Could you please clarify, as I'm waiting for this feature being available for some months now. Create an ACL in Policies > Local Policy > Access Control ListsPermit port 500I also have the Default Action as Accept in my POC.Copy the ACL name (CTRL C) youll need it for the next step. You cannot use PSK for authentication of a Remote Access FlexVPN, see this screenshot below from Cisco live presentation BRKSEX-2881. Consult your VPN device vendor specifications to verify that . IPSEC profile: this is phase2, we will create the transform set in here. IKEv2 is the supporting protocol for IP Security Protocol (IPsec) and is used for performing mutual authentication and establishing and maintaining security associations (SAs). Learn more about how Cisco is using Inclusive Language. How to configure a Cisco IOS router for IKEv2 and AnyConnect with - IFM I have a working IPSEC project in GNS3 that uses csr1000 and 7200 routers, VTI interfaces, and IKEv1. Cisco recommends that you have knowledge of the packet exchange for IKEv2. This is reposted from the Networking Academy area since there were no replies. Router 2 receives and verifies the authentication data received from Router 1. 0 Helpful Share Reply JW_UK Beginner In response to JW_UK Options 09-28-2019 03:19 AM This exchange consists of a single request/response pair and was referred to as a phase 2 exchange in IKEv1. All rights reserved. To a remote end configured with encryption domains i wasnt sucessfull. #pre-shared-key cisco1234. Uses certificates for the authentication mechanism. Transport side Ike based IPsec is not available in cedge. Next-Gen USG IKEv2 VPN (Client-to-Site) - Zyxel Support Campus EMEA Finding Feature Information Prerequisites for Configuring Internet Key Exchange Version 2 ASA IKEv2 Debugs for Remote Access VPN Troubleshooting - Cisco this is due to 4.9 a lot of hash/cryptography where removed! The address range specifies that all traffic to and from that range is tunneled. 4 Sep 18 2018 17:40:58 750003 Local:80.x.y.z:500 Remote:51.a.b.c:500 Username:51.a.b.c IKEv2 Negotiation aborted due to ERROR: Detected unsupported . Initiates SA creation, *Nov 11 19:30:34.811: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=0000000000000000 (I) MsgID = 00000000 CurState: IDLE Event: EV_INIT_SA. The sample configuration connects a Cisco ASA device to an Azure route-based VPN gateway. Thanks again for this article. Tunnel is up on the Initiator and the status shows. Hence, you would see 'PFS (Y/N): N, DH group: none' until the first rekey. New here? Cisco recommends that you have knowledge of the packet exchange for IKEv2. Router 1 initiates the CHILD_SA exchange. An attacker could exploit this vulnerability by sending crafted IKEv2 SA-Init . Responder sends the response for IKE_AUTH. It seems like it's not passing domain information. If this CREATE_CHILD_SA exchange is not rekeying an existing SA, the N payload must be omitted. : crypto ikev2 profile default . These messages negotiate cryptographic algorithms, exchange nonces, and do a Diffie-Hellman exchange. Tunnel is up on the Responder. This section lists the configurations used in this document. cEdge supports standard IKE tunnels in 19.x. - edited I followed the guide and created the IPSEC interface on the service side instead of VPN0, unfortunately I'm getting a IKEv2 failure: IKEv2:% Getting preshared key from profile keyring if-ipsec1-ikev2-keyringIKEv2:% Matched peer block 'if-ipsec1-ikev2-keyring-peer'IKEv2:(SESSION ID = 0,SA ID = 0):Searching Policy with fvrf 0, local address X.X.X.XIKEv2:(SESSION ID = 0,SA ID = 0):Found Policy 'policy1-global'IKEv2-ERROR:Address type 1622425149 not supported. I shared this with TAC too. I had the same Firebox and RADIUS server working for IPSec MUVPN, but not for IKEv2. Related Community Discussions View Bug Details in Bug Search Tool Why Is Login Required? All of the devices used in this document started with a cleared (default) configuration. Cisco IOS and IOS XE Software Internet Key Exchange Version 2 Denial of Getting "no pre-shared key with peer" in IKEv2 setup on csr1000 - Cisco Find answers to your questions by entering keywords or phrases in the Search bar above. Communication over the IPSec Tunnel should be done via VPN1. Keyring: configure the key will be exchanged to establish phase1 and the type which is in our example (pre-shared) Example: #crypto ikev2 keyring cisco. Local Type = 0. I opened an SR with TAC for the exact same reason. Hi, made some more tests and my problem is the following, IPSec tunnel can be established if remote end is configured without any specific encryption domains for the communication and with a transport network within the tunnel (for routing purpose - like in GRE Tunnel). Solved: IKEv2-ERROR:: Packet is a retransmission - Cisco Find answers to your questions by entering keywords or phrases in the Search bar above. I have a similar problem with an IPSec Tunnel to an external Firewall. This packet contains: ISAKMP Header(SPI/ version/flags), SAr1(cryptographic algorithm that IKE responder chooses), KEr(DH public Key value of the responder), and Responder Nonce. The information in this document is based on these software and hardware versions: The information in this document was created from the devices in a specific lab environment. IKEv2 Settings Policy - HQ-VPN Auth Type - Preshared Manual Key Key is set in both fields IPsec Tab: Crypto Map Type - Static IKEv2 Mode - Tunnel Transform Sets IKEv2 Proposals - SHA-256 Enable Reverse Route Injection- Checked Enable PFS - Checked Modulus Group - 19 Lifetime Duration - 28800 Lifetime Size - 4608000 Advanced Tab: IKEv2 Packet Exchange and Protocol Level Debugging, Technical Support & Documentation - Cisco Systems, Router 1 receives a packet that matches the crypto acl for peer ASA 10.0.0.2. Create VPN Gateway Policy (Phase1) To create a Phase1 VPN policy, go to Configuration -> VPN -> IPSec VPN and click on the " VPN Gateway " tab. Remote Type = 0. . Router1 verifies and processes the response: (1) The initiator DH secret key is computed, and (2) the initiator skeyid is also generated. Template applied to Service VPN 1, Source interface from VPN 0 (Internet Interface with public IP to reach external Firewall via Internet). In the IKEv1 Phase 1 settings, you can select one of these modes: Main Mode. IPSEC interface not available from VPN0 - Cisco Solved: IPsec tunnel seems to present wrong IKEv2 proposal - Cisco E.g. This module describes the Internet Key Exchange Version 2 (IKEv2) protocol. Cisco recommends that you have knowledge of the packet exchange for IKEv2. New here? Same here. In addition, this document provides information on how to translate certain debug lines in a configuration. INFO_R Event: EV_CHK_INFO_TYPE IKEv2-PROTO-5: (99): SM Trace-> SA: I . First pair of messages is the IKE_SA_INIT exchange. Edit your Feature Template for the VPN Interface Ethernet that is applied to your physical interface in VPN0.Under ACL/QOS add a IPv4 Ingress Access List using the name of the ACL you created in the first step. Has anyone been able to do this on a ISR4k? IOS XE routers must source IPSEC interfaces from the Service side VPN (not VPN0), but also, it is necessary to add a inbound IPv4 ACL to the Interface in VPN0 to permit UDP 500 (IPSEC) and if using NAT UDP 4500 as well.After the tunnel is established you can add a IPv4 static route on the Service side with a next hop of the Tunnel interface to route traffic via the tunnel. The CLI based workaround for it (on cEdge). Working output: #show crypto ikev2 profile IKEv2 profile: default Ref Count: 4 Match criteria: Fvrf: global Local address/interface: none Identities: none Certificate maps: mymap Local identity: none <----- Remote identity: none Conditions: FlexVPN No local identity configured, relaying on global default. The keys used for the encryption and integrity protection are derived from SKEYID and are known as: SK_e (encryption), SK_a (authentication), SK_d is derived and used for derivation of further keying material for CHILD_SAs, and a separate SK_e and SK_a is computed for each direction. I notice the guide was written for the vEdge. ", https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/Security/Security-Book/security-book_chapter_01.html?bookSearch=true#c_Configuring_IKE_Enabled_IPsec_Tunnels_12216.xml. Which Interface did you use? In this document . IKEv2 Payload Types Transform Type Values IKEv2 Transform Attribute Types Transform Type 1 - Encryption Algorithm Transform IDs Transform Type 2 - Pseudorandom Function Transform IDs Transform Type 3 - Integrity Algorithm Transform IDs Transform Type 4 - Key Exchange Method Transform IDs Transform Type 5 - Extended Sequence Numbers Transform IDs Are you seeing encrypts and decrypts over your IPSEC tunnel? Doesn't work for me. The problem is that a 'VPN Interface IPSEC' is not available: https://www.zscaler.com/resources/solution-briefs/partner-viptela-cisco-sd-wan-deployment.pdf. Can you point specifically on the vManage how we can do that? Client Related Configuration The link you shared is for a vEdge setup, the one I've found is for cEdge 16.12.x. This mode is more secure, and uses three . #address 10.0.0.2. Be aware the static route will only be withdrawn from the routing table if the Tunnel goes down. When i run debug on Cisco ASA i found following, also when tunnel is up i am seeing following messaged in debugging, not sure what is going on. All traffic must be accepted and specific routing is needed to direct traffic into specific tunnels. I've tried domain\user, [email protected] and just plain user. Note. These parameters are identical to the one that was received from ASA1. Cisco site-to-site VPN tunnel Failed to find a matching policy If the SA offers include different DH groups, KEi must be an element of the group the initiator expects the responder to accept. Nonce Ni(optional): If the CHILD_SA is created as part of the initial exchange, a second KE payload and nonce must not be sent. *Nov 11 19:30:34.835: IKEv2:KMI message 12 consumed. what i am missing here. 1 Accepted Solution. The connection uses a custom IPsec/IKE policy with the UsePolicyBasedTrafficSelectors option, as described in this article.. Can you also post the config for the VPN template. My template for 'VPN Interface IPsec' looks like this: Then, this template is added under the Service VPN : I thought it was all working fine, however I now have a new problem.IKEv2 is working for Phase 1, but IPSEC is failing.For some reason the ISR4K is creating 16 SA's whilst Zscaler only support a maximum of 8 SA's, therefore the tunnel is currently unusable. All but the headers of all the messages that follow are encrypted and authenticated. IPsec with IKEv2 simple lab - Cisco Windows or MAC (native or AC) client can only use Certificates or EAP. Initiator starts IKE_AUTH exchange and generates the authentication payload. Do you had to apply some NAT config? The first CHILD_SA is created for the proxy_ID pair that matches the trigger packet. Cisco Bug: CSCvp93211 - Garbage value in IKEv2 error debug You can use IKEv2 as a virtual private network (VPN) tunneling protocol that supports automatic VPN reconnection. The CHILD_SA packet typically contains: Router 1 receives the response packet from Router 2 and completes activating the CHILD_SA. In IKEv1 there was a clearly demarcated phase1 exchange that consisted of six (6) packets followed by a phase 2 exchange that consisted of three (3) packets; the IKEv2 exchange is variable. Relevant Configuration:crypto ikev2 proposal PHASE1-prop encryption 3des aes-cbc-128 integrity sha1 group 2 crypto ikev2 keyring KEYRNG peer peer2 address 10.0.0.1 255.255.255.0 hostname host2 pre-shared-key local cisco pre-shared-key remote cisco, *Nov 11 19:30:34.822: IKEv2:(SA ID = 1):Next payload: SA, version: 2.0 Exchange type:IKE_SA_INIT,flags:RESPONDER MSG-RESPONSEMessage id: 0, length: 449 Payload contents: SANext payload: KE, reserved: 0x0, length: 48 last proposal: 0x0, reserved: 0x0, length: 44 Proposal: 1, Protocol id: IKE, SPI size: 0, #trans: 4 last transform: 0x3, reserved: 0x0: length: 12 type: 1, reserved: 0x0, id: AES-CBC last transform: 0x3, reserved: 0x0: length: 8 type: 2, reserved: 0x0, id: SHA1 last transform: 0x3, reserved: 0x0: length: 8 type: 3, reserved: 0x0, id: SHA96 last transform: 0x0, reserved: 0x0: length: 8 type: 4, reserved: 0x0, id: DH_GROUP_1024_MODP/Group 2 KENext payload: N, reserved: 0x0, length: 136 DH group: 2, Reserved: 0x0 NNext payload: VID, reserved: 0x0, length: 24 VID Next payload: VID, reserved: 0x0, length: 23 VID Next payload: NOTIFY, reserved: 0x0, length: 21 NOTIFY(NAT_DETECTION_SOURCE_IP) Next payload: NOTIFY, reserved: 0x0, length: 28 Security protocol id: IKE, spi size: 0, type: NAT_DETECTION_SOURCE_IP NOTIFY(NAT_DETECTION_DESTINATION_IP) Next payload: CERTREQ, reserved: 0x0, length: 28 Security protocol id: IKE, spi size: 0, type: NAT_DETECTION_DESTINATION_IP CERTREQ Next payload: NOTIFY, reserved: 0x0, length: 105 Cert encoding Hash and URL of PKIX NOTIFY(HTTP_CERT_LOOKUP_SUPPORTED) Next payload: NONE, reserved: 0x0, length: 8 Security protocol id: IKE, spi size: 0, type: HTTP_CERT_LOOKUP_SUPPORTED, *Nov 11 19:30:34.822: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000000 CurState: INIT_DONE Event: EV_DONE *Nov 11 19:30:34.822: IKEv2:(SA ID = 1):Cisco DeleteReason Notify is enabled *Nov 11 19:30:34.822: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000000 CurState: INIT_DONE Event: EV_CHK4_ROLE *Nov 11 19:30:34.822: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000000 CurState: INIT_DONE Event:EV_START_TMR *Nov 11 19:30:34.822: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000000 CurState: R_WAIT_AUTH Event: EV_NO_EVENT *Nov 11 19:30:34.822: IKEv2:New ikev2 sa request admitted *Nov 11 19:30:34.822: IKEv2:Incrementing outgoing negotiating sa count by one, *Nov 11 19:30:34.823: IKEv2:Got a packet from dispatcher *Nov 11 19:30:34.823: IKEv2:Got a packet from dispatcher *Nov 11 19:30:34.823: IKEv2:Processing an item off the pak queue, I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000000 CurState: INIT_DONE Event:EV_START_TMR, *Nov 11 19:30:34.823: IKEv2:(SA ID = 1):Next payload: SA, version: 2.0 Exchange type: IKE_SA_INIT, flags:RESPONDER MSG-RESPONSEMessage id: 0, length: 449 Payload contents: SANext payload: KE, reserved: 0x0, length: 48 last proposal: 0x0, reserved: 0x0, length: 44 Proposal: 1, Protocol id: IKE, SPI size: 0, #trans: 4 last transform: 0x3, reserved: 0x0: length: 12 type: 1, reserved: 0x0, id: AES-CBC last transform: 0x3, reserved: 0x0: length: 8 type: 2, reserved: 0x0, id: SHA1 last transform: 0x3, reserved: 0x0: length: 8 type: 3, reserved: 0x0, id: SHA96 last transform: 0x0, reserved: 0x0: length: 8 type: 4, reserved: 0x0, id: DH_GROUP_1024_MODP/Group 2 KENext payload: N, reserved: 0x0, length: 136 DH group: 2, Reserved: 0x0 NNext payload: VID, reserved: 0x0, length: 24 *Nov 11 19:30:34.823: IKEv2:Parse Vendor Specific Payload: CISCO-DELETE-REASON VID Next payload: VID, reserved: 0x0, length: 23 *Nov 11 19:30:34.823: IKEv2:Parse Vendor Specific Payload: (CUSTOM) VID Next payload: NOTIFY, reserved: 0x0, length: 21 *Nov 11 19:30:34.823: IKEv2:Parse Notify Payload: NAT_DETECTION_SOURCE_IP NOTIFY(NAT_DETECTION_SOURCE_IP) Next payload: NOTIFY, reserved: 0x0, length: 28 Security protocol id: IKE, spi size: 0, type: NAT_DETECTION_SOURCE_IP *Nov 11 19:30:34.824: IKEv2:Parse Notify Payload: NAT_DETECTION_DESTINATION_IP NOTIFY(NAT_DETECTION_DESTINATION_IP) Next payload: CERTREQ, reserved: 0x0, length: 28 Security protocol id: IKE, spi size: 0, type: NAT_DETECTION_DESTINATION_IP CERTREQ Next payload: NOTIFY, reserved: 0x0, length: 105 Cert encoding Hash and URL of PKIX *Nov 11 19:30:34.824: IKEv2:Parse Notify Payload: HTTP_CERT_LOOKUP_SUPPORTED NOTIFY(HTTP_CERT_LOOKUP_SUPPORTED) Next payload: NONE, reserved: 0x0, length: 8 Security protocol id: IKE, spi size: 0, type: HTTP_CERT_LOOKUP_SUPPORTED, *Nov 11 19:30:34.824: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: I_WAIT_INIT Event: EV_RECV_INIT *Nov 11 19:30:34.824: IKEv2:(SA ID = 1):Processing IKE_SA_INIT message *Nov 11 19:30:34.824: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: I_PROC_INIT Event: EV_CHK4_NOTIFY *Nov 11 19:30:34.824: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: I_PROC_INIT Event: EV_VERIFY_MSG *Nov 11 19:30:34.824: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: I_PROC_INIT Event: EV_PROC_MSG *Nov 11 19:30:34.824: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: I_PROC_INIT Event: EV_DETECT_NAT *Nov 11 19:30:34.824: IKEv2:(SA ID = 1):Process NAT discovery notify *Nov 11 19:30:34.824: IKEv2:(SA ID = 1):Processing nat detect src notify *Nov 11 19:30:34.824: IKEv2:(SA ID = 1):Remote address matched *Nov 11 19:30:34.824: IKEv2:(SA ID = 1):Processing nat detect dst notify *Nov 11 19:30:34.824: IKEv2:(SA ID = 1):Local address matched *Nov 11 19:30:34.824: IKEv2:(SA ID = 1):No NAT found *Nov 11 19:30:34.824: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: I_PROC_INIT Event: EV_CHK_NAT_T *Nov 11 19:30:34.824: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: I_PROC_INIT Event: EV_CHK_CONFIG_MODE *Nov 11 19:30:34.824: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: INIT_DONE Event:EV_GEN_DH_SECRET *Nov 11 19:30:34.831: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: INIT_DONE Event: EV_NO_EVENT *Nov 11 19:30:34.831: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: INIT_DONE Event: EV_OK_RECD_DH_SECRET_RESP *Nov 11 19:30:34.831: IKEv2:(SA ID = 1):Action: Action_Null *Nov 11 19:30:34.831: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: INIT_DONE Event:EV_GEN_SKEYID *Nov 11 19:30:34.831: IKEv2:(SA ID = 1):Generate skeyid *Nov 11 19:30:34.831: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: INIT_DONE Event: EV_DONE *Nov 11 19:30:34.831: IKEv2:(SA ID = 1):Cisco DeleteReason Notify is enabled *Nov 11 19:30:34.831: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: INIT_DONE Event: EV_CHK4_ROLE *Nov 11 19:30:34.831: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: I_BLD_AUTH Event: EV_GET_CONFIG_MODE *Nov 11 19:30:34.831: IKEv2:Sending config data to toolkit *Nov 11 19:30:34.831: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: I_BLD_AUTH Event: EV_CHK_EAP. Hi, can you please post the config that solved your problem. You can configure IPsec on tunnels for VPN 1 through 65530, except for 512. https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/System-Interface/systems-interfaces-book/configure-interfaces.html. Components Used The information in this document is based on these software and hardware versions: Internet Key Exchange Version 2 (IKEv2) Same in every possible way. Cisco Community Technology and Support Security VPN Remote Access IKEv2 Auth exchange failed 33016 5 2 Remote Access IKEv2 Auth exchange failed Go to solution mustafa.chapal Beginner 08-08-2018 01:52 PM - edited 03-12-2019 05:29 AM Hi, The VPN is not connecting at all. The DH Group configured under the crypto map would be used only during rekey. They contain the source and destination address of the initiator and responder respectively for forwarding/receiving encrypted traffic. 189035: *Aug 8 14:01:22.161 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):IKE Proposal: 1, SPI size: 0 (initial negotiation), AES-CBC SHA256 SHA256 DH_GROUP_2048_MODP/Group 14, 189036: *Aug 8 14:01:22.161 Chicago: IKEv2:(SA ID = 1):[IKEv2 -> PKI] Retrieve configured trustpoint(s), 189037: *Aug 8 14:01:22.161 Chicago: IKEv2:(SA ID = 1):[PKI -> IKEv2] Retrieved trustpoint(s): 'TP-self-signed-653483565', 189038: *Aug 8 14:01:22.161 Chicago: IKEv2:(SA ID = 1):[IKEv2 -> PKI] Get Public Key Hashes of trustpoints, 189039: *Aug 8 14:01:22.161 Chicago: IKEv2:(SA ID = 1):[PKI -> IKEv2] Getting of Public Key Hashes of trustpoints FAILED, 189040: *Aug 8 14:01:22.161 Chicago: IKEv2:Failed to retrieve Certificate Issuer list, 189041: *Aug 8 14:01:22.161 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Sending Packet [To 2.2.2.2:500/From 1.1.1.1:500/VRF i0:f0], Initiator SPI : 8A15E970577C6140 - Responder SPI : 0550071FA9DFE718 Message id: 0, SA KE N VID VID NOTIFY(NAT_DETECTION_SOURCE_IP) NOTIFY(NAT_DETECTION_DESTINATION_IP), 189042: *Aug 8 14:01:22.161 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Completed SA init exchange, 189043: *Aug 8 14:01:22.161 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Starting timer (30 sec) to wait for auth message, 189044: *Aug 8 14:01:22.429 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Received Packet [From 2.2.2.2:4500/To 1.1.1.1:500/VRF i0:f0], Initiator SPI : 8A15E970577C6140 - Responder SPI : 0550071FA9DFE718 Message id: 1, IDi NOTIFY(INITIAL_CONTACT) NOTIFY(Unknown - 16396) IDr AUTH CFG NOTIFY(ESP_TFC_NO_SUPPORT) NOTIFY(NON_FIRST_FRAGS) SA TSi TSr, 189045: *Aug 8 14:01:22.429 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Stopping timer to wait for auth message, 189046: *Aug 8 14:01:22.429 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Checking NAT discovery, 189047: *Aug 8 14:01:22.429 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):NAT OUTSIDE found, 189048: *Aug 8 14:01:22.429 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):NAT detected float to init port 4500, resp port 4500, 189049: *Aug 8 14:01:22.433 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Searching policy based on peer's identity '10.5.1.70' of type 'IPv4 address', 189050: *Aug 8 14:01:22.433 Chicago: IKEv2:found matching IKEv2 profile 'FlexVPN', 189051: *Aug 8 14:01:22.433 Chicago: IKEv2:% Getting preshared key from profile keyring keys, 189052: *Aug 8 14:01:22.433 Chicago: IKEv2:% Matched peer block 'DYNAMIC', 189053: *Aug 8 14:01:22.433 Chicago: IKEv2:Searching Policy with fvrf 0, local address 1.1.1.1, 189054: *Aug 8 14:01:22.433 Chicago: IKEv2:Found Policy 'ikev2policy', 189055: *Aug 8 14:01:22.433 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Verify peer's policy, 189056: *Aug 8 14:01:22.433 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Peer's policy verified, 189057: *Aug 8 14:01:22.433 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Get peer's authentication method, 189058: *Aug 8 14:01:22.433 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Peer's authentication method is 'PSK', 189059: *Aug 8 14:01:22.433 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Get peer's preshared key for 10.5.1.70, 189060: *Aug 8 14:01:22.433 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Verify peer's authentication data, 189061: *Aug 8 14:01:22.433 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Use preshared key for id 10.5.1.70, key len 7, 189062: *Aug 8 14:01:22.433 Chicago: IKEv2:[IKEv2 -> Crypto Engine] Generate IKEv2 authentication data, 189063: *Aug 8 14:01:22.433 Chicago: IKEv2:[Crypto Engine -> IKEv2] IKEv2 authentication data generation PASSED, 189064: *Aug 8 14:01:22.433 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Verification of peer's authenctication data PASSED, 189065: *Aug 8 14:01:22.433 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Processing INITIAL_CONTACT, 189066: *Aug 8 14:01:22.433 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Received valid config mode data. The address range specifies that all traffic to and from that range are tunnelled. Options. N(Notify payload-optional). #proposal cisco. 05:29 AM. You can only use PSK when the client is another FlexVPN hardware (router) client or Strongswan. IKEv2 allows the security association to remain unchanged despite changes in the underlying connection. Initiator building IKE_INIT_SA packet. Relevant Configuration:crypto ipsec transform-set TS esp-3des esp-sha-hmac crypto ipsec profile phse2-prof set transform-set TS set ikev2-profile IKEV2-SETUP, *Nov 11 19:30:34.831: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: I_BLD_AUTH Event:EV_GEN_AUTH *Nov 11 19:30:34.831: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: I_BLD_AUTH Event: EV_CHK_AUTH_TYPE *Nov 11 19:30:34.831: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: I_BLD_AUTH Event: EV_OK_AUTH_GEN *Nov 11 19:30:34.831: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: I_BLD_AUTH Event: EV_SEND_AUTH *Nov 11 19:30:34.831: IKEv2:Construct Vendor Specific Payload: CISCO-GRANITE *Nov 11 19:30:34.831: IKEv2:Construct Notify Payload: INITIAL_CONTACT *Nov 11 19:30:34.831: IKEv2:Construct Notify Payload: SET_WINDOW_SIZE *Nov 11 19:30:34.831: IKEv2:Construct Notify Payload: ESP_TFC_NO_SUPPORT *Nov 11 19:30:34.831: IKEv2:Construct Notify Payload: NON_FIRST_FRAGS Payload contents: VID Next payload: IDi, reserved: 0x0, length: 20 IDiNext payload: AUTH, reserved: 0x0, length: 12 Id type: IPv4 address, Reserved: 0x0 0x0 AUTHNext payload: CFG, reserved: 0x0, length: 28 Auth method PSK, reserved: 0x0, reserved 0x0 CFGNext payload: SA, reserved: 0x0, length: 309 cfg type: CFG_REQUEST, reserved: 0x0, reserved: 0x0, *Nov 11 19:30:34.831: SA Next payload:TSi, reserved: 0x0, length: 40 last proposal: 0x0, reserved: 0x0, length: 36 Proposal: 1, Protocol id: ESP, SPI size: 4, #trans: 3 last transform: 0x3, reserved: 0x0: length: 8 type: 1, reserved: 0x0, id: 3DES last transform: 0x3, reserved: 0x0: length: 8 type: 3, reserved: 0x0, id: SHA96 last transform: 0x0, reserved: 0x0: length: 8 type: 5, reserved: 0x0, id: Don't use ESN TSiNext payload: TSr, reserved: 0x0, length: 24 Num of TSs: 1, reserved 0x0, reserved 0x0 TS type: TS_IPV4_ADDR_RANGE, proto id: 0, length: 16 start port: 0, end port: 65535 start addr: 0.0.0.0, end addr: 255.255.255.255 TSrNext payload: NOTIFY, reserved: 0x0, length: 24 Num of TSs: 1, reserved 0x0, reserved 0x0 TS type: TS_IPV4_ADDR_RANGE, proto id: 0, length: 16 start port: 0, end port: 65535 start addr: 0.0.0.0, end addr: 255.255.255.255, NOTIFY(INITIAL_CONTACT) Next payload: NOTIFY, reserved: 0x0, length: 8 Security protocol id: IKE, spi size: 0, type: INITIAL_CONTACT NOTIFY(SET_WINDOW_SIZE) Next payload: NOTIFY, reserved: 0x0, length: 12 Security protocol id: IKE, spi size: 0, type: SET_WINDOW_SIZE NOTIFY(ESP_TFC_NO_SUPPORT) Next payload: NOTIFY, reserved: 0x0, length: 8 Security protocol id: IKE, spi size: 0, type: ESP_TFC_NO_SUPPORT NOTIFY(NON_FIRST_FRAGS) Next payload: NONE, reserved: 0x0, length: 8 Security protocol id: IKE, spi size: 0, type: NON_FIRST_FRAGS *Nov 11 19:30:34.832: IKEv2:(SA ID = 1):Next payload: ENCR, version: 2.0 Exchange type:IKE_AUTH, flags:INITIATORMessage id: 1, length: 556 Payload contents: ENCR Next payload: VID, reserved: 0x0, length: 528 *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001CurState: I_WAIT_AUTHEvent: EV_NO_EVENT, *Nov 11 19:30:34.832: IKEv2:Got a packet from dispatcher *Nov 11 19:30:34.832: IKEv2:Processing an item off the pak queue *Nov 11 19:30:34.832: IKEv2:(SA ID = 1):Request has mess_id 1; expected 1 through 1 *Nov 11 19:30:34.832:IKEv2:(SA ID = 1):Next payload: ENCR, version: 2.0 Exchange type:IKE_AUTH, flags:INITIATORMessage id: 1, length: 556 Payload contents: *Nov 11 19:30:34.832: IKEv2:Parse Vendor Specific Payload: (CUSTOM) VID Next payload: IDi, reserved: 0x0, length: 20 IDiNext payload: AUTH, reserved: 0x0, length: 12 Id type: IPv4 address, Reserved: 0x0 0x0 AUTH Next payload: CFG, reserved: 0x0, length: 28 Auth method PSK, reserved: 0x0, reserved 0x0 CFG Next payload: SA, reserved: 0x0, length: 309 cfg type: CFG_REQUEST, reserved: 0x0, reserved: 0x0 *Nov 11 19:30:34.832: attrib type: internal IP4 DNS, length: 0 *Nov 11 19:30:34.832: attrib type: internal IP4 DNS, length: 0 *Nov 11 19:30:34.832: attrib type: internal IP4 NBNS, length: 0 *Nov 11 19:30:34.832: attrib type: internal IP4 NBNS, length: 0 *Nov 11 19:30:34.832: attrib type: internal IP4 subnet, length: 0 *Nov 11 19:30:34.832: attrib type: application version, length: 257 attrib type: Unknown - 28675, length: 0 *Nov 11 19:30:34.832: attrib type: Unknown - 28672, length: 0 *Nov 11 19:30:34.832: attrib type: Unknown - 28692, length: 0 *Nov 11 19:30:34.832: attrib type: Unknown - 28681, length: 0 *Nov 11 19:30:34.832: attrib type: Unknown - 28674, length: 0 *Nov 11 19:30:34.832:SANext payload: TSi, reserved: 0x0, length: 40 last proposal: 0x0, reserved: 0x0, length: 36 Proposal: 1, Protocol id: ESP, SPI size: 4, #trans: 3 last transform: 0x3, reserved: 0x0: length: 8 type: 1, reserved: 0x0, id: 3DES last transform: 0x3, reserved: 0x0: length: 8 type: 3, reserved: 0x0, id: SHA96 last transform: 0x0, reserved: 0x0: length: 8 type: 5, reserved: 0x0, id: Don't use ESN TSiNext payload: TSr, reserved: 0x0, length: 24 Num of TSs: 1, reserved 0x0, reserved 0x0 TS type: TS_IPV4_ADDR_RANGE, proto id: 0, length: 16 start port: 0, end port: 65535 start addr: 0.0.0.0, end addr: 255.255.255.255 TSr Next payload: NOTIFY, reserved: 0x0, length: 24 Num of TSs: 1, reserved 0x0, reserved 0x0 TS type: TS_IPV4_ADDR_RANGE, proto id: 0, length: 16 start port: 0, end port: 65535 start addr: 0.0.0.0, end addr: 255.255.255.255.