Hey I'm trying to create a tunnel between cisco router and google cloud vpn (client site) but the connection is stuck on stage 2 (UP-IDLE), need help where the problem may lie. Some debug that I get on my site:

May 10 12:52:23.430 CEST: map_db_find_best did not find matching map
May 10 12:52:23.430 CEST: Cannot find crypto swsb : in ipsec_process_proposal (), 1590
May 10 12:52:23.438 CEST: IPSEC(ipsec_process_proposal): proxy identities not supported
IPSEC(ipsec_process_proposal): transform proposal not supported for identity

May 10 11:54:19.554 CEST: IKEv2:(SESSION ID = 3090987,SA ID = 6):Received Packet [From XXX.XXX.XXX.XXX:500/To YYY.YYY.YYY.YYY:500/VRF i9:f0]
Initiator SPI : 84F2BC1F7A5C9044 - Responder SPI : 0C1D07CE85C56572 Message id: 20
Payload contents:
May 10 11:55:49.566 CEST: IKEv2:(SESSION ID = 3090987,SA ID = 6):: There was no IPSEC policy found for received TS
May 10 11:55:49.566 CEST: IKEv2:(SESSION ID = 3090987,SA ID = 6):Sending TS unacceptable notify

From client site same logs:

failed to establish CHILD_SA, keeping IKE_SA    2021-05-10T08:04:49.998898651Z
received TS_UNACCEPTABLE notify, no CHILD_SA built  2021-05-10T08:04:49.998893445Z
parsed CREATE_CHILD_SA response 94 [ N(TS_UNACCEPT) ]   2021-05-10T08:04:49.998863886Z
received packet: from YYY.YYY.YYY.YYY[500] to XXX.XXX.XXX.XXX[500] (80 bytes)   2021-05-10T08:04:49.998762590Z
sending packet: from XXX.XXX.XXX.XXX[500] to YYY.YYY.YYY.YYY[500] (640 bytes)   2021-05-10T08:04:49.959490053Z
generating CREATE_CHILD_SA request 94 [ SA No KE TSi TSr ]  2021-05-10T08:04:49.958783525Z
establishing CHILD_SA vpn_YYY.YYY.YYY.YYY{1}    2021-05-10T08:04:49.953584118Z
creating acquire job for policy with reqid {1}  2021-05-10T08:04:49.953505597Z

Configuration on google cloud vpn look like this: GUI editor where you can select options such as "remote peer ip", "ike version", "preshared key" "routing options" the client chose POLICY-BASED routing where it gave the correct remote network and local ip ranges

And that's it, no choice of encryption, integrity or DH group. From what I have read google does this automatically by suggesting supported things SUPPORTED CIPHERS

My, cisco site:

crypto ikev2 keyring KEYRING
 peer CST-SITE
  address XXX.XXX.XXX.XXX
  pre-shared-key somekey

crypto ikev2 proposal IKE2-PROP
 encryption aes-cbc-256
 integrity sha256
 group 5

crypto ikev2 policy IKE2-POLICY
 match fvrf CST-001
 match address local XXX.XXX.XXX.XXX
 proposal IKE2-PROP

crypto ikev2 profile IKE2-PROF
 match identity remote address YYY.YYY.YYY.YYY
 identity local address XXX.XXX.XXX.XXX
 authentication remote pre-share
 authentication local pre-share
 keyring local KEYRING
 lifetime 36000
 ivrf CST-001
 dpd 60 5 periodic

crypto map CMAP_CST ipsec-isakmp
 description VPN-to-GOOGLE
 set peer YYY.YYY.YYY.YYY
 set security-association lifetime seconds 10800
 set transform-set TS-AES256-SHA256
 set pfs group5
 set ikev2-profile IKE2-PROF
 match address ACL-IPSEC-VPN

crypto ipsec transform-set TS-AES256-SHA256 esp-aes 256 esp-sha256-hmac

ip access-list extended ACL-IPSEC-VPN
 permit ip

ip route vrf CST-001 255.255.2550.0 GigabitEthernet0/0 XXX.XXX.XXX.XXX
ip route vrf CST-001 YYY.YYY.YYY.YYY GigabitEthernet0/0 XXX.XXX.XXX.XXX

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.