Experts
i have a cisco asa 5505 im trying to connect to a 5510 via l2l vpn.
phase one negotiations are failing.
VPN should be
phase one; Group 2 3DES-MD5
Phase two; NOPFS-ESP-3DES-MD5
interesting traffic is from 10.32.51.x to 10.2.0.x via 66.XXX.XXX.XXX
here is my config;
: Saved
:
ASA Version 7.2(2)
!
hostname XXXXXXXXXXX
domain-name XXXXXXXXXXXXXX
enable password XXXXXXXXXXXXXXXX encrypted
names
!
interface Vlan1
nameif inside
security-level 100
ip address 10.32.51.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 71.XX.XXX.XXX 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd XXXXXXXXXXXXXXXXX encrypted
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns server-group DefaultDNS
domain-name XXXXXXXXXX
access-list outside_20_cryptomap extended permit ip 10.32.51.0 255.255.255.0 10.1.11.0 255.255.255.0
access-list nonat extended permit ip 10.32.51.0 255.255.255.0 10.1.11.0 255.255.255.0
access-list nonat extended permit ip 10.32.51.0 255.255.255.0 10.1.1.0 255.255.255.0
access-list nonat extended permit ip 10.32.51.0 255.255.255.0 10.2.0.0 255.255.255.0
access-list outside_40_cryptomap extended permit ip 10.32.51.0 255.255.255.0 10.1.1.0 255.255.255.0
access-list outside_60_cryptomap extended permit ip 10.32.51.0 255.255.255.0 10.2.0.0 255.255.255.0
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-522.bin
no asdm history enable
arp timeout 14400
global (outside) 10 interface
nat (inside) 0 access-list nonat
nat (inside) 10 0.0.0.0 0.0.0.0
route outside 0.0.0.0 0.0.0.0 71.XX.XXX.XXX 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
http server enable
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto map outside_map 20 match address outside_20_cryptomap
crypto map outside_map 20 set pfs
crypto map outside_map 20 set peer 65.XXX.XXX.XXX
crypto map outside_map 20 set transform-set ESP-DES-SHA
crypto map outside_map 40 match address outside_40_cryptomap
crypto map outside_map 40 set pfs
crypto map outside_map 40 set peer 65.XXX.XXX.XXX
crypto map outside_map 40 set transform-set ESP-DES-SHA
crypto map outside_map 60 match address outside_60_cryptomap
crypto map outside_map 60 set pfs
crypto map outside_map 60 set peer 66.XXX.XXX.XXX
crypto map outside_map 60 set transform-set ESP-3DES-MD5
crypto map outside_map interface outside
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption des
hash sha
group 2
lifetime 28800
crypto isakmp policy 30
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
tunnel-group 65.XXX.XXX.XXX type ipsec-l2l
tunnel-group 65.XXX.XXX.XXX ipsec-attributes
pre-shared-key *
tunnel-group 65.XXX.XXX.XXX type ipsec-l2l
tunnel-group 65.XXX.XXX.XXX ipsec-attributes
pre-shared-key *
tunnel-group 66.XXX.XXX.XXX type ipsec-l2l
tunnel-group 66.XXX.XXX.XXX ipsec-attributes
pre-shared-key *
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 60
console timeout 0
management-access inside
dhcpd address 10.32.51.100-10.32.51.131 inside
dhcpd dns 10.1.11.22 4.2.2.2 interface inside
dhcpd option 3 ip 10.32.51.1 interface inside
dhcpd enable inside
!
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
!
service-policy global_policy global
any help would be greatly appreciated..
Error log is;
6|Sep 26 2007|10:44:11|305012|10.32
.51.102|71
.XXX.XXX.X
XX|Teardow
n dynamic UDP translation from inside:10.32.51.102/1025 to outside:71.XXX.XXX.XXX/466
9 duration 0:03:48
4|Sep 26 2007|10:44:06|402116|65.XX
X.XXX.XXX|
71.XXX.XXX
.XXX|IPSEC
: Received an ESP packet (SPI= 0xB91027F6, sequence number= 0xF1) from 65.XXX.XXX.XXX (user= 65.XXX.XXX.XXX) to 71.XXX.XXX.XXX. The decapsulated inner packet doesn't match the negotiated policy in the SA. The packet specifies its destination as 71.XXX.XXX.XXX, its source as 65.XXX.XXX.XXX, and its protocol as 1. The SA specifies its local proxy as 10.32.51.0/255.255.255.0/0
/0 and its remote_proxy as 10.1.1.0/255.255.255.0/0/0
.
6|Sep 26 2007|10:44:06|302015|65.XX
X.XXX.XXX|
71.XXX.XXX
.XXX|Built
inbound UDP connection 136623 for outside:65.XXX.XXX.XXX/500
(65.XXX.XXX.XXX/500) to NP Identity Ifc:71.XXX.XXX.XXX/500 (71.XXX.XXX.XXX/500)
6|Sep 26 2007|10:44:05|302015|10.1.
11.129|10.
32.51.50|B
uilt inbound UDP connection 136622 for outside:10.1.11.129/1056 (10.1.11.129/1056) to inside:10.32.51.50/161 (10.32.51.50/161)
6|Sep 26 2007|10:44:02|302021|10.2.
0.1|71.XXX
.XXX.XXX|T
eardown ICMP connection for faddr 10.2.0.1/0 gaddr 71.XXX.XXX.XXX/4388 laddr 71.XXX.XXX.XXX/4388
5|Sep 26 2007|10:44:02|111008|||Use
r 'enable_15' executed the 'ping 10.2.0.1' command.
4|Sep 26 2007|10:43:56|402116|65.XX
X.XXX.XXX|
71.XXX.XXX
.XXX|IPSEC
: Received an ESP packet (SPI= 0xB91027F6, sequence number= 0xEE) from 65.XXX.XXX.XXX (user= 65.XXX.XXX.XXX) to 71.XXX.XXX.XXX. The decapsulated inner packet doesn't match the negotiated policy in the SA. The packet specifies its destination as 71.XXX.XXX.XXX, its source as 65.XXX.XXX.XXX, and its protocol as 1. The SA specifies its local proxy as 10.32.51.0/255.255.255.0/0
/0 and its remote_proxy as 10.1.1.0/255.255.255.0/0/0
.
6|Sep 26 2007|10:43:54|302016|10.1.
46.103|10.
32.51.102|
Teardown UDP connection 136586 for outside:10.1.46.103/161 to inside:10.32.51.102/1025 duration 0:03:32 bytes 616
6|Sep 26 2007|10:43:52|302020|10.2.
0.1|71.XXX
.XXX.XXX|B
uilt ICMP connection for faddr 10.2.0.1/0 gaddr 71.XXX.XXX.XXX/4388 laddr 71.XXX.XXX.XXX/4388
4|Sep 26 2007|10:43:46|402116|65.XX
X.XXX.XXX|
71.XXX.XXX
.XXX|IPSEC
: Received an ESP packet (SPI= 0xB91027F6, sequence number= 0xEC) from 65.XXX.XXX.XXX (user= 65.XXX.XXX.XXX) to 71.XXX.XXX.XXX. The decapsulated inner packet doesn't match the negotiated policy in the SA. The packet specifies its destination as 71.XXX.XXX.XXX, its source as 65.XXX.XXX.XXX, and its protocol as 1. The SA specifies its local proxy as 10.32.51.0/255.255.255.0/0
/0 and its remote_proxy as 10.1.1.0/255.255.255.0/0/0
.
6|Sep 26 2007|10:43:45|302014|10.1.
11.21|10.3
2.51.102|T
eardown TCP connection 136619 for outside:10.1.11.21/1026 to inside:10.32.51.102/2857 duration 0:00:18 bytes 1943 TCP FINs
6|Sep 26 2007|10:43:45|302014|10.1.
11.21|10.3
2.51.102|T
eardown TCP connection 136618 for outside:10.1.11.21/135 to inside:10.32.51.102/2856 duration 0:00:18 bytes 1672 TCP FINs
4|Sep 26 2007|10:43:36|402116|65.XX
X.XXX.XXX|
71.XXX.XXX
.XXX|IPSEC
: Received an ESP packet (SPI= 0xB91027F6, sequence number= 0xE8) from 65.XXX.XXX.XXX (user= 65.XXX.XXX.XXX) to 71.XXX.XXX.XXX. The decapsulated inner packet doesn't match the negotiated policy in the SA. The packet specifies its destination as 71.XXX.XXX.XXX, its source as 65.XXX.XXX.XXX, and its protocol as 1. The SA specifies its local proxy as 10.32.51.0/255.255.255.0/0
/0 and its remote_proxy as 10.1.1.0/255.255.255.0/0/0
.
6|Sep 26 2007|10:43:35|302021|10.2.
0.1|71.XXX
.XXX.XXX|T
eardown ICMP connection for faddr 10.2.0.1/0 gaddr 71.XXX.XXX.XXX/4388 laddr 71.XXX.XXX.XXX/4388
5|Sep 26 2007|10:43:35|111008|||Use
r 'enable_15' executed the 'ping 10.2.0.1' command.
6|Sep 26 2007|10:43:29|302016|10.1.
46.25|10.3
2.51.102|T
eardown UDP connection 136602 for outside:10.1.46.25/161 to inside:10.32.51.102/1025 duration 0:02:18 bytes 308
6|Sep 26 2007|10:43:26|302013|10.1.
11.21|10.3
2.51.102|B
uilt outbound TCP connection 136619 for outside:10.1.11.21/1026 (10.1.11.21/1026) to inside:10.32.51.102/2857 (10.32.51.102/2857)
6|Sep 26 2007|10:43:26|302013|10.1.
11.21|10.3
2.51.102|B
uilt outbound TCP connection 136618 for outside:10.1.11.21/135 (10.1.11.21/135) to inside:10.32.51.102/2856 (10.32.51.102/2856)
4|Sep 26 2007|10:43:26|402116|65.XX
X.XXX.XXX|
71.XXX.XXX
.XXX|IPSEC
: Received an ESP packet (SPI= 0xB91027F6, sequence number= 0xE7) from 65.XXX.XXX.XXX (user= 65.XXX.XXX.XXX) to 71.XXX.XXX.XXX. The decapsulated inner packet doesn't match the negotiated policy in the SA. The packet specifies its destination as 71.XXX.XXX.XXX, its source as 65.XXX.XXX.XXX, and its protocol as 1. The SA specifies its local proxy as 10.32.51.0/255.255.255.0/0
/0 and its remote_proxy as 10.1.1.0/255.255.255.0/0/0
.
6|Sep 26 2007|10:43:25|302020|10.2.
0.1|71.XXX
.XXX.XXX|B
uilt ICMP connection for faddr 10.2.0.1/0 gaddr 71.XXX.XXX.XXX/4388 laddr 71.XXX.XXX.XXX/4388
4|Sep 26 2007|10:43:16|402116|65.XX
X.XXX.XXX|
71.XXX.XXX
.XXX|IPSEC
: Received an ESP packet (SPI= 0xB91027F6, sequence number= 0xE6) from 65.XXX.XXX.XXX (user= 65.XXX.XXX.XXX) to 71.XXX.XXX.XXX. The decapsulated inner packet doesn't match the negotiated policy in the SA. The packet specifies its destination as 71.XXX.XXX.XXX, its source as 65.XXX.XXX.XXX, and its protocol as 1. The SA specifies its local proxy as 10.32.51.0/255.255.255.0/0
/0 and its remote_proxy as 10.1.1.0/255.255.255.0/0/0
.
6|Sep 26 2007|10:43:16|305012|10.32
.51.102|71
.XXX.XXX.X
XX|Teardow
n dynamic TCP translation from inside:10.32.51.102/2848 to outside:71.XXX.XXX.XXX/304
20 duration 0:02:30
6|Sep 26 2007|10:43:15|305012|10.32
.51.102|71
.XXX.XXX.X
XX|Teardow
n dynamic TCP translation from inside:10.32.51.102/2846 to outside:71.XXX.XXX.XXX/304
18 duration 0:02:30
4|Sep 26 2007|09:39:50|713903|||IP = 66.XXX.XXX.XXX, Header invalid, missing SA payload! (next payload = 4)
6|Sep 26 2007|09:39:47|302013|10.1.
11.21|10.3
2.51.102|B
uilt outbound TCP connection 135810 for outside:10.1.11.21/1026 (10.1.11.21/1026) to inside:10.32.51.102/2343 (10.32.51.102/2343)
6|Sep 26 2007|09:39:47|302013|10.1.
11.21|10.3
2.51.102|B
uilt outbound TCP connection 135808 for outside:10.1.11.21/135 (10.1.11.21/135) to inside:10.32.51.102/2342 (10.32.51.102/2342)
4|Sep 26 2007|09:39:46|713903|||IP = 66.XXX.XXX.XXX, Header invalid, missing SA payload! (next payload = 4)
6|Sep 26 2007|09:39:45|302016|10.1.
46.25|10.3
2.51.112|T
eardown UDP connection 135790 for outside:10.1.46.25/161 to inside:10.32.51.112/1025 duration 0:02:18 bytes 312
4|Sep 26 2007|09:39:44|402116|65.XX
X.XXX.XXX|
71.XXX.XXX
.XXX|IPSEC
: Received an ESP packet (SPI= 0x892635AC, sequence number= 0x92) from 65.XXX.XXX.XXX (user= 65.XXX.XXX.XXX) to 71.XXX.XXX.XXX. The decapsulated inner packet doesn't match the negotiated policy in the SA. The packet specifies its destination as 71.XXX.XXX.XXX, its source as 65.XXX.XXX.XXX, and its protocol as 1. The SA specifies its local proxy as 10.32.51.0/255.255.255.0/0
/0 and its remote_proxy as 10.1.1.0/255.255.255.0/0/0
.
4|Sep 26 2007|09:39:42|713903|||IP = 66.XXX.XXX.XXX, Header invalid, missing SA payload! (next payload = 4)
4|Sep 26 2007|09:39:38|713903|||IP = 66.XXX.XXX.XXX, Header invalid, missing SA payload! (next payload = 4)
4|Sep 26 2007|09:39:34|713903|||IP = 66.XXX.XXX.XXX, Header invalid, missing SA payload! (next payload = 4)
4|Sep 26 2007|09:39:34|402116|65.XX
X.XXX.XXX|
71.XXX.XXX
.XXX|IPSEC
: Received an ESP packet (SPI= 0x892635AC, sequence number= 0x91) from 65.XXX.XXX.XXX (user= 65.XXX.XXX.XXX) to 71.XXX.XXX.XXX. The decapsulated inner packet doesn't match the negotiated policy in the SA. The packet specifies its destination as 71.XXX.XXX.XXX, its source as 65.XXX.XXX.XXX, and its protocol as 1. The SA specifies its local proxy as 10.32.51.0/255.255.255.0/0
/0 and its remote_proxy as 10.1.1.0/255.255.255.0/0/0
.
6|Sep 26 2007|09:39:31|302016|10.32
.51.102|10
.32.51.1|T
eardown UDP connection 135791 for inside:10.32.51.102/68 to NP Identity Ifc:10.32.51.1/67 duration 0:02:01 bytes 662
4|Sep 26 2007|09:39:30|713903|||IP = 66.XXX.XXX.XXX, Header invalid, missing SA payload! (next payload = 4)
4|Sep 26 2007|09:39:26|713903|||Gro
up = 66.XXX.XXX.XXX, IP = 66.XXX.XXX.XXX, Error: Unable to remove PeerTblEntry
3|Sep 26 2007|09:39:26|713902|||Gro
up = 66.XXX.XXX.XXX, IP = 66.XXX.XXX.XXX, Removing peer from peer table failed, no match!
6|Sep 26 2007|09:39:26|713905|||Gro
up = 66.XXX.XXX.XXX, IP = 66.XXX.XXX.XXX, P1 Retransmit msg dispatched to MM FSM
5|Sep 26 2007|09:39:26|713201|||Gro
up = 66.XXX.XXX.XXX, IP = 66.XXX.XXX.XXX, Duplicate Phase 1 packet detected. Retransmitting last packet.
4|Sep 26 2007|09:39:24|402116|65.XX
X.XXX.XXX|
71.XXX.XXX
.XXX|IPSEC
: Received an ESP packet (SPI= 0x892635AC, sequence number= 0x90) from 65.XXX.XXX.XXX (user= 65.XXX.XXX.XXX) to 71.XXX.XXX.XXX. The decapsulated inner packet doesn't match the negotiated policy in the SA. The packet specifies its destination as 71.XXX.XXX.XXX, its source as 65.XXX.XXX.XXX, and its protocol as 1. The SA specifies its local proxy as 10.32.51.0/255.255.255.0/0
/0 and its remote_proxy as 10.1.1.0/255.255.255.0/0/0
.
6|Sep 26 2007|09:39:22|713905|||Gro
up = 66.XXX.XXX.XXX, IP = 66.XXX.XXX.XXX, P1 Retransmit msg dispatched to MM FSM
5|Sep 26 2007|09:39:22|713201|||Gro
up = 66.XXX.XXX.XXX, IP = 66.XXX.XXX.XXX, Duplicate Phase 1 packet detected. Retransmitting last packet.
5|Sep 26 2007|09:39:20|111008|||Use
r 'enable_15' executed the 'ping inside 10.2.0.1' command.
6|Sep 26 2007|09:39:18|713219|||Gro
up = 66.XXX.XXX.XXX, IP = 66.XXX.XXX.XXX, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.
6|Sep 26 2007|09:39:18|713905|||Gro
up = 66.XXX.XXX.XXX, IP = 66.XXX.XXX.XXX, P1 Retransmit msg dispatched to MM FSM
5|Sep 26 2007|09:39:18|713201|||Gro
up = 66.XXX.XXX.XXX, IP = 66.XXX.XXX.XXX, Duplicate Phase 1 packet detected. Retransmitting last packet.
Start Free Trial
