Hot answers tagged

56

ISAKMP is part of IKE. (IKE has ISAKMP, SKEME and OAKLEY). IKE establishs the shared security policy and authenticated keys. ISAKMP is the protocol that specifies the mechanics of the key exchange. The confusion, (for me,) is that in the Cisco IOS ISAKMP/IKE are used to refer to the same thing. By which I mean, my understanding is that Cisco's IKE only ...


7

Juniper KB explaining how to locate / interpret information in the Kmd log : How do I Find the VPN Entry in the Kmd Log on a J-Series or SRX-Series device? although for releases prior to 12 the following kmd log issues below are also relevant for the higher end firewalls. [SRX High End] request security ike debug-enable does not print any useful kmd debug ...


5

Originally, UDP was chosen over TCP because of its lower latency and processing requirements. Also, if ISPs followed the IETF standards, this wouldn't be an issue. There has been a movement to add TCP as an alternative, and there was a draft RFC (A TCP transport for the Internet Key Exchange draft-ietf-ipsecme-ike-tcp-01), which expired. The problem you ...


4

IKE is mean to encapsulate other communication. If that "other communication" requires all the L4 error correction that TCP offers, than the "other communication" should use TCP. In this way, IKE/IPsec are only responsible for creating a secure transport. Not a reliable one. Imagine transferring VOIP through an IPsec/IKE tunnel. VOIP largely (and ...


4

It seems you have a wider issue that this specific message. 10 minutes to re-established a tunnel is totally abnormal. Here is a few points you should check: don't use IKEv1 anymore, switch to IKEv2 double cross-check the settings on both endpoints, and ensure they match. In your case, more specifically the lifetime values. check if both peer can initiate ...


4

If I understand your question correctly - you are trying to deploy an IPSec Site-to-Site tunnel between the two routers. In this case there are several problems in your configuration as far as I can tell: First of all - you need to establish a GRE (Unencrypted) tunnel between the two routers like so: Router A: interface Tunnel100 tunnel source ...


4

I believe the feature you are looking for is "Reverse Route Injection". Reverse route injection (RRI) is the ability for static routes to be automatically inserted into the routing process for those networks and hosts protected by a remote tunnel endpoint. These protected hosts and networks are known as remote proxy identities. Each route is ...


3

The short answer is no: My question is, is there an equivalent command for the certificate being used by the remote peer to validate themselves? The only options for viewing remote certificate information is show security ike active-peer [detail] and show security ike security-associations <peer-ip> detail. These will provide you with the ...


3

I manage dozens of IPSEC tunnels with various equipment: Cisco ASA, Fortigate, Sophos, Juniper, linux based devices, etc... and I usually configure both endpoint as initiator and never had issue. The one -obvious- case when you configure a device as responder only, is when the opposite site has a dynamic IP address, and so the peer IP address is unknown. In ...


3

Simply because IPsec was not built to initially include a Key Exchange. In fact, early implementations of IPsec expected you to manually configure an IPsec Key, from which Encryption and Authentication keys were derived. When it was determined manually setting and rotating keys would not scale, they looked to find another solution, but one that didn't ...


3

Azure Route-Based VPNs actually do support Cisco ASAs, but you have to configure Policy Based Traffic Selectors on the Azure Gateway.


2

You could build this quite simply using VTIs (GRE tunnels with IPSec protection). As the two tunnels have the same source, destination IP pairs, you will need to make sure you use a unique (per tunnel) GRE tunnel key (id), so the ASR can differentiate between them. You can choose to use the same IPSEC profile (you'll need the 'shared' keyword on the end of ...


2

You're missing the corresponding crypto map statements for that tunnel. Without the crypto map statements, you can't form Phase 2. Dynamic tunnels, like you were asking about, are only for when your IP address is dynamic (rather than static), on one end, such as if your ISP assigns you an IP address via DHCP, and your ASA would be the initiator (it could ...


2

Good questions. 1)The 1st and 2nd packets are transfer of SA proposals and cookies. Question:Arent the cookies generated by hashing the senders IP, port , protocol and timestamp? If thats the case, does the receiver need the algorithm used to calculate the hash so that he can confirm the data or is it just a random value which the receiver does ...


2

ISAKMP/IKEv1 is deprecated and should not be used anymore, it was replaced by IKEv2. Arent the cookies generated by hashing the senders IP, port , protocol and timestamp? It's open to implementations how they generate the cookies (or SPIs as they're called in IKEv2). RFC 2408, section 2.5.3 describes some possibilities (but e.g. strongSwan 5.x just ...


2

I've seen similar behavior when the Phase 2 SA liftetime settings don't match. You may want to try matching both your Phase 1 and 2 lifetime settings. This is your Phase 1 lifetime configuration on the ASA: crypto ikev2 policy 2 lifetime seconds 3600 This is your Phase 1 lifetime configuration with StrongSwan: ikelifetime = 28800s The ASA Phase 2 ...


1

You have, on your router config, the IKEv2 policy set to aes-sha with dh 2, 5. On the ASA, the policy is for 3des-sha and group 5, 2. Also note that you have not set lifetime nor prf settings on the router. Not setting something would use the default. To find out exactly what is being used, including defaults, use the show running-config all crypto ikev2 ...


1

MM_NO_STATE means Main Mode No State. That is, the state machine is still in the initial state because it hasn't received any response from the peer. Feb 18 09:26:06.732: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE Feb 18 09:26:06.732: ISAKMP:(0): sending packet to X.X.X.122 my_port 500 peer_port 500 (I) MM_NO_STATE This seems to indicate that this ...


1

I think your confusion stems from misunderstanding a few terms. For what its worth, there is a lot of confusion around these terms. A Policy Suite is a grouping of specific algorithms for the sake of providing specific security services. For example, an IPsec Policy Suite specifies 3 services: Confidentiality - which requires a Symmetric Encryption ...


1

On ASA2 (dynamic peer), you did not set the VPN peer - 10.0.0.1 in your crypto map outside_map 1. Please try the followings on ASA2: Remove crypto map outside_map 1 set pfs Add crypto map outside_map 1 set peer 10.0.0.1 In addition, on ASA2, you may need to create an interface access-list on inside interface for traffic from ASA2 inside network to reach ...


1

Please check whether this helps, I know that I am late :) Yes, this is from the Wikipedia article, Internet Security Association and Key Management Protocol, but I didn't see any references so far to Wiki/RFC here in discussion. ISAKMP defines the procedures for authenticating a communicating peer, creation and management of Security Associations, key ...


Only top voted, non community-wiki answers of a minimum length are eligible