Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 6 replies
  • Subscribers 1 subscriber
  • Views 8107 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

UTM9 to Cisco ASA Not Progressing to Phase 2

rcrcr
I am trying to connect a UTM9 to a Cisco ASA IPSec s2s endpoint.

It seems that Phase 1 succeeds, but we never progress to Phase 2.

Log from UTM below.

Any pointers?


2014:10:23-16:21:58 sophos-router pluto[6686]: "S_ABCD-Tunnel" #1: initiating Main Mode
2014:10:23-16:21:58 sophos-router pluto[6686]: "S_ABCD-Tunnel" #1: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
2014:10:23-16:21:58 sophos-router pluto[6686]: "S_ABCD-Tunnel" #1: ignoring Vendor ID payload [FRAGMENTATION c0000000]
2014:10:23-16:21:58 sophos-router pluto[6686]: "S_ABCD-Tunnel" #1: enabling possible NAT-traversal with method RFC 3947
2014:10:23-16:21:58 sophos-router pluto[6686]: "S_ABCD-Tunnel" #1: ignoring Vendor ID payload [Cisco-Unity]
2014:10:23-16:21:58 sophos-router pluto[6686]: "S_ABCD-Tunnel" #1: received Vendor ID payload [XAUTH]
2014:10:23-16:21:58 sophos-router pluto[6686]: "S_ABCD-Tunnel" #1: ignoring Vendor ID payload [6f3bb05bc8d2f5d6d5cf87f100489425]
2014:10:23-16:21:58 sophos-router pluto[6686]: "S_ABCD-Tunnel" #1: ignoring Vendor ID payload [Cisco VPN 3000 Series]
2014:10:23-16:21:58 sophos-router pluto[6686]: "S_ABCD-Tunnel" #1: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: no NAT detected
2014:10:23-16:21:58 sophos-router pluto[6686]: "S_ABCD-Tunnel" #1: received Vendor ID payload [Dead Peer Detection]
2014:10:23-16:21:58 sophos-router pluto[6686]: | protocol/port in Phase 1 ID Payload is 17/0. accepted with port_floating NAT-T
2014:10:23-16:21:58 sophos-router pluto[6686]: "S_ABCD-Tunnel" #1: Peer ID is ID_IPV4_ADDR: 'IP.REDACTED'
2014:10:23-16:21:58 sophos-router pluto[6686]: "S_ABCD-Tunnel" #1: ISAKMP SA established
2014:10:23-16:21:58 sophos-router pluto[6686]: "S_ABCD-Tunnel" #2: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP {using isakmp#1}
2014:10:23-16:21:58 sophos-router pluto[6686]: "S_ABCD-Tunnel" #1: received Delete SA payload: deleting ISAKMP State #1


This thread was automatically locked due to age.
  • 0
    Do you have the Cisco logs as well ? Usually Phase 2 means that protected networks do not match on each end, or encryption algorithm doesn't match.
  • 0
    We are seeing this on the Cisco:

    Oct 24 15:32:59 [IKEv1]: Phase 1 failure:  Mismatched attribute types for class Group Description:  Rcv'd: Group 2  Cfg'd: Group 5
    Oct 24 15:32:59 [IKEv1]: Phase 1 failure:  Mismatched attribute types for class Group Description:  Rcv'd: Group 2  Cfg'd: Group 5
    Oct 24 15:32:59 [IKEv1]: Phase 1 failure:  Mismatched attribute types for class Group Description:  Rcv'd: Group 2  Cfg'd: Group 5

    Thing is, both sides are set to Group 5. When we switched to Group 2 on both sides, the log was reversed:

    Rcv'd: Group 5  Cfg'd: Group 2
  • 0
    Also seeing this:

    Oct 24 15:33:00 [IKEv1]: IP = >, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + VENDOR (13) + NONE (0) total length : 84
    Oct 24 15:33:00 [IKEv1]: Group = >, IP = >, Failure during phase 1 rekeying attempt due to collision
  • 0
    rcrcr, please click on [Go Advanced] below and attach a picture of the Edit of the IPsec Policy in use and the Cisco Phase 1 and Phase 2 configuration.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson
    Thank you, Bob. For reasons unknown, deleting the tunnel config from the Cisco and reentering an exact paste of the same config back onto the Cisco remedied the issue. The tunnel came right up afterward.

    Thanks for you response, though!
  • 0
    Great!  I'm glad you're up, but I was looking forward to the challenge. [;)]    That was a creative, intuitive solution that I hope I would have gotten to!

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Unfiltered HTML