-2: (7): Auth exchange failed
IKEv2-PROTO-1: (7): Auth exchange failed
IKEv2-PROTO-1: (7): Auth exchange failed
IKEv2-PROTO-5: (7): SM Trace-> SA: I_SPI=2607A73B2BBE1574 R_SPI=BF1C43E8A9529DB1 (I) MsgID = 00000001 CurState: EXIT Event: EV_ABORT
IKEv2-PROTO-5: (7): SM Trace-> SA: I_SPI=2607A73B2BBE1574 R_SPI=BF1C43E8A9529DB1 (I) MsgID = 00000001 CurState: EXIT Event: EV_CHK_PENDING_ABORT

Any idea what part of the config may pose the problem? The config is essentially this:

crypto ikev2 policy 1
 encryption aes-256
 integrity sha512
 group 21
 prf sha512

PFS is group 21 also, and a pre-shared key is used.

Improve this question
7
  • It is difficult to say what is wrong if you do not have configuration at the other end to compare.
    – Hung Tran
    Dec 14, 2017 at 21:42
  • Aren't these protocols industry standards and one should be able to tell what's going wrong without having to know exact details of the remote side?
    – Marki
    Dec 14, 2017 at 22:27
  • Yes, I can "say" what the issue is, but to be sure you need to get the information at the other end. Anyway, I put my answer as below.
    – Hung Tran
    Dec 14, 2017 at 23:22
  • Please let us know if you were able to solve this issue
    – Hung Tran
    Dec 29, 2017 at 23:27
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Feb 21, 2018 at 18:23

2 Answers 2

Reset to default
2

Looks like it is a pre-shared key mismatch. You should compare your pre-shared key with the other end.

The below information is applicable for IKEv1:

  • You can run the command show crypto isakmp sa on your ASA and check the output. if the state shows MM_WAIT_MSG_6, then it is clearly the pre-shared key mismatch.
Improve this answer
8
  • I'm not sure MM_WAIT_MSGx applies to IKEv2 at all. In any case, we double checked the shared key multiple times. I don't think an SA is created at all, it stops before that.
    – Marki
    Dec 15, 2017 at 13:28
  • @Marki That is why I updated the answer with ``MM_WAIT_MSG_6` for IKEv1 :). So you are sure that the PSK is correct at both ends?
    – Hung Tran
    Dec 15, 2017 at 14:55
  • As I said. The keys are ok and this is about IKEv2 anyway.
    – Marki
    Dec 16, 2017 at 19:24
  • @Marki Ensure that you have both ikev2 remote-authentication pre-shared-key ... and ikev2 local-authentication pre-shared-key ... under your tunnel-group x.y.z.w ipsec-attributes configuration.
    – Hung Tran
    Dec 16, 2017 at 19:27
  • @Marki If it still does not work, please update the question with your ASA/VPN configuration. and you should ask for the configuration at the other end as well to compare.
    – Hung Tran
    Dec 16, 2017 at 19:30
1

We never found out what actually caused this incompatibility. We went back to using IKEv1 instead of IKEv2.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.