ASA VPN - IKE lost contact with remote peer, deleting connection

Also - check to make sure you have the attributes matched.

Example: if you are using pfs - make sure they match.

Config for our end:

object-group network REMOTENETWORK
 network-object 215.12.34.0 255.255.255.0
 
access-list outside_cryptomap_100 extended permit ip 10.88.88.96 255.255.255.240 object-group REMOTENETWORK 
access-list outside_cryptomap_100 extended permit ip 10.88.88.128 255.255.255.224 object-group REMOTENETWORK 
 
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac 
 
crypto map outside_map 100 match address outside_cryptomap_100
crypto map outside_map 100 set peer 111.111.111.111 
crypto map outside_map 100 set transform-set ESP-3DES-SHA
 
tunnel-group 111.111.111.111 type ipsec-l2l
tunnel-group 111.111.111.111 ipsec-attributes
 pre-shared-key SECRETKEY

                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:

The remote endpoint is a Microsoft ISA server.

Below is a common setup I use:


access-list Outside_1_cryptomap extended permit ip object-group 192.168.0.0 255.255.255.0 192.168.20.0 255.255.255.0

crypto map Outside_map 1 match address Outside_1_cryptomap
crypto map Outside_map 1 set pfs --> will need to be removed because I don't believe that ISa will support pfs
crypto map Outside_map 1 set peer x.x.x.x
crypto map Outside_map 1 set transform-set ESP-3DES-MD5 --> consider using MDS instead of sha as again not sure the isa supports sha
crypto map Outside_map interface Outside

Not sure what you have set for your ike pieces.
crypto isakmp enable Outside
crypto isakmp policy 30
 authentication pre-share
 encryption 3des
 hash md5
 group 2
 lifetime 86400

tunnel-group x.x.x.x type ipsec-l2l
tunnel-group x.x.x.x ipsec-attributes
 pre-shared-key *


Make sure you have all of these pieces also make sure your protocol match on both ends and the keys. I have never attempted a VPN to an ISA server many reason for that but are you sure the ISA supports sha?

Good Luck,

3nerds

I've just been informed that the remote endpoint is not an ISA server, but a Watchguard X750e firewall (10.2 firmware).  Ah, the joys of dealing with VPNs in a global environemnt with remote offices that have never done any of this before. :-)

Not a watchguard person so I don't know that this changes anything for me. Have you checked that I have listed above?

Regards,

3nerds

3nerds;we have all those ocmponents in place in our config.

We have some logs from the remote server now:

11:08:36 iked Drop negotiation to peer 203.39.210.20:500 due to phase 1 retry timeout msg_id="0203-5161"             Debug
11:08:40 iked WARNING: Mismatched ID settings at peer 203.39.210.20:500 caused an authentication failure msg_id="0203-5156"      Debug
11:08:40 iked  Process 5/6 Msg : failed to process ID payload              Debug



11:17:00 iked  Process 5/6 Msg : failed to process ID payload 4           Debug
11:17:00 iked  Process INFO_EXCHANGE : EncryptBit set before SA created              Debug
11:17:00 iked Cannot process the inform message from 203.39.210.20:500 to 194.72.181.82 cookies i=9a3397be 0547688f r=1665ee71 2185bf5c msg_id="0203-5059"       Debug


All the settings look like they match, does that give anyone a clue what we need to doublecheck?

Screenshots of remote Watchguard config for phase 1 and 2:

http://www.infinitemonkeyproductions.net/wow_forum/watchguard1.jpg
http://www.infinitemonkeyproductions.net/wow_forum/watchguard2.jpg

Please post your IKE config from the ASA.

Regards,

3nerds

Just as an fyi the only things that I can find related to those errors is related to either wrong PSK on one end or them being to long. Any possibility of shortening them to something simple for testing.

Also the debug logs of this attempt would appreciated.

3nerds

IKE details from our end:

isakmp enable outside
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption aes-256
isakmp policy 10 hash sha
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
isakmp policy 30 authentication pre-share
isakmp policy 30 encryption aes-256
isakmp policy 30 hash sha
isakmp policy 30 group 5
isakmp policy 30 lifetime 86400
isakmp policy 50 authentication pre-share
isakmp policy 50 encryption 3des
isakmp policy 50 hash sha
isakmp policy 50 group 2
isakmp policy 50 lifetime 86400
isakmp nat-traversal  20

I'll doublecheck the Pre-shared key, although if it mismatched I'd expect it to fail early on before exchanging information.  By "too long" do you mean there may be too many characters in the PSK?

 

By "too long" do you mean there may be too many characters in the PSK? --> Yes I don't know of a specific bug but had read other places that it caused problems, then again could of been they just had a typo in the long key.


Your Phase one and Phase 2 appear to match as well:

PIX: isakmp policy 50 authentication pre-share
isakmp policy 50 encryption 3des
isakmp policy 50 hash sha
isakmp policy 50 group 2
isakmp policy 50 lifetime 86400

Matches:

Watchguard: SHA1, 3DES and Group2

Any other logs to look at? If you want to turn debug off to start so we can see some cleaner logs that works for me.

Have you tried to turn off DPD on the watchguard, we see these messages in the log above "Sending keep-alive of type DPD R-U-THERE " I wonder if there is a conflict in the RFC of DPD between the Cisco and the watch guard?

Regards,

3nerds