It seems you have a wider issue that this specific message.
10 minutes to re-established a tunnel is totally abnormal.
Here is a few points you should check:
don't use IKEv1 anymore, switch to IKEv2
double cross-check the settings on both endpoints, and ensure they match. In your case, more specifically the lifetime values.
check if both peer can initiate ...
Originally, UDP was chosen over TCP because of its lower latency and processing requirements. Also, if ISPs followed the IETF standards, this wouldn't be an issue. There has been a movement to add TCP as an alternative, and there was a draft RFC (A TCP transport for the Internet Key Exchange draft-ietf-ipsecme-ike-tcp-01), which expired.
The problem you ...
Cisco has a nice IPSec Overhead calculator (CCO Login required, unfortunately).
From where we can draw, based on your IPSec settings and a few common optionals thrown in:
8 PPPoE (optional, but widespread)
20 outer IP header
8 NAT-T (optional, widespread, sometimes even default-on)
8 ESP Header (4 SPI ...
IKE is mean to encapsulate other communication. If that "other communication" requires all the L4 error correction that TCP offers, than the "other communication" should use TCP.
In this way, IKE/IPsec are only responsible for creating a secure transport. Not a reliable one.
Imagine transferring VOIP through an IPsec/IKE tunnel. VOIP largely (and ...
If I understand your question correctly - you are trying to deploy an IPSec Site-to-Site tunnel between the two routers.
In this case there are several problems in your configuration as far as I can tell:
First of all - you need to establish a GRE (Unencrypted) tunnel between the two routers like so:
tunnel source ...
I believe the feature you are looking for is "Reverse Route Injection".
Reverse route injection (RRI) is the ability for static routes to be
automatically inserted into the routing process for those networks and
hosts protected by a remote tunnel endpoint. These protected hosts and
networks are known as remote proxy identities.
Each route is ...
The short answer is no:
My question is, is there an equivalent command for the certificate
being used by the remote peer to validate themselves?
The only options for viewing remote certificate information is show security ike active-peer [detail] and show security ike security-associations <peer-ip> detail. These will provide you with the ...
I manage dozens of IPSEC tunnels with various equipment: Cisco ASA, Fortigate, Sophos, Juniper, linux based devices, etc... and I usually configure both endpoint as initiator and never had issue.
The one -obvious- case when you configure a device as responder only, is when the opposite site has a dynamic IP address, and so the peer IP address is unknown. In ...
Simply because IPsec was not built to initially include a Key Exchange. In fact, early implementations of IPsec expected you to manually configure an IPsec Key, from which Encryption and Authentication keys were derived.
When it was determined manually setting and rotating keys would not scale, they looked to find another solution, but one that didn't ...
You could build this quite simply using VTIs (GRE tunnels with IPSec protection). As the two tunnels have the same source, destination IP pairs, you will need to make sure you use a unique (per tunnel) GRE tunnel key (id), so the ASR can differentiate between them. You can choose to use the same IPSEC profile (you'll need the 'shared' keyword on the end of ...
I've seen similar behavior when the Phase 2 SA liftetime settings don't match. You may want to try matching both your Phase 1 and 2 lifetime settings.
This is your Phase 1 lifetime configuration on the ASA:
crypto ikev2 policy 2
lifetime seconds 3600
This is your Phase 1 lifetime configuration with StrongSwan:
ikelifetime = 28800s
The ASA Phase 2 ...
You're missing the corresponding crypto map statements for that tunnel. Without the crypto map statements, you can't form Phase 2. Dynamic tunnels, like you were asking about, are only for when your IP address is dynamic (rather than static), on one end, such as if your ISP assigns you an IP address via DHCP, and your ASA would be the initiator (it could ...
1)The 1st and 2nd packets are transfer of SA proposals and cookies.
Question:Arent the cookies generated by hashing the senders IP, port ,
protocol and timestamp? If thats the case, does the receiver need the
algorithm used to calculate the hash so that he can confirm the data
or is it just a random value which the receiver does not have to ...
ISAKMP/IKEv1 is deprecated and should not be used anymore, it was replaced by IKEv2.
Arent the cookies generated by hashing the senders IP, port , protocol and timestamp?
It's open to implementations how they generate the cookies (or SPIs as they're called in IKEv2). RFC 2408, section 2.5.3 describes some possibilities (but e.g. strongSwan 5.x just ...
I found the answer further above in page 16 of RFC7296
There is no need to send a notification payload regarding a different IKE SA. The current IKE SA is already in the IKE header.
The first of these paragraphs in section 3.10 says "the SPI is included only with INVALID_SELECTORS, REKEY_SA, and CHILD_SA_NOT_FOUND".
Section 1.3.2 on page 16 makes ...
You have, on your router config, the IKEv2 policy set to aes-sha with dh 2, 5. On the ASA, the policy is for 3des-sha and group 5, 2. Also note that you have not set lifetime nor prf settings on the router. Not setting something would use the default. To find out exactly what is being used, including defaults, use the show running-config all crypto ikev2 ...
MM_NO_STATE means Main Mode No State. That is, the state machine is still in the initial state because it hasn't received any response from the peer.
Feb 18 09:26:06.732: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
Feb 18 09:26:06.732: ISAKMP:(0): sending packet to X.X.X.122 my_port 500 peer_port 500 (I) MM_NO_STATE
This seems to indicate that this ...
I think your confusion stems from misunderstanding a few terms. For what its worth, there is a lot of confusion around these terms.
A Policy Suite is a grouping of specific algorithms for the sake of providing specific security services.
For example, an IPsec Policy Suite specifies 3 services:
Confidentiality - which requires a Symmetric Encryption ...
On ASA2 (dynamic peer), you did not set the VPN peer - 10.0.0.1 in your crypto map outside_map 1.
Please try the followings on ASA2:
Remove crypto map outside_map 1 set pfs
Add crypto map outside_map 1 set peer 10.0.0.1
In addition, on ASA2, you may need to create an interface access-list on inside interface for traffic from ASA2 inside network to reach ...
Please check whether this helps, I know that I am late :)
Yes, this is from the Wikipedia article, Internet Security Association and Key Management Protocol, but I didn't see any references so far to Wiki/RFC here in discussion.
ISAKMP defines the procedures for authenticating a communicating peer,
creation and management of Security Associations, key ...