ASA IKEv1 VPN troubleshooting Steps and Tips

-

 

1. Phase I proposal mismatch

 Run show crypto isakmp sa 

Initiator:

MM_WAIT_MSG2

Responder:

No info 


Most likely this is phase1 proposal mismatch, verify IKEv1 policy, other symptoms: 

Initiator log:

Information Exchange processing failed

All configured IKE versions failed to establish the tunnel

Initiator debug:

Received an un-encrypted NO_PROPOSAL_CHOSEN notify message, dropping


Responder log:

Error processing payload: Payload ID

Responder debug:

 All SA proposals found unacceptable


2. IKE version mismatch:

 Run show crypto isakmp sa 

no info at both initiator and responder


Initiator log:

Removing peer from correlator table failed, no match!

Reason: User Requested

 All configured IKE versions failed to establish the tunnel


Initiator debug:

Oakley begin quick mode

PHASE 1 COMPLETED

IKE Initiator sending 1st QM pkt

Removing peer from correlator table failed, no match!

Session is being torn down. Reason: User Requested


Responder log:

Tunnel Rejected: Conflicting protocols specified by tunnel-group and group-policy

Removing peer from correlator table failed, no match!


Responder debug:

PHASE 1 COMPLETED

IKE Responder starting QM

Tunnel Rejected: Conflicting protocols specified by tunnel-group and group-policy


3. Pre-shared key mismatch:

Run show crypto isakmp sa 

Initiator:

MM_WAIT_MSG6

Responder:

MM_WAIT_MSG5


Initiator log:

Error, peer has indicated that something is wrong with our message.  This could indicate a pre-shared key mismatch.

Tunnel Manager has failed to establish an L2L SA.  All configured IKE versions failed to establish the tunnel. Map Tag= MAP.  Map Sequence Number = 10.

Initiator debug:

Received an un-encrypted PAYLOAD_MALFORMED notify message, dropping

Error, peer has indicated that something is wrong with our message.  This could indicate a pre-shared key mismatch.

Received encrypted packet with no matching SA, dropping


Responder log:

ERROR, had problems decrypting packet, probably due to mismatched pre-shared key.  Aborting


Responder debug:

 Received encrypted Oakley Main Mode packet with invalid payloads, MessID = 0

ERROR, had problems decrypting packet, probably due to mismatched pre-shared key.  Aborting


4. Phase II mismatch:

Run show crypto isakmp sa

no info displayed from both initiator and responder


Initiator log:

Removing peer from correlator table failed, no match!

Reason: User Requested

Tunnel Manager has failed to establish an L2L SA.  All configured IKE versions failed to establish the tunnel. Map Tag= MAP.  Map Sequence Number = 10.


Initiator debug:

PHASE 1 COMPLETED

IKE Initiator sending 1st QM pkt

Received non-routine Notify message: No proposal chosen

Reason: Peer Terminate


Responder log:

QM FSM error

Removing peer from correlator table failed, no match!

 Reason: Phase 2 Mismatch


Responder debug:

PHASE 1 COMPLETED

IKE Responder starting QM

All IPSec SA proposals found unacceptable!

Removing peer from correlator table failed, no match!

Reason: Phase 2 Mismatch


5. Packet capture help identify problems:
capture IKE type isakmp match ip any host x.x.x.x

  


===========================
Reference:

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/81824-common-ipsec-trouble.html

Comments

Post a Comment

Popular posts from this blog

Firepower FMC and FTD troubleshooting

-
 1. Display real time log on FMC or FTD: pigtail for example: pigtail | grep 192.168.2.20                      pigtail | grep sftunnel 2. Restart communication channel manage_procs.pl run it from  the sensor only, run it from FMC will reset all sensors' channel. This scripts are nice to be used when the FMC and FTD have communication problems like heartbeats are not received, policy deployment is failing or events are not received > expert ************************************************************** NOTICE - Shell access will be deprecated in future releases          and will be replaced with a separate expert mode CLI. ************************************************************** admin@FTD:~$ sudo su Password: root@FTD:/home/admin# manage_procs.pl ****************  Configuration Utility  **************  1   Reconfigure Correlator  2   Reconfigure and flush Correlator  3    Restart Comm. channel  4   Update routes  5   Reset all routes  6   Validate Network  0   Exit *****
Read more

Firepower 2100/1100 FTD/ASA initial setup, reimage, upgrade.

-
  Chassis FXOS and FTD share same management IP (default 192.168.45.45) Chassis FXOS (192.168.45.45) and ASA ()use different management IP although on same physical interface. SSH to FXOS/FTD are on FTD CLI prompt, go to FXOS using the  connect fxos  command Console to Chassis is on FXOS CLI prompt, go to FTD using the  connect ftd  command The Firepower 1100 does not support the FXOS Firepower Chassis Manager; only a limited CLI is supported for troubleshooting purposes. The Firepower 2100 runs an underlying operating system called the Firepower eXtensible Operating System (FXOS).  If you run ASA on Firepower 2100, ASA can be in the following modes: Appliance mode (the default after ASA 9.13)—Appliance mode lets you configure all settings in the ASA. Only advanced troubleshooting commands are available from the FXOS CLI. See the  FXOS troubleshooting guide  for more information. Firepower Chassis Manager is not supported . ciscoasa# connect fxos [admin] Connecting to fxos. Connected
Read more