This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Release of v17 MR-2?

Hej,

now that MR-1 has appeared, I wanted to ask when MR-2 will appear? The problems and instabilities of IPSec in v17 (especially in connection with V16.5) are very annoying.



This thread was automatically locked due to age.
Parents
  • Just a quick update. I've been working with the GES team, but so far no changes. I was able to upgrade to MR3 and they got the tunnel to establish. It ran for almost a week and then started disconnecting every few hours. High availability completely breaks the tunnel.

     

    The thing that still seems to work, even though it shouldn't, is that if I switch the ipsec profile from Main Mode to Aggressive Mode the tunnel becomes more stable and will only disconnect about once a day rather than every few hours. This is strange because the ASA on the other end is set to Main Mode, and the vpn profile is not even supposed to be compatible with Aggressive Mode. It actually makes the selection list on tunnel profile blank. So this appears to be a definite bug. We're discussing switching back to Cisco. This issue has become a deal breaker for us.

     

    Anyone else had any luck?

  • We're in the same boat.  Not an ASA but connecting to a Cisco Router at HQ.   Disconnects multiple times a day.  In our case the tunnel loses some of it's SA's that get established. Out of 9 SA's  that are part of the tunnel only one or two show green in the vpn connection and the site goes down. A reconnect will re-establish it, but what a pain in the butt. 

     

    If anyone as a rock solid VPN connection to  a cisco device I would love to know what configuration you're using.   

     

    -Scott

     

  • I may have found the answer to this myself. Here's what I just sent back to support. This looks like part of the bug/s.

     

     

    Here’s something else interesting. I switched it back to Main Mode and monitored it with tail -f /log/strongswan.log

     

    The connection established and is currently connected. With Aggressive Mode disabled I did not see any attempts from the ASA using Aggressive Mode.

     

    I also searched the log for the words Main and Aggressive, and it looks like the only time the XG is “thinking” it’s receiving Aggressive Mode initiations from the ASA is when I have set it to Aggressive Mode. Before I switched it to Aggressive Mode there were no Aggressive Mode initiations received, and there haven’t been any since I switched back to Main Mode this morning. It looks like setting it to Aggressive Mode on the XG makes the XG expect to see those packets and so it’s somehow misinterpreting them when the ASA initiates.

     

    If you look at the bottom of this paste you’ll see that those Aggressive Mode initiations started yesterday at exactly the time that I enabled Aggressive Mode on the XG 9:30AM. I emailed you at 9:47AM letting you know that I had switched it to Aggressive Mode. My alert from Solarwinds shows that the tunnel dropped well before that, so the Aggressive Mode initiations were not a cause, but a byproduct of the change. This to me looks like a bug. The XG is misinterpreting these initiations.

     

    2018-01-26 04:15:55 05[IKE] <209> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:16:27 13[IKE] <210> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:16:28 31[IKE] <210> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:17:00 09[IKE] <211> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:17:00 22[IKE] <211> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:17:32 16[IKE] <212> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:17:32 13[IKE] <212> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:18:06 14[IKE] <213> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:18:06 09[IKE] <213> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:18:40 07[IKE] <214> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:18:40 26[IKE] <214> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:19:12 24[IKE] <215> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:19:12 11[IKE] <215> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:19:44 29[IKE] <216> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:19:44 06[IKE] <216> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:20:17 32[IKE] <217> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:20:17 12[IKE] <217> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:20:50 17[IKE] <218> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:20:50 18[IKE] <218> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:21:23 20[IKE] <219> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:21:23 07[IKE] <219> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:21:55 14[IKE] <220> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:21:56 24[IKE] <220> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:22:30 32[IKE] <221> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:22:30 12[IKE] <221> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:23:03 27[IKE] <222> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:23:03 14[IKE] <222> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:23:36 15[IKE] <223> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:23:36 32[IKE] <223> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:24:10 22[IKE] <224> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:24:10 27[IKE] <224> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:24:43 16[IKE] <225> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:24:43 13[IKE] <225> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:25:16 28[IKE] <226> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:25:16 11[IKE] <226> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:25:50 09[IKE] <227> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:25:50 27[IKE] <227> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:26:24 15[IKE] <228> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:26:24 30[IKE] <228> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:26:57 09[IKE] <229> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:26:57 26[IKE] <229> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:27:30 28[IKE] <230> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:27:30 11[IKE] <230> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:28:06 08[IKE] <231> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:28:06 09[IKE] <231> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:28:40 12[IKE] <232> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:28:40 28[IKE] <232> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:29:15 18[IKE] <233> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:29:15 31[IKE] <233> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:29:48 10[IKE] <234> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:29:48 17[IKE] <234> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:30:20 14[IKE] <235> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:30:21 31[IKE] <235> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:30:53 20[IKE] <236> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:30:54 17[IKE] <236> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:31:26 07[IKE] <237> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:31:26 09[IKE] <237> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:31:58 23[IKE] <238> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:31:58 28[IKE] <238> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:32:31 12[IKE] <239> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:32:31 08[IKE] <239> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:33:06 21[IKE] <240> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:33:06 23[IKE] <240> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:33:38 07[IKE] <241> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:33:38 14[IKE] <241> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:34:11 10[IKE] <242> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:34:11 20[IKE] <242> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:34:44 12[IKE] <243> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:34:44 08[IKE] <243> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:35:16 07[IKE] <244> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:35:17 10[IKE] <244> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:35:50 22[IKE] <245> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:35:50 25[IKE] <245> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:36:24 07[IKE] <246> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:36:24 10[IKE] <246> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:36:56 23[IKE] <247> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:36:57 32[IKE] <247> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:37:30 11[IKE] <248> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:37:30 29[IKE] <248> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:38:04 28[IKE] <249> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:38:04 23[IKE] <249> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:38:36 18[IKE] <250> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:38:37 11[IKE] <250> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:39:10 28[IKE] <251> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:39:10 23[IKE] <251> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:39:43 19[IKE] <252> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:39:44 07[IKE] <252> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:40:16 12[IKE] <253> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:40:16 21[IKE] <253> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:40:48 22[IKE] <254> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:40:48 28[IKE] <254> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:41:21 17[IKE] <255> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:41:21 06[IKE] <255> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:41:54 31[IKE] <256> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:41:54 22[IKE] <256> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:42:26 23[IKE] <257> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:42:27 25[IKE] <257> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:43:00 09[IKE] <258> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:43:00 07[IKE] <258> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:43:33 30[IKE] <259> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:43:33 32[IKE] <259> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:44:06 13[IKE] <260> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:44:06 09[IKE] <260> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:44:38 11[IKE] <261> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:44:38 30[IKE] <261> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:45:11 08[IKE] <262> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:45:11 31[IKE] <262> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:45:44 20[IKE] <263> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:45:44 27[IKE] <263> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:46:16 25[IKE] <264> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:46:16 08[IKE] <264> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:46:48 28[IKE] <265> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:46:48 17[IKE] <265> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:47:20 15[IKE] <266> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:47:20 21[IKE] <266> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:47:54 10[IKE] <267> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:47:54 28[IKE] <267> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:48:26 14[IKE] <268> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:48:26 15[IKE] <268> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:48:58 09[IKE] <269> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:48:58 20[IKE] <269> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:49:30 14[IKE] <270> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:49:30 15[IKE] <270> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:50:04 05[IKE] <271> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:50:04 10[IKE] <271> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:50:37 07[IKE] <272> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:50:37 29[IKE] <272> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:51:10 22[IKE] <273> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:51:10 11[IKE] <273> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:51:44 18[IKE] <274> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:51:44 07[IKE] <274> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:52:17 24[IKE] <275> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:52:17 32[IKE] <275> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:52:50 07[IKE] <276> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:52:51 29[IKE] <276> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:53:25 24[IKE] <277> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:53:26 32[IKE] <277> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:53:58 07[IKE] <278> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:53:58 29[IKE] <278> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:54:31 24[IKE] <279> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:54:31 32[IKE] <279> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:55:06 27[IKE] <280> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:55:06 26[IKE] <280> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:55:38 30[IKE] <281> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:55:38 25[IKE] <281> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:56:10 05[IKE] <282> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:56:11 15[IKE] <282> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:56:44 20[IKE] <283> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:56:44 30[IKE] <283> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:57:17 13[IKE] <284> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:57:17 05[IKE] <284> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:57:50 14[IKE] <285> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:57:50 18[IKE] <285> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:58:22 32[IKE] <286> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:58:23 08[IKE] <286> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:58:56 29[IKE] <287> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:58:56 14[IKE] <287> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 04:59:28 13[IKE] <288> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 04:59:28 05[IKE] <288> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:00:00 29[IKE] <289> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:00:01 14[IKE] <289> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:00:33 12[IKE] <290> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:00:33 11[IKE] <290> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:01:06 16[IKE] <291> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:01:06 09[IKE] <291> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:01:38 31[IKE] <292> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:01:38 12[IKE] <292> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:02:10 29[IKE] <293> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:02:11 16[IKE] <293> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:02:44 25[IKE] <294> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:02:45 31[IKE] <294> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:03:17 15[IKE] <295> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:03:17 29[IKE] <295> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:03:50 18[IKE] <296> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:03:50 07[IKE] <296> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:04:23 21[IKE] <297> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:04:23 28[IKE] <297> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:04:56 14[IKE] <298> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:04:56 18[IKE] <298> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:05:28 24[IKE] <299> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:05:28 17[IKE] <299> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:06:01 23[IKE] <300> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:06:01 26[IKE] <300> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:06:33 24[IKE] <301> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:06:33 17[IKE] <301> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:07:06 23[IKE] <303> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:07:06 26[IKE] <303> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:07:41 20[IKE] <304> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:07:41 22[IKE] <304> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:08:15 10[IKE] <305> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:08:15 23[IKE] <305> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:08:47 07[IKE] <306> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:08:47 20[IKE] <306> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:09:21 32[IKE] <307> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:09:21 27[IKE] <307> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:09:53 11[IKE] <308> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:09:53 24[IKE] <308> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:10:26 13[IKE] <309> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:10:26 21[IKE] <309> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:11:01 10[IKE] <310> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:11:01 25[IKE] <310> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:11:33 13[IKE] <311> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:11:33 21[IKE] <311> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:12:06 10[IKE] <313> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:12:06 25[IKE] <313> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:12:41 05[IKE] <314> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:12:41 31[IKE] <314> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:13:13 29[IKE] <315> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:13:13 10[IKE] <315> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:13:46 17[IKE] <316> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:13:46 05[IKE] <316> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:14:21 15[IKE] <317> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:14:21 22[IKE] <317> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:14:53 24[IKE] <318> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:14:54 13[IKE] <318> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:15:26 31[IKE] <319> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:15:26 24[IKE] <319> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:15:59 22[IKE] <320> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:15:59 19[IKE] <320> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:16:31 12[IKE] <321> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:16:31 30[IKE] <321> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:17:04 22[IKE] <322> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:17:04 19[IKE] <322> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:17:36 11[IKE] <323> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:17:36 31[IKE] <323> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:18:11 14[IKE] <324> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:18:11 22[IKE] <324> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:18:14 23[IKE] <325> 12.28.251.138 is initiating a Main Mode IKE_SA

    2018-01-26 05:18:43 27[IKE] <326> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:18:43 15[IKE] <326> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:19:16 13[IKE] <327> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:19:16 11[IKE] <327> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:19:48 15[IKE] <328> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:19:49 14[IKE] <328> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:20:21 19[IKE] <329> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:20:21 08[IKE] <329> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:20:53 28[IKE] <330> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:20:53 24[IKE] <330> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:21:26 19[IKE] <331> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:21:26 08[IKE] <331> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:21:58 28[IKE] <332> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:21:59 24[IKE] <332> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:22:31 23[IKE] <333> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:22:31 29[IKE] <333> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:23:04 10[IKE] <334> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:23:04 25[IKE] <334> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:23:36 21[IKE] <335> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:23:36 23[IKE] <335> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:24:08 31[IKE] <336> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:24:09 10[IKE] <336> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:24:41 22[IKE] <337> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:24:41 21[IKE] <337> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:25:13 14[IKE] <338> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:25:13 20[IKE] <338> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:25:46 15[IKE] <339> <ASA IP> is initiating a Main Mode IKE_SA

    2018-01-26 05:25:46 08[IKE] <339> found 1 matching config, but none allows pre-shared key authentication using Main Mode

    2018-01-26 05:26:19 20[IKE] <340> <ASA IP> is initiating a Main Mode IKE_SA                                                                                                 

    2018-01-26 05:26:19 13[IKE] <340> found 1 matching config, but none allows pre-shared key authentication u                                                                       

    2018-01-26 05:26:51 15[IKE] <341> <ASA IP> is initiating a Main Mode IKE_SA                                                                                                  

    2018-01-26 05:26:51 08[IKE] <341> found 1 matching config, but none allows pre-shared key authentication u                                                                       

    2018-01-26 05:27:24 20[IKE] <342> <ASA IP> is initiating a Main Mode IKE_SA                                                                                                 

    2018-01-26 05:27:24 13[IKE] <342> found 1 matching config, but none allows pre-shared key authentication u                                                                       

    2018-01-26 05:27:57 12[IKE] <343> <ASA IP> is initiating a Main Mode IKE_SA                                                                                                 

    2018-01-26 05:27:57 15[IKE] <343> found 1 matching config, but none allows pre-shared key authentication u                                                                        

    2018-01-26 07:30:33 30[IKE] <Glenpool-1|185> initiating Main Mode IKE_SA Glenpool-1[346] to 12.206.136.242                                                                       

    2018-01-26 08:08:33 10[IKE] <347> <ASA IP> is initiating a Main Mode IKE_SA                                                                                                 

    2018-01-26 08:08:33 29[IKE] <347> found 1 matching config, but none allows pre-shared key authentication u                                                                        

    2018-01-26 08:09:08 17[IKE] <348> <ASA IP> is initiating a Main Mode IKE_SA                                                                                                 

    2018-01-26 08:09:08 22[IKE] <348> found 1 matching config, but none allows pre-shared key authentication u                                                                       

    2018-01-26 08:09:40 18[IKE] <349> <ASA IP> is initiating a Main Mode IKE_SA                                                                                                  

    2018-01-26 08:09:40 08[IKE] <349> found 1 matching config, but none allows pre-shared key authentication u                                                                       

    2018-01-26 08:10:13 07[IKE] <350> <ASA IP> is initiating a Main Mode IKE_SA                                                                                                 

    2018-01-26 08:10:13 15[IKE] <350> found 1 matching config, but none allows pre-shared key authentication u                                                                       

    2018-01-26 08:10:48 12[IKE] <351> <ASA IP> is initiating a Main Mode IKE_SA                                                                                                  

    2018-01-26 08:12:05 12[IKE] <352> <ASA IP> is initiating a Main Mode IKE_SA                                                                                                 

    2018-01-26 08:12:29 14[IKE] <356> <ASA IP> is initiating a Main Mode IKE_SA                                                                                                 

    SG310_WP01_SFOS 17.0.3 MR-3# grep Aggressive strongswan.log                                                                                                                       

    2018-01-25 09:30:27 22[IKE] <<Tunnel Name>2-1|32> initiating Aggressive Mode IKE_SA <Tunnel Name>2-1[32] to <ASA IP>                                                                      

    2018-01-25 17:30:28 07[IKE] <69> <ASA IP> is initiating a Aggressive Mode IKE_SA                                                                                            

    2018-01-25 17:30:28 07[IKE] <69> Aggressive Mode PSK disabled for security reasons                                                                                                

    2018-01-25 17:30:36 29[IKE] <70> <ASA IP> is initiating a Aggressive Mode IKE_SA                                                                                            

    2018-01-25 17:30:36 29[IKE] <70> Aggressive Mode PSK disabled for security reasons                                                                                               

    2018-01-25 17:30:44 27[IKE] <71> <ASA IP> is initiating a Aggressive Mode IKE_SA                                                                                            

    2018-01-25 17:30:44 27[IKE] <71> Aggressive Mode PSK disabled for security reasons                                                                                                

    2018-01-25 17:30:52 05[IKE] <72> <ASA IP> is initiating a Aggressive Mode IKE_SA                                                                                            

    2018-01-25 17:30:52 05[IKE] <72> Aggressive Mode PSK disabled for security reasons                                                                                               

    2018-01-25 17:53:46 11[IKE] <<Tunnel Name>2-1|115> initiating Aggressive Mode IKE_SA <Tunnel Name>2-1[115] to <ASA IP>                                                                      

    2018-01-25 20:08:42 06[IKE] <<Tunnel Name>2-1|176> initiating Aggressive Mode IKE_SA <Tunnel Name>2-1[176] to <ASA IP>                                                                    

    2018-01-26 04:08:43 31[IKE] <193> <ASA IP> is initiating a Aggressive Mode IKE_SA                                                                                           

    2018-01-26 04:08:43 31[IKE] <193> Aggressive Mode PSK disabled for security reasons                                                                                               

    2018-01-26 04:08:51 32[IKE] <194> <ASA IP> is initiating a Aggressive Mode IKE_SA                                                                                           

    2018-01-26 04:08:51 32[IKE] <194> Aggressive Mode PSK disabled for security reasons                                                                                              

    2018-01-26 04:08:59 05[IKE] <195> <ASA IP> is initiating a Aggressive Mode IKE_SA                                                                                           

    2018-01-26 04:08:59 05[IKE] <195> Aggressive Mode PSK disabled for security reasons                                                                                               

    2018-01-26 04:09:07 25[IKE] <196> <ASA IP> is initiating a Aggressive Mode IKE_SA                                                                                           

    2018-01-26 04:09:07 25[IKE] <196> Aggressive Mode PSK disabled for security reasons                                                                                              

    2018-01-26 05:28:11 07[IKE] <<Tunnel Name>2-1|344> initiating Aggressive Mode IKE_SA <Tunnel Name>2-1[344] to <ASA IP>                                                                      

    SG310_WP01_SFOS 17.0.3 MR-3#                                                                                                      

  • Yeah,  we've been using main mode only. I just checked our logs (charon and strongswan) and dont see any mention of the HQ cisco sending over Aggressive Mode IKE requests.

     

    -Scott

  • Yeah we only use Main Mode too. It's one of those weird things I stumbled on while playing with this. Sometimes when I can't get all of the SA's to come up if I go into the ipsec profile and switch it to aggressive they will all come up. The other end is set to Main Mode. It won't stay stable in Aggressive Mode, but sometimes switching back and forth between the two will get it to run for a full day without a drop. No clue why.

  • Interesting find that switching to aggressive works for a day, but we were only main mode here on both ends and nothing in logs about aggressive etc on either end. No second configurations that I'm aware of, the remote company that manage the other end manages hundreds of tunnels and I would be surprised if it did say that but he never mentioned it during troubleshooting this, the only errors he would see were the XG sending a disconnect request/message. Edit: one other thing. Support told me to never edit a tunnel configuration while it was enable or active as it can corrupt. I noticed this happened before because before I knew that I had changed my proposal type completely as did the Cisco team, but they were still seeing in the logs that my XG was attempting using the previous encryption negotiation from before I had edited it and saved it. Even re enable connection or reboot didn't help and at that point support had me recreate vpn. Fixed that issue however not the bigger issue we are discussing
  • ok, So loaded up MR-5 last night on my XG. After the XG rebooted (after it's update was complete), my vpn tunnel did not successfully come back up all the way. I still had some SA's that were red and the tunnel was not fully up.  Now to be fair,  this was right after the update was applied and perhaps it was busy doing other things, but that tunnel should of come up "clean and green" after the reboot.    So I had to manually disconnect and reconnect my tunnel after the reboot from the firmware upgrade.

     

    That being said, we're no longer seeing all those "Invalid SPI" error messages that we used to either.   So I've turned on debugging for strongswan in case the SA's dont re-establish themselves again.    

     

    We'll see what happens.

     

    -Scott

     

      

  • Thanks for sharing, I have a suspicion the IPSec VPN will be stable by MR 6.  I will definitely report my findings with MR 5 and test as IPSec VPN much as possible, but with all the issues reported it may just take a couple of updates to work everything out.  We are still waiting to hear how MR 5 does before considering updating any productions units to v17 from 16.5.

  • Totally not stable on MR6. I've been waiting and not touching mine that was on MR3 because somehow it was finally just working. Tunnel fell apart Monday and it's been a nightmare since trying to keep it holding traffic. 

    I did just make a change that I'm hoping will resolve it since the root issue is apparently having multiple child-sa's (according to some of the reports I've read here). I re-configured one of my subnets so that I could combine it with the other 3 in a /16 for my LAN instead of 4 /24's. Now there's just one /16 to /16 tunnel and I'm hoping it will work reliably. Supposed to head out traveling for 9 days and I'm the only one here that knows this @$^@$& firewall. Fingers crossed.

  • Still having issues with MR6 as well. Not even 2 Sophos XGs on MR6 are able to connect to each other with AES256 SHA256 etc. This is SUPER ANNOYING!!! Still got other tunnels to that just won't connect either for unknown reasons e.g. couldn't parse IKE message.

  • Personnaly, since 17.0.8 MR-8

    we have lot's of deconnection with peer VPN :

     

    2018-07-23 11:26:15 21[IKE] <Bailly_Courouble-1|4661> sending DPD request
    2018-07-23 11:26:15 21[ENC] <Bailly_Courouble-1|4661> generating INFORMATIONAL_V1 request 172699093 [ HASH N(DPD) ]
    2018-07-23 11:26:15 21[NET] <Bailly_Courouble-1|4661> sending packet: from XX.XX.XX.XX[500] to 185.39.XX.XX[500] (84 bytes)
    2018-07-23 11:26:15 31[NET] <Bailly_Courouble-1|4661> received packet: from 185.39.XX.XX[500] to XX.XX.XX.XX[500] (84 bytes)
    2018-07-23 11:26:15 31[ENC] <Bailly_Courouble-1|4661> parsed INFORMATIONAL_V1 request 2556777335 [ HASH N(DPD_ACK) ]
    2018-07-23 11:26:17 23[IKE] <Bailly_Courouble-1|4661> closing CHILD_SA Bailly_Courouble-4{112} with SPIs cb297606_i (1182675 bytes) 091159cd_o (770213 bytes) and TS 10.10.15.0/24 === 172.16.87.0/24
    2018-07-23 11:26:17 23[APP] <Bailly_Courouble-1|4661> [SSO] (sso_invoke_once) SSO is disabled.
    2018-07-23 11:26:17 23[APP] <Bailly_Courouble-1|4661> [COP-UPDOWN] (ref_counting) ref_count: 1 to 0 -- down -- (10.10.15.0/24#172.16.87.0/24)
    2018-07-23 11:26:17 23[APP] <Bailly_Courouble-1|4661> [COP-UPDOWN] (cop_updown_invoke_once) UID: 4661 Net: Local XX.XX.XX.XX Remote 185.39.XX.XX Connection: Bailly_Courouble Fullname:

Reply
  • Personnaly, since 17.0.8 MR-8

    we have lot's of deconnection with peer VPN :

     

    2018-07-23 11:26:15 21[IKE] <Bailly_Courouble-1|4661> sending DPD request
    2018-07-23 11:26:15 21[ENC] <Bailly_Courouble-1|4661> generating INFORMATIONAL_V1 request 172699093 [ HASH N(DPD) ]
    2018-07-23 11:26:15 21[NET] <Bailly_Courouble-1|4661> sending packet: from XX.XX.XX.XX[500] to 185.39.XX.XX[500] (84 bytes)
    2018-07-23 11:26:15 31[NET] <Bailly_Courouble-1|4661> received packet: from 185.39.XX.XX[500] to XX.XX.XX.XX[500] (84 bytes)
    2018-07-23 11:26:15 31[ENC] <Bailly_Courouble-1|4661> parsed INFORMATIONAL_V1 request 2556777335 [ HASH N(DPD_ACK) ]
    2018-07-23 11:26:17 23[IKE] <Bailly_Courouble-1|4661> closing CHILD_SA Bailly_Courouble-4{112} with SPIs cb297606_i (1182675 bytes) 091159cd_o (770213 bytes) and TS 10.10.15.0/24 === 172.16.87.0/24
    2018-07-23 11:26:17 23[APP] <Bailly_Courouble-1|4661> [SSO] (sso_invoke_once) SSO is disabled.
    2018-07-23 11:26:17 23[APP] <Bailly_Courouble-1|4661> [COP-UPDOWN] (ref_counting) ref_count: 1 to 0 -- down -- (10.10.15.0/24#172.16.87.0/24)
    2018-07-23 11:26:17 23[APP] <Bailly_Courouble-1|4661> [COP-UPDOWN] (cop_updown_invoke_once) UID: 4661 Net: Local XX.XX.XX.XX Remote 185.39.XX.XX Connection: Bailly_Courouble Fullname:

Children
No Data