0

I am currently facing an issue while attempting to establish IPsec tunnels between AWS and a Cisco ASA firewall. The AWS tunnel logs indicate that the Identity Resolution checks are failing, preventing the successful establishment of the tunnels.

I believe this issue might be related to the configuration of the IDr (Identity Responder) on the Cisco ASA. However, I am unsure about the correct steps to configure the IDr and resolve this problem.

I kindly request your expertise and guidance on the following points:

How should the IDr be configured on a Cisco ASA to establish IPsec tunnels with AWS? Are there any specific considerations or best practices to be aware of when configuring the IDr for AWS IPsec tunnels?

Improve this question

1 Answer 1

Reset to default
0

The AWS management console has a very good tool that produces configuration templates for you that are specific to the ASA and software version in use at the same time as walking you through the AWS setup for the configuration required on their side of the connection. I have used it repeatedly over the years and never had a problem, especially when letting the ASA use its default ID (its outside interface IP address).

If you follow this process it should work fine for you:

https://docs.aws.amazon.com/vpn/latest/s2svpn/SetUpVPNConnections.html

It can be complex at first glance but it should cover everything. If you have specific errors you can edit your question to add your sanitized configuration and the specific errors you are getting.

In other words: the best practice is to follow the directions that AWS produces during the setup process carefully. The ASA platform is well supported by their environment. Not a very satisfying answer but it is true to my experience.

Improve this answer
2
  • Thanks, @FrameHowitzer!! We have followed the same steps as mentioned in the documentation but the tunnel is still down and under the Details column in the AWS console the message is IPSEC IS DOWN. Clients are saying that IPsecOverNatT is not enabled at the AWS end which is why the tunnels are not coming up. From AWS tunnel logs, it appears Identity checks are failing.
    – Ajit Trivedi
    Commented Jun 28, 2023 at 4:41
  • Is the ASA device using an internet connection that is behind a NAT device? If so, that will present a significant problem. I don't think AWS supports VPN to devices that are inside a NAT device. You need debug output from the ASA specific to IKEv2, IPSec, etc. in order to diagnose anything really.
    – FrameHowitzer
    Commented Jun 28, 2023 at 20:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.