I am setting up Cisco 5585 ASA for IPsec tunnel with one of cloud company.

we already have lots of tunnel for various cloud provider and life if good but recently this tunnel giving me hard time to setup and here is the debug and config

access-list ACL-VPN-CLOUD extended permit ip any4 object-group obj-NET-CLOUD

tunnel-group type ipsec-l2l
tunnel-group ipsec-attributes
 ikev1 pre-shared-key *****
 isakmp keepalive threshold 10 retry 10

crypto map CRYPTO-MAP 4202 match address ACL-VPN-CLOUD
crypto map CRYPTO-MAP 4202 set pfs group1
crypto map CRYPTO-MAP 4202 set peer
crypto map CRYPTO-MAP 4202 set ikev1 transform-set CLOUD-ESP-AES-MD5
crypto map CRYPTO-MAP 4202 set security-association lifetime seconds 86400

nat (any,outside) source static obj-NET-PRIVATE obj-NET-PRIVATE destination static obj-NET-CLOUD obj-NET-CLOUD

I can see Phase-1 is completed in show crypto isakmp sa

16  IKE Peer:
    Type    : L2L             Role    : initiator
    Rekey   : no              State   : MM_ACTIVE

But Phase-2 having issue to bring tunnel up, you can see full debug here https://pastebin.com/fX2tz29G

In debug i have noticed following errors, I have cross check all transform-set & ACL and all looks good so far.

Sep 15 03:14:33 [IKEv1]Group =, IP =, QM FSM error (P2 struct &0x00007f41f1085ae0, mess id 0xb6aed5ce)!
Sep 15 03:14:33 [IKEv1 DEBUG]Group =, IP =, IKE QM Initiator FSM error history (struct &0x00007f41f1085ae0)  <state>, <event>:  QM_DONE, EV_ERROR-->QM_WAIT_MSG2, EV_TIMEOUT-->QM_WAIT_MSG2, NullEvent-->QM_SND_MSG1, EV_SND_MSG-->QM_SND_MSG1, EV_START_TMR-->QM_SND_MSG1, EV_RESEND_MSG-->QM_WAIT_MSG2, EV_TIMEOUT-->QM_WAIT_MSG2, NullEvent
  • debug crypto ipsec 127 will provide the missing information on why phase 2 is failing to complete. – Yevhen Stasiv Jan 17 '20 at 2:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.