asked on

ASA5505 site-to-site - tunnel up but no decap/decrypt either direction

I've got two ASAs, one with version 9.1(6)8 and the other running version 9.1(6)11

I'm test benching a site-to-site configuration, and have set up a router to simulate the wan:
[F1 outside 172.16.1.2] ------ [172.16.1.1 router 172.16.2.1] ------ [172.16.2.2 F2 outside]

The tunnel builds and transitions to MM_Active if I ping from either inside network, and I see pkts encaps increase as expected with each icmp packet on the firewall connected to the sending device. However, I never see the decrypt packets increase on the either firewall and packet captures on the client machines do not show any traffic whatsoever from the corresponding remote network.

#pkts encaps: 1204, #pkts encrypt: 1204, #pkts digest: 1204
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0

F1 client machine: Windows 7 with firewall configured to allow all traffic to and from 10.0.1.0/24 and 10.0.2.0/24 and a route set:
Destination Netmask Gateway Interface Metric
10.0.2.0 255.255.255.0 10.0.1.1 10.0.1.10 21

F2 client: I'm using a Raspberry Pi without firewall implemented on F2 inside network (10.0.2.10):
10.0.1.0 10.0.2.1 255.255.255.0 UG 0 0 0 eth0
10.0.2.0 * 255.255.255.0 U 0 0 0 eth0

If I capture packets on the client machines I can see their gateways ping them, but pinging from the opposite firewall or the opposite client machines I get nothing.

Here's F1's config

ASA Version 9.1(6)8
!
hostname F1
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
names
!
interface Ethernet0/0
!
interface Ethernet0/1
 shutdown
!
interface Ethernet0/2
 shutdown
!
interface Ethernet0/3
 shutdown
!
interface Ethernet0/4
 shutdown
!
interface Ethernet0/5
 shutdown
!
interface Ethernet0/6
 shutdown
!
interface Ethernet0/7
 switchport access vlan 2
!
interface Vlan1
 nameif outside
 security-level 0
 ip address 172.16.1.2 255.255.255.252
!
interface Vlan2
 nameif inside
 security-level 100
 ip address 10.0.1.1 255.255.255.0
!
boot system disk0:/asa916-8-k8.bin
ftp mode passive
access-list LAN_Traffic extended permit ip 10.0.1.0 255.255.255.0 10.0.2.0 255.255.255.0
pager lines 24
logging enable
logging console warnings
logging monitor debugging
logging buffered debugging
mtu outside 1500
mtu inside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
route outside 0.0.0.0 0.0.0.0 172.16.1.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-reco<wbr ></wbr>rd DfltAccessPolicy
user-identity default-domain LOCAL
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec ikev1 transform-set L2L esp-aes-256 esp-sha-hmac
crypto ipsec security-association pmtu-aging infinite
crypto map L2L 1 match address LAN_Traffic
crypto map L2L 1 set pfs
crypto map L2L 1 set peer 172.16.2.2
crypto map L2L 1 set ikev1 transform-set L2L
crypto map L2L interface outside
crypto ca trustpool policy
crypto ikev1 enable outside
crypto ikev1 policy 1
 authentication pre-share
 encryption aes-256
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 65535
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
telnet timeout 5
ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
tunnel-group 172.16.2.2 type ipsec-l2l
tunnel-group 172.16.2.2 ipsec-attributes
 ikev1 pre-shared-key *****
!
class-map inspection_default
 match default-inspection-traffic<wbr ></wbr>
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect ip-options
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip
  inspect xdmcp
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/it<wbr ></wbr>s/service/<wbr ></wbr>oddce/serv<wbr ></wbr>ices/DDCES<wbr ></wbr>ervice
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily

Open in new window

Here's F2's config

ASA Version 9.1(6)11
!
hostname F2
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
names
!
interface Ethernet0/0
!
interface Ethernet0/1
 shutdown
!
interface Ethernet0/2
 shutdown
!
interface Ethernet0/3
 shutdown
!
interface Ethernet0/4
 shutdown
!
interface Ethernet0/5
 shutdown
!
interface Ethernet0/6
 shutdown
!
interface Ethernet0/7
 switchport access vlan 2
!
interface Vlan1
 nameif outside
 security-level 0
 ip address 172.16.2.2 255.255.255.252
!
interface Vlan2
 nameif inside
 security-level 100
 ip address 10.0.2.1 255.255.255.0
!
boot system disk0:/asa916-11-k8.bin
ftp mode passive
access-list LAN_Traffic extended permit ip 10.0.2.0 255.255.255.0 10.0.1.0 255.255.255.0
pager lines 24
logging console debugging
mtu outside 1500
mtu inside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
route outside 0.0.0.0 0.0.0.0 172.16.2.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec ikev1 transform-set L2L esp-aes-256 esp-sha-hmac
crypto ipsec security-association pmtu-aging infinite
crypto map L2L 1 match address LAN_Traffic
crypto map L2L 1 set pfs
crypto map L2L 1 set peer 172.16.1.2
crypto map L2L 1 set ikev1 transform-set L2L
crypto map L2L interface outside
crypto ca trustpool policy
crypto ikev1 enable outside
crypto ikev1 policy 1
 authentication pre-share
 encryption aes-256
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 65535
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
telnet timeout 5
ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
tunnel-group 172.16.1.2 type ipsec-l2l
tunnel-group 172.16.1.2 ipsec-attributes
 ikev1 pre-shared-key *****
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect ip-options
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip
  inspect xdmcp
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily

Open in new window

Thanks in advance for any help. I've experience with IOS but have just started working with the ASAs, which seem to be a whole 'nother ballgame.

ASKER CERTIFIED SOLUTION

ArchiTech89

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

SOLUTION

bamsi

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

SOLUTION

asavener

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

bildozer

ASKER

Sorry for the delay and thanks for your suggestions. I was stuck in a petro-chem facility all last week.

In your configs, I'm missing the outside interface--where is it assigned? I see that e0/0 isn't shutdown. Is that where outside (via VLAN 1) is assigned? That seems odd to me, but I don't work with the VLANs on 5505s much, so...

Yeah, it seems VLAN 1 is default and doesn't show in the configuration unless it's changed to 2 or higher. I tested this a couple of times as it caught me off guard

Also, I don't see NAT statements for leaving the outside interfaces of the firewalls going towards the router on either side. And if you're NATting (including PAT) on the outside interface, then you have to have a NAT exemption for the traffic through the tunnel. See the following:
ASA CLI Configuration Guide v9.1

Yeah I haven't set up any NAT yet. Wanted to get this going on a clean set of ASAs, and then replicate my production setup and create the site to site again in case I break something.

For troubleshooting, you might make the transform-set name different than the crypto map, but I don't see any problems with what you've got. In fact, it all seems pretty straightforward.

I will do this soon... It would definitely help readability

What syslog messages do you see RE: the tunnel? If you can get into ASDM, you can watch what's happening on the tunnel by monitoring debug messages.

I've included the logs. Thanks a bunch

Add sysopt connection permit-vpn on both ASAs.

I've added that command to both ASAs but haven't seen an change.

It looks like the tunnel establishes without any problems (as far as my limited knowledge can tell).

I went ahead and pinged from the host connected to F1 via 10.0.1.10 to the opposite host at 10.0.2.10 (now Ubuntu so I can run ASDM - my Pi tried, at least). The tunnel established, I canceled the ping and then gave the clear ipsec sa peer command to shut down the tunnel (I entered this at F2).

I set up logging to the console (beforehand) and logged the Putty data because I don't know how to save the output in the ASDM log.

Here's F1's debug log

%ASA-5-752004: Tunnel Manager dispatching a KEY_ACQUIRE message to IKEv1.  Map Tag = L2L.  Map Sequence Number = 1.
%ASA-7-715077: Pitcher: received a key acquire message, spi 0x0
%ASA-5-713041: IP = 172.16.2.2, IKE Initiator: New Phase 1, Intf inside, IKE Peer 172.16.2.2  local Proxy Address 10.0.1.0, remote Proxy Address 10.0.2.0,  Crypto map (L2L)
%ASA-7-715046: IP = 172.16.2.2, constructing ISAKMP SA payload
%ASA-7-715046: IP = 172.16.2.2, constructing NAT-Traversal VID ver 02 payload
%ASA-7-715046: IP = 172.16.2.2, constructing NAT-Traversal VID ver 03 payload
%ASA-7-715046: IP = 172.16.2.2, constructing NAT-Traversal VID ver RFC payload
%ASA-7-715046: IP = 172.16.2.2, constructing Fragmentation VID + extended capabilities payload
%ASA-7-713236: IP = 172.16.2.2, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 208
%ASA-7-609001: Built local-host identity:172.16.1.2
%ASA-7-609001: Built local-host outside:172.16.2.2
%ASA-6-302015: Built outbound UDP connection 131 for outside:172.16.2.2/500 (172.16.2.2/500) to identity:172.16.1.2/500 (172.16.1.2/500)
%ASA-7-713906: IKE Receiver: Packet received on 172.16.1.2:500 from 172.16.2.2:500
%ASA-7-713236: IP = 172.16.2.2, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 132
%ASA-7-715047: IP = 172.16.2.2, processing SA payload
%ASA-7-713906: IP = 172.16.2.2, Oakley proposal is acceptable
%ASA-7-715047: IP = 172.16.2.2, processing VID payload
%ASA-7-715049: IP = 172.16.2.2, Received NAT-Traversal RFC VID
%ASA-7-715047: IP = 172.16.2.2, processing VID payload
%ASA-7-715049: IP = 172.16.2.2, Received Fragmentation VID
%ASA-7-715064: IP = 172.16.2.2, IKE Peer included IKE fragmentation capability flags:  Main Mode:        True  Aggressive Mode:  True
%ASA-7-715046: IP = 172.16.2.2, constructing ke payload
%ASA-7-715046: IP = 172.16.2.2, constructing nonce payload
%ASA-7-715046: IP = 172.16.2.2, constructing Cisco Unity VID payload
%ASA-7-715046: IP = 172.16.2.2, constructing xauth V6 VID payload
%ASA-7-715048: IP = 172.16.2.2, Send IOS VID
%ASA-7-715038: IP = 172.16.2.2, Constructing ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)
%ASA-7-715046: IP = 172.16.2.2, constructing VID payload
%ASA-7-715048: IP = 172.16.2.2, Send Altiga/Cisco VPN3000/Cisco ASA GW VID
%ASA-7-715046: IP = 172.16.2.2, constructing NAT-Discovery payload
%ASA-7-713906: IP = 172.16.2.2, computing NAT Discovery hash
%ASA-7-715046: IP = 172.16.2.2, constructing NAT-Discovery payload
%ASA-7-713906: IP = 172.16.2.2, computing NAT Discovery hash
%ASA-7-713236: IP = 172.16.2.2, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NAT-D (20) + NAT-D (20) + NONE (0) total length : 304
%ASA-7-713906: IKE Receiver: Packet received on 172.16.1.2:500 from 172.16.2.2:500
%ASA-7-713236: IP = 172.16.2.2, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NAT-D (20) + NAT-D (20) + NONE (0) total length : 304
%ASA-7-715047: IP = 172.16.2.2, processing ke payload
%ASA-7-715047: IP = 172.16.2.2, processing ISA_KE payload
%ASA-7-715047: IP = 172.16.2.2, processing nonce payload
%ASA-7-715047: IP = 172.16.2.2, processing VID payload
%ASA-7-715049: IP = 172.16.2.2, Received Cisco Unity client VID
%ASA-7-715047: IP = 172.16.2.2, processing VID payload
%ASA-7-715049: IP = 172.16.2.2, Received xauth V6 VID
%ASA-7-715047: IP = 172.16.2.2, processing VID payload
%ASA-7-715038: IP = 172.16.2.2, Processing VPN3000/ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)
%ASA-7-715047: IP = 172.16.2.2, processing VID payload
%ASA-7-715049: IP = 172.16.2.2, Received Altiga/Cisco VPN3000/Cisco ASA GW VID
%ASA-7-715047: IP = 172.16.2.2, processing NAT-Discovery payload
%ASA-7-713906: IP = 172.16.2.2, computing NAT Discovery hash
%ASA-7-715047: IP = 172.16.2.2, processing NAT-Discovery payload
%ASA-7-713906: IP = 172.16.2.2, computing NAT Discovery hash
%ASA-7-713906: IP = 172.16.2.2, Connection landed on tunnel_group 172.16.2.2
%ASA-7-713906: Group = 172.16.2.2, IP = 172.16.2.2, Generating keys for Initiator...
%ASA-7-715046: Group = 172.16.2.2, IP = 172.16.2.2, constructing ID payload
%ASA-7-715046: Group = 172.16.2.2, IP = 172.16.2.2, constructing hash payload
%ASA-7-715076: Group = 172.16.2.2, IP = 172.16.2.2, Computing hash for ISAKMP
%ASA-7-715034: IP = 172.16.2.2, Constructing IOS keep alive payload: proposal=32767/32767 sec.
%ASA-7-715046: Group = 172.16.2.2, IP = 172.16.2.2, constructing dpd vid payload
%ASA-7-713236: IP = 172.16.2.2, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + IOS KEEPALIVE (128) + VENDOR (13) + NONE (0) total length : 96
%ASA-6-713172: Group = 172.16.2.2, IP = 172.16.2.2, Automatic NAT Detection Status:     Remote end is NOT behind a NAT device     This   end is NOT behind a NAT device
%ASA-7-713906: IKE Receiver: Packet received on 172.16.1.2:500 from 172.16.2.2:500
%ASA-7-713236: IP = 172.16.2.2, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + IOS KEEPALIVE (128) + VENDOR (13) + NONE (0) total length : 96
%ASA-7-715047: Group = 172.16.2.2, IP = 172.16.2.2, processing ID payload
%ASA-7-714011: Group = 172.16.2.2, IP = 172.16.2.2, ID_IPV4_ADDR ID received
172.16.2.2
%ASA-7-715047: Group = 172.16.2.2, IP = 172.16.2.2, processing hash payload
%ASA-7-715076: Group = 172.16.2.2, IP = 172.16.2.2, Computing hash for ISAKMP
%ASA-7-715034: IP = 172.16.2.2, Processing IOS keep alive payload: proposal=32767/32767 sec.
%ASA-7-715047: Group = 172.16.2.2, IP = 172.16.2.2, processing VID payload
%ASA-7-715049: Group = 172.16.2.2, IP = 172.16.2.2, Received DPD VID
%ASA-7-713906: IP = 172.16.2.2, Connection landed on tunnel_group 172.16.2.2
%ASA-6-113009: AAA retrieved default group policy (DfltGrpPolicy) for user = 172.16.2.2
%ASA-7-713906: Group = 172.16.2.2, IP = 172.16.2.2, Oakley begin quick mode
%ASA-7-714002: Group = 172.16.2.2, IP = 172.16.2.2, IKE Initiator starting QM: msg id = 80236beb
%ASA-5-713119: Group = 172.16.2.2, IP = 172.16.2.2, PHASE 1 COMPLETED
%ASA-7-713121: IP = 172.16.2.2, Keep-alive type for this connection: DPD
%ASA-7-715080: Group = 172.16.2.2, IP = 172.16.2.2, Starting P1 rekey timer: 73440 seconds.
%ASA-7-715006: Group = 172.16.2.2, IP = 172.16.2.2, IKE got SPI from key engine: SPI = 0xd3e26e97
%ASA-7-713906: Group = 172.16.2.2, IP = 172.16.2.2, oakley constucting quick mode
%ASA-7-715046: Group = 172.16.2.2, IP = 172.16.2.2, constructing blank hash payload
%ASA-7-715046: Group = 172.16.2.2, IP = 172.16.2.2, constructing IPSec SA payload
%ASA-7-715046: Group = 172.16.2.2, IP = 172.16.2.2, constructing IPSec nonce payload
%ASA-7-715046: Group = 172.16.2.2, IP = 172.16.2.2, constructing pfs ke payload
%ASA-7-715001: Group = 172.16.2.2, IP = 172.16.2.2, constructing proxy ID
%ASA-7-713906: Group = 172.16.2.2, IP = 172.16.2.2, Transmitting Proxy Id:
  Local subnet:  10.0.1.0  mask 255.255.255.0 Protocol 0  Port 0
  Remote subnet: 10.0.2.0  Mask 255.255.255.0 Protocol 0  Port 0
%ASA-7-714007: Group = 172.16.2.2, IP = 172.16.2.2, IKE Initiator sending Initial Contact
%ASA-7-715046: Group = 172.16.2.2, IP = 172.16.2.2, constructing qm hash payload
%ASA-7-714004: Group = 172.16.2.2, IP = 172.16.2.2, IKE Initiator sending 1st QM pkt: msg id = 80236beb
%ASA-7-713236: IP = 172.16.2.2, IKE_DECODE SENDING Message (msgid=80236beb) with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + KE (4) + ID (5) + ID (5) + NOTIFY (11) + NONE (0) total length : 336
%ASA-7-713906: IKE Receiver: Packet received on 172.16.1.2:500 from 172.16.2.2:500
%ASA-7-713236: IP = 172.16.2.2, IKE_DECODE RECEIVED Message (msgid=80236beb) with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + KE (4) + ID (5) + ID (5) + NONE (0) total length : 308
%ASA-7-715047: Group = 172.16.2.2, IP = 172.16.2.2, processing hash payload
%ASA-7-715047: Group = 172.16.2.2, IP = 172.16.2.2, processing SA payload
%ASA-7-715047: Group = 172.16.2.2, IP = 172.16.2.2, processing nonce payload
%ASA-7-715047: Group = 172.16.2.2, IP = 172.16.2.2, processing ke payload
%ASA-7-713906: Group = 172.16.2.2, IP = 172.16.2.2, processing ISA_KE for PFS in phase 2
%ASA-7-715047: Group = 172.16.2.2, IP = 172.16.2.2, processing ID payload
%ASA-7-714011: Group = 172.16.2.2, IP = 172.16.2.2, ID_IPV4_ADDR_SUBNET ID received--10.0.1.0--255.255.255.0
%ASA-7-715047: Group = 172.16.2.2, IP = 172.16.2.2, processing ID payload
%ASA-7-714011: Group = 172.16.2.2, IP = 172.16.2.2, ID_IPV4_ADDR_SUBNET ID received--10.0.2.0--255.255.255.0
%ASA-7-713906: Group = 172.16.2.2, IP = 172.16.2.2, loading all IPSEC SAs
%ASA-7-715001: Group = 172.16.2.2, IP = 172.16.2.2, Generating Quick Mode Key!
%ASA-7-715001: Group = 172.16.2.2, IP = 172.16.2.2, Generating Quick Mode Key!
%ASA-6-602303: IPSEC: An outbound LAN-to-LAN SA (SPI= 0x9AC99D60) between 172.16.1.2 and 172.16.2.2 (user= 172.16.2.2) has been created.
%ASA-5-713049: Group = 172.16.2.2, IP = 172.16.2.2, Security negotiation complete for LAN-to-LAN Group (172.16.2.2)  Initiator, Inbound SPI = 0xd3e26e97, Outbound SPI = 0x9ac99d60
%ASA-7-713906: Group = 172.16.2.2, IP = 172.16.2.2, oakley constructing final quick mode
%ASA-7-714006: Group = 172.16.2.2, IP = 172.16.2.2, IKE Initiator sending 3rd QM pkt: msg id = 80236beb
%ASA-7-713236: IP = 172.16.2.2, IKE_DECODE SENDING Message (msgid=80236beb) with payloads : HDR + HASH (8) + NONE (0) total length : 76
%ASA-7-715007: Group = 172.16.2.2, IP = 172.16.2.2, IKE got a KEY_ADD msg for SA: SPI = 0x9ac99d60
%ASA-6-602303: IPSEC: An inbound LAN-to-LAN SA (SPI= 0xD3E26E97) between 172.16.1.2 and 172.16.2.2 (user= 172.16.2.2) has been created.
%ASA-7-715077: Group = 172.16.2.2, IP = 172.16.2.2, Pitcher: received KEY_UPDATE, spi 0xd3e26e97
%ASA-7-715080: Group = 172.16.2.2, IP = 172.16.2.2, Starting P2 rekey timer: 24480 seconds.
%ASA-5-713120: Group = 172.16.2.2, IP = 172.16.2.2, PHASE 2 COMPLETED (msgid=80236beb)
%ASA-5-752016: IKEv1 was successful at setting up a tunnel.  Map Tag = L2L. Map Sequence Number = 1.
%ASA-7-752002: Tunnel Manager Removed entry.  Map Tag = L2L.  Map Sequence Number = 1.
%ASA-7-609001: Built local-host outside:10.0.2.10
%ASA-6-302020: Built outbound ICMP connection for faddr 10.0.2.10/0 gaddr 10.0.1.10/1 laddr 10.0.1.10/1
%ASA-6-302021: Teardown ICMP connection for faddr 10.0.2.10/0 gaddr 10.0.1.10/1 laddr 10.0.1.10/1
%ASA-7-609002: Teardown local-host outside:10.0.2.10 duration 0:00:02
%ASA-7-715036: Group = 172.16.2.2, IP = 172.16.2.2, Sending keep-alive of type DPD R-U-THERE (seq number 0x8659535)
%ASA-7-715046: Group = 172.16.2.2, IP = 172.16.2.2, constructing blank hash payload
%ASA-7-715046: Group = 172.16.2.2, IP = 172.16.2.2, constructing qm hash payload
%ASA-7-713236: IP = 172.16.2.2, IKE_DECODE SENDING Message (msgid=34ce948) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
%ASA-7-713906: IKE Receiver: Packet received on 172.16.1.2:500 from 172.16.2.2:500
%ASA-7-713236: IP = 172.16.2.2, IKE_DECODE RECEIVED Message (msgid=d30ad884) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
%ASA-7-715047: Group = 172.16.2.2, IP = 172.16.2.2, processing hash payload
%ASA-7-715047: Group = 172.16.2.2, IP = 172.16.2.2, processing notify payload
%ASA-7-715075: Group = 172.16.2.2, IP = 172.16.2.2, Received keep-alive of type DPD R-U-THERE-ACK (seq number 0x8659535)
%ASA-7-715036: Group = 172.16.2.2, IP = 172.16.2.2, Sending keep-alive of type DPD R-U-THERE (seq number 0x8659536)
%ASA-7-715046: Group = 172.16.2.2, IP = 172.16.2.2, constructing blank hash payload
%ASA-7-715046: Group = 172.16.2.2, IP = 172.16.2.2, constructing qm hash payload
%ASA-7-713236: IP = 172.16.2.2, IKE_DECODE SENDING Message (msgid=d03e834c) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
%ASA-7-713906: IKE Receiver: Packet received on 172.16.1.2:500 from 172.16.2.2:500
%ASA-7-713236: IP = 172.16.2.2, IKE_DECODE RECEIVED Message (msgid=2a9fd81c) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
%ASA-7-715047: Group = 172.16.2.2, IP = 172.16.2.2, processing hash payload
%ASA-7-715047: Group = 172.16.2.2, IP = 172.16.2.2, processing notify payload
%ASA-7-715075: Group = 172.16.2.2, IP = 172.16.2.2, Received keep-alive of type DPD R-U-THERE-ACK (seq number 0x8659536)
%ASA-7-715036: Group = 172.16.2.2, IP = 172.16.2.2, Sending keep-alive of type DPD R-U-THERE (seq number 0x8659537)
%ASA-7-715046: Group = 172.16.2.2, IP = 172.16.2.2, constructing blank hash payload
%ASA-7-715046: Group = 172.16.2.2, IP = 172.16.2.2, constructing qm hash payload
%ASA-7-713236: IP = 172.16.2.2, IKE_DECODE SENDING Message (msgid=cd4e656e) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
%ASA-7-713906: IKE Receiver: Packet received on 172.16.1.2:500 from 172.16.2.2:500
%ASA-7-713236: IP = 172.16.2.2, IKE_DECODE RECEIVED Message (msgid=da460c11) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
%ASA-7-715047: Group = 172.16.2.2, IP = 172.16.2.2, processing hash payload
%ASA-7-715047: Group = 172.16.2.2, IP = 172.16.2.2, processing notify payload
%ASA-7-715075: Group = 172.16.2.2, IP = 172.16.2.2, Received keep-alive of type DPD R-U-THERE-ACK (seq number 0x8659537)
%ASA-7-715036: Group = 172.16.2.2, IP = 172.16.2.2, Sending keep-alive of type DPD R-U-THERE (seq number 0x8659538)
%ASA-7-715046: Group = 172.16.2.2, IP = 172.16.2.2, constructing blank hash payload
%ASA-7-715046: Group = 172.16.2.2, IP = 172.16.2.2, constructing qm hash payload
%ASA-7-713236: IP = 172.16.2.2, IKE_DECODE SENDING Message (msgid=59f970f9) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
%ASA-7-713906: IKE Receiver: Packet received on 172.16.1.2:500 from 172.16.2.2:500
%ASA-7-713236: IP = 172.16.2.2, IKE_DECODE RECEIVED Message (msgid=b87c12) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
%ASA-7-715047: Group = 172.16.2.2, IP = 172.16.2.2, processing hash payload
%ASA-7-715047: Group = 172.16.2.2, IP = 172.16.2.2, processing notify payload
%ASA-7-715075: Group = 172.16.2.2, IP = 172.16.2.2, Received keep-alive of type DPD R-U-THERE-ACK (seq number 0x8659538)
%ASA-7-715036: Group = 172.16.2.2, IP = 172.16.2.2, Sending keep-alive of type DPD R-U-THERE (seq number 0x8659539)
%ASA-7-715046: Group = 172.16.2.2, IP = 172.16.2.2, constructing blank hash payload
%ASA-7-715046: Group = 172.16.2.2, IP = 172.16.2.2, constructing qm hash payload
%ASA-7-713236: IP = 172.16.2.2, IKE_DECODE SENDING Message (msgid=130a074d) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
%ASA-7-713906: IKE Receiver: Packet received on 172.16.1.2:500 from 172.16.2.2:500
%ASA-7-713236: IP = 172.16.2.2, IKE_DECODE RECEIVED Message (msgid=d04c7cbb) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
%ASA-7-715047: Group = 172.16.2.2, IP = 172.16.2.2, processing hash payload
%ASA-7-715047: Group = 172.16.2.2, IP = 172.16.2.2, processing notify payload
%ASA-7-715075: Group = 172.16.2.2, IP = 172.16.2.2, Received keep-alive of type DPD R-U-THERE-ACK (seq number 0x8659539)
%ASA-7-715036: Group = 172.16.2.2, IP = 172.16.2.2, Sending keep-alive of type DPD R-U-THERE (seq number 0x865953a)
%ASA-7-715046: Group = 172.16.2.2, IP = 172.16.2.2, constructing blank hash payload
%ASA-7-715046: Group = 172.16.2.2, IP = 172.16.2.2, constructing qm hash payload
%ASA-7-713236: IP = 172.16.2.2, IKE_DECODE SENDING Message (msgid=6cce3) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
%ASA-7-713906: IKE Receiver: Packet received on 172.16.1.2:500 from 172.16.2.2:500
%ASA-7-713236: IP = 172.16.2.2, IKE_DECODE RECEIVED Message (msgid=c6a8e90e) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
%ASA-7-715047: Group = 172.16.2.2, IP = 172.16.2.2, processing hash payload
%ASA-7-715047: Group = 172.16.2.2, IP = 172.16.2.2, processing notify payload
%ASA-7-715075: Group = 172.16.2.2, IP = 172.16.2.2, Received keep-alive of type DPD R-U-THERE-ACK (seq number 0x865953a)
%ASA-7-713906: IKE Receiver: Packet received on 172.16.1.2:500 from 172.16.2.2:500
%ASA-7-713236: IP = 172.16.2.2, IKE_DECODE RECEIVED Message (msgid=9bce2ca7) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 68
%ASA-7-715047: Group = 172.16.2.2, IP = 172.16.2.2, processing hash payload
%ASA-7-713906: Group = 172.16.2.2, IP = 172.16.2.2, processing delete
%ASA-5-713050: Group = 172.16.2.2, IP = 172.16.2.2, Connection terminated for peer 172.16.2.2.  Reason: Peer Terminate  Remote Proxy 10.0.2.0, Local Proxy 10.0.1.0
%ASA-7-713906: Group = 172.16.2.2, IP = 172.16.2.2, Active unit receives a delete event for remote peer 172.16.2.2.

%ASA-7-715009: Group = 172.16.2.2, IP = 172.16.2.2, IKE Deleting SA: Remote Proxy 10.0.2.0, Local Proxy 10.0.1.0
%ASA-7-713906: Group = 172.16.2.2, IP = 172.16.2.2, IKE SA MM:82fa12f4 rcv'd Terminate: state MM_ACTIVE  flags 0x0020c062, refcnt 1, tuncnt 0
%ASA-7-713906: Group = 172.16.2.2, IP = 172.16.2.2, IKE SA MM:82fa12f4 terminating:  flags 0x0120c022, refcnt 0, tuncnt 0
%ASA-7-713906: Group = 172.16.2.2, IP = 172.16.2.2, sending delete/delete with reason message
%ASA-6-602304: IPSEC: An outbound LAN-to-LAN SA (SPI= 0x9AC99D60) between 172.16.1.2 and 172.16.2.2 (user= 172.16.2.2) has been deleted.
%ASA-6-602304: IPSEC: An inbound LAN-to-LAN SA (SPI= 0xD3E26E97) between 172.16.2.2 and 172.16.1.2 (user= 172.16.2.2) has been deleted.
%ASA-7-715046: Group = 172.16.2.2, IP = 172.16.2.2, constructing blank hash payload
%ASA-7-715046: Group = 172.16.2.2, IP = 172.16.2.2, constructing IKE delete payload
%ASA-7-715046: Group = 172.16.2.2, IP = 172.16.2.2, constructing qm hash payload
%ASA-7-713236: IP = 172.16.2.2, IKE_DECODE SENDING Message (msgid=4949fd3c) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 80
%ASA-7-713906: IKE Receiver: Packet received on 172.16.1.2:500 from 172.16.2.2:500
%ASA-7-715077: Pitcher: received key delete msg, spi 0xd3e26e97
%ASA-7-715077: Pitcher: received key delete msg, spi 0xd3e26e97
%ASA-5-713259: Group = 172.16.2.2, IP = 172.16.2.2, Session is being torn down. Reason: User Requested
%ASA-4-113019: Group = 172.16.2.2, Username = 172.16.2.2, IP = 172.16.2.2, Session disconnected. Session Type: LAN-to-LAN, Duration: 0h:01m:08s, Bytes xmt: 60, Bytes rcv: 0, Reason: User Requested
%ASA-7-713906: Ignoring msg to mark SA with dsID 69632 dead because SA deleted

Open in new window

Here's F2's debug log

%ASA-7-609001: Built local-host outside:172.16.1.2
%ASA-7-609001: Built local-host identity:172.16.2.2
%ASA-6-302015: Built inbound UDP connection 787 for outside:172.16.1.2/500 (172.16.1.2/500) to identity:172.16.2.2/500 (172.16.2.2/500)
%ASA-7-713906: IKE Receiver: Packet received on 172.16.2.2:500 from 172.16.1.2:500
%ASA-7-713236: IP = 172.16.1.2, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 208
%ASA-7-715047: IP = 172.16.1.2, processing SA payload
%ASA-7-713906: IP = 172.16.1.2, Oakley proposal is acceptable
%ASA-7-715047: IP = 172.16.1.2, processing VID payload
%ASA-7-715049: IP = 172.16.1.2, Received NAT-Traversal ver 02 VID
%ASA-7-715047: IP = 172.16.1.2, processing VID payload
%ASA-7-715049: IP = 172.16.1.2, Received NAT-Traversal ver 03 VID
%ASA-7-715047: IP = 172.16.1.2, processing VID payload
%ASA-7-715049: IP = 172.16.1.2, Received NAT-Traversal RFC VID
%ASA-7-715047: IP = 172.16.1.2, processing VID payload
%ASA-7-715049: IP = 172.16.1.2, Received Fragmentation VID
%ASA-7-715064: IP = 172.16.1.2, IKE Peer included IKE fragmentation capability flags:  Main Mode:        True  Aggressive Mode:  True
%ASA-7-715047: IP = 172.16.1.2, processing IKE SA payload
%ASA-7-715028: IP = 172.16.1.2, IKE SA Proposal # 1, Transform # 1 acceptable  Matches global IKE entry # 3
%ASA-7-715046: IP = 172.16.1.2, constructing ISAKMP SA payload
%ASA-7-715046: IP = 172.16.1.2, constructing NAT-Traversal VID ver RFC payload
%ASA-7-715046: IP = 172.16.1.2, constructing Fragmentation VID + extended capabilities payload
%ASA-7-713236: IP = 172.16.1.2, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 132
%ASA-7-713906: IKE Receiver: Packet received on 172.16.2.2:500 from 172.16.1.2:500
%ASA-7-713236: IP = 172.16.1.2, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NAT-D (20) + NAT-D (20) + NONE (0) total length : 304
%ASA-7-715047: IP = 172.16.1.2, processing ke payload
%ASA-7-715047: IP = 172.16.1.2, processing ISA_KE payload
%ASA-7-715047: IP = 172.16.1.2, processing nonce payload
%ASA-7-715047: IP = 172.16.1.2, processing VID payload
%ASA-7-715049: IP = 172.16.1.2, Received Cisco Unity client VID
%ASA-7-715047: IP = 172.16.1.2, processing VID payload
%ASA-7-715049: IP = 172.16.1.2, Received xauth V6 VID
%ASA-7-715047: IP = 172.16.1.2, processing VID payload
%ASA-7-715038: IP = 172.16.1.2, Processing VPN3000/ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)
%ASA-7-715047: IP = 172.16.1.2, processing VID payload
%ASA-7-715049: IP = 172.16.1.2, Received Altiga/Cisco VPN3000/Cisco ASA GW VID
%ASA-7-715047: IP = 172.16.1.2, processing NAT-Discovery payload
%ASA-7-713906: IP = 172.16.1.2, computing NAT Discovery hash
%ASA-7-715047: IP = 172.16.1.2, processing NAT-Discovery payload
%ASA-7-713906: IP = 172.16.1.2, computing NAT Discovery hash
%ASA-7-715046: IP = 172.16.1.2, constructing ke payload
%ASA-7-715046: IP = 172.16.1.2, constructing nonce payload
%ASA-7-715046: IP = 172.16.1.2, constructing Cisco Unity VID payload
%ASA-7-715046: IP = 172.16.1.2, constructing xauth V6 VID payload
%ASA-7-715048: IP = 172.16.1.2, Send IOS VID
%ASA-7-715038: IP = 172.16.1.2, Constructing ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)
%ASA-7-715046: IP = 172.16.1.2, constructing VID payload
%ASA-7-715048: IP = 172.16.1.2, Send Altiga/Cisco VPN3000/Cisco ASA GW VID
%ASA-7-715046: IP = 172.16.1.2, constructing NAT-Discovery payload
%ASA-7-713906: IP = 172.16.1.2, computing NAT Discovery hash
%ASA-7-715046: IP = 172.16.1.2, constructing NAT-Discovery payload
%ASA-7-713906: IP = 172.16.1.2, computing NAT Discovery hash
%ASA-7-713906: IP = 172.16.1.2, Connection landed on tunnel_group 172.16.1.2
%ASA-7-713906: Group = 172.16.1.2, IP = 172.16.1.2, Generating keys for Responder...
%ASA-7-713236: IP = 172.16.1.2, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NAT-D (20) + NAT-D (20) + NONE (0) total length : 304
%ASA-7-713906: IKE Receiver: Packet received on 172.16.2.2:500 from 172.16.1.2:500
%ASA-7-713236: IP = 172.16.1.2, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + IOS KEEPALIVE (128) + VENDOR (13) + NONE (0) total length : 96
%ASA-7-715047: Group = 172.16.1.2, IP = 172.16.1.2, processing ID payload
%ASA-7-714011: Group = 172.16.1.2, IP = 172.16.1.2, ID_IPV4_ADDR ID received
172.16.1.2
%ASA-7-715047: Group = 172.16.1.2, IP = 172.16.1.2, processing hash payload
%ASA-7-715076: Group = 172.16.1.2, IP = 172.16.1.2, Computing hash for ISAKMP
%ASA-7-715034: IP = 172.16.1.2, Processing IOS keep alive payload: proposal=32767/32767 sec.
%ASA-7-715047: Group = 172.16.1.2, IP = 172.16.1.2, processing VID payload
%ASA-7-715049: Group = 172.16.1.2, IP = 172.16.1.2, Received DPD VID
%ASA-6-713172: Group = 172.16.1.2, IP = 172.16.1.2, Automatic NAT Detection Status:     Remote end is NOT behind a NAT device     This   end is NOT behind a NAT device
%ASA-7-713906: IP = 172.16.1.2, Connection landed on tunnel_group 172.16.1.2
%ASA-7-715046: Group = 172.16.1.2, IP = 172.16.1.2, constructing ID payload
%ASA-7-715046: Group = 172.16.1.2, IP = 172.16.1.2, constructing hash payload
%ASA-7-715076: Group = 172.16.1.2, IP = 172.16.1.2, Computing hash for ISAKMP
%ASA-7-715034: IP = 172.16.1.2, Constructing IOS keep alive payload: proposal=32767/32767 sec.
%ASA-7-715046: Group = 172.16.1.2, IP = 172.16.1.2, constructing dpd vid payload
%ASA-7-713236: IP = 172.16.1.2, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + IOS KEEPALIVE (128) + VENDOR (13) + NONE (0) total length : 96
%ASA-6-113009: AAA retrieved default group policy (DfltGrpPolicy) for user = 172.16.1.2
%ASA-5-713119: Group = 172.16.1.2, IP = 172.16.1.2, PHASE 1 COMPLETED
%ASA-7-713121: IP = 172.16.1.2, Keep-alive type for this connection: DPD
%ASA-7-715080: Group = 172.16.1.2, IP = 172.16.1.2, Starting P1 rekey timer: 82080 seconds.
%ASA-7-713906: IKE Receiver: Packet received on 172.16.2.2:500 from 172.16.1.2:500
%ASA-7-714003: IP = 172.16.1.2, IKE Responder starting QM: msg id = 80236beb
%ASA-7-713236: IP = 172.16.1.2, IKE_DECODE RECEIVED Message (msgid=80236beb) with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + KE (4) + ID (5) + ID (5) + NOTIFY (11) + NONE (0) total length : 336
%ASA-7-715047: Group = 172.16.1.2, IP = 172.16.1.2, processing hash payload
%ASA-7-715047: Group = 172.16.1.2, IP = 172.16.1.2, processing SA payload
%ASA-7-715047: Group = 172.16.1.2, IP = 172.16.1.2, processing nonce payload
%ASA-7-715047: Group = 172.16.1.2, IP = 172.16.1.2, processing ke payload
%ASA-7-713906: Group = 172.16.1.2, IP = 172.16.1.2, processing ISA_KE for PFS in phase 2
%ASA-7-715047: Group = 172.16.1.2, IP = 172.16.1.2, processing ID payload
%ASA-7-714011: Group = 172.16.1.2, IP = 172.16.1.2, ID_IPV4_ADDR_SUBNET ID received--10.0.1.0--255.255.255.0
%ASA-7-713035: Group = 172.16.1.2, IP = 172.16.1.2, Received remote IP Proxy Subnet data in ID Payload:   Address 10.0.1.0, Mask 255.255.255.0, Protocol 0, Port 0
%ASA-7-715047: Group = 172.16.1.2, IP = 172.16.1.2, processing ID payload
%ASA-7-714011: Group = 172.16.1.2, IP = 172.16.1.2, ID_IPV4_ADDR_SUBNET ID received--10.0.2.0--255.255.255.0
%ASA-7-713034: Group = 172.16.1.2, IP = 172.16.1.2, Received local IP Proxy Subnet data in ID Payload:   Address 10.0.2.0, Mask 255.255.255.0, Protocol 0, Port 0
%ASA-7-715047: Group = 172.16.1.2, IP = 172.16.1.2, processing notify payload
%ASA-7-713906: Group = 172.16.1.2, IP = 172.16.1.2, QM IsRekeyed old sa not found by addr
%ASA-7-713221: Group = 172.16.1.2, IP = 172.16.1.2, Static Crypto Map check, checking map = L2L, seq = 1...
%ASA-7-713225: Group = 172.16.1.2, IP = 172.16.1.2, Static Crypto Map check, map L2L, seq = 1 is a successful match
%ASA-7-713066: Group = 172.16.1.2, IP = 172.16.1.2, IKE Remote Peer configured for crypto map: L2L
%ASA-7-715047: Group = 172.16.1.2, IP = 172.16.1.2, processing IPSec SA payload
%ASA-7-715027: Group = 172.16.1.2, IP = 172.16.1.2, IPSec SA Proposal # 1, Transform # 1 acceptable  Matches global IPSec SA entry # 1
%ASA-7-713906: Group = 172.16.1.2, IP = 172.16.1.2, IKE: requesting SPI!
%ASA-7-715006: Group = 172.16.1.2, IP = 172.16.1.2, IKE got SPI from key engine: SPI = 0x9ac99d60
%ASA-7-713906: Group = 172.16.1.2, IP = 172.16.1.2, oakley constucting quick mode
%ASA-7-715046: Group = 172.16.1.2, IP = 172.16.1.2, constructing blank hash payload
%ASA-7-715046: Group = 172.16.1.2, IP = 172.16.1.2, constructing IPSec SA payload
%ASA-7-715046: Group = 172.16.1.2, IP = 172.16.1.2, constructing IPSec nonce payload
%ASA-7-715046: Group = 172.16.1.2, IP = 172.16.1.2, constructing pfs ke payload
%ASA-7-715001: Group = 172.16.1.2, IP = 172.16.1.2, constructing proxy ID
%ASA-7-713906: Group = 172.16.1.2, IP = 172.16.1.2, Transmitting Proxy Id:
  Remote subnet: 10.0.1.0  Mask 255.255.255.0 Protocol 0  Port 0
  Local subnet:  10.0.2.0  mask 255.255.255.0 Protocol 0  Port 0
%ASA-7-715046: Group = 172.16.1.2, IP = 172.16.1.2, constructing qm hash payload
%ASA-7-714005: Group = 172.16.1.2, IP = 172.16.1.2, IKE Responder sending 2nd QM pkt: msg id = 80236beb
%ASA-7-713236: IP = 172.16.1.2, IKE_DECODE SENDING Message (msgid=80236beb) with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + KE (4) + ID (5) + ID (5) + NONE (0) total length : 308
%ASA-7-713906: IKE Receiver: Packet received on 172.16.2.2:500 from 172.16.1.2:500
%ASA-7-713236: IP = 172.16.1.2, IKE_DECODE RECEIVED Message (msgid=80236beb) with payloads : HDR + HASH (8) + NONE (0) total length : 52
%ASA-7-715047: Group = 172.16.1.2, IP = 172.16.1.2, processing hash payload
%ASA-7-713906: Group = 172.16.1.2, IP = 172.16.1.2, loading all IPSEC SAs
%ASA-7-715001: Group = 172.16.1.2, IP = 172.16.1.2, Generating Quick Mode Key!
%ASA-7-715001: Group = 172.16.1.2, IP = 172.16.1.2, Generating Quick Mode Key!
%ASA-5-713049: Group = 172.16.1.2, IP = 172.16.1.2, Security negotiation complete for LAN-to-LAN Group (172.16.1.2)  Responder, Inbound SPI = 0x9ac99d60, Outbound SPI = 0xd3e26e97
%ASA-6-602303: IPSEC: An outbound LAN-to-LAN SA (SPI= 0xD3E26E97) between 172.16.2.2 and 172.16.1.2 (user= 172.16.1.2) has been created.
%ASA-7-715007: Group = 172.16.1.2, IP = 172.16.1.2, IKE got a KEY_ADD msg for SA: SPI = 0xd3e26e97
%ASA-6-602303: IPSEC: An inbound LAN-to-LAN SA (SPI= 0x9AC99D60) between 172.16.2.2 and 172.16.1.2 (user= 172.16.1.2) has been created.
%ASA-7-715077: Group = 172.16.1.2, IP = 172.16.1.2, Pitcher: received KEY_UPDATE, spi 0x9ac99d60
%ASA-7-715080: Group = 172.16.1.2, IP = 172.16.1.2, Starting P2 rekey timer: 27360 seconds.
%ASA-5-713120: Group = 172.16.1.2, IP = 172.16.1.2, PHASE 2 COMPLETED (msgid=80236beb)
%ASA-7-713906: IKE Receiver: Packet received on 172.16.2.2:500 from 172.16.1.2:500
%ASA-7-713236: IP = 172.16.1.2, IKE_DECODE RECEIVED Message (msgid=34ce948) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
%ASA-7-715047: Group = 172.16.1.2, IP = 172.16.1.2, processing hash payload
%ASA-7-715047: Group = 172.16.1.2, IP = 172.16.1.2, processing notify payload
%ASA-7-715075: Group = 172.16.1.2, IP = 172.16.1.2, Received keep-alive of type DPD R-U-THERE (seq number 0x8659535)
%ASA-7-715036: Group = 172.16.1.2, IP = 172.16.1.2, Sending keep-alive of type DPD R-U-THERE-ACK (seq number 0x8659535)
%ASA-7-715046: Group = 172.16.1.2, IP = 172.16.1.2, constructing blank hash payload
%ASA-7-715046: Group = 172.16.1.2, IP = 172.16.1.2, constructing qm hash payload
%ASA-7-713236: IP = 172.16.1.2, IKE_DECODE SENDING Message (msgid=d30ad884) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
%ASA-7-713906: IKE Receiver: Packet received on 172.16.2.2:500 from 172.16.1.2:500
%ASA-7-713236: IP = 172.16.1.2, IKE_DECODE RECEIVED Message (msgid=d03e834c) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
%ASA-7-715047: Group = 172.16.1.2, IP = 172.16.1.2, processing hash payload
%ASA-7-715047: Group = 172.16.1.2, IP = 172.16.1.2, processing notify payload
%ASA-7-715075: Group = 172.16.1.2, IP = 172.16.1.2, Received keep-alive of type DPD R-U-THERE (seq number 0x8659536)
%ASA-7-715036: Group = 172.16.1.2, IP = 172.16.1.2, Sending keep-alive of type DPD R-U-THERE-ACK (seq number 0x8659536)
%ASA-7-715046: Group = 172.16.1.2, IP = 172.16.1.2, constructing blank hash payload
%ASA-7-715046: Group = 172.16.1.2, IP = 172.16.1.2, constructing qm hash payload
%ASA-7-713236: IP = 172.16.1.2, IKE_DECODE SENDING Message (msgid=2a9fd81c) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
%ASA-7-713906: IKE Receiver: Packet received on 172.16.2.2:500 from 172.16.1.2:500
%ASA-7-713236: IP = 172.16.1.2, IKE_DECODE RECEIVED Message (msgid=cd4e656e) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
%ASA-7-715047: Group = 172.16.1.2, IP = 172.16.1.2, processing hash payload
%ASA-7-715047: Group = 172.16.1.2, IP = 172.16.1.2, processing notify payload
%ASA-7-715075: Group = 172.16.1.2, IP = 172.16.1.2, Received keep-alive of type DPD R-U-THERE (seq number 0x8659537)
%ASA-7-715036: Group = 172.16.1.2, IP = 172.16.1.2, Sending keep-alive of type DPD R-U-THERE-ACK (seq number 0x8659537)
%ASA-7-715046: Group = 172.16.1.2, IP = 172.16.1.2, constructing blank hash payload
%ASA-7-715046: Group = 172.16.1.2, IP = 172.16.1.2, constructing qm hash payload
%ASA-7-713236: IP = 172.16.1.2, IKE_DECODE SENDING Message (msgid=da460c11) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
%ASA-7-713906: IKE Receiver: Packet received on 172.16.2.2:500 from 172.16.1.2:500
%ASA-7-713236: IP = 172.16.1.2, IKE_DECODE RECEIVED Message (msgid=59f970f9) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
%ASA-7-715047: Group = 172.16.1.2, IP = 172.16.1.2, processing hash payload
%ASA-7-715047: Group = 172.16.1.2, IP = 172.16.1.2, processing notify payload
%ASA-7-715075: Group = 172.16.1.2, IP = 172.16.1.2, Received keep-alive of type DPD R-U-THERE (seq number 0x8659538)
%ASA-7-715036: Group = 172.16.1.2, IP = 172.16.1.2, Sending keep-alive of type DPD R-U-THERE-ACK (seq number 0x8659538)
%ASA-7-715046: Group = 172.16.1.2, IP = 172.16.1.2, constructing blank hash payload
%ASA-7-715046: Group = 172.16.1.2, IP = 172.16.1.2, constructing qm hash payload
%ASA-7-713236: IP = 172.16.1.2, IKE_DECODE SENDING Message (msgid=b87c12) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
%ASA-7-713906: IKE Receiver: Packet received on 172.16.2.2:500 from 172.16.1.2:500
%ASA-7-713236: IP = 172.16.1.2, IKE_DECODE RECEIVED Message (msgid=130a074d) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
%ASA-7-715047: Group = 172.16.1.2, IP = 172.16.1.2, processing hash payload
%ASA-7-715047: Group = 172.16.1.2, IP = 172.16.1.2, processing notify payload
%ASA-7-715075: Group = 172.16.1.2, IP = 172.16.1.2, Received keep-alive of type DPD R-U-THERE (seq number 0x8659539)
%ASA-7-715036: Group = 172.16.1.2, IP = 172.16.1.2, Sending keep-alive of type DPD R-U-THERE-ACK (seq number 0x8659539)
%ASA-7-715046: Group = 172.16.1.2, IP = 172.16.1.2, constructing blank hash payload
%ASA-7-715046: Group = 172.16.1.2, IP = 172.16.1.2, constructing qm hash payload
%ASA-7-713236: IP = 172.16.1.2, IKE_DECODE SENDING Message (msgid=d04c7cbb) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
clear ipsec sa peer 172.16.%ASA-7-713906: IKE Receiver: Packet received on 172.16.2.2:500 from 172.16.1.2:500
%ASA-7-713236: IP = 172.16.1.2, IKE_DECODE RECEIVED Message (msgid=6cce3) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
%ASA-7-715047: Group = 172.16.1.2, IP = 172.16.1.2, processing hash payload
%ASA-7-715047: Group = 172.16.1.2, IP = 172.16.1.2, processing notify payload
%ASA-7-715075: Group = 172.16.1.2, IP = 172.16.1.2, Received keep-alive of type DPD R-U-THERE (seq number 0x865953a)
%ASA-7-715036: Group = 172.16.1.2, IP = 172.16.1.2, Sending keep-alive of type DPD R-U-THERE-ACK (seq number 0x865953a)
%ASA-7-715046: Group = 172.16.1.2, IP = 172.16.1.2, constructing blank hash payload
%ASA-7-715046: Group = 172.16.1.2, IP = 172.16.1.2, constructing qm hash payload
%ASA-7-713236: IP = 172.16.1.2, IKE_DECODE SENDING Message (msgid=c6a8e90e) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
1.2

F2(config)# %ASA-5-111008: User 'enable_15' executed the 'clear ipsec sa peer 172.16.1.2' command.
%ASA-5-111010: User 'enable_15', running 'CLI' from IP 0.0.0.0, executed 'clear ipsec sa peer 172.16.1.2'
%ASA-7-715077: Group = 172.16.1.2, IP = 172.16.1.2, Pitcher: received key delete msg, spi 0x9ac99d60
%ASA-5-713050: Group = 172.16.1.2, IP = 172.16.1.2, Connection terminated for peer 172.16.1.2.  Reason: Administrator Reset  Remote Proxy 10.0.1.0, Local Proxy 10.0.2.0
%ASA-7-713906: Group = 172.16.1.2, IP = 172.16.1.2, sending delete/delete with reason message
%ASA-7-715046: Group = 172.16.1.2, IP = 172.16.1.2, constructing blank hash payload
%ASA-7-715046: Group = 172.16.1.2, IP = 172.16.1.2, constructing IPSec delete payload
%ASA-7-715046: Group = 172.16.1.2, IP = 172.16.1.2, constructing qm hash payload
%ASA-7-713236: IP = 172.16.1.2, IKE_DECODE SENDING Message (msgid=9bce2ca7) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 68
%ASA-7-713906: Group = 172.16.1.2, IP = 172.16.1.2, Active unit receives a delete event for remote peer 172.16.1.2.

%ASA-7-715009: Group = 172.16.1.2, IP = 172.16.1.2, IKE Deleting SA: Remote Proxy 10.0.1.0, Local Proxy 10.0.2.0
%ASA-7-713906: Group = 172.16.1.2, IP = 172.16.1.2, IKE SA MM:283053a8 rcv'd Terminate: state MM_ACTIVE  flags 0x0021c042, refcnt 1, tuncnt 0
%ASA-7-713906: Group = 172.16.1.2, IP = 172.16.1.2, IKE SA MM:283053a8 terminating:  flags 0x0121c002, refcnt 0, tuncnt 0
%ASA-7-713906: Group = 172.16.1.2, IP = 172.16.1.2, sending delete/delete with reason message
%ASA-6-602304: IPSEC: An outbound LAN-to-LAN SA (SPI= 0xD3E26E97) between 172.16.2.2 and 172.16.1.2 (user= 172.16.1.2) has been deleted.
%ASA-6-602304: IPSEC: An inbound LAN-to-LAN SA (SPI= 0x9AC99D60) between 172.16.1.2 and 172.16.2.2 (user= 172.16.1.2) has been deleted.
%ASA-7-715046: Group = 172.16.1.2, IP = 172.16.1.2, constructing blank hash payload
%ASA-7-715046: Group = 172.16.1.2, IP = 172.16.1.2, constructing IKE delete payload
%ASA-7-715046: Group = 172.16.1.2, IP = 172.16.1.2, constructing qm hash payload
%ASA-7-713236: IP = 172.16.1.2, IKE_DECODE SENDING Message (msgid=420de1fe) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 80
%ASA-7-715077: Pitcher: received key delete msg, spi 0x9ac99d60
%ASA-7-715077: Pitcher: received key delete msg, spi 0x9ac99d60
%ASA-5-713259: Group = 172.16.1.2, IP = 172.16.1.2, Session is being torn down. Reason: Administrator Reset
%ASA-4-113019: Group = 172.16.1.2, Username = 172.16.1.2, IP = 172.16.1.2, Session disconnected. Session Type: LAN-to-LAN, Duration: 0h:01m:07s, Bytes xmt: 0, Bytes rcv: 0, Reason: Administrator Reset
%ASA-7-713906: Ignoring msg to mark SA with dsID 69632 dead because SA deleted
%ASA-7-713906: IKE Receiver: Packet received on 172.16.2.2:500 from 172.16.1.2:500
%ASA-5-713904: IP = 172.16.1.2, Received encrypted packet with no matching SA, dropping
%ASA-6-302010: 3 in use, 184 most used

Open in new window

SOLUTION

asavener

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

bildozer

ASKER

TL;DR - Meraki WAN simulation didn't work. Used an old wireless router instead and voila. Thanks for taking the time to offer some insight. I definitely learned a lot from parsing the debug information and configurations.

I was using a Meraki MX64 to route between the 172.16.1.X and 172.16.2.X, which worked for the most part. While troubleshooting, I noticed that while I saw the ESP traffic in the Meraki packet capture in both directions, the hit counters for the permit any rules did not increase (I had a permit any in both directions and tried playing with using less specific ip/masks and more specific: using /32 and the complete outside IP adddress) . However, pinging from each ASA outside interface to the next did increase the hit counter.

I tried disabling firewall inspection in each VLAN's group policy but still no decaps. I had no NAT set up for these VLANs, and they weren't going outside so there shouldn't have been any by default as far as I understand.

Meraki support worked with me on the counter issue and finally told me that their permit any is actually a permit ICMP, TCP, UDP (the other options in the drop down). I assumed it was like cisco permit IP any. The hit counters were not counting IP protocol 50, and the MX64 was also not allowing it, even with firewall inspection disabled for each VLAN.

Finally I pulled out an old TP-Link wireless router with DD-WRT and configured the WAN and LAN interfaces to route between the ASAs, with the firewall disabled.

Immediately the pings to Ubuntu showed in tcpdump, and the replies show were received on the Windows 7 machine.