# respective log entries pulled from 5506x ASA on the other end 9/12/2016 14:37 172.16.2.1 Warning %ASA-4-752012: IKEv1 was unsuccessful at setting up a tunnel. Map Tag = outside_map. Map Sequence Number = 20. 9/12/2016 14:37 172.16.2.1 Notice %ASA-5-713041: IP = my.ip.xx, IKE Initiator: New Phase 1, Intf inside, IKE Peer my.ip.xx local Proxy Address 172.16.1.3, remote Proxy Address 192.168.0.0, Crypto map (outside_map) 9/12/2016 14:37 172.16.2.1 Notice %ASA-5-752004: Tunnel Manager dispatching a KEY_ACQUIRE message to IKEv1. Map Tag = outside_map. Map Sequence Number = 20. 9/12/2016 14:37 172.16.2.1 Warning %ASA-4-113019: Group = my.ip.xx, Username = my.ip.xx, IP = my.ip.xx, Session disconnected. Session Type: LAN-to-LAN, Duration: 0h:36m:30s, Bytes xmt: 294519133, Bytes rcv: 128491866, Reason: Lost Service 9/12/2016 14:37 172.16.2.1 Notice %ASA-5-713259: Group = my.ip.xx, IP = my.ip.xx, Session is being torn down. Reason: Lost Service 9/12/2016 14:37 172.16.2.1 Error %ASA-3-713902: Group = my.ip.xx, IP = my.ip.xx, QM FSM error (P2 struct &0x00007fffc3e9aa10, mess id 0x7d107bfa)! 9/12/2016 14:37 172.16.2.1 Error %ASA-3-752015: Tunnel Manager has failed to establish an L2L SA. All configured IKE versions failed to establish the tunnel. Map Tag= outside_map. Map Sequence Number = 20. 9/12/2016 14:37 172.16.2.1 Warning %ASA-4-752012: IKEv1 was unsuccessful at setting up a tunnel. Map Tag = outside_map. Map Sequence Number = 20. 9/12/2016 14:37 172.16.2.1 Notice %ASA-5-752004: Tunnel Manager dispatching a KEY_ACQUIRE message to IKEv1. Map Tag = outside_map. Map Sequence Number = 20. 9/12/2016 14:36 172.16.2.1 Notice %ASA-5-713041: Group = my.ip.xx, IP = my.ip.xx, IKE Initiator: Rekeying Phase 2, Intf outside, IKE Peer my.ip.xx local Proxy Address 172.16.1.3, remote Proxy Address 192.168.0.0, Crypto map (outside_map)
# show vpn ipsec { auto-firewall-nat-exclude disable esp-group FOO0 { compression disable lifetime 28800 mode tunnel pfs disable proposal 1 { encryption aes256 hash sha1 } } ike-group FOO0 { ikev2-reauth no key-exchange ikev1 lifetime 28800 proposal 1 { dh-group 2 encryption aes256 hash sha1 } } ipsec-interfaces { interface eth0 } nat-networks { allowed-network 0.0.0.0/0 { } } nat-traversal enable site-to-site { peer sombody.no-ip.org { authentication { mode pre-shared-secret pre-shared-secret somesecret } connection-type initiate description "sombody Network" dhcp-interface eth0 ike-group FOO0 ikev2-reauth no tunnel 1 { allow-nat-networks disable allow-public-networks disable esp-group FOO0 local { prefix 192.168.0.0/24 } remote { prefix 172.16.1.3/32 } } } } }
Any ideas? Is my side correct for IKEv1?