IKEv1 TS 2 - IKE version mismatch

-

Group Policy VPN protocol mismatch, responsder is configured with IKEv2 only

Phase 1 actually is completed, but show crypto isakmp sa doesn't display anything  on both initiator and responder.
Negotiation failed at QM. Only responder debug gives real reason.

Initiator:

Buffer log:
Jan 20 2020 15:35:04: %ASA-3-713902: Group = 10.0.0.2, IP = 10.0.0.2, Removing peer from correlator table failed, no match!
Jan 20 2020 15:35:04: %ASA-4-113019: Group = 10.0.0.2, Username = 10.0.0.2, IP = 10.0.0.2, Session disconnected. Session Type: LAN-to-LAN, Duration: 0h:00m:00s, Bytes xmt: 0, Bytes rcv: 0, Reason: User Requested
Jan 20 2020 15:35:04: %ASA-4-752012: IKEv1 was unsuccessful at setting up a tunnel.  Map Tag = MAP.  Map Sequence Number = 10.
Jan 20 2020 15:35:04: %ASA-3-752015: Tunnel Manager has failed to establish an L2L SA.  All configured IKE versions failed to establish the tunnel. Map Tag= MAP.  Map Sequence Number = 10.

Debug
ASAv1# Dec 23 17:59:13 [IKEv1 DEBUG]Pitcher: received a key acquire message, spi 0x0
Dec 23 17:59:13 [IKEv1]IP = 10.0.0.2, IKE Initiator: New Phase 1, Intf inside, IKE Peer 10.0.0.2  local Proxy Address 192.168.1.0, remote Proxy Address 192.168.2.0,  Crypto map (MAP)
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, constructing ISAKMP SA payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, constructing NAT-Traversal VID ver 02 payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, constructing NAT-Traversal VID ver 03 payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, constructing NAT-Traversal VID ver RFC payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, constructing Fragmentation VID + extended capabilities payload
Dec 23 17:59:13 [IKEv1]IP = 10.0.0.2, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 168
Dec 23 17:59:13 [IKEv1]IKE Receiver: Packet received on 10.0.0.1:500 from 10.0.0.2:500
Dec 23 17:59:13 [IKEv1]IP = 10.0.0.2, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 128
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, processing SA payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, Oakley proposal is acceptable
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, processing VID payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, Received NAT-Traversal RFC VID
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, processing VID payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, Received Fragmentation VID
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, IKE Peer included IKE fragmentation capability flags:  Main Mode:        True  Aggressive Mode:  True
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, constructing ke payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, constructing nonce payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, constructing Cisco Unity VID payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, constructing xauth V6 VID payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, Send IOS VID
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, Constructing ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, constructing VID payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, Send Altiga/Cisco VPN3000/Cisco ASA GW VID
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, constructing NAT-Discovery payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, computing NAT Discovery hash
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, constructing NAT-Discovery payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, computing NAT Discovery hash
Dec 23 17:59:13 [IKEv1]IP = 10.0.0.2, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NAT-D (20) + NAT-D (20) + NONE (0) total length : 304
Dec 23 17:59:13 [IKEv1]IKE Receiver: Packet received on 10.0.0.1:500 from 10.0.0.2:500
Dec 23 17:59:13 [IKEv1]IP = 10.0.0.2, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NAT-D (20) + NAT-D (20) + NONE (0) total length : 304
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, processing ke payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, processing ISA_KE payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, processing nonce payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, processing VID payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, Received Cisco Unity client VID
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, processing VID payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, Received xauth V6 VID
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, processing VID payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, Processing VPN3000/ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, processing VID payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, Received Altiga/Cisco VPN3000/Cisco ASA GW VID
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, processing NAT-Discovery payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, computing NAT Discovery hash
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, processing NAT-Discovery payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, computing NAT Discovery hash
Dec 23 17:59:13 [IKEv1]IP = 10.0.0.2, Connection landed on tunnel_group 10.0.0.2
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.2, IP = 10.0.0.2, Generating keys for Initiator...
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.2, IP = 10.0.0.2, constructing ID payload
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.2, IP = 10.0.0.2, constructing hash payload
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.2, IP = 10.0.0.2, Computing hash for ISAKMP
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, Constructing IOS keep alive payload: proposal=32767/32767 sec.
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.2, IP = 10.0.0.2, constructing dpd vid payload
Dec 23 17:59:13 [IKEv1]IP = 10.0.0.2, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + IOS KEEPALIVE (128) + VENDOR (13) + NONE (0) total length : 96
Dec 23 17:59:13 [IKEv1]Group = 10.0.0.2, IP = 10.0.0.2, Automatic NAT Detection Status:     Remote end is NOT behind a NAT device     This   end is NOT behind a NAT device
Dec 23 17:59:13 [IKEv1]IKE Receiver: Packet received on 10.0.0.1:500 from 10.0.0.2:500
Dec 23 17:59:13 [IKEv1]IKE Receiver: Packet received on 10.0.0.1:500 from 10.0.0.2:500
Dec 23 17:59:13 [IKEv1]IP = 10.0.0.2, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + IOS KEEPALIVE (128) + VENDOR (13) + NONE (0) total length : 96
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.2, IP = 10.0.0.2, processing ID payload
Dec 23 17:59:13 [IKEv1 DECODE]Group = 10.0.0.2, IP = 10.0.0.2, ID_IPV4_ADDR ID received
10.0.0.2
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.2, IP = 10.0.0.2, processing hash payload
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.2, IP = 10.0.0.2, Computing hash for ISAKMP
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.2, Processing IOS keep alive payload: proposal=32767/32767 sec.
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.2, IP = 10.0.0.2, processing VID payload
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.2, IP = 10.0.0.2, Received DPD VID
Dec 23 17:59:13 [IKEv1]IP = 10.0.0.2, Connection landed on tunnel_group 10.0.0.2
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.2, IP = 10.0.0.2, Oakley begin quick mode
Dec 23 17:59:13 [IKEv1 DECODE]Group = 10.0.0.2, IP = 10.0.0.2, IKE Initiator starting QM: msg id = 39665a54
Dec 23 17:59:13 [IKEv1]Group = 10.0.0.2, IP = 10.0.0.2, PHASE 1 COMPLETED
Dec 23 17:59:13 [IKEv1]IP = 10.0.0.2, Keep-alive type for this connection: DPD
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.2, IP = 10.0.0.2, Starting P1 rekey timer: 73440 seconds.
Dec 23 17:59:13 [IKEv1]Group = 10.0.0.2, IP = 10.0.0.2, Add to IKEv1 Tunnel Table succeeded for SA with logical ID 49152
Dec 23 17:59:13 [IKEv1]Group = 10.0.0.2, IP = 10.0.0.2, Add to IKEv1 MIB Table succeeded for SA with logical ID 49152
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.2, IP = 10.0.0.2, IKE got SPI from key engine: SPI = 0xc0d3668a
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.2, IP = 10.0.0.2, oakley constructing quick mode
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.2, IP = 10.0.0.2, constructing blank hash payload
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.2, IP = 10.0.0.2, constructing IPSec SA payload
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.2, IP = 10.0.0.2, constructing IPSec nonce payload
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.2, IP = 10.0.0.2, constructing proxy ID
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.2, IP = 10.0.0.2, Transmitting Proxy Id:
  Local subnet:  192.168.1.0  mask 255.255.255.0 Protocol 0  Port 0
  Remote subnet: 192.168.2.0  Mask 255.255.255.0 Protocol 0  Port 0
Dec 23 17:59:13 [IKEv1 DECODE]Group = 10.0.0.2, IP = 10.0.0.2, IKE Initiator sending Initial Contact
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.2, IP = 10.0.0.2, constructing qm hash payload
Dec 23 17:59:13 [IKEv1 DECODE]Group = 10.0.0.2, IP = 10.0.0.2, IKE Initiator sending 1st QM pkt: msg id = 39665a54
Dec 23 17:59:13 [IKEv1]IP = 10.0.0.2, IKE_DECODE SENDING Message (msgid=39665a54) with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + ID (5) + ID (5) + NOTIFY (11) + NONE (0) total length : 200
Dec 23 17:59:13 [IKEv1]IKE Receiver: Packet received on 10.0.0.1:500 from 10.0.0.2:500
Dec 23 17:59:13 [IKEv1]IP = 10.0.0.2, IKE_DECODE RECEIVED Message (msgid=ec8d2430) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 80
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.2, IP = 10.0.0.2, processing hash payload
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.2, IP = 10.0.0.2, processing delete
Dec 23 17:59:13 [IKEv1]Group = 10.0.0.2, IP = 10.0.0.2, Connection terminated for peer 10.0.0.2.  Reason: Peer Terminate  Remote Proxy 0.0.0.0, Local Proxy 0.0.0.0
Dec 23 17:59:13 [IKEv1]Group = 10.0.0.2, IP = 10.0.0.2, Remove from IKEv1 Tunnel Table succeeded for SA with logicalId 49152
Dec 23 17:59:13 [IKEv1]Group = 10.0.0.2, IP = 10.0.0.2, Remove from IKEv1 MIB Table succeeded for SA with logical ID 49152
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.2, IP = 10.0.0.2, sending delete/delete with reason message
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.2, IP = 10.0.0.2, constructing blank hash payload
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.2, IP = 10.0.0.2, constructing IPSec delete payload
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.2, IP = 10.0.0.2, constructing qm hash payload
Dec 23 17:59:13 [IKEv1]IP = 10.0.0.2, IKE_DECODE SENDING Message (msgid=c4ad7e13) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 68
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.2, IP = 10.0.0.2, IKE Deleting SA: Remote Proxy 192.168.2.0, Local Proxy 192.168.1.0
Dec 23 17:59:13 [IKEv1]Group = 10.0.0.2, IP = 10.0.0.2, Removing peer from correlator table failed, no match!
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.2, IP = 10.0.0.2, IKE SA MM:32c45f0d terminating:  flags 0x0100c822, refcnt 0, tuncnt 0
Dec 23 17:59:13 [IKEv1]Group = 10.0.0.2, IP = 10.0.0.2, Session is being torn down. Reason: User Requested
Dec 23 17:59:13 [IKEv1]Ignoring msg to mark SA with dsID 49152 dead because SA deleted
Dec 23 17:59:13 [IKEv1 DEBUG]Pitcher: received key delete msg, spi 0xc0d3668a


Responder:

Buffer log:
Jan 20 2020 15:32:25: %ASA-3-713206: Group = 10.0.0.1, IP = 10.0.0.1, Tunnel Rejected: Conflicting protocols specified by tunnel-group and group-policy
Jan 20 2020 15:32:25: %ASA-3-713902: Group = 10.0.0.1, IP = 10.0.0.1, QM FSM error (P2 struct &0x00007f48d93d67c0, mess id 0xa2616fb9)!
Jan 20 2020 15:32:25: %ASA-3-713902: Group = 10.0.0.1, IP = 10.0.0.1, Removing peer from correlator table failed, no match!

Jan 20 2020 15:32:25: %ASA-4-113019: Group = 10.0.0.1, Username = 10.0.0.1, IP = 10.0.0.1, Session disconnected. Session Type: LAN-to-LAN, Duration: 0h:00m:00s, Bytes xmt: 0, Bytes rcv: 0, Reason: Unknown

Debug:
ASAv2# Dec 23 17:59:13 [IKEv1]IKE Receiver: Packet received on 10.0.0.2:500 from 10.0.0.1:500
Dec 23 17:59:13 [IKEv1]IP = 10.0.0.1, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 168
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, processing SA payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, Oakley proposal is acceptable
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, processing VID payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, Received NAT-Traversal ver 02 VID
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, processing VID payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, Received NAT-Traversal ver 03 VID
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, processing VID payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, Received NAT-Traversal RFC VID
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, processing VID payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, Received Fragmentation VID
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, IKE Peer included IKE fragmentation capability flags:  Main Mode:        True  Aggressive Mode:  True
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, processing IKE SA payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, IKE SA Proposal # 1, Transform # 1 acceptable  Matches global IKE entry # 2
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, constructing ISAKMP SA payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, constructing NAT-Traversal VID ver RFC payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, constructing Fragmentation VID + extended capabilities payload
Dec 23 17:59:13 [IKEv1]IP = 10.0.0.1, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 128
Dec 23 17:59:13 [IKEv1]IKE Receiver: Packet received on 10.0.0.2:500 from 10.0.0.1:500
Dec 23 17:59:13 [IKEv1]IP = 10.0.0.1, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NAT-D (20) + NAT-D (20) + NONE (0) total length : 304
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, processing ke payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, processing ISA_KE payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, processing nonce payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, processing VID payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, Received Cisco Unity client VID
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, processing VID payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, Received xauth V6 VID
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, processing VID payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, Processing VPN3000/ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, processing VID payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, Received Altiga/Cisco VPN3000/Cisco ASA GW VID
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, processing NAT-Discovery payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, computing NAT Discovery hash
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, processing NAT-Discovery payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, computing NAT Discovery hash
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, constructing ke payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, constructing nonce payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, constructing Cisco Unity VID payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, constructing xauth V6 VID payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, Send IOS VID
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, Constructing ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, constructing VID payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, Send Altiga/Cisco VPN3000/Cisco ASA GW VID
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, constructing NAT-Discovery payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, computing NAT Discovery hash
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, constructing NAT-Discovery payload
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, computing NAT Discovery hash
Dec 23 17:59:13 [IKEv1]IP = 10.0.0.1, Connection landed on tunnel_group 10.0.0.1
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.1, IP = 10.0.0.1, Generating keys for Responder...
Dec 23 17:59:13 [IKEv1]IP = 10.0.0.1, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NAT-D (20) + NAT-D (20) + NONE (0) total length : 304
Dec 23 17:59:13 [IKEv1]IKE Receiver: Packet received on 10.0.0.2:500 from 10.0.0.1:500
Dec 23 17:59:13 [IKEv1]IP = 10.0.0.1, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + IOS KEEPALIVE (128) + VENDOR (13) + NONE (0) total length : 96
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.1, IP = 10.0.0.1, processing ID payload
Dec 23 17:59:13 [IKEv1 DECODE]Group = 10.0.0.1, IP = 10.0.0.1, ID_IPV4_ADDR ID received
10.0.0.1
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.1, IP = 10.0.0.1, processing hash payload
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.1, IP = 10.0.0.1, Computing hash for ISAKMP
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, Processing IOS keep alive payload: proposal=32767/32767 sec.
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.1, IP = 10.0.0.1, processing VID payload
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.1, IP = 10.0.0.1, Received DPD VID
Dec 23 17:59:13 [IKEv1]Group = 10.0.0.1, IP = 10.0.0.1, Automatic NAT Detection Status:     Remote end is NOT behind a NAT device     This   end is NOT behind a NAT device
Dec 23 17:59:13 [IKEv1]IP = 10.0.0.1, Connection landed on tunnel_group 10.0.0.1
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.1, IP = 10.0.0.1, constructing ID payload
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.1, IP = 10.0.0.1, constructing hash payload
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.1, IP = 10.0.0.1, Computing hash for ISAKMP
Dec 23 17:59:13 [IKEv1 DEBUG]IP = 10.0.0.1, Constructing IOS keep alive payload: proposal=32767/32767 sec.
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.1, IP = 10.0.0.1, constructing dpd vid payload
Dec 23 17:59:13 [IKEv1]IP = 10.0.0.1, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + IOS KEEPALIVE (128) + VENDOR (13) + NONE (0) total length : 96
Dec 23 17:59:13 [IKEv1]Group = 10.0.0.1, IP = 10.0.0.1, PHASE 1 COMPLETED
Dec 23 17:59:13 [IKEv1]IP = 10.0.0.1, Keep-alive type for this connection: DPD
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.1, IP = 10.0.0.1, Starting P1 rekey timer: 41040 seconds.
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.1, IP = 10.0.0.1, sending notify message
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.1, IP = 10.0.0.1, constructing blank hash payload
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.1, IP = 10.0.0.1, constructing qm hash payload
Dec 23 17:59:13 [IKEv1]IP = 10.0.0.1, IKE_DECODE SENDING Message (msgid=72b966fa) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 88
Dec 23 17:59:13 [IKEv1]Group = 10.0.0.1, IP = 10.0.0.1, Add to IKEv1 Tunnel Table succeeded for SA with logical ID 49152
Dec 23 17:59:13 [IKEv1]Group = 10.0.0.1, IP = 10.0.0.1, Add to IKEv1 MIB Table succeeded for SA with logical ID 49152
Dec 23 17:59:13 [IKEv1]IKE Receiver: Packet received on 10.0.0.2:500 from 10.0.0.1:500
Dec 23 17:59:13 [IKEv1 DECODE]IP = 10.0.0.1, IKE Responder starting QM: msg id = 39665a54
Dec 23 17:59:13 [IKEv1]IP = 10.0.0.1, IKE_DECODE RECEIVED Message (msgid=39665a54) with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + ID (5) + ID (5) + NOTIFY (11) + NONE (0) total length : 200
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.1, IP = 10.0.0.1, processing hash payload
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.1, IP = 10.0.0.1, processing SA payload
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.1, IP = 10.0.0.1, processing nonce payload
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.1, IP = 10.0.0.1, processing ID payload
Dec 23 17:59:13 [IKEv1 DECODE]Group = 10.0.0.1, IP = 10.0.0.1, ID_IPV4_ADDR_SUBNET ID received--192.168.1.0--255.255.255.0
Dec 23 17:59:13 [IKEv1]Group = 10.0.0.1, IP = 10.0.0.1, Received remote IP Proxy Subnet data in ID Payload:   Address 192.168.1.0, Mask 255.255.255.0, Protocol 0, Port 0
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.1, IP = 10.0.0.1, processing ID payload
Dec 23 17:59:13 [IKEv1 DECODE]Group = 10.0.0.1, IP = 10.0.0.1, ID_IPV4_ADDR_SUBNET ID received--192.168.2.0--255.255.255.0
Dec 23 17:59:13 [IKEv1]Group = 10.0.0.1, IP = 10.0.0.1, Received local IP Proxy Subnet data in ID Payload:   Address 192.168.2.0, Mask 255.255.255.0, Protocol 0, Port 0
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.1, IP = 10.0.0.1, processing notify payload
Dec 23 17:59:13 [IKEv1]Group = 10.0.0.1, IP = 10.0.0.1, Tunnel Rejected: Conflicting protocols specified by tunnel-group and group-policy
Dec 23 17:59:13 [IKEv1]Group = 10.0.0.1, IP = 10.0.0.1, QM FSM error (P2 struct &0x00007f48d93eea20, mess id 0x39665a54)!
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.1, IP = 10.0.0.1, IKE QM Responder FSM error history (struct &0x00007f48d93eea20)  , :  QM_DONE, EV_ERROR-->QM_BLD_MSG2, EV_PROC_MSG-->QM_BLD_MSG2, EV_HASH_OK-->QM_BLD_MSG2, NullEvent-->QM_BLD_MSG2, EV_COMP_HASH-->QM_BLD_MSG2, EV_VALIDATE_MSG-->QM_BLD_MSG2, EV_DECRYPT_OK-->QM_BLD_MSG2, NullEvent
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.1, IP = 10.0.0.1, sending delete/delete with reason message
Dec 23 17:59:13 [IKEv1]Group = 10.0.0.1, IP = 10.0.0.1, Removing peer from correlator table failed, no match!
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.1, IP = 10.0.0.1, IKE SA MM:e8cb38d2 rcv'd Terminate: state MM_ACTIVE  flags 0x0001c042, refcnt 1, tuncnt 0
Dec 23 17:59:13 [IKEv1]Group = 10.0.0.1, IP = 10.0.0.1, Remove from IKEv1 Tunnel Table succeeded for SA with logicalId 49152
Dec 23 17:59:13 [IKEv1]Group = 10.0.0.1, IP = 10.0.0.1, Remove from IKEv1 MIB Table succeeded for SA with logical ID 49152
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.1, IP = 10.0.0.1, IKE SA MM:e8cb38d2 terminating:  flags 0x0101c002, refcnt 0, tuncnt 0
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.1, IP = 10.0.0.1, sending delete/delete with reason message
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.1, IP = 10.0.0.1, constructing blank hash payload
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.1, IP = 10.0.0.1, constructing IKE delete payload
Dec 23 17:59:13 [IKEv1 DEBUG]Group = 10.0.0.1, IP = 10.0.0.1, constructing qm hash payload
Dec 23 17:59:13 [IKEv1]IP = 10.0.0.1, IKE_DECODE SENDING Message (msgid=ec8d2430) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 80
Dec 23 17:59:13 [IKEv1]Group = 10.0.0.1, IP = 10.0.0.1, Session is being torn down. Reason: Unknown
Dec 23 17:59:13 [IKEv1]Ignoring msg to mark SA with dsID 49152 dead because SA deleted
Dec 23 17:59:13 [IKEv1]IKE Receiver: Packet received on 10.0.0.2:500 from 10.0.0.1:500
Dec 23 17:59:13 [IKEv1]IP = 10.0.0.1, Received encrypted packet with no matching SA, dropping


Comments

Post a Comment

Popular posts from this blog

Firepower FMC and FTD troubleshooting

-
 1. Display real time log on FMC or FTD: pigtail for example: pigtail | grep 192.168.2.20                      pigtail | grep sftunnel 2. Restart communication channel manage_procs.pl run it from  the sensor only, run it from FMC will reset all sensors' channel. This scripts are nice to be used when the FMC and FTD have communication problems like heartbeats are not received, policy deployment is failing or events are not received > expert ************************************************************** NOTICE - Shell access will be deprecated in future releases          and will be replaced with a separate expert mode CLI. ************************************************************** admin@FTD:~$ sudo su Password: root@FTD:/home/admin# manage_procs.pl ****************  Configuration Utility  **************  1   Reconfigure Correlator  2   Reconfigure and flush Correlator  3    Restart Comm. channel  4   Update routes  5   Reset all routes  6   Validate Network  0   Exit *****
Read more

Firepower 2100/1100 FTD/ASA initial setup, reimage, upgrade.

-
  Chassis FXOS and FTD share same management IP (default 192.168.45.45) Chassis FXOS (192.168.45.45) and ASA ()use different management IP although on same physical interface. SSH to FXOS/FTD are on FTD CLI prompt, go to FXOS using the  connect fxos  command Console to Chassis is on FXOS CLI prompt, go to FTD using the  connect ftd  command The Firepower 1100 does not support the FXOS Firepower Chassis Manager; only a limited CLI is supported for troubleshooting purposes. The Firepower 2100 runs an underlying operating system called the Firepower eXtensible Operating System (FXOS).  If you run ASA on Firepower 2100, ASA can be in the following modes: Appliance mode (the default after ASA 9.13)—Appliance mode lets you configure all settings in the ASA. Only advanced troubleshooting commands are available from the FXOS CLI. See the  FXOS troubleshooting guide  for more information. Firepower Chassis Manager is not supported . ciscoasa# connect fxos [admin] Connecting to fxos. Connected
Read more

ASA IKEv1 VPN troubleshooting Steps and Tips

-
  1. Phase I proposal mismatch  Run show crypto isakmp sa  Initiator: MM_WAIT_MSG2 Responder: No info  Most likely this is phase1 proposal mismatch, verify IKEv1 policy, other symptoms:   Initiator log: Information Exchange processing failed All configured IKE versions failed to establish the tunnel Initiator debug: Received an un-encrypted NO_PROPOSAL_CHOSEN notify message, dropping Responder log: Error processing payload: Payload ID Responder debug:  All SA proposals found unacceptable 2. IKE version mismatch:  Run  show crypto isakmp sa  no info at both initiator and responder Initiator log: Removing peer from correlator table failed, no match! Reason: User Requested  All configured IKE versions failed to establish the tunnel Initiator debug: Oakley begin quick mode PHASE 1 COMPLETED IKE Initiator sending 1st QM pkt Removing peer from correlator table failed, no match! Session is being torn down. Reason: User Requested Responder log: Tunnel Rejected: Conflicting protocols specified
Read more