I have set up a platform (consisting of 2x ASR1001X) routers as Flexvpn DVTI hubs to terminate different remote sites (mostly ISR1000, but also older C886s) into different VRFs. The authorization backend is a Freeradius.
Enclosed my Hub Config
crypto ikev2 name-mangler MANGLER-1 email all ! crypto ikev2 profile FLEX-BOX-1 match identity remote address ::/0 match identity remote address 0.0.0.0 match identity remote email domain *****.com identity local fqdn hub1.****.com authentication remote pre-share authentication local rsa-sig keyring aaa NTVPN name-mangler MANGLER-1 password cisco pki trustpoint TP-1 dpd 60 10 periodic aaa authorization user psk list VPN name-mangler MANGLER-1 password cisco virtual-template 800 ! crypto ipsec transform-set AES_128-SHA esp-aes esp-sha-hmac mode tunnel crypto ipsec transform-set AES_128-SHA_256 esp-aes esp-sha256-hmac mode tunnel crypto ipsec transform-set AES_256-SHA esp-aes 256 esp-sha-hmac mode tunnel crypto ipsec transform-set AES_256-SHA_256 esp-aes 256 esp-sha256-hmac mode tunnel ! crypto ipsec profile IPSEC-1 set security-association lifetime seconds 7200 set transform-set AES_256-SHA_256 AES_256-SHA AES_128-SHA_256 AES_128-SHA set pfs group15 set ikev2-profile FLEX-BOX-1 responder-only ! interface Virtual-Template800 type tunnel ip unnumbered Loopback800 no ip redirects no ip proxy-arp ip mtu 1400 ip tcp adjust-mss 1300 tunnel mode ipsec ipv4 tunnel path-mtu-discovery tunnel protection ipsec profile IPSEC-NTVPN-1
and the Spoke site:
crypto ikev2 client flexvpn default peer 1 ***** no backup group client connect Tunnel1 ! crypto ikev2 authorization policy default no route set interface route set remote ipv4 10.240.1.32 255.255.255.255 ! ! crypto ikev2 profile Flex_IKEv2 match identity remote fqdn domain ***.com identity local email ***@***.com authentication remote rsa-sig authentication local pre-share key ***** pki trustpoint TP-VPN dpd 60 10 periodic aaa authorization user cert list default default ! crypto ipsec profile default set ikev2-profile Flex_IKEv2 ! ! ! ! interface Tunnel1 ip address negotiated ip mtu 1400 ip tcp adjust-mss 1300 tunnel source GigabitEthernet0/0/1 tunnel destination dynamic tunnel path-mtu-discovery tunnel protection ipsec profile default
i excluded the whole PKI/AAA/RADIUS stuff because the plain authentication is working fine.
The story works fine as long as the spoke site has a public IP address on the internet. But as soon as the device is behind a NAT I can't get a tunnel anymore.
The hub router logs following hints
Mar 10 15:59:36.976: IKEv2-ERROR:: A supplied parameter is incorrect Mar 10 15:59:37.692: IKEv2-ERROR:Couldn't find matching SA: Detected an invalid IKE SPI Mar 10 15:59:50.443: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access4, changed state to down Mar 10 15:59:50.455: IKEv2:% DVTI Vi4 created for profile FLEX-BOX-1 with PSH index 2. Mar 10 15:59:50.455: IKEv2:IPSec policy validate request sent for profile FLEX-BOX-1 with psh index 2. Mar 10 15:59:50.456: IKEv2:(SA ID = 2):[IPsec -> IKEv2] Callback received for the validate proposal - FAILED.
as soon as i turn back to a WAN access where the Spoke-Side Router has an non-NAT globally reachable address everything works fine again.
any ideas what this could be or how to isolate the root-cause of my problem?
