Solved

Problem with vpn between Cisco ASA 5510 and Cyberoam CR100i

Posted on 2009-05-13
8
5,108 Views
Last Modified: 2012-05-06
Hello Experts
I want to configure vpn between Cisco ASA and Cyberoam cr100i firewall. I have Static IP on Cisco ASA site, and dynamic IP on cyberoam site. I have tried to configure as per cisco's static-to dynamic configuration. But dint got success. Cyberoam also supports Dynamic dns, but for asa i am not sure, whether the vpn can be done on dynamic dns or not. My running confiugration is this.

Interfac Details:
Cisco ASA WAN: Static 83.xxx.xxx.146
Cisco ASA LAN: 10.100.1.254/24

Cyberoam WAN: Dynamic (PPPoE)
Cyberoam LAN: 192.168.5.75/24

Vpn configuration done in consideration of Main Mode.

ciscoasa# show run
: Saved
:
ASA Version 7.2(3)
!
hostname ciscoasa
domain-name default.domain.invalid
enable password P@SSWORD encrypted
names
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 10.100.1.254 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 83.XXX.XXX.146 255.255.255.240
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd 2KFQnbNIdI.2KYOU encrypted
boot system disk0:/asa723-k8.bin
ftp mode passive
dns server-group DefaultDNS
 domain-name default.domain.invalid
access-list outside_access_in extended permit tcp any host 83.xxx.xx.147 eq www
inactive
access-list outside_access_in extended permit tcp any host 83.xxx.xx.147 eq ftp-
data
access-list outside_access_in extended permit tcp any host 83.xxx.xx.147 eq ftp
access-list omnixauhvpn_splitTunnelAcl standard permit 10.100.1.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 10.100.1.0 255.255.255.0 172.16.1.0 255.255.255.224
access-list outside_nat0_outbound extended permit ip 10.100.1.0 255.255.255.0 192.168.5.0 255.255.255.0
access-list outside_1_cryptomap extended permit ip 10.100.1.0 255.255.255.0 192.168.5.0 255.255.255.0
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
ip local pool vpn-pool 172.16.1.1-172.16.1.20 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-523.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) 83.xxx.xx.147 10.100.1.10 netmask 255.255.255.255
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 83.111.50.145 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
http server enable
http 172.16.1.0 255.255.255.0 inside
http 10.100.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set asatocr_trset esp-des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 set pfs
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-DES-MD5
crypto dynamic-map asatocr_dmap 19 set transform-set asatocr_trset
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set pfs
crypto map outside_map 1 set peer 217.165.128.65
crypto map outside_map 1 set transform-set ESP-DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map maptocr 2 ipsec-isakmp dynamic asatocr_dmap
crypto map maptocr interface outside
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption des
 hash md5
 group 2
 lifetime 86400
crypto isakmp policy 13
 authentication pre-share
 encryption des
 hash md5
 group 2
 lifetime 3600
crypto isakmp nat-traversal  20
telnet 10.100.1.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
management-access inside
dhcp-client client-id interface inside
dhcpd auto_config outside
!

!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
group-policy omnixauhvpn internal
group-policy omnixauhvpn attributes
 dns-server value 10.100.1.10
 vpn-tunnel-protocol IPSec
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value omnixauhvpn_splitTunnelAcl
 default-domain value gsis.omnix.ae

USERS INFO DELETED


tunnel-group DefaultRAGroup ipsec-attributes
 pre-shared-key *
tunnel-group omnixauhvpn type ipsec-ra
tunnel-group omnixauhvpn general-attributes
 address-pool vpn-pool
 default-group-policy omnixauhvpn
tunnel-group omnixauhvpn ipsec-attributes
 pre-shared-key *
tunnel-group promedia.gotdns.com type ipsec-l2l
tunnel-group promedia.gotdns.com ipsec-attributes
 pre-shared-key *
tunnel-group 86.98.10.177 type ipsec-l2l
tunnel-group 86.98.10.177 ipsec-attributes
 pre-shared-key *
tunnel-group 86.98.66.132 type ipsec-l2l
tunnel-group 86.98.66.132 ipsec-attributes
 pre-shared-key *
prompt hostname context
Cryptochecksum:5084c0025700ebb0eabd8010385cab6b
: end
ciscoasa#

And my debug output:

ciscoasa(config)# May 13 01:20:14 [IKEv1]: IP = 86.98.66.132, Received encrypted
 packet with no matching SA, dropping
May 13 01:20:16 [IKEv1]: IP = 86.98.66.132, Received encrypted packet with no ma
tching SA, dropping
May 13 01:20:26 [IKEv1]: IP = 86.98.66.132, Received encrypted packet with no ma
tching SA, dropping
May 13 01:20:46 [IKEv1]: IP = 86.98.66.132, Received encrypted packet with no ma
tching SA, dropping
May 13 01:20:54 [IKEv1]: IP = 86.98.66.132, Received encrypted packet with no ma
tching SA, dropping
May 13 01:21:03 [IKEv1]: IP = 86.98.66.132, Received encrypted packet with no ma
tching SA, dropping

I have gone through following link,
http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a00807e0aca.shtml
But not found success, i hav tried many other configuration like changing sequence number of dynamic map and other stuffs.

I have tried this link for sonicwall to cisco connectivity with main mode and aggressive mode.
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a008052c9d4.shtml#configs

but still problem remains exists.

And one more thing i would like to add, myASA does not support 3DES-AES encryption.

If any body have idea about configuration between Cyberoam-Cisco using dynamic dns, then also welcomed.

Any help would be appreciated.

Thanks in advance.

mudresh
0
Comment
Question by:pnpking
  • 5
  • 3
8 Comments
 
LVL 5

Accepted Solution

by:
ksims1129 earned 500 total points
ID: 24373699
add the following lines to the configuation of the ASA

tunnel-group DefaultL2LGroup ipsec-attributes
 pre-shared-key keyfordynamicVPNterminations

On the Cyberoam device add the keyfordynamicVPNterminations to the VPN policy associated with the the ASA

I dont know if the cyberoam device supports dynamic L2L vpn tunnels

Hope this helps
0
 

Author Comment

by:pnpking
ID: 24382176
Hello Ksims1129

Thanks for immediate response, I have configured this option in my firewall and found following output. Ih had changed some configuration, now Phase 1 is shows completed but it shows in phase 2 this error

May 13 22:06:39 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, All IPSec SA proposals found unacceptable!

And Cyber Oam configuration is like this:

CYBEROAM CONFIGURATION:

VPN Policy  
Policy Name*  CR_2_PIX  
Description  
Keying Method*  Automatic  
Allow Re-keying*  Yes  
Key Negotation Tries*  3  
Authentication Mode*  Main Mode  
Pass Data In Compressed Format*  Yes  
Perfect Forward Secrecy (PFS)*  Yes  
   
Phase 1  
Encryption Algorithm*  DES  Authentication Algorithm*  MD5  
DH Group (Key Group)*  2 (DH1024)  
Key Life*  3600  
Rekey Margin*  120 Seconds  
Randomize Re-Keying Margin By*  0 %  
Enable Dead Peer Detection  Yes  
Check Peer After Every  30 Seconds  
Wait For Response Upto  120 Seconds  
Action When Peer Is Not Active  Clear  
   
Phase 2  
Encryption Algorithm*  DES  Authentication Algorithm*  MD5  
PFS Group (DH Group)*  Same as Phase-I  
Key Life*  3600 Seconds  

Here I am pasting the configuartion and debug output of the firewall (Request to check once for specifically CRYPTO MAP configuration and ACCESS LIST configuration). which may help you to find out the error. If there is any error in my existing configuration then you please suggest me preffered configuration for this setup.  

Running config and Debug output:


*********RUNNING CONFIG OF FIREWALL**************
 

ciscoasa(config)# show run
: Saved
:
ASA Version 7.2(3)
!
hostname ciscoasa
domain-name default.domain.invalid
enable password password encrypted
names
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 10.100.1.254 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 83.xxx.xxx.146 255.255.255.240
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd 2KFQnbNIdI.2KYOU encrypted
boot system disk0:/asa723-k8.bin
ftp mode passive
dns server-group DefaultDNS
 domain-name default.domain.invalid
access-list outside_access_in extended permit tcp any host 83.xxx.xx.147 eq www inactive
access-list outside_access_in extended permit tcp any host 83.xxx.xx.147 eq ftp-data
access-list outside_access_in extended permit tcp any host 83.xxx.xx.147 eq ftp
access-list omnixauhvpn_splitTunnelAcl standard permit 10.100.1.0 255.255.255.0
access-list inside_nat0_inbound extended permit ip 10.100.1.0 255.255.255.0 192.168.5.0 255.255.255.0
access-list outside_1_cryptomap extended permit ip 10.100.1.0 255.255.255.0 192.168.5.0 255.255.255.0
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
ip local pool vpn-pool 172.16.1.1-172.16.1.20 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-523.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_inbound
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) 83.xxx.xx.147 10.100.1.10 netmask 255.255.255.255
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 83.xxx.xx.145 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
http server enable
http 10.100.1.0 255.255.255.0 inside
http 172.16.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set asatocr_trset esp-des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 set pfs
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-DES-MD5
crypto dynamic-map asatocr_dmap 19 set transform-set asatocr_trset
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set pfs
crypto map outside_map 1 set peer 217.165.128.65
crypto map outside_map 1 set transform-set ESP-DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map maptocr 2 ipsec-isakmp dynamic asatocr_dmap
crypto map maptocr interface outside
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption des
 hash md5
 group 2
 lifetime 86400
crypto isakmp policy 13
 authentication pre-share
 encryption des
 hash md5
 group 2
 lifetime 3600
telnet 10.100.1.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
management-access inside
dhcp-client client-id interface inside
dhcpd auto_config outside
!

!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
group-policy omnixauhvpn internal
group-policy omnixauhvpn attributes
 dns-server value 10.100.1.10
 vpn-tunnel-protocol IPSec
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value omnixauhvpn_splitTunnelAcl
 default-domain value gsis.omnix.ae

USER INFO DELETED


tunnel-group DefaultL2LGroup ipsec-attributes
 pre-shared-key *
tunnel-group omnixauhvpn type ipsec-ra
tunnel-group omnixauhvpn general-attributes
 address-pool vpn-pool
 default-group-policy omnixauhvpn
tunnel-group omnixauhvpn ipsec-attributes
 pre-shared-key *
tunnel-group promedia.gotdns.com type ipsec-l2l
tunnel-group promedia.gotdns.com ipsec-attributes
 pre-shared-key *
prompt hostname context
Cryptochecksum:8ec8f70bb3096cdf3a0087107cd020ee
: end

ciscoasa(config)#

 


*********DEBUGGING OUTPUT OF FIREWALL**************

DEBUGGING OF THE ASA FIREWALL AFTER CHANGING CONFIGURATION:



ciscoasa(config)#

----OUTPUT CUT-----
ce 2c 14 43 7f 99 59 1e 17 e5 47 71                |  .,.C.Y...Gq

 RECV PACKET from 86.98.64.17
ISAKMP Header
  Initiator COOKIE: ee 9c 2d be ea 52 d1 4e
  Responder COOKIE: ec 7e 2b 2e 4e 57 a9 15
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Quick Mode
  Flags: (Encryption)
  MessageID: 7DDF94C0
  Length: 284
May 13 22:04:53 [IKEv1]: IP = 86.98.64.17, Received encrypted packet with no matching SA, dropping


ciscoasa(config)#

IKE Recv RAW packet dump
ea fb 64 63 6d ae 73 cd 00 00 00 00 00 00 00 00    |  ..dcm.s.........
----OUTPUT CUT-----
ec 42 7b 1f 00 00 00 14 44 85 15 2d 18 b6 bb cd    |  .B{.....D..-....
0b e8 a8 46 95 79 dd cc                            |  ...F.y..

 RECV PACKET from 86.98.64.17
ISAKMP Header
  Initiator COOKIE: ea fb 64 63 6d ae 73 cd
  Responder COOKIE: 00 00 00 00 00 00 00 00
  Next Payload: Security Association
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (none)
  MessageID: 00000000
  Length: 200
  Payload Security Association
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 52
    DOI: IPsec
    Situation:(SIT_IDENTITY_ONLY)
    Payload Proposal
      Next Payload: None
      Reserved: 00
      Payload Length: 40
      Proposal #: 0
      Protocol-Id: PROTO_ISAKMP
      SPI Size: 0
      # of transforms: 1
      Payload Transform
        Next Payload: None
        Reserved: 00
        Payload Length: 32
        Transform #: 0
        Transform-Id: KEY_IKE
        Reserved2: 0000
        Life Type: seconds
        Life Duration (Hex): 0e 10
        Encryption Algorithm: DES-CBC
        Hash Algorithm: MD5
        Authentication Method: Preshared key
        Group Description: Group 2
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      cd 60 46 43 35 df 21 f8 7c fd b2 fc 68 b6 a4 48
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 7b 1f
  Payload Vendor ID
    Next Payload: None
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 dd cc
May 13 22:05:07 [IKEv1]: IP = 86.98.64.17, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) +

VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 200
May 13 22:05:07 [IKEv1 DEBUG]: IP = 86.98.64.17, processing SA payload
May 13 22:05:07 [IKEv1 DEBUG]: IP = 86.98.64.17, Oakley proposal is acceptable
May 13 22:05:07 [IKEv1 DEBUG]: IP = 86.98.64.17, processing VID payload
May 13 22:05:07 [IKEv1 DEBUG]: IP = 86.98.64.17, Received DPD VID
May 13 22:05:07 [IKEv1 DEBUG]: IP = 86.98.64.17, processing VID payload
May 13 22:05:07 [IKEv1 DEBUG]: IP = 86.98.64.17, Received NAT-Traversal RFC VID
May 13 22:05:07 [IKEv1 DEBUG]: IP = 86.98.64.17, processing VID payload
May 13 22:05:07 [IKEv1 DEBUG]: IP = 86.98.64.17, Received NAT-Traversal ver 03 VID
May 13 22:05:07 [IKEv1 DEBUG]: IP = 86.98.64.17, processing VID payload
May 13 22:05:07 [IKEv1 DEBUG]: IP = 86.98.64.17, processing VID payload
May 13 22:05:07 [IKEv1 DEBUG]: IP = 86.98.64.17, Received NAT-Traversal ver 02 VID
May 13 22:05:07 [IKEv1 DEBUG]: IP = 86.98.64.17, processing VID payload
May 13 22:05:07 [IKEv1 DEBUG]: IP = 86.98.64.17, processing IKE SA payload
May 13 22:05:07 [IKEv1 DEBUG]: IP = 86.98.64.17, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 3
May 13 22:05:07 [IKEv1 DEBUG]: IP = 86.98.64.17, constructing ISAKMP SA payload
May 13 22:05:07 [IKEv1 DEBUG]: IP = 86.98.64.17, constructing Fragmentation VID + extended capabilities payload
May 13 22:05:07 [IKEv1]: IP = 86.98.64.17, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) +

NONE (0) total length : 104

SENDING PACKET to 86.98.64.17
ISAKMP Header
  Initiator COOKIE: ea fb 64 63 6d ae 73 cd
  Responder COOKIE: 35 19 32 a9 bf e1 39 1d
  Next Payload: Security Association
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (none)
  MessageID: 00000000
  Length: 104
  Payload Security Association
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 52
    DOI: IPsec
    Situation:(SIT_IDENTITY_ONLY)
    Payload Proposal
      Next Payload: None
      Reserved: 00
      Payload Length: 40
      Proposal #: 1
      Protocol-Id: PROTO_ISAKMP
      SPI Size: 0
      # of transforms: 1
      Payload Transform
        Next Payload: None
        Reserved: 00
        Payload Length: 32
        Transform #: 0
        Transform-Id: KEY_IKE
        Reserved2: 0000
        Encryption Algorithm: DES-CBC
        Hash Algorithm: MD5
        Group Description: Group 2
        Authentication Method: Preshared key
        Life Type: seconds
        Life Duration (Hex): 0e 10
  Payload Vendor ID
    Next Payload: None
    Reserved: 00
    Payload Length: 24
    Data (In Hex):
      40 48 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 c2 d3
      c0 00 00 00


IKE Recv RAW packet dump
ea fb 64 63 6d ae 73 cd 35 19 32 a9 bf e1 39 1d    |  ..dcm.s.5.2...9.
----OUTPUT CUT-----
00 00 00 14 53 ba dd 69 f9 e0 ab 98 27 e0 a1 bf    |  ....S..i....'...
95 0a 7a bf                                        |  ..z.

 RECV PACKET from 86.98.64.17
ISAKMP Header
  Initiator COOKIE: ea fb 64 63 6d ae 73 cd
  Responder COOKIE: 35 19 32 a9 bf e1 39 1d
  Next Payload: Key Exchange
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (none)
  MessageID: 00000000
  Length: 180
  Payload Key Exchange
    Next Payload: Nonce
    Reserved: 00
    Payload Length: 132
    Data:
      52 af 66 77 b0 71 9a c6 74 29 9c 2a ca 0b f9 c0
----OUTPUT CUT-----
      9b e3 8b 33 76 bb 7f 4d 17 fe 74 39 f0 1e e3 87
      6c 5e 05 15 79 92 f7 0d b6 a4 81 a1 40 83 68 5b
      6b 9e 9d dc c9 e0 f3 11 1f be d1 9a 5b cc e8 77
  Payload Nonce
    Next Payload: None
    Reserved: 00
    Payload Length: 20
    Data:
      53 ba dd 69 f9 e0 ab 98 27 e0 a1 bf 95 0a 7a bf
May 13 22:05:07 [IKEv1]: IP = 86.98.64.17, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) +

NONE (0) total length : 180
May 13 22:05:07 [IKEv1 DEBUG]: IP = 86.98.64.17, processing ke payload
May 13 22:05:07 [IKEv1 DEBUG]: IP = 86.98.64.17, processing ISA_KE payload
May 13 22:05:07 [IKEv1 DEBUG]: IP = 86.98.64.17, processing nonce payload
May 13 22:05:07 [IKEv1 DEBUG]: IP = 86.98.64.17, constructing ke payload
May 13 22:05:07 [IKEv1 DEBUG]: IP = 86.98.64.17, constructing nonce payload
May 13 22:05:07 [IKEv1 DEBUG]: IP = 86.98.64.17, constructing Cisco Unity VID payload
May 13 22:05:07 [IKEv1 DEBUG]: IP = 86.98.64.17, constructing xauth V6 VID payload
May 13 22:05:07 [IKEv1 DEBUG]: IP = 86.98.64.17, Send IOS VID
May 13 22:05:07 [IKEv1 DEBUG]: IP = 86.98.64.17, Constructing ASA spoofing IOS Vendor ID payload (version: 1.0.0,

capabilities: 20000001)
May 13 22:05:07 [IKEv1 DEBUG]: IP = 86.98.64.17, constructing VID payload
May 13 22:05:07 [IKEv1 DEBUG]: IP = 86.98.64.17, Send Altiga/Cisco VPN3000/Cisco ASA GW VID
May 13 22:05:07 [IKEv1]: IP = 86.98.64.17, Connection landed on tunnel_group DefaultL2LGroup
May 13 22:05:07 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, Generating keys for Responder...
May 13 22:05:07 [IKEv1]: IP = 86.98.64.17, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) +

VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 256

SENDING PACKET to 86.98.64.17
ISAKMP Header
  Initiator COOKIE: ea fb 64 63 6d ae 73 cd
  Responder COOKIE: 35 19 32 a9 bf e1 39 1d
  Next Payload: Key Exchange
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (none)
  MessageID: 00000000
  Length: 256
  Payload Key Exchange
    Next Payload: Nonce
    Reserved: 00
    Payload Length: 132
    Data:
      97 0a 57 40 45 50 b9 f2 92 2f f5 e7 6b 89 37 6d
----OUTPUT CUT-----
 
      5d 81 3d d9 22 d5 59 f8 06 07 dc 08 d8 2b ae 99
  Payload Nonce
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 24
    Data:
      38 16 62 bb 23 f0 38 26 72 30 0c bd 17 dd 33 73
      f2 cb 76 86
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      12 f5 f2 8c 45 71 68 a9 70 2d 9f e2 74 cc 01 00
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 12
    Data (In Hex): 09 00 26 89 df d6 b7 12
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      c0 de 95 b4 bf e0 39 1d bc 1a 63 89 53 01 44 39
  Payload Vendor ID
    Next Payload: None
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      1f 07 f7 0e aa 65 14 d3 b0 fa 96 54 2a 50 01 00


IKE Recv RAW packet dump
ea fb 64 63 6d ae 73 cd 35 19 32 a9 bf e1 39 1d    |  ..dcm.s.5.2...9.
----OUTPUT CUT-----
2c 0d fd 4a 60 63 80 51 5e 8b 5f cf                |  ,..J`c.Q^._.

 RECV PACKET from 86.98.64.17
ISAKMP Header
  Initiator COOKIE: ea fb 64 63 6d ae 73 cd
  Responder COOKIE: 35 19 32 a9 bf e1 39 1d
  Next Payload: Identification
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (Encryption)
  MessageID: 00000000
  Length: 60

AFTER DECRYPTION
ISAKMP Header
  Initiator COOKIE: ea fb 64 63 6d ae 73 cd
  Responder COOKIE: 35 19 32 a9 bf e1 39 1d
  Next Payload: Identification
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (Encryption)
  MessageID: 00000000
  Length: 60
  Payload Identification
    Next Payload: Hash
    Reserved: 00
    Payload Length: 12
    ID Type: IPv4 Address (1)
    Protocol ID (UDP/TCP, etc...): 0
    Port: 0
    ID Data: 86.98.64.17
  Payload Hash
    Next Payload: None
    Reserved: 00
    Payload Length: 20
    Data:
      3b a4 e5 d1 6e 04 27 49 5f f0 ad ff 7e a9 14 77
May 13 22:05:08 [IKEv1]: IP = 86.98.64.17, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) +

NONE (0) total length : 60
May 13 22:05:08 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing ID payload
May 13 22:05:08 [IKEv1 DECODE]: Group = DefaultL2LGroup, IP = 86.98.64.17, ID_IPV4_ADDR ID received
86.98.64.17
May 13 22:05:08 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing hash payload
May 13 22:05:08 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, Computing hash for ISAKMP
May 13 22:05:08 [IKEv1]: IP = 86.98.64.17, Connection landed on tunnel_group DefaultL2LGroup
May 13 22:05:08 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, Freeing previously allocated memory for

authorization-dn-attributes
May 13 22:05:08 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing ID payload
May 13 22:05:08 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing hash payload
May 13 22:05:08 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, Computing hash for ISAKMP
May 13 22:05:08 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing dpd vid payload
May 13 22:05:08 [IKEv1]: IP = 86.98.64.17, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) +

VENDOR (13) + NONE (0) total length : 80

BEFORE ENCRYPTION
RAW PACKET DUMP on SEND
ea fb 64 63 6d ae 73 cd 35 19 32 a9 bf e1 39 1d    |  ..dcm.s.5.2...9.
05 10 02 00 00 00 00 00 1c 00 00 00 08 00 00 0c    |  ................
01 11 01 f4 53 6f 32 92 0d 00 00 14 01 4c 56 22    |  ....So2......LV"
84 46 41 47 16 59 89 0f a8 78 86 5c 00 00 00 14    |  .FAG.Y...x.\....
af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00    |  ....h...k...wW..

ISAKMP Header
  Initiator COOKIE: ea fb 64 63 6d ae 73 cd
  Responder COOKIE: 35 19 32 a9 bf e1 39 1d
  Next Payload: Identification
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (none)
  MessageID: 00000000
  Length: 469762048
  Payload Identification
    Next Payload: Hash
    Reserved: 00
    Payload Length: 12
    ID Type: IPv4 Address (1)
    Protocol ID (UDP/TCP, etc...): 17
    Port: 500
    ID Data: 83.xxx.xx.146
  Payload Hash
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data:
      01 4c 56 22 84 46 41 47 16 59 89 0f a8 78 86 5c
  Payload Vendor ID
    Next Payload: None
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00

SENDING PACKET to 86.98.64.17
ISAKMP Header
  Initiator COOKIE: ea fb 64 63 6d ae 73 cd
  Responder COOKIE: 35 19 32 a9 bf e1 39 1d
  Next Payload: Identification
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (Encryption)
  MessageID: 00000000
  Length: 84
May 13 22:05:08 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, PHASE 1 COMPLETED
May 13 22:05:08 [IKEv1]: IP = 86.98.64.17, Keep-alive type for this connection: DPD
May 13 22:05:08 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, Starting P1 rekey timer: 2700 seconds.


IKE Recv RAW packet dump
ea fb 64 63 6d ae 73 cd 35 19 32 a9 bf e1 39 1d    |  ..dcm.s.5.2...9.
08 10 20 01 7d 7f f4 f5 00 00 01 1c 39 7e de 78    |  .. .}......9~.x
8e 66 4d 25 b6 27 56 9f 4c 5a 1b 5a 2a 7b 26 f6    |  .fM%.'V.LZ.Z*{&.
3c 1e c9 5c c3 9a 16 57 e8 7f eb db 82 cb b5 d6    |  <..\...W.......
3e 07 97 55 74 a5 60 ae e6 46 b4 ce 37 23 71 ad    |  >..Ut.`..F..7#q.
52 71 05 5e 9f 9e 24 70 25 8e 28 25 a3 7c 11 cd    |  Rq.^..$p%.(%.|..
87 71 53 e2 f5 5e fe 9b 6c 51 4e 66 b3 d0 2d 4d    |  .qS..^..lQNf..-M
52 52 ac 62 f0 c2 08 4f a8 6a e0 f6 e0 4e 2f 86    |  RR.b...O.j...N/.
6f 6d 73 84 b3 bf 26 37 db 05 fc f9 7e c8 e6 99    |  oms...&7....~...
09 8f c9 f4 38 4c c0 6f e2 2e 30 09 4d 7c 32 bb    |  ....8L.o..0.M|2.
d2 40 fb c3 5b 26 3c 1f 0a 32 16 28 74 9f c2 74    |  .@..[&<..2.(t..t
55 d4 51 4f c4 6d 8b 4a 6a 27 ec 15 5a 69 a3 bd    |  U.QO.m.Jj'..Zi..
cd e0 f3 ed 53 7e 1f 2e 55 f4 b3 ed 6e ee a0 f2    |  ....S~..U...n...
33 b4 4c 66 30 f1 b4 1c 88 67 17 04 ca af a3 f6    |  3.Lf0....g......
31 6e be 53 b8 7f a7 c4 b9 0c dd b6 35 7a 42 62    |  1n.S.......5zBb
6c 6a 25 3a 07 7d 96 4e 08 f6 b8 ad a2 4f e0 91    |  lj%:.}.N.....O..
6b 07 c3 fb be 4d 73 7d d9 6b 58 ed aa ba e1 ad    |  k....Ms}.kX.....
57 09 d2 34 16 98 1c 6f eb 4d 1e 1d                |  W..4...o.M..

 RECV PACKET from 86.98.64.17
ISAKMP Header
  Initiator COOKIE: ea fb 64 63 6d ae 73 cd
  Responder COOKIE: 35 19 32 a9 bf e1 39 1d
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Quick Mode
  Flags: (Encryption)
  MessageID: 7D7FF4F5
  Length: 284
May 13 22:05:08 [IKEv1 DECODE]: IP = 86.98.64.17, IKE Responder starting QM: msg id = 7d7ff4f5

AFTER DECRYPTION
ISAKMP Header
  Initiator COOKIE: ea fb 64 63 6d ae 73 cd
  Responder COOKIE: 35 19 32 a9 bf e1 39 1d
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Quick Mode
  Flags: (Encryption)
  MessageID: 7D7FF4F5
  Length: 284
  Payload Hash
    Next Payload: Security Association
    Reserved: 00
    Payload Length: 20
    Data:
      37 30 8e 77 f2 27 b8 db ce ea 35 ce 92 f2 c2 ae
  Payload Security Association
    Next Payload: Nonce
    Reserved: 00
    Payload Length: 52
    DOI: IPsec
    Situation:(SIT_IDENTITY_ONLY)
    Payload Proposal
      Next Payload: None
      Reserved: 00
      Payload Length: 40
      Proposal #: 0
      Protocol-Id: PROTO_IPSEC_ESP
      SPI Size: 4
      # of transforms: 1
      SPI: f8 77 5d 34
      Payload Transform
        Next Payload: None
        Reserved: 00
        Payload Length: 28
        Transform #: 0
        Transform-Id: ESP_DES
        Reserved2: 0000
        Group Description: Group 2
        Encapsulation Mode: Tunnel
        Life Type: Seconds
        Life Duration (Hex): 0e 10
        Authentication Algorithm: MD5
  Payload Nonce
    Next Payload: Key Exchange
    Reserved: 00
    Payload Length: 20
    Data:
      e0 72 43 b5 8c 9f 01 13 6b 20 cc c2 5e 00 93 94
  Payload Key Exchange
    Next Payload: Identification
    Reserved: 00
    Payload Length: 132
    Data:
      3b 9a 81 1f 99 00 5d 89 e8 13 40 78 60 e2 b1 ea
      e9 ad 83 65 7e 8a 83 c9 49 f9 ac 76 2f 8b b8 0a
----OUTPUT CUT-----
      c6 d9 a4 fb 5b 46 90 60 eb eb 6d 9b c9 78 fe 76
  Payload Identification
    Next Payload: Identification
    Reserved: 00
    Payload Length: 16
    ID Type: IPv4 Subnet (4)
    Protocol ID (UDP/TCP, etc...): 0
    Port: 0
    ID Data: 192.168.5.0/255.255.255.0
  Payload Identification
    Next Payload: None
    Reserved: 00
    Payload Length: 16
    ID Type: IPv4 Subnet (4)
    Protocol ID (UDP/TCP, etc...): 0
    Port: 0
    ID Data: 10.100.1.0/255.255.255.0
May 13 22:05:08 [IKEv1]: IP = 86.98.64.17, IKE_DECODE RECEIVED Message (msgid=7d7ff4f5) with payloads : HDR + HASH (8) + SA

(1) + NONCE (10) + KE (4) + ID (5) + ID (5) + NONE (0) total length : 284
May 13 22:05:08 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing hash payload
May 13 22:05:08 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing SA payload
May 13 22:05:08 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing nonce payload
May 13 22:05:08 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing ke payload
May 13 22:05:08 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing ISA_KE for PFS in phase 2
May 13 22:05:08 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing ID payload
May 13 22:05:08 [IKEv1 DECODE]: Group = DefaultL2LGroup, IP = 86.98.64.17, ID_IPV4_ADDR_SUBNET ID

received--192.168.5.0--255.255.255.0
May 13 22:05:08 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, Received remote IP Proxy Subnet data in ID Payload:  

Address 192.168.5.0, Mask 255.255.255.0, Protocol 0, Port 0
May 13 22:05:08 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing ID payload
May 13 22:05:08 [IKEv1 DECODE]: Group = DefaultL2LGroup, IP = 86.98.64.17, ID_IPV4_ADDR_SUBNET ID

received--10.100.1.0--255.255.255.0
May 13 22:05:08 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, Received local IP Proxy Subnet data in ID Payload:  

Address 10.100.1.0, Mask 255.255.255.0, Protocol 0, Port 0
May 13 22:05:08 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, QM IsRekeyed old sa not found by addr
May 13 22:05:08 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, Static Crypto Map check, checking map = maptocr, seq =

1...
May 13 22:05:08 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, Static Crypto Map check, map = maptocr, seq = 1, no ACL

configured
May 13 22:05:08 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, IKE Remote Peer configured for crypto map: asatocr_dmap
May 13 22:05:08 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing IPSec SA payload
May 13 22:05:08 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, All IPSec SA proposals found unacceptable!
May 13 22:05:08 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, sending notify message
May 13 22:05:08 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing blank hash payload
May 13 22:05:08 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing ipsec notify payload for msg id

7d7ff4f5
May 13 22:05:08 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing qm hash payload
May 13 22:05:08 [IKEv1]: IP = 86.98.64.17, IKE_DECODE SENDING Message (msgid=9aa98e93) with payloads : HDR + HASH (8) +

NOTIFY (11) + NONE (0) total length : 80

BEFORE ENCRYPTION
RAW PACKET DUMP on SEND
ea fb 64 63 6d ae 73 cd 35 19 32 a9 bf e1 39 1d    |  ..dcm.s.5.2...9.
08 10 05 00 93 8e a9 9a 1c 00 00 00 0b 00 00 14    |  ................
55 d1 e7 16 6b 36 53 a8 d8 b4 ac 47 53 5a 7b a7    |  U...k6S....GSZ{.
00 00 00 20 00 00 00 01 03 10 00 0e ea fb 64 63    |  ... ..........dc
6d ae 73 cd 35 19 32 a9 bf e1 39 1d 7d 7f f4 f5    |  m.s.5.2...9.}..

ISAKMP Header
  Initiator COOKIE: ea fb 64 63 6d ae 73 cd
  Responder COOKIE: 35 19 32 a9 bf e1 39 1d
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Informational
  Flags: (none)
  MessageID: 938EA99A
  Length: 469762048
  Payload Hash
    Next Payload: Notification
    Reserved: 00
    Payload Length: 20
    Data:
      55 d1 e7 16 6b 36 53 a8 d8 b4 ac 47 53 5a 7b a7
  Payload Notification
    Next Payload: None
    Reserved: 00
    Payload Length: 32
    DOI: IPsec
    Protocol-ID: PROTO_IPSEC_ESP
    Spi Size: 16
    Notify Type: NO_PROPOSAL_CHOSEN
    SPI:
      ea fb 64 63 6d ae 73 cd 35 19 32 a9 bf e1 39 1d
    Data: 7d 7f f4 f5

ISAKMP Header
  Initiator COOKIE: ea fb 64 63 6d ae 73 cd
  Responder COOKIE: 35 19 32 a9 bf e1 39 1d
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Informational
  Flags: (Encryption)
  MessageID: 9AA98E93
  Length: 84
May 13 22:05:08 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, QM FSM error (P2 struct &0x3a4cf10, mess id 0x7d7ff4f5)!
May 13 22:05:08 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, IKE QM Responder FSM error history (struct

&0x3a4cf10)  <state>, <event>:  QM_DONE, EV_ERROR-->QM_BLD_MSG2, EV_NEGO_SA-->QM_BLD_MSG2, EV_IS_REKEY-->QM_BLD_MSG2,

EV_CONFIRM_SA-->QM_BLD_MSG2, EV_PROC_MSG-->QM_BLD_MSG2, EV_HASH_OK-->QM_BLD_MSG2, NullEvent-->QM_BLD_MSG2, EV_COMP_HASH
May 13 22:05:08 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, sending delete/delete with reason message
May 13 22:05:08 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, Removing peer from correlator table failed, no match!
May 13 22:05:08 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, Could not delete route for L2L peer that came in on a

dynamic map. address: 192.168.5.0, mask: 255.0.0.0
May 13 22:05:08 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, IKE SA MM:a9321935 rcv'd Terminate: state MM_ACTIVE

 flags 0x00000042, refcnt 1, tuncnt 0
May 13 22:05:08 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, IKE SA MM:a9321935 terminating:  flags 0x01000002,

refcnt 0, tuncnt 0
May 13 22:05:08 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, sending delete/delete with reason message
May 13 22:05:08 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing blank hash payload
May 13 22:05:08 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing IKE delete payload
May 13 22:05:08 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing qm hash payload
May 13 22:05:08 [IKEv1]: IP = 86.98.64.17, IKE_DECODE SENDING Message (msgid=839d6027) with payloads : HDR + HASH (8) +

DELETE (12) + NONE (0) total length : 76

BEFORE ENCRYPTION
RAW PACKET DUMP on SEND
ea fb 64 63 6d ae 73 cd 35 19 32 a9 bf e1 39 1d    |  ..dcm.s.5.2...9.
08 10 05 00 27 60 9d 83 1c 00 00 00 0c 00 00 14    |  ....'`..........
3f 93 d0 dd 5c 8e 94 e4 27 e1 ce 3c 9e ba 28 58    |  ?...\...'..<..(X
00 00 00 1c 00 00 00 01 01 10 00 01 ea fb 64 63    |  ..............dc
6d ae 73 cd 35 19 32 a9 bf e1 39 1d                |  m.s.5.2...9.

ISAKMP Header
  Initiator COOKIE: ea fb 64 63 6d ae 73 cd
  Responder COOKIE: 35 19 32 a9 bf e1 39 1d
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Informational
  Flags: (none)
  MessageID: 27609D83
  Length: 469762048
  Payload Hash
    Next Payload: Delete
    Reserved: 00
    Payload Length: 20
    Data:
      3f 93 d0 dd 5c 8e 94 e4 27 e1 ce 3c 9e ba 28 58
  Payload Delete
    Next Payload: None
    Reserved: 00
    Payload Length: 28
    DOI: IPsec
    Protocol-ID: PROTO_ISAKMP
    Spi Size: 16
    # of SPIs: 1
    SPI (Hex dump):
      ea fb 64 63 6d ae 73 cd 35 19 32 a9 bf e1 39 1d

ISAKMP Header
  Initiator COOKIE: ea fb 64 63 6d ae 73 cd
  Responder COOKIE: 35 19 32 a9 bf e1 39 1d
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Informational
  Flags: (Encryption)
  MessageID: 839D6027
  Length: 76


IKE Recv RAW packet dump
ea fb 64 63 6d ae 73 cd 35 19 32 a9 bf e1 39 1d    |  ..dcm.s.5.2...9.
08 10 05 01 c8 1c 41 7b 00 00 00 4c 51 24 9f f1    |  ......A{...LQ$..
81 4b 21 0f e6 9d ca 7c 06 b6 12 7f 1a a1 34 e1    |  .K!....|.....4.
7f 00 f0 12 b6 df a2 af c7 d9 eb e5 5e 81 60 14    |  ...........^.`.
8f 6c 5d f4 c8 05 7f 19 43 d8 05 76                |  .l]....C..v

 RECV PACKET from 86.98.64.17
ISAKMP Header
  Initiator COOKIE: ea fb 64 63 6d ae 73 cd
  Responder COOKIE: 35 19 32 a9 bf e1 39 1d
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Informational
  Flags: (Encryption)
  MessageID: C81C417B
  Length: 76
May 13 22:05:08 [IKEv1]: IP = 86.98.64.17, Received encrypted packet with no matching SA, dropping


IKE Recv RAW packet dump
ea fb 64 63 6d ae 73 cd 35 19 32 a9 bf e1 39 1d    |  ..dcm.s.5.2...9.
08 10 20 01 7d 7f f4 f5 00 00 01 1c 39 7e de 78    |  .. .}......9~.x
8e 66 4d 25 b6 27 56 9f 4c 5a 1b 5a 2a 7b 26 f6    |  .fM%.'V.LZ.Z*{&.
3c 1e c9 5c c3 9a 16 57 e8 7f eb db 82 cb b5 d6    |  <..\...W.......
3e 07 97 55 74 a5 60 ae e6 46 b4 ce 37 23 71 ad    |  >..Ut.`..F..7#q.
52 71 05 5e 9f 9e 24 70 25 8e 28 25 a3 7c 11 cd    |  Rq.^..$p%.(%.|..
87 71 53 e2 f5 5e fe 9b 6c 51 4e 66 b3 d0 2d 4d    |  .qS..^..lQNf..-M
52 52 ac 62 f0 c2 08 4f a8 6a e0 f6 e0 4e 2f 86    |  RR.b...O.j...N/.
6f 6d 73 84 b3 bf 26 37 db 05 fc f9 7e c8 e6 99    |  oms...&7....~...
09 8f c9 f4 38 4c c0 6f e2 2e 30 09 4d 7c 32 bb    |  ....8L.o..0.M|2.
d2 40 fb c3 5b 26 3c 1f 0a 32 16 28 74 9f c2 74    |  .@..[&<..2.(t..t
55 d4 51 4f c4 6d 8b 4a 6a 27 ec 15 5a 69 a3 bd    |  U.QO.m.Jj'..Zi..
cd e0 f3 ed 53 7e 1f 2e 55 f4 b3 ed 6e ee a0 f2    |  ....S~..U...n...
33 b4 4c 66 30 f1 b4 1c 88 67 17 04 ca af a3 f6    |  3.Lf0....g......
31 6e be 53 b8 7f a7 c4 b9 0c dd b6 35 7a 42 62    |  1n.S.......5zBb
6c 6a 25 3a 07 7d 96 4e 08 f6 b8 ad a2 4f e0 91    |  lj%:.}.N.....O..
6b 07 c3 fb be 4d 73 7d d9 6b 58 ed aa ba e1 ad    |  k....Ms}.kX.....
57 09 d2 34 16 98 1c 6f eb 4d 1e 1d                |  W..4...o.M..

 RECV PACKET from 86.98.64.17
ISAKMP Header
  Initiator COOKIE: ea fb 64 63 6d ae 73 cd
  Responder COOKIE: 35 19 32 a9 bf e1 39 1d
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Quick Mode
  Flags: (Encryption)
  MessageID: 7D7FF4F5
  Length: 284
May 13 22:05:18 [IKEv1]: IP = 86.98.64.17, Received encrypted packet with no matching SA, dropping


IKE Recv RAW packet dump
3d 8f 57 50 f8 1b c6 9a 00 00 00 00 00 00 00 00    |  =.WP............
01 10 02 00 00 00 00 00 00 00 00 c8 0d 00 00 34    |  ...............4
00 00 00 01 00 00 00 01 00 00 00 28 00 01 00 01    |  ...........(....
00 00 00 20 00 01 00 00 80 0b 00 01 80 0c 0e 10    |  ... ............
80 01 00 01 80 02 00 01 80 03 00 01 80 04 00 02    |  ................
0d 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc    |  ........h...k...
77 57 01 00 0d 00 00 14 4a 13 1c 81 07 03 58 45    |  wW......J.....XE
5c 57 28 f2 0e 95 45 2f 0d 00 00 14 7d 94 19 a6    |  \W(...E/....}...
53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 00 14    |  S..o,....R.V....
cd 60 46 43 35 df 21 f8 7c fd b2 fc 68 b6 a4 48    |  .`FC5.!.|...h..H
0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 81 b5    |  ........>.in.c..
ec 42 7b 1f 00 00 00 14 44 85 15 2d 18 b6 bb cd    |  .B{.....D..-....
0b e8 a8 46 95 79 dd cc                            |  ...F.y..

 RECV PACKET from 86.98.64.17
ISAKMP Header
  Initiator COOKIE: 3d 8f 57 50 f8 1b c6 9a
  Responder COOKIE: 00 00 00 00 00 00 00 00
  Next Payload: Security Association
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (none)
  MessageID: 00000000
  Length: 200
  Payload Security Association
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 52
    DOI: IPsec
    Situation:(SIT_IDENTITY_ONLY)
    Payload Proposal
      Next Payload: None
      Reserved: 00
      Payload Length: 40
      Proposal #: 0
      Protocol-Id: PROTO_ISAKMP
      SPI Size: 0
      # of transforms: 1
      Payload Transform
        Next Payload: None
        Reserved: 00
        Payload Length: 32
        Transform #: 0
        Transform-Id: KEY_IKE
        Reserved2: 0000
        Life Type: seconds
        Life Duration (Hex): 0e 10
        Encryption Algorithm: DES-CBC
        Hash Algorithm: MD5
        Authentication Method: Preshared key
        Group Description: Group 2
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      cd 60 46 43 35 df 21 f8 7c fd b2 fc 68 b6 a4 48
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 7b 1f
  Payload Vendor ID
    Next Payload: None
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 dd cc
May 13 22:05:19 [IKEv1]: IP = 86.98.64.17, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) +

VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 200
May 13 22:05:19 [IKEv1 DEBUG]: IP = 86.98.64.17, processing SA payload
May 13 22:05:19 [IKEv1 DEBUG]: IP = 86.98.64.17, Oakley proposal is acceptable
May 13 22:05:19 [IKEv1 DEBUG]: IP = 86.98.64.17, processing VID payload
May 13 22:05:19 [IKEv1 DEBUG]: IP = 86.98.64.17, Received DPD VID
May 13 22:05:19 [IKEv1 DEBUG]: IP = 86.98.64.17, processing VID payload
May 13 22:05:19 [IKEv1 DEBUG]: IP = 86.98.64.17, Received NAT-Traversal RFC VID
May 13 22:05:19 [IKEv1 DEBUG]: IP = 86.98.64.17, processing VID payload
May 13 22:05:19 [IKEv1 DEBUG]: IP = 86.98.64.17, Received NAT-Traversal ver 03 VID
May 13 22:05:19 [IKEv1 DEBUG]: IP = 86.98.64.17, processing VID payload
May 13 22:05:19 [IKEv1 DEBUG]: IP = 86.98.64.17, processing VID payload
May 13 22:05:19 [IKEv1 DEBUG]: IP = 86.98.64.17, Received NAT-Traversal ver 02 VID
May 13 22:05:19 [IKEv1 DEBUG]: IP = 86.98.64.17, processing VID payload
May 13 22:05:19 [IKEv1 DEBUG]: IP = 86.98.64.17, processing IKE SA payload
May 13 22:05:19 [IKEv1 DEBUG]: IP = 86.98.64.17, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 3
May 13 22:05:19 [IKEv1 DEBUG]: IP = 86.98.64.17, constructing ISAKMP SA payload
May 13 22:05:19 [IKEv1 DEBUG]: IP = 86.98.64.17, constructing Fragmentation VID + extended capabilities payload
May 13 22:05:19 [IKEv1]: IP = 86.98.64.17, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) +

NONE (0) total length : 104

SENDING PACKET to 86.98.64.17
ISAKMP Header
  Initiator COOKIE: 3d 8f 57 50 f8 1b c6 9a
  Responder COOKIE: 67 39 08 87 1a 0f 0a d1
  Next Payload: Security Association
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (none)
  MessageID: 00000000
  Length: 104
  Payload Security Association
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 52
    DOI: IPsec
    Situation:(SIT_IDENTITY_ONLY)
    Payload Proposal
      Next Payload: None
      Reserved: 00
      Payload Length: 40
      Proposal #: 1
      Protocol-Id: PROTO_ISAKMP
      SPI Size: 0
      # of transforms: 1
      Payload Transform
        Next Payload: None
        Reserved: 00
        Payload Length: 32
        Transform #: 0
        Transform-Id: KEY_IKE
        Reserved2: 0000
        Encryption Algorithm: DES-CBC
        Hash Algorithm: MD5
        Group Description: Group 2
        Authentication Method: Preshared key
        Life Type: seconds
        Life Duration (Hex): 0e 10
  Payload Vendor ID
    Next Payload: None
    Reserved: 00
    Payload Length: 24
    Data (In Hex):
      40 48 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 c2 d3
      c0 00 00 00


IKE Recv RAW packet dump
3d 8f 57 50 f8 1b c6 9a 67 39 08 87 1a 0f 0a d1    |  =.WP....g9......
04 10 02 00 00 00 00 00 00 00 00 b4 0a 00 00 84    |  ................
7c ae 97 b3 35 7d be d3 a2 93 4d b2 df 69 65 51    |  |...5}....M..ieQ
54 70 fe 69 79 3e f6 ed d0 89 7c c7 77 df 68 67    |  Tp.iy>....|.w.hg
ed 76 7b 1d 0f 10 22 24 34 97 5d 1c 7a b7 99 99    |  .v{..."$4.].z...
b4 f7 c4 e5 06 5d be 4a 45 de 4f 7c 4c 69 b4 d3    |  .....].JE.O|Li..
aa 34 03 ea fa 33 38 14 ce de 91 ca a8 38 f8 de    |  .4...38......8..
3d 7e 79 2f 60 43 e5 d2 e5 f4 f4 7a ac 50 6d fd    |  =~y/`C.....z.Pm.
81 a2 ac 09 4d b8 85 7b e9 6e df 3a ca 0e 7c 89    |  ....M..{.n.:..|.
8c 11 8a a6 c3 67 c0 65 9b 2b 5a c7 d4 ce ca 83    |  .....g.e.+Z.....
00 00 00 14 fe 3a 66 f9 1d f4 8c fa c6 ce 9e 79    |  .....:f........y
37 68 e2 f2                                        |  7h..

 RECV PACKET from 86.98.64.17
ISAKMP Header
  Initiator COOKIE: 3d 8f 57 50 f8 1b c6 9a
  Responder COOKIE: 67 39 08 87 1a 0f 0a d1
  Next Payload: Key Exchange
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (none)
  MessageID: 00000000
  Length: 180
  Payload Key Exchange
    Next Payload: Nonce
    Reserved: 00
    Payload Length: 132
    Data:
      7c ae 97 b3 35 7d be d3 a2 93 4d b2 df 69 65 51
      54 70 fe 69 79 3e f6 ed d0 89 7c c7 77 df 68 67
      ed 76 7b 1d 0f 10 22 24 34 97 5d 1c 7a b7 99 99
      b4 f7 c4 e5 06 5d be 4a 45 de 4f 7c 4c 69 b4 d3
      aa 34 03 ea fa 33 38 14 ce de 91 ca a8 38 f8 de
      3d 7e 79 2f 60 43 e5 d2 e5 f4 f4 7a ac 50 6d fd
      81 a2 ac 09 4d b8 85 7b e9 6e df 3a ca 0e 7c 89
      8c 11 8a a6 c3 67 c0 65 9b 2b 5a c7 d4 ce ca 83
  Payload Nonce
    Next Payload: None
    Reserved: 00
    Payload Length: 20
    Data:
      fe 3a 66 f9 1d f4 8c fa c6 ce 9e 79 37 68 e2 f2
May 13 22:05:19 [IKEv1]: IP = 86.98.64.17, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) +

NONE (0) total length : 180
May 13 22:05:19 [IKEv1 DEBUG]: IP = 86.98.64.17, processing ke payload
May 13 22:05:19 [IKEv1 DEBUG]: IP = 86.98.64.17, processing ISA_KE payload
May 13 22:05:19 [IKEv1 DEBUG]: IP = 86.98.64.17, processing nonce payload
May 13 22:05:19 [IKEv1 DEBUG]: IP = 86.98.64.17, constructing ke payload
May 13 22:05:19 [IKEv1 DEBUG]: IP = 86.98.64.17, constructing nonce payload
May 13 22:05:19 [IKEv1 DEBUG]: IP = 86.98.64.17, constructing Cisco Unity VID payload
May 13 22:05:19 [IKEv1 DEBUG]: IP = 86.98.64.17, constructing xauth V6 VID payload
May 13 22:05:19 [IKEv1 DEBUG]: IP = 86.98.64.17, Send IOS VID
May 13 22:05:19 [IKEv1 DEBUG]: IP = 86.98.64.17, Constructing ASA spoofing IOS Vendor ID payload (version: 1.0.0,

capabilities: 20000001)
May 13 22:05:19 [IKEv1 DEBUG]: IP = 86.98.64.17, constructing VID payload
May 13 22:05:19 [IKEv1 DEBUG]: IP = 86.98.64.17, Send Altiga/Cisco VPN3000/Cisco ASA GW VID
May 13 22:05:19 [IKEv1]: IP = 86.98.64.17, Connection landed on tunnel_group DefaultL2LGroup
May 13 22:05:19 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, Generating keys for Responder...
May 13 22:05:19 [IKEv1]: IP = 86.98.64.17, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) +

VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 256

SENDING PACKET to 86.98.64.17
ISAKMP Header
  Initiator COOKIE: 3d 8f 57 50 f8 1b c6 9a
  Responder COOKIE: 67 39 08 87 1a 0f 0a d1
  Next Payload: Key Exchange
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (none)
  MessageID: 00000000
  Length: 256
  Payload Key Exchange
    Next Payload: Nonce
    Reserved: 00
    Payload Length: 132
    Data:
      f9 3e 6a ac 85 1e 76 24 e5 ef 15 d3 db 47 54 37
      22 b1 f4 a4 88 ff 8c e6 7f 54 ad d8 64 a0 aa 4a
      33 91 7c e3 39 93 16 60 e1 6b 08 38 e3 2e 62 c4
      1f 55 30 11 4a 98 f2 99 8c 9c eb 18 f6 4c 70 5c
      c1 64 4c 2a df d8 c2 91 57 88 a2 79 a4 62 b7 f6
      f5 31 ec c2 40 53 e6 8e e8 a8 26 00 d5 26 87 64
      e8 a0 38 c4 49 58 87 02 4a eb 31 19 be f5 84 b5
      4a 0d df 2f d4 44 59 95 4c 56 06 8f fc 2d 67 bf
  Payload Nonce
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 24
    Data:
      af 07 fd 54 1f 30 56 89 63 ee 4f 56 19 2b ea d4
      29 f7 88 a9
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      12 f5 f2 8c 45 71 68 a9 70 2d 9f e2 74 cc 01 00
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 12
    Data (In Hex): 09 00 26 89 df d6 b7 12
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      92 fe af 9a 1a 0e 0a d1 2e 2f 32 d4 6a 83 b7 74
  Payload Vendor ID
    Next Payload: None
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      1f 07 f7 0e aa 65 14 d3 b0 fa 96 54 2a 50 01 00


IKE Recv RAW packet dump
3d 8f 57 50 f8 1b c6 9a 67 39 08 87 1a 0f 0a d1    |  =.WP....g9......
05 10 02 01 00 00 00 00 00 00 00 3c 95 1a fa 08    |  ...........<....
8d f6 20 27 8e c1 9b 0e d2 8c ff dd 62 9d e5 76    |  .. '........b..v
29 a8 1a 26 f9 a3 98 ca fe 0a 2e 1c                |  )..&........

 RECV PACKET from 86.98.64.17
ISAKMP Header
  Initiator COOKIE: 3d 8f 57 50 f8 1b c6 9a
  Responder COOKIE: 67 39 08 87 1a 0f 0a d1
  Next Payload: Identification
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (Encryption)
  MessageID: 00000000
  Length: 60

AFTER DECRYPTION
ISAKMP Header
  Initiator COOKIE: 3d 8f 57 50 f8 1b c6 9a
  Responder COOKIE: 67 39 08 87 1a 0f 0a d1
  Next Payload: Identification
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (Encryption)
  MessageID: 00000000
  Length: 60
  Payload Identification
    Next Payload: Hash
    Reserved: 00
    Payload Length: 12
    ID Type: IPv4 Address (1)
    Protocol ID (UDP/TCP, etc...): 0
    Port: 0
    ID Data: 86.98.64.17
  Payload Hash
    Next Payload: None
    Reserved: 00
    Payload Length: 20
    Data:
      76 e3 2f 61 5c 79 c1 5e c9 71 22 2e ea a2 0d 6d
May 13 22:05:19 [IKEv1]: IP = 86.98.64.17, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) +

NONE (0) total length : 60
May 13 22:05:19 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing ID payload
May 13 22:05:19 [IKEv1 DECODE]: Group = DefaultL2LGroup, IP = 86.98.64.17, ID_IPV4_ADDR ID received
86.98.64.17
May 13 22:05:19 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing hash payload
May 13 22:05:19 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, Computing hash for ISAKMP
May 13 22:05:19 [IKEv1]: IP = 86.98.64.17, Connection landed on tunnel_group DefaultL2LGroup
May 13 22:05:19 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, Freeing previously allocated memory for

authorization-dn-attributes
May 13 22:05:19 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing ID payload
May 13 22:05:19 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing hash payload
May 13 22:05:19 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, Computing hash for ISAKMP
May 13 22:05:19 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing dpd vid payload
May 13 22:05:19 [IKEv1]: IP = 86.98.64.17, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) +

VENDOR (13) + NONE (0) total length : 80

BEFORE ENCRYPTION
RAW PACKET DUMP on SEND
3d 8f 57 50 f8 1b c6 9a 67 39 08 87 1a 0f 0a d1    |  =.WP....g9......
05 10 02 00 00 00 00 00 1c 00 00 00 08 00 00 0c    |  ................
01 11 01 f4 53 6f 32 92 0d 00 00 14 96 5a fd 8c    |  ....So2......Z..
96 ef d0 d1 82 e9 f8 5d 57 6b ab 89 00 00 00 14    |  .......]Wk......
af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00    |  ....h...k...wW..

ISAKMP Header
  Initiator COOKIE: 3d 8f 57 50 f8 1b c6 9a
  Responder COOKIE: 67 39 08 87 1a 0f 0a d1
  Next Payload: Identification
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (none)
  MessageID: 00000000
  Length: 469762048
  Payload Identification
    Next Payload: Hash
    Reserved: 00
    Payload Length: 12
    ID Type: IPv4 Address (1)
    Protocol ID (UDP/TCP, etc...): 17
    Port: 500
    ID Data: 83.xxx.xx.146
  Payload Hash
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data:
      96 5a fd 8c 96 ef d0 d1 82 e9 f8 5d 57 6b ab 89
  Payload Vendor ID
    Next Payload: None
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00

SENDING PACKET to 86.98.64.17
ISAKMP Header
  Initiator COOKIE: 3d 8f 57 50 f8 1b c6 9a
  Responder COOKIE: 67 39 08 87 1a 0f 0a d1
  Next Payload: Identification
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (Encryption)
  MessageID: 00000000
  Length: 84
May 13 22:05:19 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, PHASE 1 COMPLETED
May 13 22:05:19 [IKEv1]: IP = 86.98.64.17, Keep-alive type for this connection: DPD
May 13 22:05:19 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, Starting P1 rekey timer: 2700 seconds.


IKE Recv RAW packet dump
3d 8f 57 50 f8 1b c6 9a 67 39 08 87 1a 0f 0a d1    |  =.WP....g9......
08 10 20 01 47 24 c2 86 00 00 01 1c 3d d2 44 67    |  .. .G$......=.Dg
ab 8b 19 00 e1 0f 02 28 ef dc 4c 85 40 0d 69 23    |  .......(..L.@.i#
db 77 80 b7 45 d9 8e a0 6f 85 5d 96 c1 30 f5 15    |  .w..E...o.]..0..
fc 64 94 e0 5f ac f5 92 39 af af 54 9f bb 2f 5b    |  .d.._...9..T../[
8c 7c e5 1c 82 0b f6 3f 37 6c 80 2c fa 39 f7 72    |  .|.....?7l.,.9.r
5e 5e 67 20 47 2f ae c0 8f 65 e1 75 9d 9d 4a d2    |  ^^g G/...e.u..J.
e9 1e 72 43 25 a1 80 67 9a 6f a3 4d 97 cb f0 30    |  ..rC%..g.o.M...0
07 d9 97 ec f6 fb 74 7e 31 d7 f5 4f 7f fd 57 38    |  ......t~1..O.W8
4a 3c 95 90 02 4b b0 75 84 96 00 c9 1d b4 a7 8b    |  J<...K.u........
34 be fe 9d ee b3 d4 95 52 a7 c1 c6 61 71 8a e8    |  4.......R...aq..
10 0d c8 2a f5 4a 11 3a 96 8b 8b 9f ae 3e 6b e4    |  ...*.J.:.....>k.
be b6 43 7b d2 59 20 79 96 c2 59 a7 4e fe ae 66    |  ..C{.Y y..Y.N..f
0e 78 b7 46 b9 85 68 4a f2 8b 7a 6a c5 ad d4 98    |  .x.F..hJ..zj....
fc 17 4e c4 23 64 bb a3 c7 f9 ad 8b 8b 61 6a 46    |  ..N.#d.......ajF
f3 ea 7f 26 2c 1d 6e dd c9 dd 7f b9 d5 f9 9d 40    |  ..&,.n.......@
6c 12 80 12 25 da 0d 67 2e d2 c1 1a f3 17 6d 2f    |  l...%..g......m/
b6 28 3f 28 f2 8b 83 eb 90 70 f7 a8                |  .(?(.....p..

 RECV PACKET from 86.98.64.17
ISAKMP Header
  Initiator COOKIE: 3d 8f 57 50 f8 1b c6 9a
  Responder COOKIE: 67 39 08 87 1a 0f 0a d1
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Quick Mode
  Flags: (Encryption)
  MessageID: 4724C286
  Length: 284
May 13 22:05:20 [IKEv1 DECODE]: IP = 86.98.64.17, IKE Responder starting QM: msg id = 4724c286

AFTER DECRYPTION
ISAKMP Header
  Initiator COOKIE: 3d 8f 57 50 f8 1b c6 9a
  Responder COOKIE: 67 39 08 87 1a 0f 0a d1
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Quick Mode
  Flags: (Encryption)
  MessageID: 4724C286
  Length: 284
  Payload Hash
    Next Payload: Security Association
    Reserved: 00
    Payload Length: 20
    Data:
      b1 b8 a5 5a 03 ad 83 8b be 21 95 c4 88 26 a5 b8
  Payload Security Association
    Next Payload: Nonce
    Reserved: 00
    Payload Length: 52
    DOI: IPsec
    Situation:(SIT_IDENTITY_ONLY)
    Payload Proposal
      Next Payload: None
      Reserved: 00
      Payload Length: 40
      Proposal #: 0
      Protocol-Id: PROTO_IPSEC_ESP
      SPI Size: 4
      # of transforms: 1
      SPI: f8 77 5d 35
      Payload Transform
        Next Payload: None
        Reserved: 00
        Payload Length: 28
        Transform #: 0
        Transform-Id: ESP_DES
        Reserved2: 0000
        Group Description: Group 2
        Encapsulation Mode: Tunnel
        Life Type: Seconds
        Life Duration (Hex): 0e 10
        Authentication Algorithm: MD5
  Payload Nonce
    Next Payload: Key Exchange
    Reserved: 00
    Payload Length: 20
    Data:
      8e 73 a5 a3 06 c4 0d d7 d9 20 90 a2 2e 1a 04 af
  Payload Key Exchange
    Next Payload: Identification
    Reserved: 00
    Payload Length: 132
    Data:
      5b 58 6c 79 dc d0 00 ce c3 02 4e 11 5f b7 59 a4
      4d 0f fb d1 0e 92 a4 f3 1b 63 11 42 96 a8 e7 5c
      bb d6 43 15 2f 26 d9 d8 32 97 ba 76 fe aa dd 62
      d1 47 fb 97 da e9 67 28 6f 64 35 0a bd aa b3 ce
      28 a6 19 e3 3c e0 fa fe 28 99 cd 8c 4c 88 e8 f0
      0e 27 f8 c6 6a 0d 20 a3 d5 27 82 d1 d5 ec 30 e9
      37 6b 3d a7 d3 a8 c3 53 ba d1 cc 83 08 38 05 50
      e2 9d c4 e6 49 9e af 7c 7e 97 2a 50 ba 47 a9 d9
  Payload Identification
    Next Payload: Identification
    Reserved: 00
    Payload Length: 16
    ID Type: IPv4 Subnet (4)
    Protocol ID (UDP/TCP, etc...): 0
    Port: 0
    ID Data: 192.168.5.0/255.255.255.0
  Payload Identification
    Next Payload: None
    Reserved: 00
    Payload Length: 16
    ID Type: IPv4 Subnet (4)
    Protocol ID (UDP/TCP, etc...): 0
    Port: 0
    ID Data: 10.100.1.0/255.255.255.0
May 13 22:05:20 [IKEv1]: IP = 86.98.64.17, IKE_DECODE RECEIVED Message (msgid=4724c286) with payloads : HDR + HASH (8) + SA

(1) + NONCE (10) + KE (4) + ID (5) + ID (5) + NONE (0) total length : 284
May 13 22:05:20 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing hash payload
May 13 22:05:20 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing SA payload
May 13 22:05:20 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing nonce payload
May 13 22:05:20 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing ke payload
May 13 22:05:20 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing ISA_KE for PFS in phase 2
May 13 22:05:20 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing ID payload
May 13 22:05:20 [IKEv1 DECODE]: Group = DefaultL2LGroup, IP = 86.98.64.17, ID_IPV4_ADDR_SUBNET ID

received--192.168.5.0--255.255.255.0
May 13 22:05:20 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, Received remote IP Proxy Subnet data in ID Payload:  

Address 192.168.5.0, Mask 255.255.255.0, Protocol 0, Port 0
May 13 22:05:20 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing ID payload
May 13 22:05:20 [IKEv1 DECODE]: Group = DefaultL2LGroup, IP = 86.98.64.17, ID_IPV4_ADDR_SUBNET ID

received--10.100.1.0--255.255.255.0
May 13 22:05:20 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, Received local IP Proxy Subnet data in ID Payload:  

Address 10.100.1.0, Mask 255.255.255.0, Protocol 0, Port 0
May 13 22:05:20 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, QM IsRekeyed old sa not found by addr
May 13 22:05:20 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, Static Crypto Map check, checking map = maptocr, seq =

1...
May 13 22:05:20 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, Static Crypto Map check, map = maptocr, seq = 1, no ACL

configured
May 13 22:05:20 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, IKE Remote Peer configured for crypto map: asatocr_dmap
May 13 22:05:20 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing IPSec SA payload
May 13 22:05:20 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, All IPSec SA proposals found unacceptable!
May 13 22:05:20 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, sending notify message
May 13 22:05:20 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing blank hash payload
May 13 22:05:20 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing ipsec notify payload for msg id

4724c286
May 13 22:05:20 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing qm hash payload
May 13 22:05:20 [IKEv1]: IP = 86.98.64.17, IKE_DECODE SENDING Message (msgid=96f92ed) with payloads : HDR + HASH (8) + NOTIFY

(11) + NONE (0) total length : 80

BEFORE ENCRYPTION
RAW PACKET DUMP on SEND
3d 8f 57 50 f8 1b c6 9a 67 39 08 87 1a 0f 0a d1    |  =.WP....g9......
08 10 05 00 ed 92 6f 09 1c 00 00 00 0b 00 00 14    |  ......o.........
d5 cf 99 e3 44 d7 4f 3c 5e fa 75 59 cc 44 93 4e    |  ....D.O<^.uY.D.N
00 00 00 20 00 00 00 01 03 10 00 0e 3d 8f 57 50    |  ... ........=.WP
f8 1b c6 9a 67 39 08 87 1a 0f 0a d1 47 24 c2 86    |  ....g9......G$..

ISAKMP Header
  Initiator COOKIE: 3d 8f 57 50 f8 1b c6 9a
  Responder COOKIE: 67 39 08 87 1a 0f 0a d1
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Informational
  Flags: (none)
  MessageID: ED926F09
  Length: 469762048
  Payload Hash
    Next Payload: Notification
    Reserved: 00
    Payload Length: 20
    Data:
      d5 cf 99 e3 44 d7 4f 3c 5e fa 75 59 cc 44 93 4e
  Payload Notification
    Next Payload: None
    Reserved: 00
    Payload Length: 32
    DOI: IPsec
    Protocol-ID: PROTO_IPSEC_ESP
    Spi Size: 16
    Notify Type: NO_PROPOSAL_CHOSEN
    SPI:
      3d 8f 57 50 f8 1b c6 9a 67 39 08 87 1a 0f 0a d1
    Data: 47 24 c2 86

ISAKMP Header
  Initiator COOKIE: 3d 8f 57 50 f8 1b c6 9a
  Responder COOKIE: 67 39 08 87 1a 0f 0a d1
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Informational
  Flags: (Encryption)
  MessageID: 096F92ED
  Length: 84
May 13 22:05:20 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, QM FSM error (P2 struct &0x3a4cf10, mess id 0x4724c286)!
May 13 22:05:20 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, IKE QM Responder FSM error history (struct

&0x3a4cf10)  <state>, <event>:  QM_DONE, EV_ERROR-->QM_BLD_MSG2, EV_NEGO_SA-->QM_BLD_MSG2, EV_IS_REKEY-->QM_BLD_MSG2,

EV_CONFIRM_SA-->QM_BLD_MSG2, EV_PROC_MSG-->QM_BLD_MSG2, EV_HASH_OK-->QM_BLD_MSG2, NullEvent-->QM_BLD_MSG2, EV_COMP_HASH
May 13 22:05:20 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, sending delete/delete with reason message
May 13 22:05:20 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, Removing peer from correlator table failed, no match!
May 13 22:05:20 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, Could not delete route for L2L peer that came in on a

dynamic map. address: 192.168.5.0, mask: 255.0.0.0
May 13 22:05:20 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, IKE SA MM:87083967 rcv'd Terminate: state MM_ACTIVE

 flags 0x00000042, refcnt 1, tuncnt 0
May 13 22:05:20 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, IKE SA MM:87083967 terminating:  flags 0x01000002,

refcnt 0, tuncnt 0
May 13 22:05:20 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, sending delete/delete with reason message
May 13 22:05:20 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing blank hash payload
May 13 22:05:20 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing IKE delete payload
May 13 22:05:20 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing qm hash payload
May 13 22:05:20 [IKEv1]: IP = 86.98.64.17, IKE_DECODE SENDING Message (msgid=adb6f1a2) with payloads : HDR + HASH (8) +

DELETE (12) + NONE (0) total length : 76

BEFORE ENCRYPTION
RAW PACKET DUMP on SEND
3d 8f 57 50 f8 1b c6 9a 67 39 08 87 1a 0f 0a d1    |  =.WP....g9......
08 10 05 00 a2 f1 b6 ad 1c 00 00 00 0c 00 00 14    |  ................
cf 80 00 16 b5 f1 d3 aa f6 4d eb 8a 22 88 b9 a4    |  .........M.."...
00 00 00 1c 00 00 00 01 01 10 00 01 3d 8f 57 50    |  ............=.WP
f8 1b c6 9a 67 39 08 87 1a 0f 0a d1                |  ....g9......

ISAKMP Header
  Initiator COOKIE: 3d 8f 57 50 f8 1b c6 9a
  Responder COOKIE: 67 39 08 87 1a 0f 0a d1
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Informational
  Flags: (none)
  MessageID: A2F1B6AD
  Length: 469762048
  Payload Hash
    Next Payload: Delete
    Reserved: 00
    Payload Length: 20
    Data:
      cf 80 00 16 b5 f1 d3 aa f6 4d eb 8a 22 88 b9 a4
  Payload Delete
    Next Payload: None
    Reserved: 00
    Payload Length: 28
    DOI: IPsec
    Protocol-ID: PROTO_ISAKMP
    Spi Size: 16
    # of SPIs: 1
    SPI (Hex dump):
      3d 8f 57 50 f8 1b c6 9a 67 39 08 87 1a 0f 0a d1

ISAKMP Header
  Initiator COOKIE: 3d 8f 57 50 f8 1b c6 9a
  Responder COOKIE: 67 39 08 87 1a 0f 0a d1
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Informational
  Flags: (Encryption)
  MessageID: ADB6F1A2
  Length: 76


IKE Recv RAW packet dump
3d 8f 57 50 f8 1b c6 9a 67 39 08 87 1a 0f 0a d1    |  =.WP....g9......
08 10 05 01 95 ab 16 0c 00 00 00 4c b4 6c 1a 62    |  ...........L.l.b
44 8c 51 a9 72 66 c4 e7 af 36 e2 96 69 ea 22 e3    |  D.Q.rf...6..i.".
b6 24 ff 33 c8 42 b5 74 27 19 5e b1 28 21 67 83    |  .$.3.B.t'.^.(!g.
b3 e1 fe 6d bd 1e a0 03 97 ad bb 23                |  ...m.......#

 RECV PACKET from 86.98.64.17
ISAKMP Header
  Initiator COOKIE: 3d 8f 57 50 f8 1b c6 9a
  Responder COOKIE: 67 39 08 87 1a 0f 0a d1
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Informational
  Flags: (Encryption)
  MessageID: 95AB160C
  Length: 76
May 13 22:05:20 [IKEv1]: IP = 86.98.64.17, Received encrypted packet with no matching SA, dropping


IKE Recv RAW packet dump
3d 8f 57 50 f8 1b c6 9a 67 39 08 87 1a 0f 0a d1    |  =.WP....g9......
08 10 20 01 47 24 c2 86 00 00 01 1c 3d d2 44 67    |  .. .G$......=.Dg
ab 8b 19 00 e1 0f 02 28 ef dc 4c 85 40 0d 69 23    |  .......(..L.@.i#
db 77 80 b7 45 d9 8e a0 6f 85 5d 96 c1 30 f5 15    |  .w..E...o.]..0..
fc 64 94 e0 5f ac f5 92 39 af af 54 9f bb 2f 5b    |  .d.._...9..T../[
8c 7c e5 1c 82 0b f6 3f 37 6c 80 2c fa 39 f7 72    |  .|.....?7l.,.9.r
5e 5e 67 20 47 2f ae c0 8f 65 e1 75 9d 9d 4a d2    |  ^^g G/...e.u..J.
e9 1e 72 43 25 a1 80 67 9a 6f a3 4d 97 cb f0 30    |  ..rC%..g.o.M...0
07 d9 97 ec f6 fb 74 7e 31 d7 f5 4f 7f fd 57 38    |  ......t~1..O.W8
4a 3c 95 90 02 4b b0 75 84 96 00 c9 1d b4 a7 8b    |  J<...K.u........
34 be fe 9d ee b3 d4 95 52 a7 c1 c6 61 71 8a e8    |  4.......R...aq..
10 0d c8 2a f5 4a 11 3a 96 8b 8b 9f ae 3e 6b e4    |  ...*.J.:.....>k.
be b6 43 7b d2 59 20 79 96 c2 59 a7 4e fe ae 66    |  ..C{.Y y..Y.N..f
0e 78 b7 46 b9 85 68 4a f2 8b 7a 6a c5 ad d4 98    |  .x.F..hJ..zj....
fc 17 4e c4 23 64 bb a3 c7 f9 ad 8b 8b 61 6a 46    |  ..N.#d.......ajF
f3 ea 7f 26 2c 1d 6e dd c9 dd 7f b9 d5 f9 9d 40    |  ..&,.n.......@
6c 12 80 12 25 da 0d 67 2e d2 c1 1a f3 17 6d 2f    |  l...%..g......m/
b6 28 3f 28 f2 8b 83 eb 90 70 f7 a8                |  .(?(.....p..

 RECV PACKET from 86.98.64.17
ISAKMP Header
  Initiator COOKIE: 3d 8f 57 50 f8 1b c6 9a
  Responder COOKIE: 67 39 08 87 1a 0f 0a d1
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Quick Mode
  Flags: (Encryption)
  MessageID: 4724C286
  Length: 284
May 13 22:05:30 [IKEv1]: IP = 86.98.64.17, Received encrypted packet with no matching SA, dropping


IKE Recv RAW packet dump
60 0a 9c 70 78 e3 80 f7 00 00 00 00 00 00 00 00    |  `..px...........
01 10 02 00 00 00 00 00 00 00 00 c8 0d 00 00 34    |  ...............4
00 00 00 01 00 00 00 01 00 00 00 28 00 01 00 01    |  ...........(....
00 00 00 20 00 01 00 00 80 0b 00 01 80 0c 0e 10    |  ... ............
80 01 00 01 80 02 00 01 80 03 00 01 80 04 00 02    |  ................
0d 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc    |  ........h...k...
77 57 01 00 0d 00 00 14 4a 13 1c 81 07 03 58 45    |  wW......J.....XE
5c 57 28 f2 0e 95 45 2f 0d 00 00 14 7d 94 19 a6    |  \W(...E/....}...
53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 00 14    |  S..o,....R.V....
cd 60 46 43 35 df 21 f8 7c fd b2 fc 68 b6 a4 48    |  .`FC5.!.|...h..H
0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 81 b5    |  ........>.in.c..
ec 42 7b 1f 00 00 00 14 44 85 15 2d 18 b6 bb cd    |  .B{.....D..-....
0b e8 a8 46 95 79 dd cc                            |  ...F.y..

 RECV PACKET from 86.98.64.17
ISAKMP Header
  Initiator COOKIE: 60 0a 9c 70 78 e3 80 f7
  Responder COOKIE: 00 00 00 00 00 00 00 00
  Next Payload: Security Association
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (none)
  MessageID: 00000000
  Length: 200
  Payload Security Association
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 52
    DOI: IPsec
    Situation:(SIT_IDENTITY_ONLY)
    Payload Proposal
      Next Payload: None
      Reserved: 00
      Payload Length: 40
      Proposal #: 0
      Protocol-Id: PROTO_ISAKMP
      SPI Size: 0
      # of transforms: 1
      Payload Transform
        Next Payload: None
        Reserved: 00
        Payload Length: 32
        Transform #: 0
        Transform-Id: KEY_IKE
        Reserved2: 0000
        Life Type: seconds
        Life Duration (Hex): 0e 10
        Encryption Algorithm: DES-CBC
        Hash Algorithm: MD5
        Authentication Method: Preshared key
        Group Description: Group 2
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      cd 60 46 43 35 df 21 f8 7c fd b2 fc 68 b6 a4 48
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 7b 1f
  Payload Vendor ID
    Next Payload: None
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 dd cc
May 13 22:05:33 [IKEv1]: IP = 86.98.64.17, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) +

VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 200
May 13 22:05:33 [IKEv1 DEBUG]: IP = 86.98.64.17, processing SA payload
May 13 22:05:33 [IKEv1 DEBUG]: IP = 86.98.64.17, Oakley proposal is acceptable
May 13 22:05:33 [IKEv1 DEBUG]: IP = 86.98.64.17, processing VID payload
May 13 22:05:33 [IKEv1 DEBUG]: IP = 86.98.64.17, Received DPD VID
May 13 22:05:33 [IKEv1 DEBUG]: IP = 86.98.64.17, processing VID payload
May 13 22:05:33 [IKEv1 DEBUG]: IP = 86.98.64.17, Received NAT-Traversal RFC VID
May 13 22:05:33 [IKEv1 DEBUG]: IP = 86.98.64.17, processing VID payload
May 13 22:05:33 [IKEv1 DEBUG]: IP = 86.98.64.17, Received NAT-Traversal ver 03 VID
May 13 22:05:33 [IKEv1 DEBUG]: IP = 86.98.64.17, processing VID payload
May 13 22:05:33 [IKEv1 DEBUG]: IP = 86.98.64.17, processing VID payload
May 13 22:05:33 [IKEv1 DEBUG]: IP = 86.98.64.17, Received NAT-Traversal ver 02 VID
May 13 22:05:33 [IKEv1 DEBUG]: IP = 86.98.64.17, processing VID payload
May 13 22:05:33 [IKEv1 DEBUG]: IP = 86.98.64.17, processing IKE SA payload
May 13 22:05:33 [IKEv1 DEBUG]: IP = 86.98.64.17, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 3
May 13 22:05:33 [IKEv1 DEBUG]: IP = 86.98.64.17, constructing ISAKMP SA payload
May 13 22:05:33 [IKEv1 DEBUG]: IP = 86.98.64.17, constructing Fragmentation VID + extended capabilities payload
May 13 22:05:33 [IKEv1]: IP = 86.98.64.17, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) +

NONE (0) total length : 104

SENDING PACKET to 86.98.64.17
ISAKMP Header
  Initiator COOKIE: 60 0a 9c 70 78 e3 80 f7
  Responder COOKIE: 94 d0 b2 d3 fb 37 de 91
  Next Payload: Security Association
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (none)
  MessageID: 00000000
  Length: 104
  Payload Security Association
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 52
    DOI: IPsec
    Situation:(SIT_IDENTITY_ONLY)
    Payload Proposal
      Next Payload: None
      Reserved: 00
      Payload Length: 40
      Proposal #: 1
      Protocol-Id: PROTO_ISAKMP
      SPI Size: 0
      # of transforms: 1
      Payload Transform
        Next Payload: None
        Reserved: 00
        Payload Length: 32
        Transform #: 0
        Transform-Id: KEY_IKE
        Reserved2: 0000
        Encryption Algorithm: DES-CBC
        Hash Algorithm: MD5
        Group Description: Group 2
        Authentication Method: Preshared key
        Life Type: seconds
        Life Duration (Hex): 0e 10
  Payload Vendor ID
    Next Payload: None
    Reserved: 00
    Payload Length: 24
    Data (In Hex):
      40 48 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 c2 d3
      c0 00 00 00


IKE Recv RAW packet dump
60 0a 9c 70 78 e3 80 f7 94 d0 b2 d3 fb 37 de 91    |  `..px........7..
04 10 02 00 00 00 00 00 00 00 00 b4 0a 00 00 84    |  ................
28 ad 3a 7c a0 1a 67 1d 4a 7b 91 61 d3 81 68 ae    |  (.:|..g.J{.a..h.
01 3f e4 ba 61 51 b7 2c c5 06 55 a8 04 23 cd fb    |  .?..aQ.,..U..#..
93 7e 64 ee e8 f0 f6 70 bc f3 3c f3 12 68 5a 33    |  .~d....p..<..hZ3
88 6f 14 1d e3 b9 f5 60 07 ad 48 1b 85 ae 1b 8a    |  .o.....`..H.....
4c 0e 70 cf 8b 53 09 8d d1 09 be 67 6c 80 7d 07    |  L.p..S.....gl.}.
59 e4 58 c3 11 87 63 b2 a6 62 f5 aa 71 53 f2 61    |  Y.X...c..b..qS.a
bb 4d a8 9c ee 3a 25 9c 5b b9 96 be dc 80 52 a7    |  .M...:%.[.....R.
59 70 47 6f 8f d5 8b 52 fc fc f1 d9 66 a9 d6 9d    |  YpGo...R....f...
00 00 00 14 bd 0c 50 5d 1f 2a d3 ce 22 f4 a6 82    |  ......P].*.."...
e5 bc 97 63                                        |  ...c

 RECV PACKET from 86.98.64.17
ISAKMP Header
  Initiator COOKIE: 60 0a 9c 70 78 e3 80 f7
  Responder COOKIE: 94 d0 b2 d3 fb 37 de 91
  Next Payload: Key Exchange
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (none)
  MessageID: 00000000
  Length: 180
  Payload Key Exchange
    Next Payload: Nonce
    Reserved: 00
    Payload Length: 132
    Data:
      28 ad 3a 7c a0 1a 67 1d 4a 7b 91 61 d3 81 68 ae
      01 3f e4 ba 61 51 b7 2c c5 06 55 a8 04 23 cd fb
      93 7e 64 ee e8 f0 f6 70 bc f3 3c f3 12 68 5a 33
      88 6f 14 1d e3 b9 f5 60 07 ad 48 1b 85 ae 1b 8a
      4c 0e 70 cf 8b 53 09 8d d1 09 be 67 6c 80 7d 07
      59 e4 58 c3 11 87 63 b2 a6 62 f5 aa 71 53 f2 61
      bb 4d a8 9c ee 3a 25 9c 5b b9 96 be dc 80 52 a7
      59 70 47 6f 8f d5 8b 52 fc fc f1 d9 66 a9 d6 9d
  Payload Nonce
    Next Payload: None
    Reserved: 00
    Payload Length: 20
    Data:
      bd 0c 50 5d 1f 2a d3 ce 22 f4 a6 82 e5 bc 97 63
May 13 22:05:33 [IKEv1]: IP = 86.98.64.17, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) +

NONE (0) total length : 180
May 13 22:05:33 [IKEv1 DEBUG]: IP = 86.98.64.17, processing ke payload
May 13 22:05:33 [IKEv1 DEBUG]: IP = 86.98.64.17, processing ISA_KE payload
May 13 22:05:33 [IKEv1 DEBUG]: IP = 86.98.64.17, processing nonce payload
May 13 22:05:33 [IKEv1 DEBUG]: IP = 86.98.64.17, constructing ke payload
May 13 22:05:33 [IKEv1 DEBUG]: IP = 86.98.64.17, constructing nonce payload
May 13 22:05:33 [IKEv1 DEBUG]: IP = 86.98.64.17, constructing Cisco Unity VID payload
May 13 22:05:33 [IKEv1 DEBUG]: IP = 86.98.64.17, constructing xauth V6 VID payload
May 13 22:05:33 [IKEv1 DEBUG]: IP = 86.98.64.17, Send IOS VID
May 13 22:05:33 [IKEv1 DEBUG]: IP = 86.98.64.17, Constructing ASA spoofing IOS Vendor ID payload (version: 1.0.0,

capabilities: 20000001)
May 13 22:05:33 [IKEv1 DEBUG]: IP = 86.98.64.17, constructing VID payload
May 13 22:05:33 [IKEv1 DEBUG]: IP = 86.98.64.17, Send Altiga/Cisco VPN3000/Cisco ASA GW VID
May 13 22:05:33 [IKEv1]: IP = 86.98.64.17, Connection landed on tunnel_group DefaultL2LGroup
May 13 22:05:33 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, Generating keys for Responder...
May 13 22:05:33 [IKEv1]: IP = 86.98.64.17, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) +

VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 256

SENDING PACKET to 86.98.64.17
ISAKMP Header
  Initiator COOKIE: 60 0a 9c 70 78 e3 80 f7
  Responder COOKIE: 94 d0 b2 d3 fb 37 de 91
  Next Payload: Key Exchange
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (none)
  MessageID: 00000000
  Length: 256
  Payload Key Exchange
    Next Payload: Nonce
    Reserved: 00
    Payload Length: 132
    Data:
      7e d0 60 ad 05 70 6c 11 e8 ce f2 62 8b bb 99 af
      c5 b3 5c e9 21 61 05 c2 25 c8 02 75 7b 5d c5 9f
      52 e9 09 dd db 1e 0e 0a 31 e2 fe 97 22 29 05 31
      7b 57 30 55 c5 3d 10 5b 8b 61 ac e4 ae 09 8e a5
      91 6a 24 cc d7 a5 dd 68 4f 7f 9e d8 f2 b2 8b d5
      1c 5d 3c f8 2b 59 2c db b0 e9 87 2b 59 c6 b8 b3
      f5 30 cd 5a 3c 54 f8 9c de 81 6a 46 75 89 72 48
      9e 65 6e bd 05 a3 1c d9 f5 b1 a7 6e 23 0e db 22
  Payload Nonce
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 24
    Data:
      0a 36 43 0e 38 e9 b9 10 7e ac 85 dc 53 6e 93 48
      e5 09 e1 6c
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      12 f5 f2 8c 45 71 68 a9 70 2d 9f e2 74 cc 01 00
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 12
    Data (In Hex): 09 00 26 89 df d6 b7 12
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      61 17 15 ce fb 36 de 91 63 ff 26 ab 79 4d cf ad
  Payload Vendor ID
    Next Payload: None
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      1f 07 f7 0e aa 65 14 d3 b0 fa 96 54 2a 50 01 00


IKE Recv RAW packet dump
60 0a 9c 70 78 e3 80 f7 94 d0 b2 d3 fb 37 de 91    |  `..px........7..
05 10 02 01 00 00 00 00 00 00 00 3c 69 e9 d4 59    |  ...........<i..Y
20 63 13 e7 35 ac e8 3b 08 75 9e 77 7a cd 9a 17    |   c..5..;.u.wz...
8f 90 ce 61 04 4a be 78 42 1b 5d e4                |  ...a.J.xB.].

 RECV PACKET from 86.98.64.17
ISAKMP Header
  Initiator COOKIE: 60 0a 9c 70 78 e3 80 f7
  Responder COOKIE: 94 d0 b2 d3 fb 37 de 91
  Next Payload: Identification
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (Encryption)
  MessageID: 00000000
  Length: 60

AFTER DECRYPTION
ISAKMP Header
  Initiator COOKIE: 60 0a 9c 70 78 e3 80 f7
  Responder COOKIE: 94 d0 b2 d3 fb 37 de 91
  Next Payload: Identification
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (Encryption)
  MessageID: 00000000
  Length: 60
  Payload Identification
    Next Payload: Hash
    Reserved: 00
    Payload Length: 12
    ID Type: IPv4 Address (1)
    Protocol ID (UDP/TCP, etc...): 0
    Port: 0
    ID Data: 86.98.64.17
  Payload Hash
    Next Payload: None
    Reserved: 00
    Payload Length: 20
    Data:
      01 16 23 a7 6d ba b5 85 ec a3 1b c5 4a c9 cf 46
May 13 22:05:33 [IKEv1]: IP = 86.98.64.17, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) +

NONE (0) total length : 60
May 13 22:05:33 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing ID payload
May 13 22:05:33 [IKEv1 DECODE]: Group = DefaultL2LGroup, IP = 86.98.64.17, ID_IPV4_ADDR ID received
86.98.64.17
May 13 22:05:33 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing hash payload
May 13 22:05:33 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, Computing hash for ISAKMP
May 13 22:05:33 [IKEv1]: IP = 86.98.64.17, Connection landed on tunnel_group DefaultL2LGroup
May 13 22:05:33 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, Freeing previously allocated memory for

authorization-dn-attributes
May 13 22:05:33 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing ID payload
May 13 22:05:33 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing hash payload
May 13 22:05:33 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, Computing hash for ISAKMP
May 13 22:05:33 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing dpd vid payload
May 13 22:05:33 [IKEv1]: IP = 86.98.64.17, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) +

VENDOR (13) + NONE (0) total length : 80

BEFORE ENCRYPTION
RAW PACKET DUMP on SEND
60 0a 9c 70 78 e3 80 f7 94 d0 b2 d3 fb 37 de 91    |  `..px........7..
05 10 02 00 00 00 00 00 1c 00 00 00 08 00 00 0c    |  ................
01 11 01 f4 53 6f 32 92 0d 00 00 14 a0 b8 df 56    |  ....So2........V
fd dd 89 41 35 35 ff 0b e5 5a 39 0a 00 00 00 14    |  ...A55...Z9.....
af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00    |  ....h...k...wW..

ISAKMP Header
  Initiator COOKIE: 60 0a 9c 70 78 e3 80 f7
  Responder COOKIE: 94 d0 b2 d3 fb 37 de 91
  Next Payload: Identification
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (none)
  MessageID: 00000000
  Length: 469762048
  Payload Identification
    Next Payload: Hash
    Reserved: 00
    Payload Length: 12
    ID Type: IPv4 Address (1)
    Protocol ID (UDP/TCP, etc...): 17
    Port: 500
    ID Data: 83.xxx.xx.146
  Payload Hash
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data:
      a0 b8 df 56 fd dd 89 41 35 35 ff 0b e5 5a 39 0a
  Payload Vendor ID
    Next Payload: None
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00

SENDING PACKET to 86.98.64.17
ISAKMP Header
  Initiator COOKIE: 60 0a 9c 70 78 e3 80 f7
  Responder COOKIE: 94 d0 b2 d3 fb 37 de 91
  Next Payload: Identification
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (Encryption)
  MessageID: 00000000
  Length: 84
May 13 22:05:33 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, PHASE 1 COMPLETED
May 13 22:05:33 [IKEv1]: IP = 86.98.64.17, Keep-alive type for this connection: DPD
May 13 22:05:33 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, Starting P1 rekey timer: 2700 seconds.


IKE Recv RAW packet dump
60 0a 9c 70 78 e3 80 f7 94 d0 b2 d3 fb 37 de 91    |  `..px........7..
08 10 20 01 01 f4 16 63 00 00 01 1c 65 3c 23 16    |  .. ....c....e<#.
33 18 f0 31 b4 90 3b d0 e8 29 fb 1c 9c 76 0c 88    |  3..1..;..)...v..
17 16 47 25 6e f4 c0 22 a1 52 6e 8f 1e 6b f5 64    |  ..G%n..".Rn..k.d
90 0c da 95 c4 5f 3d 86 5f b1 88 6c 6d d3 bf 49    |  ....._=._..lm..I
da ff ad 42 d1 df fb 02 d7 86 ea 0c bb 7f d8 8d    |  ...B...........
38 bc 45 93 56 d9 ee b7 a0 ee 39 b4 58 eb 32 5c    |  8.E.V.....9.X.2\
d2 99 3d f8 82 ad 92 46 15 9e d0 a9 8f 8d bc ce    |  ..=....F........
c4 6f 8b 5c 41 a3 69 47 c5 2f 90 b5 1a 84 ba 99    |  .o.\A.iG./......
77 16 93 5f 84 55 a4 6e 6b 6d 97 89 a6 48 0f 82    |  w.._.U.nkm...H..
60 ca 8d 4a 1d 79 ca 33 f7 df c4 90 bb d6 22 87    |  `..J.y.3......".
e5 20 68 9a 46 51 b6 70 e8 06 71 02 0e da 93 c4    |  . h.FQ.p..q.....
d9 50 c0 4c 3e e9 3c 63 98 44 17 48 43 4c 3f 0f    |  .P.L>.<c.D.HCL?.
42 d6 d9 7c 96 d9 5c 59 4c ab 0a 04 05 c6 3d 34    |  B..|..\YL.....=4
1a 32 c8 0f 23 72 b9 d8 83 45 61 7c b8 82 24 62    |  .2..#r...Ea|..$b
04 fd 16 04 78 47 b8 5c 3a 74 ad 58 48 6d fa b1    |  ....xG.\:t.XHm..
12 87 87 48 90 9d 74 62 d6 90 f2 2d 3f 05 8b b2    |  ...H..tb...-?...
6f 11 68 be b7 bf 69 8d 3e 08 59 da                |  o.h...i.>.Y.

 RECV PACKET from 86.98.64.17
ISAKMP Header
  Initiator COOKIE: 60 0a 9c 70 78 e3 80 f7
  Responder COOKIE: 94 d0 b2 d3 fb 37 de 91
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Quick Mode
  Flags: (Encryption)
  MessageID: 01F41663
  Length: 284
May 13 22:05:33 [IKEv1 DECODE]: IP = 86.98.64.17, IKE Responder starting QM: msg id = 01f41663

AFTER DECRYPTION
ISAKMP Header
  Initiator COOKIE: 60 0a 9c 70 78 e3 80 f7
  Responder COOKIE: 94 d0 b2 d3 fb 37 de 91
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Quick Mode
  Flags: (Encryption)
  MessageID: 01F41663
  Length: 284
  Payload Hash
    Next Payload: Security Association
    Reserved: 00
    Payload Length: 20
    Data:
      99 70 d7 dd 1c 50 e3 c3 95 0b 81 ed a6 df bd b5
  Payload Security Association
    Next Payload: Nonce
    Reserved: 00
    Payload Length: 52
    DOI: IPsec
    Situation:(SIT_IDENTITY_ONLY)
    Payload Proposal
      Next Payload: None
      Reserved: 00
      Payload Length: 40
      Proposal #: 0
      Protocol-Id: PROTO_IPSEC_ESP
      SPI Size: 4
      # of transforms: 1
      SPI: f8 77 5d 36
      Payload Transform
        Next Payload: None
        Reserved: 00
        Payload Length: 28
        Transform #: 0
        Transform-Id: ESP_DES
        Reserved2: 0000
        Group Description: Group 2
        Encapsulation Mode: Tunnel
        Life Type: Seconds
        Life Duration (Hex): 0e 10
        Authentication Algorithm: MD5
  Payload Nonce
    Next Payload: Key Exchange
    Reserved: 00
    Payload Length: 20
    Data:
      d9 e7 5a 55 8d 80 bf d9 50 41 4d 1a 35 9a ae 8b
  Payload Key Exchange
    Next Payload: Identification
    Reserved: 00
    Payload Length: 132
    Data:
      cd dc c4 94 d7 c6 e5 65 43 6f 96 67 06 e3 0d 95
      a4 6c bc b3 e6 90 8c 31 29 e8 7f 41 ea 60 7c bb
      86 7e 45 c3 7e 6a a6 2d 5c 91 2f 94 a6 fe 62 ad
      83 4f 48 2b 50 99 2f 67 5b b4 98 8d 74 15 89 49
      b1 2c 18 9a e5 2f 23 85 72 69 4c ac e7 11 56 83
      90 5e 32 c0 51 1f 97 cb 7d ab ab d6 c2 82 00 b6
      3c 21 32 71 d7 26 01 7b e4 4a 6b 88 05 4c c5 13
      d4 d0 84 0a 0e 62 a4 02 96 68 93 b1 d3 cc 20 5c
  Payload Identification
    Next Payload: Identification
    Reserved: 00
    Payload Length: 16
    ID Type: IPv4 Subnet (4)
    Protocol ID (UDP/TCP, etc...): 0
    Port: 0
    ID Data: 192.168.5.0/255.255.255.0
  Payload Identification
    Next Payload: None
    Reserved: 00
    Payload Length: 16
    ID Type: IPv4 Subnet (4)
    Protocol ID (UDP/TCP, etc...): 0
    Port: 0
    ID Data: 10.100.1.0/255.255.255.0
May 13 22:05:33 [IKEv1]: IP = 86.98.64.17, IKE_DECODE RECEIVED Message (msgid=1f41663) with payloads : HDR + HASH (8) + SA

(1) + NONCE (10) + KE (4) + ID (5) + ID (5) + NONE (0) total length : 284
May 13 22:05:33 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing hash payload
May 13 22:05:33 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing SA payload
May 13 22:05:33 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing nonce payload
May 13 22:05:33 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing ke payload
May 13 22:05:33 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing ISA_KE for PFS in phase 2
May 13 22:05:33 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing ID payload
May 13 22:05:33 [IKEv1 DECODE]: Group = DefaultL2LGroup, IP = 86.98.64.17, ID_IPV4_ADDR_SUBNET ID

received--192.168.5.0--255.255.255.0
May 13 22:05:33 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, Received remote IP Proxy Subnet data in ID Payload:  

Address 192.168.5.0, Mask 255.255.255.0, Protocol 0, Port 0
May 13 22:05:33 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing ID payload
May 13 22:05:33 [IKEv1 DECODE]: Group = DefaultL2LGroup, IP = 86.98.64.17, ID_IPV4_ADDR_SUBNET ID

received--10.100.1.0--255.255.255.0
May 13 22:05:33 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, Received local IP Proxy Subnet data in ID Payload:  

Address 10.100.1.0, Mask 255.255.255.0, Protocol 0, Port 0
May 13 22:05:33 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, QM IsRekeyed old sa not found by addr
May 13 22:05:33 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, Static Crypto Map check, checking map = maptocr, seq =

1...
May 13 22:05:33 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, Static Crypto Map check, map = maptocr, seq = 1, no ACL

configured
May 13 22:05:33 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, IKE Remote Peer configured for crypto map: asatocr_dmap
May 13 22:05:33 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing IPSec SA payload
May 13 22:05:33 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, All IPSec SA proposals found unacceptable!
May 13 22:05:33 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, sending notify message
May 13 22:05:33 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing blank hash payload
May 13 22:05:33 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing ipsec notify payload for msg id

1f41663
May 13 22:05:33 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing qm hash payload
May 13 22:05:33 [IKEv1]: IP = 86.98.64.17, IKE_DECODE SENDING Message (msgid=e074c276) with payloads : HDR + HASH (8) +

NOTIFY (11) + NONE (0) total length : 80

BEFORE ENCRYPTION
RAW PACKET DUMP on SEND
60 0a 9c 70 78 e3 80 f7 94 d0 b2 d3 fb 37 de 91    |  `..px........7..
08 10 05 00 76 c2 74 e0 1c 00 00 00 0b 00 00 14    |  ....v.t.........
40 bf 57 ca c9 e3 be a5 0d c1 7c 80 29 12 73 3d    |  @.W.......|.).s=
00 00 00 20 00 00 00 01 03 10 00 0e 60 0a 9c 70    |  ... ........`..p
78 e3 80 f7 94 d0 b2 d3 fb 37 de 91 01 f4 16 63    |  x........7.....c

ISAKMP Header
  Initiator COOKIE: 60 0a 9c 70 78 e3 80 f7
  Responder COOKIE: 94 d0 b2 d3 fb 37 de 91
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Informational
  Flags: (none)
  MessageID: 76C274E0
  Length: 469762048
  Payload Hash
    Next Payload: Notification
    Reserved: 00
    Payload Length: 20
    Data:
      40 bf 57 ca c9 e3 be a5 0d c1 7c 80 29 12 73 3d
  Payload Notification
    Next Payload: None
    Reserved: 00
    Payload Length: 32
    DOI: IPsec
    Protocol-ID: PROTO_IPSEC_ESP
    Spi Size: 16
    Notify Type: NO_PROPOSAL_CHOSEN
    SPI:
      60 0a 9c 70 78 e3 80 f7 94 d0 b2 d3 fb 37 de 91
    Data: 01 f4 16 63

ISAKMP Header
  Initiator COOKIE: 60 0a 9c 70 78 e3 80 f7
  Responder COOKIE: 94 d0 b2 d3 fb 37 de 91
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Informational
  Flags: (Encryption)
  MessageID: E074C276
  Length: 84
May 13 22:05:33 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, QM FSM error (P2 struct &0x3a4cf10, mess id 0x1f41663)!
May 13 22:05:33 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, IKE QM Responder FSM error history (struct

&0x3a4cf10)  <state>, <event>:  QM_DONE, EV_ERROR-->QM_BLD_MSG2, EV_NEGO_SA-->QM_BLD_MSG2, EV_IS_REKEY-->QM_BLD_MSG2,

EV_CONFIRM_SA-->QM_BLD_MSG2, EV_PROC_MSG-->QM_BLD_MSG2, EV_HASH_OK-->QM_BLD_MSG2, NullEvent-->QM_BLD_MSG2, EV_COMP_HASH
May 13 22:05:33 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, sending delete/delete with reason message
May 13 22:05:33 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, Removing peer from correlator table failed, no match!
May 13 22:05:33 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, Could not delete route for L2L peer that came in on a

dynamic map. address: 192.168.5.0, mask: 255.0.0.0
May 13 22:05:33 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, IKE SA MM:d3b2d094 rcv'd Terminate: state MM_ACTIVE

 flags 0x00000042, refcnt 1, tuncnt 0
May 13 22:05:33 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, IKE SA MM:d3b2d094 terminating:  flags 0x01000002,

refcnt 0, tuncnt 0
May 13 22:05:33 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, sending delete/delete with reason message
May 13 22:05:33 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing blank hash payload
May 13 22:05:33 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing IKE delete payload
May 13 22:05:33 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing qm hash payload
May 13 22:05:33 [IKEv1]: IP = 86.98.64.17, IKE_DECODE SENDING Message (msgid=60f4ac0d) with payloads : HDR + HASH (8) +

DELETE (12) + NONE (0) total length : 76

BEFORE ENCRYPTION
RAW PACKET DUMP on SEND
60 0a 9c 70 78 e3 80 f7 94 d0 b2 d3 fb 37 de 91    |  `..px........7..
08 10 05 00 0d ac f4 60 1c 00 00 00 0c 00 00 14    |  .......`........
d3 45 e5 d4 a3 8a 79 48 7a 94 a7 e0 b3 2d 37 33    |  .E....yHz....-73
00 00 00 1c 00 00 00 01 01 10 00 01 60 0a 9c 70    |  ............`..p
78 e3 80 f7 94 d0 b2 d3 fb 37 de 91                |  x........7..

ISAKMP Header
  Initiator COOKIE: 60 0a 9c 70 78 e3 80 f7
  Responder COOKIE: 94 d0 b2 d3 fb 37 de 91
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Informational
  Flags: (none)
  MessageID: 0DACF460
  Length: 469762048
  Payload Hash
    Next Payload: Delete
    Reserved: 00
    Payload Length: 20
    Data:
      d3 45 e5 d4 a3 8a 79 48 7a 94 a7 e0 b3 2d 37 33
  Payload Delete
    Next Payload: None
    Reserved: 00
    Payload Length: 28
    DOI: IPsec
    Protocol-ID: PROTO_ISAKMP
    Spi Size: 16
    # of SPIs: 1
    SPI (Hex dump):
      60 0a 9c 70 78 e3 80 f7 94 d0 b2 d3 fb 37 de 91

ISAKMP Header
  Initiator COOKIE: 60 0a 9c 70 78 e3 80 f7
  Responder COOKIE: 94 d0 b2 d3 fb 37 de 91
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Informational
  Flags: (Encryption)
  MessageID: 60F4AC0D
  Length: 76


IKE Recv RAW packet dump
60 0a 9c 70 78 e3 80 f7 94 d0 b2 d3 fb 37 de 91    |  `..px........7..
08 10 05 01 36 bc b4 09 00 00 00 4c d6 42 4e 65    |  ....6......L.BNe
54 a7 18 67 92 b3 7b d7 a2 2f 85 66 8e df 78 fd    |  T..g..{../.f..x.
df 0f 51 9c 7a df e6 4b 51 c1 90 a3 18 6c 9b 25    |  ..Q.z..KQ....l.%
a2 18 56 bf 42 12 eb af 12 1f 16 0f                |  ..V.B.......

 RECV PACKET from 86.98.64.17
ISAKMP Header
  Initiator COOKIE: 60 0a 9c 70 78 e3 80 f7
  Responder COOKIE: 94 d0 b2 d3 fb 37 de 91
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Informational
  Flags: (Encryption)
  MessageID: 36BCB409
  Length: 76
May 13 22:05:33 [IKEv1]: IP = 86.98.64.17, Received encrypted packet with no matching SA, dropping


IKE Recv RAW packet dump
ea fb 64 63 6d ae 73 cd 35 19 32 a9 bf e1 39 1d    |  ..dcm.s.5.2...9.
08 10 20 01 7d 7f f4 f5 00 00 01 1c 39 7e de 78    |  .. .}......9~.x
8e 66 4d 25 b6 27 56 9f 4c 5a 1b 5a 2a 7b 26 f6    |  .fM%.'V.LZ.Z*{&.
3c 1e c9 5c c3 9a 16 57 e8 7f eb db 82 cb b5 d6    |  <..\...W.......
3e 07 97 55 74 a5 60 ae e6 46 b4 ce 37 23 71 ad    |  >..Ut.`..F..7#q.
52 71 05 5e 9f 9e 24 70 25 8e 28 25 a3 7c 11 cd    |  Rq.^..$p%.(%.|..
87 71 53 e2 f5 5e fe 9b 6c 51 4e 66 b3 d0 2d 4d    |  .qS..^..lQNf..-M
52 52 ac 62 f0 c2 08 4f a8 6a e0 f6 e0 4e 2f 86    |  RR.b...O.j...N/.
6f 6d 73 84 b3 bf 26 37 db 05 fc f9 7e c8 e6 99    |  oms...&7....~...
09 8f c9 f4 38 4c c0 6f e2 2e 30 09 4d 7c 32 bb    |  ....8L.o..0.M|2.
d2 40 fb c3 5b 26 3c 1f 0a 32 16 28 74 9f c2 74    |  .@..[&<..2.(t..t
55 d4 51 4f c4 6d 8b 4a 6a 27 ec 15 5a 69 a3 bd    |  U.QO.m.Jj'..Zi..
cd e0 f3 ed 53 7e 1f 2e 55 f4 b3 ed 6e ee a0 f2    |  ....S~..U...n...
33 b4 4c 66 30 f1 b4 1c 88 67 17 04 ca af a3 f6    |  3.Lf0....g......
31 6e be 53 b8 7f a7 c4 b9 0c dd b6 35 7a 42 62    |  1n.S.......5zBb
6c 6a 25 3a 07 7d 96 4e 08 f6 b8 ad a2 4f e0 91    |  lj%:.}.N.....O..
6b 07 c3 fb be 4d 73 7d d9 6b 58 ed aa ba e1 ad    |  k....Ms}.kX.....
57 09 d2 34 16 98 1c 6f eb 4d 1e 1d                |  W..4...o.M..

 RECV PACKET from 86.98.64.17
ISAKMP Header
  Initiator COOKIE: ea fb 64 63 6d ae 73 cd
  Responder COOKIE: 35 19 32 a9 bf e1 39 1d
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Quick Mode
  Flags: (Encryption)
  MessageID: 7D7FF4F5
  Length: 284
May 13 22:05:38 [IKEv1]: IP = 86.98.64.17, Received encrypted packet with no matching SA, dropping


IKE Recv RAW packet dump
60 0a 9c 70 78 e3 80 f7 94 d0 b2 d3 fb 37 de 91    |  `..px........7..
08 10 20 01 01 f4 16 63 00 00 01 1c 65 3c 23 16    |  .. ....c....e<#.
33 18 f0 31 b4 90 3b d0 e8 29 fb 1c 9c 76 0c 88    |  3..1..;..)...v..
17 16 47 25 6e f4 c0 22 a1 52 6e 8f 1e 6b f5 64    |  ..G%n..".Rn..k.d
90 0c da 95 c4 5f 3d 86 5f b1 88 6c 6d d3 bf 49    |  ....._=._..lm..I
da ff ad 42 d1 df fb 02 d7 86 ea 0c bb 7f d8 8d    |  ...B...........
38 bc 45 93 56 d9 ee b7 a0 ee 39 b4 58 eb 32 5c    |  8.E.V.....9.X.2\
d2 99 3d f8 82 ad 92 46 15 9e d0 a9 8f 8d bc ce    |  ..=....F........
c4 6f 8b 5c 41 a3 69 47 c5 2f 90 b5 1a 84 ba 99    |  .o.\A.iG./......
77 16 93 5f 84 55 a4 6e 6b 6d 97 89 a6 48 0f 82    |  w.._.U.nkm...H..
60 ca 8d 4a 1d 79 ca 33 f7 df c4 90 bb d6 22 87    |  `..J.y.3......".
e5 20 68 9a 46 51 b6 70 e8 06 71 02 0e da 93 c4    |  . h.FQ.p..q.....
d9 50 c0 4c 3e e9 3c 63 98 44 17 48 43 4c 3f 0f    |  .P.L>.<c.D.HCL?.
42 d6 d9 7c 96 d9 5c 59 4c ab 0a 04 05 c6 3d 34    |  B..|..\YL.....=4
1a 32 c8 0f 23 72 b9 d8 83 45 61 7c b8 82 24 62    |  .2..#r...Ea|..$b
04 fd 16 04 78 47 b8 5c 3a 74 ad 58 48 6d fa b1    |  ....xG.\:t.XHm..
12 87 87 48 90 9d 74 62 d6 90 f2 2d 3f 05 8b b2    |  ...H..tb...-?...
6f 11 68 be b7 bf 69 8d 3e 08 59 da                |  o.h...i.>.Y.

 RECV PACKET from 86.98.64.17
ISAKMP Header
  Initiator COOKIE: 60 0a 9c 70 78 e3 80 f7
  Responder COOKIE: 94 d0 b2 d3 fb 37 de 91
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Quick Mode
  Flags: (Encryption)
  MessageID: 01F41663
  Length: 284
May 13 22:05:43 [IKEv1]: IP = 86.98.64.17, Received encrypted packet with no matching SA, dropping


IKE Recv RAW packet dump
3d 8f 57 50 f8 1b c6 9a 67 39 08 87 1a 0f 0a d1    |  =.WP....g9......
08 10 20 01 47 24 c2 86 00 00 01 1c 3d d2 44 67    |  .. .G$......=.Dg
ab 8b 19 00 e1 0f 02 28 ef dc 4c 85 40 0d 69 23    |  .......(..L.@.i#
db 77 80 b7 45 d9 8e a0 6f 85 5d 96 c1 30 f5 15    |  .w..E...o.]..0..
fc 64 94 e0 5f ac f5 92 39 af af 54 9f bb 2f 5b    |  .d.._...9..T../[
8c 7c e5 1c 82 0b f6 3f 37 6c 80 2c fa 39 f7 72    |  .|.....?7l.,.9.r
5e 5e 67 20 47 2f ae c0 8f 65 e1 75 9d 9d 4a d2    |  ^^g G/...e.u..J.
e9 1e 72 43 25 a1 80 67 9a 6f a3 4d 97 cb f0 30    |  ..rC%..g.o.M...0
07 d9 97 ec f6 fb 74 7e 31 d7 f5 4f 7f fd 57 38    |  ......t~1..O.W8
4a 3c 95 90 02 4b b0 75 84 96 00 c9 1d b4 a7 8b    |  J<...K.u........
34 be fe 9d ee b3 d4 95 52 a7 c1 c6 61 71 8a e8    |  4.......R...aq..
10 0d c8 2a f5 4a 11 3a 96 8b 8b 9f ae 3e 6b e4    |  ...*.J.:.....>k.
be b6 43 7b d2 59 20 79 96 c2 59 a7 4e fe ae 66    |  ..C{.Y y..Y.N..f
0e 78 b7 46 b9 85 68 4a f2 8b 7a 6a c5 ad d4 98    |  .x.F..hJ..zj....
fc 17 4e c4 23 64 bb a3 c7 f9 ad 8b 8b 61 6a 46    |  ..N.#d.......ajF
f3 ea 7f 26 2c 1d 6e dd c9 dd 7f b9 d5 f9 9d 40    |  ..&,.n.......@
6c 12 80 12 25 da 0d 67 2e d2 c1 1a f3 17 6d 2f    |  l...%..g......m/
b6 28 3f 28 f2 8b 83 eb 90 70 f7 a8                |  .(?(.....p..

 RECV PACKET from 86.98.64.17
ISAKMP Header
  Initiator COOKIE: 3d 8f 57 50 f8 1b c6 9a
  Responder COOKIE: 67 39 08 87 1a 0f 0a d1
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Quick Mode
  Flags: (Encryption)
  MessageID: 4724C286
  Length: 284
May 13 22:05:50 [IKEv1]: IP = 86.98.64.17, Received encrypted packet with no matching SA, dropping


IKE Recv RAW packet dump
60 0a 9c 70 78 e3 80 f7 94 d0 b2 d3 fb 37 de 91    |  `..px........7..
08 10 20 01 01 f4 16 63 00 00 01 1c 65 3c 23 16    |  .. ....c....e<#.
33 18 f0 31 b4 90 3b d0 e8 29 fb 1c 9c 76 0c 88    |  3..1..;..)...v..
17 16 47 25 6e f4 c0 22 a1 52 6e 8f 1e 6b f5 64    |  ..G%n..".Rn..k.d
90 0c da 95 c4 5f 3d 86 5f b1 88 6c 6d d3 bf 49    |  ....._=._..lm..I
da ff ad 42 d1 df fb 02 d7 86 ea 0c bb 7f d8 8d    |  ...B...........
38 bc 45 93 56 d9 ee b7 a0 ee 39 b4 58 eb 32 5c    |  8.E.V.....9.X.2\
d2 99 3d f8 82 ad 92 46 15 9e d0 a9 8f 8d bc ce    |  ..=....F........
c4 6f 8b 5c 41 a3 69 47 c5 2f 90 b5 1a 84 ba 99    |  .o.\A.iG./......
77 16 93 5f 84 55 a4 6e 6b 6d 97 89 a6 48 0f 82    |  w.._.U.nkm...H..
60 ca 8d 4a 1d 79 ca 33 f7 df c4 90 bb d6 22 87    |  `..J.y.3......".
e5 20 68 9a 46 51 b6 70 e8 06 71 02 0e da 93 c4    |  . h.FQ.p..q.....
d9 50 c0 4c 3e e9 3c 63 98 44 17 48 43 4c 3f 0f    |  .P.L>.<c.D.HCL?.
42 d6 d9 7c 96 d9 5c 59 4c ab 0a 04 05 c6 3d 34    |  B..|..\YL.....=4
1a 32 c8 0f 23 72 b9 d8 83 45 61 7c b8 82 24 62    |  .2..#r...Ea|..$b
04 fd 16 04 78 47 b8 5c 3a 74 ad 58 48 6d fa b1    |  ....xG.\:t.XHm..
12 87 87 48 90 9d 74 62 d6 90 f2 2d 3f 05 8b b2    |  ...H..tb...-?...
6f 11 68 be b7 bf 69 8d 3e 08 59 da                |  o.h...i.>.Y.

 RECV PACKET from 86.98.64.17
ISAKMP Header
  Initiator COOKIE: 60 0a 9c 70 78 e3 80 f7
  Responder COOKIE: 94 d0 b2 d3 fb 37 de 91
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Quick Mode
  Flags: (Encryption)
  MessageID: 01F41663
  Length: 284
May 13 22:06:03 [IKEv1]: IP = 86.98.64.17, Received encrypted packet with no matching SA, dropping


IKE Recv RAW packet dump
09 08 d4 01 96 22 1d 3c 00 00 00 00 00 00 00 00    |  .....".<........
01 10 02 00 00 00 00 00 00 00 00 c8 0d 00 00 34    |  ...............4
00 00 00 01 00 00 00 01 00 00 00 28 00 01 00 01    |  ...........(....
00 00 00 20 00 01 00 00 80 0b 00 01 80 0c 0e 10    |  ... ............
80 01 00 01 80 02 00 01 80 03 00 01 80 04 00 02    |  ................
0d 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc    |  ........h...k...
77 57 01 00 0d 00 00 14 4a 13 1c 81 07 03 58 45    |  wW......J.....XE
5c 57 28 f2 0e 95 45 2f 0d 00 00 14 7d 94 19 a6    |  \W(...E/....}...
53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 00 14    |  S..o,....R.V....
cd 60 46 43 35 df 21 f8 7c fd b2 fc 68 b6 a4 48    |  .`FC5.!.|...h..H
0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 81 b5    |  ........>.in.c..
ec 42 7b 1f 00 00 00 14 44 85 15 2d 18 b6 bb cd    |  .B{.....D..-....
0b e8 a8 46 95 79 dd cc                            |  ...F.y..

 RECV PACKET from 86.98.64.17
ISAKMP Header
  Initiator COOKIE: 09 08 d4 01 96 22 1d 3c
  Responder COOKIE: 00 00 00 00 00 00 00 00
  Next Payload: Security Association
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (none)
  MessageID: 00000000
  Length: 200
  Payload Security Association
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 52
    DOI: IPsec
    Situation:(SIT_IDENTITY_ONLY)
    Payload Proposal
      Next Payload: None
      Reserved: 00
      Payload Length: 40
      Proposal #: 0
      Protocol-Id: PROTO_ISAKMP
      SPI Size: 0
      # of transforms: 1
      Payload Transform
        Next Payload: None
        Reserved: 00
        Payload Length: 32
        Transform #: 0
        Transform-Id: KEY_IKE
        Reserved2: 0000
        Life Type: seconds
        Life Duration (Hex): 0e 10
        Encryption Algorithm: DES-CBC
        Hash Algorithm: MD5
        Authentication Method: Preshared key
        Group Description: Group 2
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      cd 60 46 43 35 df 21 f8 7c fd b2 fc 68 b6 a4 48
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 7b 1f
  Payload Vendor ID
    Next Payload: None
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 dd cc
May 13 22:06:18 [IKEv1]: IP = 86.98.64.17, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) +

VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 200
May 13 22:06:18 [IKEv1 DEBUG]: IP = 86.98.64.17, processing SA payload
May 13 22:06:18 [IKEv1 DEBUG]: IP = 86.98.64.17, Oakley proposal is acceptable
May 13 22:06:18 [IKEv1 DEBUG]: IP = 86.98.64.17, processing VID payload
May 13 22:06:18 [IKEv1 DEBUG]: IP = 86.98.64.17, Received DPD VID
May 13 22:06:18 [IKEv1 DEBUG]: IP = 86.98.64.17, processing VID payload
May 13 22:06:18 [IKEv1 DEBUG]: IP = 86.98.64.17, Received NAT-Traversal RFC VID
May 13 22:06:18 [IKEv1 DEBUG]: IP = 86.98.64.17, processing VID payload
May 13 22:06:18 [IKEv1 DEBUG]: IP = 86.98.64.17, Received NAT-Traversal ver 03 VID
May 13 22:06:18 [IKEv1 DEBUG]: IP = 86.98.64.17, processing VID payload
May 13 22:06:18 [IKEv1 DEBUG]: IP = 86.98.64.17, processing VID payload
May 13 22:06:18 [IKEv1 DEBUG]: IP = 86.98.64.17, Received NAT-Traversal ver 02 VID
May 13 22:06:18 [IKEv1 DEBUG]: IP = 86.98.64.17, processing VID payload
May 13 22:06:18 [IKEv1 DEBUG]: IP = 86.98.64.17, processing IKE SA payload
May 13 22:06:18 [IKEv1 DEBUG]: IP = 86.98.64.17, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 3
May 13 22:06:18 [IKEv1 DEBUG]: IP = 86.98.64.17, constructing ISAKMP SA payload
May 13 22:06:18 [IKEv1 DEBUG]: IP = 86.98.64.17, constructing Fragmentation VID + extended capabilities payload
May 13 22:06:18 [IKEv1]: IP = 86.98.64.17, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) +

NONE (0) total length : 104

SENDING PACKET to 86.98.64.17
ISAKMP Header
  Initiator COOKIE: 09 08 d4 01 96 22 1d 3c
  Responder COOKIE: 13 49 3d c6 1e 2e 2f bf
  Next Payload: Security Association
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (none)
  MessageID: 00000000
  Length: 104
  Payload Security Association
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 52
    DOI: IPsec
    Situation:(SIT_IDENTITY_ONLY)
    Payload Proposal
      Next Payload: None
      Reserved: 00
      Payload Length: 40
      Proposal #: 1
      Protocol-Id: PROTO_ISAKMP
      SPI Size: 0
      # of transforms: 1
      Payload Transform
        Next Payload: None
        Reserved: 00
        Payload Length: 32
        Transform #: 0
        Transform-Id: KEY_IKE
        Reserved2: 0000
        Encryption Algorithm: DES-CBC
        Hash Algorithm: MD5
        Group Description: Group 2
        Authentication Method: Preshared key
        Life Type: seconds
        Life Duration (Hex): 0e 10
  Payload Vendor ID
    Next Payload: None
    Reserved: 00
    Payload Length: 24
    Data (In Hex):
      40 48 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 c2 d3
      c0 00 00 00


 ciscoasa(config)# May 13 22:06:26 [IKEv1]: IP = 86.98.64.17, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR +

SA (1) + VENDOR (13) + NONE (0) total length : 104

ISAKMP Header
  Initiator COOKIE: 09 08 d4 01 96 22 1d 3c
  Responder COOKIE: 13 49 3d c6 1e 2e 2f bf
  Next Payload: Security Association
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (none)
  MessageID: 00000000
  Length: 104
  Payload Security Association
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 52
    DOI: IPsec
    Situation:(SIT_IDENTITY_ONLY)
    Payload Proposal
      Next Payload: None
      Reserved: 00
      Payload Length: 40
      Proposal #: 1
      Protocol-Id: PROTO_ISAKMP
      SPI Size: 0
      # of transforms: 1
      Payload Transform
        Next Payload: None
        Reserved: 00
        Payload Length: 32
        Transform #: 0
        Transform-Id: KEY_IKE
        Reserved2: 0000
        Encryption Algorithm: DES-CBC
        Hash Algorithm: MD5
        Group Description: Group 2
        Authentication Method: Preshared key
        Life Type: seconds
        Life Duration (Hex): 0e 10
  Payload Vendor ID
    Next Payload: None
    Reserved: 00
    Payload Length: 24
    Data (In Hex):
      40 48 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 c2 d3
      c0 00 00 00


 ciscoasa(config)#

 ciscoasa(config)#

IKE Recv RAW packet dump
09 08 d4 01 96 22 1d 3c 13 49 3d c6 1e 2e 2f bf    |  .....".<.I=.../.
04 10 02 00 00 00 00 00 00 00 00 b4 0a 00 00 84    |  ................
ab c6 e9 06 f0 98 f2 ed c9 a8 69 91 55 3c fa ab    |  ..........i.U<..
1c 6e c8 ed 72 e5 26 a8 a8 27 fb f3 f7 64 9f 95    |  .n..r.&..'...d..
f7 b5 66 85 aa e9 f1 d7 20 90 d7 d6 10 b8 7c a4    |  ..f..... .....|.
b0 48 c0 1b 03 63 ef 3f 35 93 3a 77 78 60 b5 93    |  .H...c.?5.:wx`..
c7 ee 20 bd 1c 72 a0 d6 3d 0f 7b cb 69 9e b7 d0    |  .. ..r..=.{.i...
69 59 ec 8a d3 f6 c0 60 76 92 c1 a1 4d c1 09 63    |  iY.....`v...M..c
54 a4 c4 d4 c0 f8 6d e7 fe dc e2 c2 53 e7 6a 97    |  T.....m.....S.j.
6d 34 0c c5 58 4c cc 33 ef 57 9a fa d7 35 3a 20    |  m4..XL.3.W...5:
00 00 00 14 e6 6e 66 20 a8 45 c9 a1 71 6e 4a 32    |  .....nf .E..qnJ2
9b e6 7a 70                                        |  ..zp

 RECV PACKET from 86.98.64.17
ISAKMP Header
  Initiator COOKIE: 09 08 d4 01 96 22 1d 3c
  Responder COOKIE: 13 49 3d c6 1e 2e 2f bf
  Next Payload: Key Exchange
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (none)
  MessageID: 00000000
  Length: 180
  Payload Key Exchange
    Next Payload: Nonce
    Reserved: 00
    Payload Length: 132
    Data:
      ab c6 e9 06 f0 98 f2 ed c9 a8 69 91 55 3c fa ab
      1c 6e c8 ed 72 e5 26 a8 a8 27 fb f3 f7 64 9f 95
      f7 b5 66 85 aa e9 f1 d7 20 90 d7 d6 10 b8 7c a4
      b0 48 c0 1b 03 63 ef 3f 35 93 3a 77 78 60 b5 93
      c7 ee 20 bd 1c 72 a0 d6 3d 0f 7b cb 69 9e b7 d0
      69 59 ec 8a d3 f6 c0 60 76 92 c1 a1 4d c1 09 63
      54 a4 c4 d4 c0 f8 6d e7 fe dc e2 c2 53 e7 6a 97
      6d 34 0c c5 58 4c cc 33 ef 57 9a fa d7 35 3a 20
  Payload Nonce
    Next Payload: None
    Reserved: 00
    Payload Length: 20
    Data:
      e6 6e 66 20 a8 45 c9 a1 71 6e 4a 32 9b e6 7a 70
May 13 22:06:29 [IKEv1]: IP = 86.98.64.17, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) +

NONE (0) total length : 180
May 13 22:06:29 [IKEv1 DEBUG]: IP = 86.98.64.17, processing ke payload
May 13 22:06:29 [IKEv1 DEBUG]: IP = 86.98.64.17, processing ISA_KE payload
May 13 22:06:29 [IKEv1 DEBUG]: IP = 86.98.64.17, processing nonce payload
May 13 22:06:29 [IKEv1 DEBUG]: IP = 86.98.64.17, constructing ke payload
May 13 22:06:29 [IKEv1 DEBUG]: IP = 86.98.64.17, constructing nonce payload
May 13 22:06:29 [IKEv1 DEBUG]: IP = 86.98.64.17, constructing Cisco Unity VID payload
May 13 22:06:29 [IKEv1 DEBUG]: IP = 86.98.64.17, constructing xauth V6 VID payload
May 13 22:06:29 [IKEv1 DEBUG]: IP = 86.98.64.17, Send IOS VID
May 13 22:06:29 [IKEv1 DEBUG]: IP = 86.98.64.17, Constructing ASA spoofing IOS Vendor ID payload (version: 1.0.0,

capabilities: 20000001)
May 13 22:06:29 [IKEv1 DEBUG]: IP = 86.98.64.17, constructing VID payload
May 13 22:06:29 [IKEv1 DEBUG]: IP = 86.98.64.17, Send Altiga/Cisco VPN3000/Cisco ASA GW VID
May 13 22:06:29 [IKEv1]: IP = 86.98.64.17, Connection landed on tunnel_group DefaultL2LGroup
May 13 22:06:29 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, Generating keys for Responder...
May 13 22:06:29 [IKEv1]: IP = 86.98.64.17, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) +

VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 256

SENDING PACKET to 86.98.64.17
ISAKMP Header
  Initiator COOKIE: 09 08 d4 01 96 22 1d 3c
  Responder COOKIE: 13 49 3d c6 1e 2e 2f bf
  Next Payload: Key Exchange
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (none)
  MessageID: 00000000
  Length: 256
  Payload Key Exchange
    Next Payload: Nonce
    Reserved: 00
    Payload Length: 132
    Data:
      b3 db 5c 90 30 63 da 2c 30 64 57 a3 5f b5 f5 37
      5d d2 cd 0b 08 c2 c7 2e b6 07 3b e0 fc 5b d4 a1
      7d 6d 88 ea 45 35 02 f0 ab 44 00 26 cb d6 f5 31
      10 86 ba d3 19 6f fa aa 97 d8 58 e6 fd 95 32 82
      83 77 bc 94 b8 15 c7 d5 32 8f 67 4a 42 3b e5 d3
      96 72 3e c8 98 c3 53 d9 cd 9f 46 14 b7 aa e8 a8
      fa 17 ef 11 49 ff 4a 7f ec d6 f7 f3 e7 8a 86 2b
      5e 96 db 00 3f 64 46 12 e5 ae db bb cb de e7 10
  Payload Nonce
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 24
    Data:
      89 dd 18 bb 72 db e6 9c 0d 01 5d 97 ae b2 1d 77
      bf 73 a7 db
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      12 f5 f2 8c 45 71 68 a9 70 2d 9f e2 74 cc 01 00
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 12
    Data (In Hex): 09 00 26 89 df d6 b7 12
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      e6 8e 9a db 1e 2f 2f bf 9d 2c 9a f5 21 c8 7b b6
  Payload Vendor ID
    Next Payload: None
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      1f 07 f7 0e aa 65 14 d3 b0 fa 96 54 2a 50 01 00


 ciscoasa(config)#

 ciscoasa(config)#
ISAKMP Header
  Initiator COOKIE: 09 08 d4 01 96 22 1d 3c
  Responder COOKIE: 13 49 3d c6 1e 2e 2f bf
  Next Payload: Key Exchange
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (none)
  MessageID: 00000000
  Length: 256
  Payload Key Exchange
    Next Payload: Nonce
    Reserved: 00
    Payload Length: 132
    Data:
      b3 db 5c 90 30 63 da 2c 30 64 57 a3 5f b5 f5 37
      5d d2 cd 0b 08 c2 c7 2e b6 07 3b e0 fc 5b d4 a1
      7d 6d 88 ea 45 35 02 f0 ab 44 00 26 cb d6 f5 31
      10 86 ba d3 19 6f fa aa 97 d8 58 e6 fd 95 32 82
      83 77 bc 94 b8 15 c7 d5 32 8f 67 4a 42 3b e5 d3
      96 72 3e c8 98 c3 53 d9 cd 9f 46 14 b7 aa e8 a8
      fa 17 ef 11 49 ff 4a 7f ec d6 f7 f3 e7 8a 86 2b
      5e 96 db 00 3f 64 46 12 e5 ae db bb cb de e7 10
  Payload Nonce
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 24
    Data:
      89 dd 18 bb 72 db e6 9c 0d 01 5d 97 ae b2 1d 77
      bf 73 a7 db
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      12 f5 f2 8c 45 71 68 a9 70 2d 9f e2 74 cc 01 00
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 12
    Data (In Hex): 09 00 26 89 df d6 b7 12
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      e6 8e 9a db 1e 2f 2f bf 9d 2c 9a f5 21 c8 7b b6
  Payload Vendor ID
    Next Payload: None
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      1f 07 f7 0e aa 65 14 d3 b0 fa 96 54 2a 50 01 00


IKE Recv RAW packet dump
09 08 d4 01 96 22 1d 3c 13 49 3d c6 1e 2e 2f bf    |  .....".<.I=.../.
05 10 02 01 00 00 00 00 00 00 00 3c f3 a9 bb aa    |  ...........<....
45 b7 e7 53 f6 2a a8 d6 18 50 2c c6 cd 27 a6 fb    |  E..S.*...P,..'..
85 88 1f 64 95 0a 88 0b ef af 6e f7                |  ...d......n.

 RECV PACKET from 86.98.64.17
ISAKMP Header
  Initiator COOKIE: 09 08 d4 01 96 22 1d 3c
  Responder COOKIE: 13 49 3d c6 1e 2e 2f bf
  Next Payload: Identification
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (Encryption)
  MessageID: 00000000
  Length: 60

AFTER DECRYPTION
ISAKMP Header
  Initiator COOKIE: 09 08 d4 01 96 22 1d 3c
  Responder COOKIE: 13 49 3d c6 1e 2e 2f bf
  Next Payload: Identification
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (Encryption)
  MessageID: 00000000
  Length: 60
  Payload Identification
    Next Payload: Hash
    Reserved: 00
    Payload Length: 12
    ID Type: IPv4 Address (1)
    Protocol ID (UDP/TCP, etc...): 0
    Port: 0
    ID Data: 86.98.64.17
  Payload Hash
    Next Payload: None
    Reserved: 00
    Payload Length: 20
    Data:
      fb 16 14 31 f1 df 66 e8 80 42 53 e1 33 4d 32 ab
May 13 22:06:39 [IKEv1]: IP = 86.98.64.17, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) +

NONE (0) total length : 60
May 13 22:06:39 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing ID payload
May 13 22:06:39 [IKEv1 DECODE]: Group = DefaultL2LGroup, IP = 86.98.64.17, ID_IPV4_ADDR ID received
86.98.64.17
May 13 22:06:39 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing hash payload
May 13 22:06:39 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, Computing hash for ISAKMP
May 13 22:06:39 [IKEv1]: IP = 86.98.64.17, Connection landed on tunnel_group DefaultL2LGroup
May 13 22:06:39 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, Freeing previously allocated memory for

authorization-dn-attributes
May 13 22:06:39 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing ID payload
May 13 22:06:39 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing hash payload
May 13 22:06:39 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, Computing hash for ISAKMP
May 13 22:06:39 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing dpd vid payload
May 13 22:06:39 [IKEv1]: IP = 86.98.64.17, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) +

VENDOR (13) + NONE (0) total length : 80

BEFORE ENCRYPTION
RAW PACKET DUMP on SEND
09 08 d4 01 96 22 1d 3c 13 49 3d c6 1e 2e 2f bf    |  .....".<.I=.../.
05 10 02 00 00 00 00 00 1c 00 00 00 08 00 00 0c    |  ................
01 11 01 f4 53 6f 32 92 0d 00 00 14 ad a4 45 db    |  ....So2.......E.
a7 50 03 ba ba 25 5d 99 f7 48 87 a2 00 00 00 14    |  .P...%]..H......
af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00    |  ....h...k...wW..

ISAKMP Header
  Initiator COOKIE: 09 08 d4 01 96 22 1d 3c
  Responder COOKIE: 13 49 3d c6 1e 2e 2f bf
  Next Payload: Identification
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (none)
  MessageID: 00000000
  Length: 469762048
  Payload Identification
    Next Payload: Hash
    Reserved: 00
    Payload Length: 12
    ID Type: IPv4 Address (1)
    Protocol ID (UDP/TCP, etc...): 17
    Port: 500
    ID Data: 83.xxx.xx.146
  Payload Hash
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data:
      ad a4 45 db a7 50 03 ba ba 25 5d 99 f7 48 87 a2
  Payload Vendor ID
    Next Payload: None
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00

SENDING PACKET to 86.98.64.17
ISAKMP Header
  Initiator COOKIE: 09 08 d4 01 96 22 1d 3c
  Responder COOKIE: 13 49 3d c6 1e 2e 2f bf
  Next Payload: Identification
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (Encryption)
  MessageID: 00000000
  Length: 84
May 13 22:06:39 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, PHASE 1 COMPLETED
May 13 22:06:39 [IKEv1]: IP = 86.98.64.17, Keep-alive type for this connection: DPD
May 13 22:06:39 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, Starting P1 rekey timer: 2700 seconds.


IKE Recv RAW packet dump
09 08 d4 01 96 22 1d 3c 13 49 3d c6 1e 2e 2f bf    |  .....".<.I=.../.
08 10 20 01 58 75 b4 89 00 00 01 1c 8c ad 16 93    |  .. .Xu..........
87 35 67 8f d7 e0 e5 05 eb 53 1b 41 9b 2e f2 5a    |  .5g......S.A...Z
cc c0 4e ab 1c b7 4f 16 29 23 74 b0 27 0d f9 6d    |  ..N...O.)#t.'..m
15 f3 af 23 cb 65 b2 99 fd 7a ee 94 62 e8 45 dd    |  ...#.e...z..b.E.
81 23 fe 47 57 32 be 96 8f a1 de 05 4c 01 27 e5    |  .#.GW2......L.'.
31 57 b6 f8 66 a6 b4 22 f0 62 fe d5 b9 22 f8 26    |  1W..f..".b...".&
dd d7 32 16 64 ff 5b 78 cd 37 6e 7a a6 7c 87 65    |  ..2.d.[x.7nz.|.e
05 ba 1c a0 70 13 56 5d 0d 82 b0 26 5e d5 22 8c    |  ....p.V]...&^.".
31 83 40 74 f3 2a 15 d5 8a bb 5b 5f 03 37 2b 47    |  1.@t.*....[_.7+G
a4 6f e5 68 7e 5a ca 9b 86 83 88 b9 ba 23 d1 8a    |  .o.h~Z.......#..
24 16 85 d4 9b f9 65 c8 25 6d e2 61 1b ff 48 ce    |  $.....e.%m.a..H.
17 b3 0d c3 d0 82 d5 43 58 6b 9c 8c 15 67 f3 0c    |  .......CXk...g..
32 0f d7 34 53 2a 18 cd 6c 04 8d dc 2d bb 1b 20    |  2..4S*..l...-..
ef 09 f0 cd fc 0e c2 74 6f 1f 00 27 0f 29 3c 9d    |  .......to..'.)<.
ac 25 ca 42 2a b9 c6 c0 83 52 85 b6 54 18 af 8d    |  .%.B*....R..T...
3e 24 0e 5b 7d ab f6 25 6b 1b cb 6d 4e cf 9e 0b    |  >$.[}..%k..mN...
75 93 3a 57 85 2e 1a 38 87 e6 2e b6                |  u.:W...8....

 RECV PACKET from 86.98.64.17
ISAKMP Header
  Initiator COOKIE: 09 08 d4 01 96 22 1d 3c
  Responder COOKIE: 13 49 3d c6 1e 2e 2f bf
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Quick Mode
  Flags: (Encryption)
  MessageID: 5875B489
  Length: 284
May 13 22:06:39 [IKEv1 DECODE]: IP = 86.98.64.17, IKE Responder starting QM: msg id = 5875b489

AFTER DECRYPTION
ISAKMP Header
  Initiator COOKIE: 09 08 d4 01 96 22 1d 3c
  Responder COOKIE: 13 49 3d c6 1e 2e 2f bf
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Quick Mode
  Flags: (Encryption)
  MessageID: 5875B489
  Length: 284
  Payload Hash
    Next Payload: Security Association
    Reserved: 00
    Payload Length: 20
    Data:
      ef f2 15 6c 1f 3f 3f a3 9e e0 ee d2 d4 78 02 7c
  Payload Security Association
    Next Payload: Nonce
    Reserved: 00
    Payload Length: 52
    DOI: IPsec
    Situation:(SIT_IDENTITY_ONLY)
    Payload Proposal
      Next Payload: None
      Reserved: 00
      Payload Length: 40
      Proposal #: 0
      Protocol-Id: PROTO_IPSEC_ESP
      SPI Size: 4
      # of transforms: 1
      SPI: f8 77 5d 37
      Payload Transform
        Next Payload: None
        Reserved: 00
        Payload Length: 28
        Transform #: 0
        Transform-Id: ESP_DES
        Reserved2: 0000
        Group Description: Group 2
        Encapsulation Mode: Tunnel
        Life Type: Seconds
        Life Duration (Hex): 0e 10
        Authentication Algorithm: MD5
  Payload Nonce
    Next Payload: Key Exchange
    Reserved: 00
    Payload Length: 20
    Data:
      c7 78 67 be 63 7b 82 42 49 d8 31 29 b0 05 d3 0c
  Payload Key Exchange
    Next Payload: Identification
    Reserved: 00
    Payload Length: 132
    Data:
      d1 04 29 39 c5 8c a9 e3 97 b2 2a 10 0f 35 31 8f
      d4 1c f5 95 b2 62 08 bd 5c 09 2f 5e 2b 8f 00 a7
      4c ff ac 52 c3 38 65 3f 42 ba 33 94 5c 27 48 63
      14 36 68 ba 5b a7 1a 75 ed c4 e2 3d 5f 94 eb aa
      b9 c0 3c 35 b8 67 f6 6a 13 a7 6b 69 7f cd 75 ef
      81 fd db ab d1 64 72 20 37 e1 01 55 ba 23 77 3e
      81 79 eb e2 2c 68 1d de d4 57 54 41 79 12 8a a0
      a1 c9 98 48 0f ab 4e be 54 a3 ae 30 d8 41 2f 8b
  Payload Identification
    Next Payload: Identification
    Reserved: 00
    Payload Length: 16
    ID Type: IPv4 Subnet (4)
    Protocol ID (UDP/TCP, etc...): 0
    Port: 0
    ID Data: 192.168.5.0/255.255.255.0
  Payload Identification
    Next Payload: None
    Reserved: 00
    Payload Length: 16
    ID Type: IPv4 Subnet (4)
    Protocol ID (UDP/TCP, etc...): 0
    Port: 0
    ID Data: 10.100.1.0/255.255.255.0
May 13 22:06:39 [IKEv1]: IP = 86.98.64.17, IKE_DECODE RECEIVED Message (msgid=5875b489) with payloads : HDR + HASH (8) + SA

(1) + NONCE (10) + KE (4) + ID (5) + ID (5) + NONE (0) total length : 284
May 13 22:06:39 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing hash payload
May 13 22:06:39 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing SA payload
May 13 22:06:39 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing nonce payload
May 13 22:06:39 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing ke payload
May 13 22:06:39 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing ISA_KE for PFS in phase 2
May 13 22:06:39 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing ID payload
May 13 22:06:39 [IKEv1 DECODE]: Group = DefaultL2LGroup, IP = 86.98.64.17, ID_IPV4_ADDR_SUBNET ID

received--192.168.5.0--255.255.255.0
May 13 22:06:39 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, Received remote IP Proxy Subnet data in ID Payload:  

Address 192.168.5.0, Mask 255.255.255.0, Protocol 0, Port 0
May 13 22:06:39 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing ID payload
May 13 22:06:39 [IKEv1 DECODE]: Group = DefaultL2LGroup, IP = 86.98.64.17, ID_IPV4_ADDR_SUBNET ID

received--10.100.1.0--255.255.255.0
May 13 22:06:39 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, Received local IP Proxy Subnet data in ID Payload:  

Address 10.100.1.0, Mask 255.255.255.0, Protocol 0, Port 0
May 13 22:06:39 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, QM IsRekeyed old sa not found by addr
May 13 22:06:39 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, Static Crypto Map check, checking map = maptocr, seq =

1...
May 13 22:06:39 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, Static Crypto Map check, map = maptocr, seq = 1, no ACL

configured
May 13 22:06:39 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, IKE Remote Peer configured for crypto map: asatocr_dmap
May 13 22:06:39 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, processing IPSec SA payload
May 13 22:06:39 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, All IPSec SA proposals found unacceptable!
May 13 22:06:39 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, sending notify message
May 13 22:06:39 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing blank hash payload
May 13 22:06:39 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing ipsec notify payload for msg id

5875b489
May 13 22:06:39 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing qm hash payload
May 13 22:06:39 [IKEv1]: IP = 86.98.64.17, IKE_DECODE SENDING Message (msgid=7141e3b8) with payloads : HDR + HASH (8) +

NOTIFY (11) + NONE (0) total length : 80

BEFORE ENCRYPTION
RAW PACKET DUMP on SEND
09 08 d4 01 96 22 1d 3c 13 49 3d c6 1e 2e 2f bf    |  .....".<.I=.../.
08 10 05 00 b8 e3 41 71 1c 00 00 00 0b 00 00 14    |  ......Aq........
bd 5c 23 13 f4 92 8c 16 7b c6 33 6e 91 f4 21 a1    |  .\#.....{.3n..!.
00 00 00 20 00 00 00 01 03 10 00 0e 09 08 d4 01    |  ... ............
96 22 1d 3c 13 49 3d c6 1e 2e 2f bf 58 75 b4 89    |  .".<.I=.../.Xu..

ISAKMP Header
  Initiator COOKIE: 09 08 d4 01 96 22 1d 3c
  Responder COOKIE: 13 49 3d c6 1e 2e 2f bf
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Informational
  Flags: (none)
  MessageID: B8E34171
  Length: 469762048
  Payload Hash
    Next Payload: Notification
    Reserved: 00
    Payload Length: 20
    Data:
      bd 5c 23 13 f4 92 8c 16 7b c6 33 6e 91 f4 21 a1
  Payload Notification
    Next Payload: None
    Reserved: 00
    Payload Length: 32
    DOI: IPsec
    Protocol-ID: PROTO_IPSEC_ESP
    Spi Size: 16
    Notify Type: NO_PROPOSAL_CHOSEN
    SPI:
      09 08 d4 01 96 22 1d 3c 13 49 3d c6 1e 2e 2f bf
    Data: 58 75 b4 89

ISAKMP Header
  Initiator COOKIE: 09 08 d4 01 96 22 1d 3c
  Responder COOKIE: 13 49 3d c6 1e 2e 2f bf
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Informational
  Flags: (Encryption)
  MessageID: 7141E3B8
  Length: 84
May 13 22:06:39 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, QM FSM error (P2 struct &0x3a4cf10, mess id 0x5875b489)!
May 13 22:06:39 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, IKE QM Responder FSM error history (struct

&0x3a4cf10)  <state>, <event>:  QM_DONE, EV_ERROR-->QM_BLD_MSG2, EV_NEGO_SA-->QM_BLD_MSG2, EV_IS_REKEY-->QM_BLD_MSG2,

EV_CONFIRM_SA-->QM_BLD_MSG2, EV_PROC_MSG-->QM_BLD_MSG2, EV_HASH_OK-->QM_BLD_MSG2, NullEvent-->QM_BLD_MSG2, EV_COMP_HASH
May 13 22:06:39 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, sending delete/delete with reason message
May 13 22:06:39 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, Removing peer from correlator table failed, no match!
May 13 22:06:39 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, Could not delete route for L2L peer that came in on a

dynamic map. address: 192.168.5.0, mask: 255.0.0.0
May 13 22:06:39 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, IKE SA MM:c63d4913 rcv'd Terminate: state MM_ACTIVE

 flags 0x00000042, refcnt 1, tuncnt 0
May 13 22:06:39 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, IKE SA MM:c63d4913 terminating:  flags 0x01000002,

refcnt 0, tuncnt 0
May 13 22:06:39 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, sending delete/delete with reason message
May 13 22:06:39 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing blank hash payload
May 13 22:06:39 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing IKE delete payload
May 13 22:06:39 [IKEv1 DEBUG]: Group = DefaultL2LGroup, IP = 86.98.64.17, constructing qm hash payload
May 13 22:06:39 [IKEv1]: IP = 86.98.64.17, IKE_DECODE SENDING Message (msgid=531dfa40) with payloads : HDR + HASH (8) +

DELETE (12) + NONE (0) total length : 76

BEFORE ENCRYPTION
RAW PACKET DUMP on SEND
09 08 d4 01 96 22 1d 3c 13 49 3d c6 1e 2e 2f bf    |  .....".<.I=.../.
08 10 05 00 40 fa 1d 53 1c 00 00 00 0c 00 00 14    |  ....@..S........
e7 6d 77 b4 24 48 75 ef 68 bb ed 7e c1 bc 10 99    |  .mw.$Hu.h..~....
00 00 00 1c 00 00 00 01 01 10 00 01 09 08 d4 01    |  ................
96 22 1d 3c 13 49 3d c6 1e 2e 2f bf                |  .".<.I=.../.

ISAKMP Header
  Initiator COOKIE: 09 08 d4 01 96 22 1d 3c
  Responder COOKIE: 13 49 3d c6 1e 2e 2f bf
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Informational
  Flags: (none)
  MessageID: 40FA1D53
  Length: 469762048
  Payload Hash
    Next Payload: Delete
    Reserved: 00
    Payload Length: 20
    Data:
      e7 6d 77 b4 24 48 75 ef 68 bb ed 7e c1 bc 10 99
  Payload Delete
    Next Payload: None
    Reserved: 00
    Payload Length: 28
    DOI: IPsec
    Protocol-ID: PROTO_ISAKMP
    Spi Size: 16
    # of SPIs: 1
    SPI (Hex dump):
      09 08 d4 01 96 22 1d 3c 13 49 3d c6 1e 2e 2f bf

ISAKMP Header
  Initiator COOKIE: 09 08 d4 01 96 22 1d 3c
  Responder COOKIE: 13 49 3d c6 1e 2e 2f bf
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Informational
  Flags: (Encryption)
  MessageID: 531DFA40
  Length: 76


IKE Recv RAW packet dump
09 08 d4 01 96 22 1d 3c 13 49 3d c6 1e 2e 2f bf    |  .....".<.I=.../.
08 10 05 01 cd b9 8f 61 00 00 00 4c c2 d3 68 16    |  .......a...L..h.
28 0c f2 fe 08 9d a6 0b e2 aa a7 e4 80 ef 95 63    |  (..............c
5a 7c 10 b2 1d a7 b6 f5 bf f3 56 94 55 37 92 50    |  Z|........V.U7.P
5d 33 c5 ce 62 d8 9c f3 21 a0 85 86                |  ]3..b...!...

 RECV PACKET from 86.98.64.17
ISAKMP Header
  Initiator COOKIE: 09 08 d4 01 96 22 1d 3c
  Responder COOKIE: 13 49 3d c6 1e 2e 2f bf
  Next Payload: Hash
  Version: 1.0
  Exchange Type: Informational
  Flags: (Encryption)
  MessageID: CDB98F61
  Length: 76
May 13 22:06:39 [IKEv1]: IP = 86.98.64.17, Received encrypted packet with no matching SA, dropping


IKE Recv RAW packet dump
7a 6e a8 1e d8 39 13 4a 00 00 00 00 00 00 00 00    |  zn...9.J........
01 10 02 00 00 00 00 00 00 00 00 c8 0d 00 00 34    |  ...............4
00 00 00 01 00 00 00 01 00 00 00 28 00 01 00 01    |  ...........(....
00 00 00 20 00 01 00 00 80 0b 00 01 80 0c 0e 10    |  ... ............
80 01 00 01 80 02 00 01 80 03 00 01 80 04 00 02    |  ................
0d 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc    |  ........h...k...
77 57 01 00 0d 00 00 14 4a 13 1c 81 07 03 58 45    |  wW......J.....XE
5c 57 28 f2 0e 95 45 2f 0d 00 00 14 7d 94 19 a6    |  \W(...E/....}...
53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 00 14    |  S..o,....R.V....
cd 60 46 43 35 df 21 f8 7c fd b2 fc 68 b6 a4 48    |  .`FC5.!.|...h..H
0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 81 b5    |  ........>.in.c..
ec 42 7b 1f 00 00 00 14 44 85 15 2d 18 b6 bb cd    |  .B{.....D..-....
0b e8 a8 46 95 79 dd cc                            |  ...F.y..

 RECV PACKET from 86.98.64.17
ISAKMP Header
  Initiator COOKIE: 7a 6e a8 1e d8 39 13 4a
  Responder COOKIE: 00 00 00 00 00 00 00 00
  Next Payload: Security Association
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (none)
  MessageID: 00000000
  Length: 200
  Payload Security Association
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 52
    DOI: IPsec
    Situation:(SIT_IDENTITY_ONLY)
    Payload Proposal
      Next Payload: None
      Reserved: 00
      Payload Length: 40
      Proposal #: 0
      Protocol-Id: PROTO_ISAKMP
      SPI Size: 0
      # of transforms: 1
      Payload Transform
        Next Payload: None
        Reserved: 00
        Payload Length: 32
        Transform #: 0
        Transform-Id: KEY_IKE
        Reserved2: 0000
        Life Type: seconds
        Life Duration (Hex): 0e 10
        Encryption Algorithm: DES-CBC
        Hash Algorithm: MD5
        Authentication Method: Preshared key
        Group Description: Group 2
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      cd 60 46 43 35 df 21 f8 7c fd b2 fc 68 b6 a4 48
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 7b 1f
  Payload Vendor ID
    Next Payload: None
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 dd cc
May 13 22:06:43 [IKEv1]: IP = 86.98.64.17, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) +

VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 200
May 13 22:06:43 [IKEv1 DEBUG]: IP = 86.98.64.17, processing SA payload
May 13 22:06:43 [IKEv1 DEBUG]: IP = 86.98.64.17, Oakley proposal is acceptable
May 13 22:06:43 [IKEv1 DEBUG]: IP = 86.98.64.17, processing VID payload
May 13 22:06:43 [IKEv1 DEBUG]: IP = 86.98.64.17, Received DPD VID
May 13 22:06:43 [IKEv1 DEBUG]: IP = 86.98.64.17, processing VID payload
May 13 22:06:43 [IKEv1 DEBUG]: IP = 86.98.64.17, Received NAT-Traversal RFC VID
May 13 22:06:43 [IKEv1 DEBUG]: IP = 86.98.64.17, processing VID payload
May 13 22:06:43 [IKEv1 DEBUG]: IP = 86.98.64.17, Received NAT-Traversal ver 03 VID
May 13 22:06:43 [IKEv1 DEBUG]: IP = 86.98.64.17, processing VID payload
May 13 22:06:43 [IKEv1 DEBUG]: IP = 86.98.64.17, processing VID payload
May 13 22:06:43 [IKEv1 DEBUG]: IP = 86.98.64.17, Received NAT-Traversal ver 02 VID
May 13 22:06:43 [IKEv1 DEBUG]: IP = 86.98.64.17, processing VID payload
May 13 22:06:43 [IKEv1 DEBUG]: IP = 86.98.64.17, processing IKE SA payload
May 13 22:06:43 [IKEv1 DEBUG]: IP = 86.98.64.17, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 3
May 13 22:06:43 [IKEv1 DEBUG]: IP = 86.98.64.17, constructing ISAKMP SA payload
May 13 22:06:43 [IKEv1 DEBUG]: IP = 86.98.64.17, constructing Fragmentation VID + extended capabilities payload
May 13 22:06:43 [IKEv1]: IP = 86.98.64.17, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) +

NONE (0) total length : 104

SENDING PACKET to 86.98.64.17
ISAKMP Header
  Initiator COOKIE: 7a 6e a8 1e d8 39 13 4a
  Responder COOKIE: 80 09 07 dc fd 9c a3 d2
  Next Payload: Security Association
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (none)
  MessageID: 00000000
  Length: 104
  Payload Security Association
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 52
    DOI: IPsec
    Situation:(SIT_IDENTITY_ONLY)
    Payload Proposal
      Next Payload: None
      Reserved: 00
      Payload Length: 40
      Proposal #: 1
      Protocol-Id: PROTO_ISAKMP
      SPI Size: 0
      # of transforms: 1
      Payload Transform
        Next Payload: None
        Reserved: 00
        Payload Length: 32
        Transform #: 0
        Transform-Id: KEY_IKE
        Reserved2: 0000
        Encryption Algorithm: DES-CBC
        Hash Algorithm: MD5
        Group Description: Group 2
        Authentication Method: Preshared key
        Life Type: seconds
        Life Duration (Hex): 0e 10
  Payload Vendor ID
    Next Payload: None
    Reserved: 00
    Payload Length: 24
    Data (In Hex):
      40 48 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 c2 d3
      c0 00 00 00


 ciscoasa(config)# May 13 22:06:51 [IKEv1]: IP = 86.98.64.17, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR +

SA (1) + VENDOR (13) + NONE (0) total length : 104

ISAKMP Header
  Initiator COOKIE: 7a 6e a8 1e d8 39 13 4a
  Responder COOKIE: 80 09 07 dc fd 9c a3 d2
  Next Payload: Security Association
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (none)
  MessageID: 00000000
  Length: 104
  Payload Security Association
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 52
    DOI: IPsec
    Situation:(SIT_IDENTITY_ONLY)
    Payload Proposal
      Next Payload: None
      Reserved: 00
      Payload Length: 40
      Proposal #: 1
      Protocol-Id: PROTO_ISAKMP
      SPI Size: 0
      # of transforms: 1
      Payload Transform
        Next Payload: None
        Reserved: 00
        Payload Length: 32
        Transform #: 0
        Transform-Id: KEY_IKE
        Reserved2: 0000
        Encryption Algorithm: DES-CBC
        Hash Algorithm: MD5
        Group Description: Group 2
        Authentication Method: Preshared key
        Life Type: seconds
        Life Duration (Hex): 0e 10
  Payload Vendor ID
    Next Payload: None
    Reserved: 00
    Payload Length: 24
    Data (In Hex):
      40 48 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 c2 d3
      c0 00 00 00


 ciscoasa(config)#  
   


0
 

Author Comment

by:pnpking
ID: 24382214
Forgot to mention this, QM FSM error in above output. This is for your knowledge only.

May 13 22:05:08 [IKEv1]: Group = DefaultL2LGroup, IP = 86.98.64.17, QM FSM error (P2 struct &0x3a4cf10, mess id 0x7d7ff4f5)!

Thanks
0
 

Author Comment

by:pnpking
ID: 24382364
Hello
After adding below command, i am able to connect between the site and tunnel shows up and active, but traffic is not passing through the tunnel.

crypto dynamic-map asatocr_dmap 19 set pfs group2

 I am not able to ping to other side firewall or pc. Rest of config is same as above post.

Any help would be appreciated.

Thanks
0
6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

 
LVL 5

Expert Comment

by:ksims1129
ID: 24383899
you do not have a security association lifetime add the following

crypto dynamic-map outside_dyn_map 20 set security-association lifetime seconds 3600

0
 

Author Comment

by:pnpking
ID: 24384206
I have removed the unnecessary configuration, and simplified it. I have added line mentioned by you, I got succeeded to establish the tunnel between Cyberoam and Cisco ASA. I can also see into up and running mode, and can see the subnet defined by the tunnel. Even its inserting reverse route into the routing table. But in the configuration of dynamic vpn to static vpn where can i define the access lists? As though tunnel is established, but Data communication or ping is not working between both networks.

What else configuration should i have to further change?

Thanks


******************CONFIGURATION*************
 

 ciscoasa# show run

: Saved

:

ASA Version 7.2(3) 

!

hostname ciscoasa

domain-name default.domain.invalid

enable password e/2HhAcTQ.AtcDFV encrypted

names

!

interface Vlan1

 nameif inside

 security-level 100

 ip address 10.100.1.254 255.255.255.0 

!

interface Vlan2

 nameif outside

 security-level 0

 ip address 83.xxx.xx.146 255.255.255.240 

!

interface Ethernet0/0

 switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

passwd 2KFQnbNIdI.2KYOU encrypted

boot system disk0:/asa723-k8.bin

ftp mode passive

dns server-group DefaultDNS

 domain-name default.domain.invalid

same-security-traffic permit intra-interface

access-list outside_access_in extended permit tcp any host 83.xxx.xxx.147 eq www inactive 

access-list outside_access_in extended permit tcp any host 83.xxx.xxx.147 eq ftp-data 

access-list outside_access_in extended permit tcp any host 83.xxx.xxx.147 eq ftp 

access-list omnixauhvpn_splitTunnelAcl standard permit 10.100.1.0 255.255.255.0 

access-list inside_nat0_outbound extended permit ip 10.100.1.0 255.255.255.0 172.16.1.0 255.255.255.224 

access-list nonat extended permit ip 10.100.1.0 255.255.255.0 192.168.5.0 255.255.255.0 

pager lines 24
 

               

 logging enable

logging asdm informational

mtu inside 1500

mtu outside 1500

ip local pool vpn-pool 172.16.1.1-172.16.1.20 mask 255.255.255.0

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-523.bin

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list nonat

nat (inside) 1 0.0.0.0 0.0.0.0

static (inside,outside) 83.xxx.xxx.147 10.100.1.10 netmask 255.255.255.255 

access-group outside_access_in in interface outside

route outside 0.0.0.0 0.0.0.0 83.xxx.xxx.145 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout uauth 0:05:00 absolute

http server enable

http 172.16.1.0 255.255.255.0 inside

http 10.100.1.0 255.255.255.0 inside

no snmp-server location
 

               

 no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac 

crypto dynamic-map asatocr_dmap 20 set pfs 

crypto dynamic-map asatocr_dmap 20 set transform-set ESP-DES-MD5

crypto dynamic-map asatocr_dmap 20 set security-association lifetime seconds 3600

crypto dynamic-map asatocr_dmap 20 set reverse-route

crypto map maptocr 20 ipsec-isakmp dynamic asatocr_dmap

crypto map maptocr interface outside

crypto isakmp identity address 

crypto isakmp enable outside

crypto isakmp policy 10

 authentication pre-share

 encryption des

 hash md5

 group 2

 lifetime 3600

crypto isakmp nat-traversal  20

telnet 10.100.1.0 255.255.255.0 inside

telnet timeout 5

ssh timeout 5

console timeout 0

management-access inside

dhcp-client client-id interface inside

dhcpd auto_config outside

!
 

!

class-map inspection_default

 match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

 parameters

  message-length maximum 512

policy-map global_policy

 class inspection_default

  inspect dns preset_dns_map 

  inspect ftp 

  inspect h323 h225 

  inspect h323 ras 

  inspect rsh 

  inspect rtsp 

  inspect esmtp 

  inspect sqlnet 

  inspect skinny 

  inspect sunrpc 

  inspect xdmcp 

  inspect sip 

  inspect netbios 

  inspect tftp 

!

service-policy global_policy global
 

USER INFO DELETED
 

tunnel-group DefaultL2LGroup ipsec-attributes

 pre-shared-key *

prompt hostname context 

Cryptochecksum:65c8d820d4e46667dcb0bc721ed03578

: end
 

 ciscoasa# 
 

*******************DEBUG OUTPUT**************
 
 

ciscoasa# debug icmp trace 255

debug icmp trace enabled at level 255

ciscoasa# ICMP echo request from inside:10.100.1.22 to outside:192.168.5.141 ID=768 seq=24835 len=32

ICMP echo request from inside:10.100.1.22 to outside:192.168.5.141 ID=768 seq=25091 len=32

ICMP echo request from inside:10.100.1.22 to outside:192.168.5.141 ID=768 seq=25347 len=32

ICMP echo request from inside:10.100.1.22 to outside:192.168.5.141 ID=768 seq=25603 len=32
 

ciscoasa# debshow crypto isakmp sa
 

   Active SA: 1

    Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)

Total IKE SA: 1
 

1   IKE Peer: 217.165.129.248

    Type    : L2L             Role    : responder 

    Rekey   : no              State   : MM_ACTIVE 
 

 ciscoasa# 
 

 ciscoasa# show cry
 

 ciscoasa# show crypto ipsec sa

interface: outside

    Crypto map tag: asatocr_dmap, seq num: 20, local addr: 83.xxx.xxx.146
 

      local ident (addr/mask/prot/port): (10.100.1.0/255.255.255.0/0/0)

      remote ident (addr/mask/prot/port): (192.168.5.0/255.255.255.0/0/0)

      current_peer: 217.165.129.248
 

      #pkts encaps: 16, #pkts encrypt: 16, #pkts digest: 16

      #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0

      #pkts compressed: 0, #pkts decompressed: 0

      #pkts not compressed: 16, #pkts comp failed: 0, #pkts decomp failed: 0

      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0

      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0

      #send errors: 0, #recv errors: 0
 

      local crypto endpt.: 83.xxx.xxx.146, remote crypto endpt.: 217.165.129.248
 

      path mtu 1500, ipsec overhead 58, media mtu 1500

      current outbound spi: F0F1225D
 

    inbound esp sas:

      spi: 0x6FA77A77 (1873246839)

         transform: esp-des esp-md5-hmac none 

         in use settings ={L2L, Tunnel, PFS Group 2, }

         slot: 0, conn_id: 26, crypto-map: asatocr_dmap

	 sa timing: remaining key lifetime (sec): 3349

         IV size: 8 bytes

         replay detection support: Y

    outbound esp sas:

      spi: 0xF0F1225D (4042334813)

         transform: esp-des esp-md5-hmac none 

         in use settings ={L2L, Tunnel, PFS Group 2, }

         slot: 0, conn_id: 26, crypto-map: asatocr_dmap

         sa timing: remaining key lifetime (sec): 3347

         IV size: 8 bytes

         replay detection support: Y
 
 

 ciscoasa# show crypto ipsec stats 
 

IPsec Global Statistics

-----------------------

Active tunnels: 1

Previous tunnels: 9

Inbound

    Bytes: 0

    Decompressed bytes: 0

    Packets: 0

    Dropped packets: 0

    Replay failures: 0

    Authentications: 0

    Authentication failures: 0

    Decryptions: 0

    Decryption failures: 0

    Decapsulated fragments needing reassembly: 0

Outbound

    Bytes: 5183

    Uncompressed bytes: 5183

    Packets: 95

    Dropped packets: 0

    Authentications: 95

    Authentication failures: 0

    Encryptions: 95

    Encryption failures: 0
 

               

     Fragmentation successes: 0

        Pre-fragmentation successses: 0

        Post-fragmentation successes: 0

    Fragmentation failures: 0

        Pre-fragmentation failures: 0

        Post-fragmentation failures: 0

    Fragments created: 0

    PMTUs sent: 0

    PMTUs rcvd: 0

Protocol failures: 0

Missing SA failures: 0

System capacity failures: 0
 

************ROUTING TABLE*************

ciscoasa# show route
 

Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP

       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP

       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area

       * - candidate default, U - per-user static route, o - ODR

       P - periodic downloaded static route
 

Gateway of last resort is 83.111.50.145 to network 0.0.0.0
 

C    83.XXX.XXX.144 255.255.255.240 is directly connected, outside

C    127.1.0.0 255.255.0.0 is directly connected, _internal_loopback

S 192.168.5.0 255.255.255.0 [1/0] via 83.XXX.XXX.145,outsid(INJECTED BY IPSEC TUNNEL)

C    10.100.1.0 255.255.255.0 is directly connected, inside

S*   0.0.0.0 0.0.0.0 [1/0] via 83.XXX.XXX145, outside

ciscoasa#

Open in new window

0
 
LVL 5

Expert Comment

by:ksims1129
ID: 24384233
yes your translation is not set up. what are the subnets traffice is flowing between. seperate the traffic by which device the subnets are on
0
 

Author Closing Comment

by:pnpking
ID: 31580885
My vpn got worked after a lots of exercise. There was an accesslist problem for traffic routing, that has been resolved from cyberoam side. now all works good.

thanks for the help.
0

Featured Post

Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

Join & Write a Comment

I've written this article to illustrate how we can implement a Dynamic Multipoint VPN (DMVPN) with both hub and spokes having a dynamically assigned non-broadcast multiple-access (NBMA) network IP (public IP). Here is the basic setup of DMVPN Pha…
When it comes to security, there are always trade-offs between security and convenience/ease of administration. This article examines some of the main pros and cons of using key authentication vs password authentication for hosting an SFTP server.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now