0

I have a Cisco 2901 router that has an IKEv1 IPSec VPN with a Palo Alto firewall. We had a problem with our existing VPN setup where it takes a long time to get the tunnel to come back up when re-negotiating (around 30 minutes or so). Both ends have the same IKE profiles. We managed to fix it by explicitly setting both peers to main mode. Now getting the tunnel back up after re-negotiation takes around 10 minutes or so to complete.

But this message keeps popping up on the logs even when I have already disabled aggressive mode by setting crypto isakmp aggressive-mode disable on my end.

%CRYPTO-5-IKMP_AG_MODE_DISABLED: Unable to initiate or respond to Aggressive Mode while disabled

Both peers can already establish the tunnel but it still does take a while to bring it up online. The message above keeps repeating for about 5 to 6 times and the IKEv1 negotiation fails during that time until after the 5th or 6th time the message above comes up then it brings the tunnel online.

This message kept popping up even before we explicitly set both peers to use main mode. It's better than before but still takes a while to get the tunnel back up and running.

Improve this question
4
  • Aggressive mode should be faster. Make sure both peers have it enabled.
    – Ron Trunk
    Apr 23, 2020 at 0:31
  • 3
    It's not a function of aggressive mode vs main mode if it's taking 10-30m to build a tunnel. Those two Ike modes are 3 messages and 6 messages, respectively... Meaning the effective difference in negotiation speed is no more than 2x round trip time. You need to post more logs and/or configs for us to help diagnose the issue.
    – Eddie
    Apr 23, 2020 at 1:23
  • 1
    As @Eddie said, if it's taking minutes to establish, something is wrong with the configuration. Even over satellite, I've never seen it take more than a few dozen seconds. (in fact, right up to juniper's internal ~1s RTT) My own VPNs will stay down until there's traffic to restart them.
    – Ricky
    Apr 23, 2020 at 2:03
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Dec 17, 2020 at 17:06

1 Answer 1

Reset to default
5

It seems you have a wider issue that this specific message. 10 minutes to re-established a tunnel is totally abnormal.

Here is a few points you should check:

  • don't use IKEv1 anymore, switch to IKEv2
  • double cross-check the settings on both endpoints, and ensure they match. In your case, more specifically the lifetime values.
  • check if both peer can initiate the tunnel. If one is configured as responder only, then when it detect that the tunnel is down, it still have to wait for the other side to detect it and reinitiate the connection
  • related to the point above, ensure that the firewalls between your endpoints, and on the endpoint themselves, allow the traffic from both peers to initiate the tunnel.
  • if possible reduce the number of proposals (ideally keep a single -strong- one)
  • if you use extended authentication, search the relevant log for any issue that could arise in the authentication process
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.