Quantcast
Channel: All EdgeRouter posts
Viewing all articles
Browse latest Browse all 60861

ipsec site-to-site tunnel hangs after several minutes no log entry on ERL side

$
0
0
# respective log entries pulled from 5506x ASA on the other end

9/12/2016 14:37 	172.16.2.1 	Warning 	%ASA-4-752012: IKEv1 was unsuccessful at setting up a tunnel. Map Tag = outside_map. Map Sequence Number = 20.
9/12/2016 14:37 	172.16.2.1 	Notice 	%ASA-5-713041: IP = my.ip.xx, IKE Initiator: New Phase 1, Intf inside, IKE Peer my.ip.xx local Proxy Address 172.16.1.3, remote Proxy Address 192.168.0.0, Crypto map (outside_map)
9/12/2016 14:37 	172.16.2.1 	Notice 	%ASA-5-752004: Tunnel Manager dispatching a KEY_ACQUIRE message to IKEv1. Map Tag = outside_map. Map Sequence Number = 20.
9/12/2016 14:37 	172.16.2.1 	Warning 	%ASA-4-113019: Group = my.ip.xx, Username = my.ip.xx, IP = my.ip.xx, Session disconnected. Session Type: LAN-to-LAN, Duration: 0h:36m:30s, Bytes xmt: 294519133, Bytes rcv: 128491866, Reason: Lost Service
9/12/2016 14:37 	172.16.2.1 	Notice 	%ASA-5-713259: Group = my.ip.xx, IP = my.ip.xx, Session is being torn down. Reason: Lost Service
9/12/2016 14:37 	172.16.2.1 	Error 	%ASA-3-713902: Group = my.ip.xx, IP = my.ip.xx, QM FSM error (P2 struct &0x00007fffc3e9aa10, mess id 0x7d107bfa)!
9/12/2016 14:37 	172.16.2.1 	Error 	%ASA-3-752015: Tunnel Manager has failed to establish an L2L SA. All configured IKE versions failed to establish the tunnel. Map Tag= outside_map. Map Sequence Number = 20.
9/12/2016 14:37 	172.16.2.1 	Warning 	%ASA-4-752012: IKEv1 was unsuccessful at setting up a tunnel. Map Tag = outside_map. Map Sequence Number = 20.
9/12/2016 14:37 	172.16.2.1 	Notice 	%ASA-5-752004: Tunnel Manager dispatching a KEY_ACQUIRE message to IKEv1. Map Tag = outside_map. Map Sequence Number = 20.
9/12/2016 14:36 	172.16.2.1 	Notice 	%ASA-5-713041: Group = my.ip.xx, IP = my.ip.xx, IKE Initiator: Rekeying Phase 2, Intf outside, IKE Peer my.ip.xx local Proxy Address 172.16.1.3, remote Proxy Address 192.168.0.0, Crypto map (outside_map) 
# show vpn

 ipsec {
     auto-firewall-nat-exclude disable
     esp-group FOO0 {
         compression disable
         lifetime 28800
         mode tunnel
         pfs disable
         proposal 1 {
             encryption aes256
             hash sha1
         }
     }
     ike-group FOO0 {
         ikev2-reauth no
         key-exchange ikev1
         lifetime 28800
         proposal 1 {
             dh-group 2
             encryption aes256
             hash sha1
         }
     }
     ipsec-interfaces {
         interface eth0
     }
     nat-networks {
         allowed-network 0.0.0.0/0 {
         }
     }
     nat-traversal enable
     site-to-site {
         peer sombody.no-ip.org {
             authentication {
                 mode pre-shared-secret
                 pre-shared-secret somesecret
             }
             connection-type initiate
             description "sombody Network"
             dhcp-interface eth0
             ike-group FOO0
             ikev2-reauth no
             tunnel 1 {
                 allow-nat-networks disable
                 allow-public-networks disable
                 esp-group FOO0
                 local {
                     prefix 192.168.0.0/24
                 }
                 remote {
                     prefix 172.16.1.3/32
                 }
             }
         }
     }
 }

 

Any ideas?  Is my side correct for IKEv1?


Viewing all articles
Browse latest Browse all 60861

Trending Articles