1

im struggeling on a Cisco IPSEC Konfiguration.

My aim is to terminate spoke sites behind CGN gateways into a MPLS L3VPN Network via IPSEC tunnels.

The router at hub site is a ASR1k running IOS XE 3.16 Spoke site routers are random, im currently testing with a C819 4G model.

Here is my hub site configuration:

! crypto keyring KEYRING
pre-shared-key hostname router1-xxx key somekey ! crypto isakmp policy 103 encr aes 256 authentication pre-share group 5 lifetime 7200 ! crypto isakmp profile IKEPROFILE keyring WISY-TURIN-KEYRING match identity user-fqdn router1-xxx virtual-template 103 ! ! crypto ipsec transform-set AES_256-SHA ah-sha-hmac esp-aes 256 mode tunnel ! crypto ipsec profile IPSECPROFILE description some description set security-association lifetime seconds 7200 set transform-set AES_256-SHA set pfs group5 responder-only ! ! interface Virtual-Template103 type tunnel description some description vrf forwarding CUSTOMER ip address 10.1.1.1 255.255.255.252 tunnel source Loopback0 tunnel mode ipsec ipv4 tunnel protection ipsec profile IPSECPROFILE !

Here the spoke configuration crypto isakmp policy 103 encr aes 256 authentication pre-share group 5 lifetime 7200 crypto isakmp keepalive 10 ! crypto isakmp peer address 212.218.X.X set aggressive-mode password somekey set aggressive-mode client-endpoint user-fqdn router1-xxx ! ! crypto ipsec transform-set AES_256-SHA ah-sha-hmac esp-aes 256 mode tunnel ! crypto ipsec profile WIPSECPROFILE description Wirth Systems Standort Turin set security-association lifetime seconds 7200 set transform-set AES_256-SHA set pfs group5 ! ! interface Tunnel0 ip address 10.1.1.2 255.255.255.252 ip nat outside ip virtual-reassembly in tunnel source Cellular0 tunnel mode ipsec ipv4 tunnel destination 212.218.x.x tunnel protection ipsec profile IPSECPROFILE

Phase1 is coming UP OK, but i have issues bringing Phase2 up.

Here is the output of

show crypto ipsec sa
at the hub router:

interface: Virtual-Access2 Crypto map tag: Virtual-Access2-head-0, local addr 212.218.X.X

protected vrf: CUSTOMER local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0) remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0) current_peer 5.90.X.X port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0 #pkts not decompressed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0

 local crypto endpt.: 212.218.154.5, remote crypto endpt.: 5.90.10.185
 path mtu 1576, ip mtu 1576, ip mtu idb GigabitEthernet0/0/0
 current outbound spi: 0x0(0)
 PFS (Y/N): N, DH group: none

 inbound esp sas:

 inbound ah sas:

 inbound pcp sas:

 outbound esp sas:

 outbound ah sas:

 outbound pcp sas:

So no SA is created. I'm also confused about the fact that this output says

PFS (Y/N): N, DH group: none
although PFS is configured.

debug crypto ipsec
brings following output:

*Jun 30 18:42:05.074: IPSEC(validate_proposal_request): proposal part #1, (key eng. msg.) INBOUND local= 212.218.X.X:0, remote= 5.90.X.X:0, local_proxy= 0.0.0.0/0.0.0.0/256/0, remote_proxy= 0.0.0.0/0.0.0.0/256/0, protocol= AH, transform= NONE (Tunnel-UDP), lifedur= 0s and 0kb, spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x0 *Jun 30 18:42:05.075: IPSEC(validate_proposal_request): proposal part #2 *Jun 30 18:42:05.075: IPSEC(validate_proposal_request): proposal part #2, (key eng. msg.) INBOUND local= 212.218.X.X:0, remote= 5.90.X.X:0, local_proxy= 0.0.0.0/0.0.0.0/256/0, remote_proxy= 0.0.0.0/0.0.0.0/256/0, protocol= ESP, transform= NONE (Tunnel-UDP), lifedur= 0s and 0kb, spi= 0x0(0), conn_id= 0, keysize= 256, flags= 0x0 *Jun 30 18:42:05.075: Crypto mapdb : proxy_match src addr : 0.0.0.0 dst addr : 0.0.0.0 protocol : 0 src port : 0 dst port : 0 *Jun 30 18:42:05.081: IPSEC(key_engine): got a queue event with 1 KMI message(s) *Jun 30 18:42:05.081: Crypto mapdb : proxy_match src addr : 0.0.0.0 dst addr : 0.0.0.0 protocol : 256 src port : 0 dst port : 0 *Jun 30 18:42:05.081: IPSEC(crypto_ipsec_create_ipsec_sas): Map found Virtual-Access2-head-0 *Jun 30 18:42:05.082: %ACE-3-TRANSERR: IOSXE-ESP(14): IKEA trans 0xC30; opcode 0x60; param 0x1F79; error 0x5; retry cnt 0 *Jun 30 18:42:05.082: %ACE-3-TRANSERR: IOSXE-ESP(14): IKEA trans 0xC32; opcode 0x60; param 0x1F7A; error 0x5; retry cnt 0

Any idea how to solve this issue?

Thanks in advance for all replys.

2

Cisco bug on ASR1k that causes issues in IPSEC over GRE configuration with AH and ESP Mixed configuration CSCtb60545 / CSCsv96390

changed ah-sha-hmac to esp-sha-hmac in the Transform-set configuration which solved the issue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.