Have an account?

  •   Personalized content
  •   Your products and support

Need an account?

Create an account

Configure IKEv1 IPsec Site-to-Site Tunnels with the ASDM or CLI on the ASA

Available Languages

Download Options

  • PDF     (372.8 KB)
    View with Adobe Reader on a variety of devices
  • ePub     (367.5 KB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (389.1 KB)
    View on Kindle device or Kindle app on multiple devices
Updated:April 13, 2018
Document ID:119141

    Introduction

    This document describes how to configure an Internet Key Exchange version 1 (IKEv1) IPsec site-to-site tunnel between a Cisco 5515-X Series Adaptive Security Appliance (ASA) that runs software Version 9.2.x and a Cisco 5510 Series ASA that runs software Version 8.2.x.

    Prerequisites

    Requirements

    Cisco recommends that these requirements be met before you attempt the configuration that is described in this document:

    • The end-to-end IP connectivity must be established.

    • These protocols must be allowed:

      • User Datagram Protocol (UDP) 500 and 4500 for the IPsec control plane

      • Encapsulating Security Payload (ESP) IP Protocol 50 for the IPsec data plane

    Components Used

    The information in this document is based on these software and hardware versions:

    • Cisco 5510 Series ASA that runs software Version 8.2

    • Cisco 5515-X ASA that runs the software Version 9.2

    The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.

    Configure

    This section describes how to configure the site-to-site VPN tunnel via the Adaptive Security Device Manager (ASDM) VPN wizard or via the CLI.

    Network Diagram

    This is the topology that is used for the examples throughout this document:

    Configure Via the ASDM VPN Wizard

    Complete these steps in order to set up the site-to-site VPN tunnel via the ASDM wizard:

    1. Open the ASDM and navigate to Wizards > VPN Wizards > Site-to-site VPN Wizard:



    2. Click Next once you reach the wizard home page:

      Note: The most recent ASDM versions provide a link to a video that explains this configuration.

    3. Configure the peer IP address. In this example, the peer IP address is set to 192.168.1.1 on Site B. If you configure the peer IP address on Site A, it must be changed to 172.16.1.1. The interface through which the remote end can be reached is also specified. Click Next once complete.



    4. Configure the local and remote networks (traffic source and destination). This image shows the configuration for Site B (the reverse applies for Site A):



    5. On the Security page, configure the pre-shared key (it must match on both of the ends). Click Next once complete.



    6. Configure the source interface for the traffic on the ASA. The ASDM automatically creates the Network Address Translation (NAT) rule based on the ASA version and pushes it with the rest of the configuration in the final step.

      Note: For the example that is used in this document, inside is the source of the traffic.



    7. The wizard now provides a summary of the configuration that will be pushed to the ASA. Review and verify the configuration settings, and then click Finish.

    Configure Via the CLI

    This section describes how to configure the IKEv1 IPsec site-to-site tunnel via the CLI.

    Configure Site B for ASA Versions 8.4 and Later

    In ASA Versions 8.4 and later, support for both IKEv1 and Internet Key Exchange version 2 (IKEv2) was introduced.

    Tip: For more information about the differences between the two versions, refer to the Why migrate to IKEv2? section of the Swift Migration of IKEv1 to IKEv2 L2L Tunnel Configuration on ASA 8.4 Code Cisco document.

    Tip: For an IKEv2 configuration example with the ASA, refer to the Site-to-Site IKEv2 Tunnel between ASA and Router Configuration Examples Cisco document.

    Phase 1 (IKEv1)

    Complete these steps for the Phase 1 configuration:

    1. Enter this command into the CLI in order to enable IKEv1 on the outside interface:

      crypto ikev1 enable outside
    2. Create an IKEv1 policy that defines the algorithms/methods to be used for hashing, authentication, Diffie-Hellman group, lifetime, and encryption:

      crypto ikev1 policy 1
      !The 1 in the above command refers to the Policy suite priority
       (1 highest, 65535 lowest)
        authentication pre-share
        encryption aes
        hash sha
        group 2
        lifetime 86400
    3. Create a tunnel group under the IPsec attributes and configure the peer IP address and the tunnel pre-shared key:

      tunnel-group 192.168.1.1 type ipsec-l2l
      tunnel-group 192.168.1.1 ipsec-attributes
       ikev1 pre-shared-key cisco
       ! Note the IKEv1 keyword at the beginning of the pre-shared-key command.

    Phase 2 (IPsec)

    Complete these steps for the Phase 2 configuration:

    1. Create an access list that defines the traffic to be encrypted and tunneled. In this example, the traffic of interest is the traffic from the tunnel that is sourced from the 10.2.2.0 subnet to the 10.1.1.0. It can contain multiple entries if there are multiple subnets involved between the sites.

      In Versions 8.4 and later, objects or object groups can be created that serve as containers for the networks, subnets, host IP addresses, or multiple objects. Create two objects that have the local and remote subnets and use them for both the crypto Access Control List (ACL) and the NAT statements.

      object network 10.2.2.0_24
       subnet 10.2.2.0 255.255.255.0
      object network 10.1.1.0_24
       subnet 10.1.1.0 255.255.255.0

      access-list 100 extended permit ip object 10.2.2.0_24 object 10.1.1.0_24
    2. Configure the Transform Set (TS), which must involve the keyword IKEv1. An identical TS must be created on the remote end as well. 

      crypto ipsec ikev1 transform-set myset esp-aes esp-sha-hmac
    3. Configure the crypto map, which contains these components:

      • The peer IP address

      • The defined access list that contains the traffic of interest

      • The TS

      • An optional Perfect Forward Secrecy (PFS) setting, which creates a new pair of Diffie-Hellman keys that are used in order to protect the data (both sides must be PFS-enabled before Phase 2 comes up)

    4. Apply the crypto map on the outside interface:

      crypto map outside_map 20 match address 100
      crypto map outside_map 20 set peer 192.168.1.1
      crypto map outside_map 20 set ikev1 transform-set myset
      crypto map outside_map 20 set pfs
      crypto map outside_map interface outside

    NAT Exemption

    Ensure that the VPN traffic is not subjected to any other NAT rule. This is the NAT rule that is used:

       

    nat (inside,outside) 1 source static 10.2.2.0_24 10.2.2.0_24 destination static
     10.1.1.0_24 10.1.1.0_24 no-proxy-arp route-lookup

    Note: When multiple subnets are used, you must create object groups with all of the source and destination subnets and use them in the NAT rule.

       

    object-group  network 10.x.x.x_SOURCE
     network-object  10.4.4.0 255.255.255.0
     network-object  10.2.2.0 255.255.255.0

    object network 10.x.x.x_DESTINATION
     network-object  10.3.3.0 255.255.255.0
     network-object  10.1.1.0 255.255.255.0

    nat (inside,outside) 1 source static 10.x.x.x_SOURCE 10.x.x.x_SOURCE destination
     static 10.x.x.x_DESTINATION  10.x.x.x_DESTINATION no-proxy-arp route-lookup 

    Complete Sample Configuration

    Here is the complete configuration for Site B:

    crypto ikev1 enable outside

    crypto ikev1 policy 10
     authentication pre-share
     encryption aes
     hash sha
     group 2
     lifetime 86400

    tunnel-group 192.168.1.1 type ipsec-l2l
    tunnel-group 192.168.1.1 ipsec-attributes
     ikev1 pre-shared-key cisco
     !Note the IKEv1 keyword at the beginning of the pre-shared-key command.

    object network 10.2.2.0_24 
     subnet 10.2.2.0 255.255.255.0 
    object network 10.1.1.0_24 
     subnet 10.1.1.0 255.255.255.0

    access-list 100 extended permit ip object 10.2.2.0_24 object 10.1.1.0_24

    crypto ipsec ikev1 transform-set myset esp-aes esp-sha-hmac

    crypto map outside_map 20 match address 100
    crypto map outside_map 20 set peer 192.168.1.1
    crypto map outside_map 20 set ikev1 transform-set myset
    crypto map outside_map 20 set pfs
    crypto map outside_map interface outside

    nat (inside,outside) 1 source static 10.2.2.0_24 10.2.2.0_24 destination static
     10.1.1.0_24 10.1.1.0_24 no-proxy-arp route-lookup

    Configure Site A for ASA Versions 8.2 and Earlier

    This section describes how to configure Site A for ASA Versions 8.2 and earlier.

    Phase 1 (ISAKMP)

    Complete these steps for the Phase 1 configuration:

    1. Enter this command into the CLI in order to enable Internet Security Association and Key Management Protocol (ISAKMP) on the outside interface:

      crypto isakmp enable outside

      Note: Because multiple versions of IKE (IKEv1 and IKEv2) are not supported any longer, the ISAKMP is used in order to refer to Phase 1.

    2. Create an ISAKMP policy that defines the algorithms/methods to be used in order to build Phase 1.

      Note: In this example configuration, the keyword IKEv1 from Version 9.x is replaced with ISAKMP.

      crypto isakmp policy 1
        authentication pre-share
        encryption aes
        hash sha
        group 2
        lifetime 86400
    3. Create a tunnel group for the peer IP address (external IP address of 5515) with the pre-shared key:

       tunnel-group 172.16.1.1 type ipsec-l2l
       tunnel-group 172.16.1.1 ipsec-attributes 
        pre-shared-key cisco

    Phase 2 (IPsec)

    Complete these steps for the Phase 2 configuration:

    1. Similar to the configuration in Version 9.x, you must create an extended access list in order to define the traffic of interest.

      access-list 100 extended permit ip 10.1.1.0 255.255.255.0
       10.2.2.0 255.255.255.0
    2. Define a TS that contains all of the available encryption and hashing algorithms (offered issues have a question mark). Ensure that it is identical to that which was configured on the other side.

      crypto ipsec transform-set myset esp-aes esp-sha-hmac
    3. Configure a crypto map, which contains these components:

      • The peer IP address

      • The defined access list that contains the traffic of interest

      • The TS

      • An optional PFS setting, which creates a new pair of Diffie-Hellman keys that are used in order to protect the data (both sides must be PFS-enabled so that Phase 2 comes up)
    4. Apply the crypto map on the outside interface:

      crypto map outside_map 20 set peer 172.16.1.1
      crypto map outside_map 20 match address 100
      crypto map outside_map 20 set transform-set myset
      crypto map outside_map 20 set pfs
      crypto map outside_map interface outside

    NAT Exemption

    Create an access list that defines the traffic to be exempted from the NAT checks. In this version, it appears similar to the access list that you defined for the traffic of interest:

    access-list nonat line 1 extended permit ip 10.1.1.0 255.255.255.0
     10.2.2.0  255.255.255.0

    When multiple subnets are used, add another line to the same access list:

    access-list nonat line 1 extended permit ip 10.3.3.0 255.255.255.0 
     10.4.4.0 255.255.255.0

    The access list is used with the NAT, as shown here:

    nat (inside) 0 access-list nonat

    Note: The inside here refers to the name of the inside interface on which the ASA receives the traffic that matches the access list.

    Complete Sample Configuration

    Here is the complete configuration for Site A:

    crypto isakmp enable outside
    crypto isakmp policy 10
     authentication pre-share
     encryption aes
     hash sha
 group 2
     lifetime 86400

    tunnel-group 172.16.1.1 type ipsec-l2l
    tunnel-group 172.16.1.1 ipsec-attributes
     pre-shared-key cisco

    access-list 100 extended permit ip 10.1.1.0 255.255.255.0
     10.2.2.0 255.255.255.0
    crypto ipsec transform-set myset esp-aes esp-sha-hmac

    crypto map outside_map 20 set peer
    crypto map outside_map 20 match address 100
    crypto map outside_map 20 set transform-set myset
    crypto map outside_map 20 set pfs
    crypto map outside_map interface outside

    access-list nonat line 1 extended permit ip 10.1.1.0 255.255.255.0
     10.2.2.0  255.255.255.0

    nat (inside) 0 access-list nonat

    Group Policy

    Group policies are used in order to define specific settings that apply to the tunnel. These policies are used in conjunction with the tunnel group.

    The group policy can be defined as either internal, which means that the attributes are pulled from that which is defined on the ASA, or it can be defined as external, where the attributes are queried from an external server. This is the command that is used in order to define the group policy:

    group-policy SITE_A internal

    Note: You can define multiple attributes in the group policy. For a list of all possible attributes, refer to the Configuring Group Policies section of the Selected ASDM VPN Configuration Procedures for the Cisco ASA 5500 Series, Version 5.2.

    Group Policy Optional Attributes

    The vpn-tunnel-protocol attribute determines the tunnel type to which these settings should be applied. In this example, IPsec is used:

    vpn-tunnel-protocol ?
      group-policy mode commands/options:
      IPSec       IP Security Protocol
  l2tp-ipsec  L2TP using IPSec for security
      svc         SSL VPN Client
      webvpn      WebVPN

    vpn-tunnel-protocol ipsec - Versions 8.2 and prior
    vpn-tunnel-protocol ikev1 - Version 8.4 and later

    You have the option to configure the the tunnel so that it stays idle (no traffic) and does not go down. In order to configure this option, the vpn-idle-timeout attribute value should use minutes, or you can set the value to none, which means that the tunnel never goes down. 

    Here is an example:

    group-policy SITE_A attributes
     vpn-idle-timeout ?
     group-policy mode commands/options:
     <1-35791394>  Number of minutes
     none   IPsec VPN: Disable timeout and allow an unlimited idle period;

    The default-group-policy command under the general attributes of the tunnel group defines the group policy that is used in order to push certain policy settings for the tunnel that is established. The default settings for the options that you did not define in the group policy are taken from a global default group policy:

    tunnel-group 172.16.1.1 general-attributes
     default-group-policy SITE_A

    Verify

    Use the information that is provided in this section in order to verify that your configuration works properly.

    ASDM

    In order to view the tunnel status from the ASDM, navigate to Monitoring > VPN. This information is provided:

    • The peer IP address

    • The protocol that is used in order to build the tunnel

    • The encryption algorithm that is used

    • The time at which the tunnel came up and the up-time

    • The number of packets that are received and transferred

    Tip: Click Refresh in order to view the latest values, as the data does not update in real-time.

    CLI

    This section describes how to verify your configuration via the CLI.

    Phase 1

    Enter this command into the CLI in order to verify the Phase 1 configuration on the Site B (5515) side:

    show crypto ikev1 sa

    Active SA: 1
       Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
    Total IKE SA: 1

    1   IKE Peer: 192.168.1.1
        Type    : L2L             Role    : initiator
        Rekey   : no              State   : MM_ACTIVE

    Enter this command into the CLI in order to verify the Phase 1 configuration on the Site A (5510) side:

    show crypto isakmp sa

    Active SA: 1
       Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
    Total IKE SA: 1

    1   IKE Peer: 172.16.1.1
        Type    : L2L             Role    : initiator
        Rekey   : no              State   : MM_ACTIVE

    Phase 2

    The show crypto ipsec sa command shows the IPsec SAs that are built between the peers. The encrypted tunnel is built between IP addresses 192.168.1.1 and 172.16.1.1 for the traffic that flows between the networks 10.1.1.0 and 10.2.2.0. You can see the two ESP SAs built for the inbound and outbound traffic. The Authentication Header (AH) is not used because there are no AH SAs.

    Enter this command into the CLI in order to verify the Phase 2 configuration on the Site B (5515) side:

    interface: FastEthernet0
    Crypto map tag: outside_map, local addr. 172.16.1.1
     local ident (addr/mask/prot/port): (10.2.2.0/255.255.255.0/0/0)
     remote ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0)
     current_peer: 192.168.1.1
       PERMIT, flags={origin_is_acl,}
      #pkts encaps: 20, #pkts encrypt: 20, #pkts digest 20
      #pkts decaps: 20, #pkts decrypt: 20, #pkts verify 20
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 0, #pkts compr. failed: 0, 
      #pkts decompress failed: 0, #send errors 0, #recv errors 0
       local crypto endpt.: 172.16.1.1, remote crypto endpt.: 172.16.1.1
       path mtu 1500, media mtu 1500
       current outbound spi: 3D3
       inbound esp sas:
        spi: 0x136A010F(325714191)
          transform: esp-aes esp-sha-hmac ,
          in use settings ={Tunnel, }
          slot: 0, conn id: 3442, flow_id: 1443, crypto map: outside_map
          sa timing: remaining key lifetime (k/sec): (4608000/52)
          IV size: 8 bytes
          replay detection support: Y
       inbound ah sas:
       inbound pcp sas:
       inbound pcp sas:
       outbound esp sas:
        spi: 0x3D3(979)
          transform: esp-aes esp-sha-hmac ,
          in use settings ={Tunnel, }
          slot: 0, conn id: 3443, flow_id: 1444, crypto map: outside_map
          sa timing: remaining key lifetime (k/sec): (4608000/52)
          IV size: 8 bytes
          replay detection support: Y
       outbound ah sas:
       outbound pcp sas

    Enter this command into the CLI in order to verify the Phase 2 configuration on the Site A (5510) side:

    interface: FastEthernet0
       Crypto map tag: outside_map, local addr. 192.168.1.1
      local ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0)
      remote ident (addr/mask/prot/port): (10.2.2.0/255.255.255.0/0/0)
      current_peer: 172.16.1.1
        PERMIT, flags={origin_is_acl,}
       #pkts encaps: 20, #pkts encrypt: 20, #pkts digest 20
       #pkts decaps: 20, #pkts decrypt: 20, #pkts verify 20
       #pkts compressed: 0, #pkts decompressed: 0
       #pkts not compressed: 0, #pkts compr. failed: 0,
       #pkts decompress failed: 0, #send errors 0, #recv errors 0
        local crypto endpt.: 192.168.1.1, remote crypto endpt.: 172.16.1.1
        path mtu 1500, media mtu 1500
        current outbound spi: 3D3
        inbound esp sas:
         spi: 0x136A010F(325714191)
           transform: esp-aes esp-sha-hmac ,
           in use settings ={Tunnel, }
           slot: 0, conn id: 3442, flow_id: 1443, crypto map: outside_map
           sa timing: remaining key lifetime (k/sec): (4608000/52)
           IV size: 8 bytes
           replay detection support: Y
        inbound ah sas:
        inbound pcp sas:
        inbound pcp sas:
        outbound esp sas:
         spi: 0x3D3(979)
           transform: esp-aes esp-sha-hmac ,
           in use settings ={Tunnel, }
           slot: 0, conn id: 3443, flow_id: 1444, crypto map: outside_map
           sa timing: remaining key lifetime (k/sec): (4608000/52)
           IV size: 8 bytes
           replay detection support: Y
        outbound ah sas:
        outbound pcp sas 

    Troubleshoot

    Use the information that is provided in this section in order to troubleshoot configuration issues.

    ASA Versions 8.4 and Later

    Enter these debug commands in order to determine the location of the tunnel failure:

      

    • debug crypto ikev1 127 (Phase 1)

    • debug crypto ipsec 127 (Phase 2)

    Here is a complete example debug output:

    IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1,
     saddr=10.2.2.1, sport=19038, daddr=10.1.1.1, dport=19038
    IPSEC(crypto_map_check)-3: Checking crypto map outside_map 20: matched.
    Feb 13 23:48:56 [IKEv1 DEBUG]Pitcher: received a key acquire message, spi 0x0
    IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1,
     saddr=10.2.2.1, sport=19038, daddr=10.1.1.1, dport=19038
    IPSEC(crypto_map_check)-3: Checking crypto map outside_map 20: matched.
    Feb 13 23:48:56 [IKEv1]IP = 192.168.1.1, IKE Initiator: New Phase 1, Intf NP
     Identity Ifc, IKE Peer 192.168.1.1  local Proxy Address 10.2.2.0, remote Proxy
     Address 10.1.1.0,  Crypto map (outside_map) Feb 13 23:48:56 [IKEv1 DEBUG]IP =
     192.168.1.1, constructing ISAKMP SA payload Feb 13 23:48:56 [IKEv1 DEBUG]IP =
     192.168.1.1, constructing NAT-Traversal VID ver 02 payload
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, constructing NAT-Traversal VID
     ver 03 payload
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, constructing NAT-Traversal VID
     ver RFC payload
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, constructing Fragmentation VID +
     extended capabilities payload
    Feb 13 23:48:56 [IKEv1]IP = 192.168.1.1, IKE_DECODE SENDING Message (msgid=0)
     with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR
     (13) + NONE (0) total length : 172
    Feb 13 23:48:56 [IKEv1]IKE Receiver: Packet received on 172.16.1.1:500
     from 192.168.1.1:500
    Feb 13 23:48:56 [IKEv1]IP = 192.168.1.1, IKE_DECODE RECEIVED Message (msgid=0)
     with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total
     length : 132
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, processing SA payload
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, Oakley proposal is acceptable
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, processing VID payload
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, Received NAT-Traversal ver 02 VID
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, processing VID payload
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, Received Fragmentation VID
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, IKE Peer included IKE
     fragmentation capability flags:  Main Mode: True  Aggressive Mode:  True
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, constructing ke payload
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, constructing nonce payload
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, constructing Cisco Unity
     VID payload
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, constructing xauth V6
     VID payload
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, Send IOS VID
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, Constructing ASA spoofing IOS
     Vendor ID payload (version: 1.0.0, capabilities: 20000001)
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, constructing VID payload
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, Send Altiga/Cisco VPN3000/Cisco
     ASA GW VID
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, constructing NAT-Discovery payload
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, computing NAT Discovery hash
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, constructing NAT-Discovery payload
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, computing NAT Discovery hash
    Feb 13 23:48:56 [IKEv1]IP = 192.168.1.1, IKE_DECODE SENDING Message (msgid=0)
     with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR
     (13) + VENDOR (13) + NAT-D (130) + NAT-D (130) + NONE (0) total length : 304
    Feb 13 23:48:56 [IKEv1]IKE Receiver: Packet received on 172.16.1.1:500
     from 192.168.1.1:500
    Feb 13 23:48:56 [IKEv1]IP = 192.168.1.1, IKE_DECODE RECEIVED Message (msgid=0)
     with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR
     (13) + VENDOR (13) + NAT-D (130) + NAT-D (130) + NONE (0) total length : 304
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, processing ke payload
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, processing ISA_KE payload
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, processing nonce payload
    Feb 13 23:48:56 [IKEv1 DEBUG]?IP = 192.168.1.1, processing VID payload
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, Received Cisco Unity client VID
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, processing VID payload
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, Received xauth V6 VID
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, processing VID payload
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, Processing VPN3000/ASA spoofing
     IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, processing VID payload
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, Received Altiga/Cisco
     VPN3000/Cisco ASA GW VID
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, processing NAT-Discovery payload
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, computing NAT Discovery hash
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, processing NAT-Discovery payload
    !
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, computing NAT Discovery hash
    Feb 13 23:48:56 [IKEv1]IP = 192.168.1.1, Connection landed on tunnel_group
     192.168.1.1
    Feb 13 23:48:56 [IKEv1 DEBUG]!Group = 192.168.1.1, IP = 192.168.1.1, Generating
     keys for Initiator...
    Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1, constructing
     ID payload
    Feb 13 23:48:56 [IKEv1 DEBUG]!Group = 192.168.1.1, IP = 192.168.1.1, constructing
     hash payload
    Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1, Computing
     hash for ISAKMP
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, Constructing IOS keep alive
     payload: proposal=32767/32767 sec.
    !
    Success rate is 80 percent (4/5), round-trip min/avg/max = 1/3/10 ms
    ciscoasa# Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
     constructing dpd vid payload
    Feb 13 23:48:56 [IKEv1]IP = 192.168.1.1, IKE_DECODE SENDING Message (msgid=0)
     with payloads : HDR + ID (5) + HASH (8) + IOS KEEPALIVE (128) + VENDOR (13) +
     NONE (0) total length : 96
    Feb 13 23:48:56 [IKEv1]Group = 192.168.1.1, IP = 192.168.1.1, Automatic NAT
     Detection Status: Remote end is NOT behind a NAT device This end is NOT behind
     a NAT device
    Feb 13 23:48:56 [IKEv1]IKE Receiver: Packet received on 172.16.1.1:500
     from 192.168.1.1:500
    Feb 13 23:48:56 [IKEv1]IP = 192.168.1.1, IKE_DECODE RECEIVED Message (msgid=0)
     with payloads : HDR + ID (5) + HASH (8) + IOS KEEPALIVE (128) + VENDOR (13) +
     NONE (0) total length : 96
    Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1, processing
     ID payload
    Feb 13 23:48:56 [IKEv1 DECODE]Group = 192.168.1.1, IP = 192.168.1.1,
     ID_IPV4_ADDR ID received 192.168.1.1
    Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
     processing hash payload
    Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1, Computing
     hash for ISAKMP
    Feb 13 23:48:56 [IKEv1 DEBUG]IP = 192.168.1.1, Processing IOS keep alive payload:
     proposal=32767/32767 sec.
    Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1, processing
     VID payload
    Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1, Received
     DPD VID
    Feb 13 23:48:56 [IKEv1]IP = 192.168.1.1, Connection landed on tunnel_group
     192.168.1.1
    Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1, Oakley
     begin quick mode
    Feb 13 23:48:56 [IKEv1 DECODE]Group = 192.168.1.1, IP = 192.168.1.1, IKE
     Initiator starting QM: msg id = 4c073b21
    Feb 13 23:48:56 [IKEv1]Group = 192.168.1.1, IP = 192.168.1.1, PHASE 1 COMPLETED
    Feb 13 23:48:56 [IKEv1]IP = 192.168.1.1, Keep-alive type for this connection: DPD
    Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1, Starting P1
     rekey timer: 73440 seconds.
    IPSEC: New embryonic SA created @ 0x75298588,
       SCB: 0x75C34F18,
       Direction: inbound
       SPI      : 0x03FC9DB7
       Session ID: 0x00004000
       VPIF num  : 0x00000002
       Tunnel type: l2l
       Protocol   : esp
       Lifetime   : 240 seconds
    Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
     IKE got SPI from key engine: SPI = 0x03fc9db7
    Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
     oakley constucting quick mode
    Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
     constructing blank hash payload
    Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
     constructing IPSec SA payload
    Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
     constructing IPSec nonce payload
    Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
     constructing proxy ID
    Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
     Transmitting Proxy Id:
       Local subnet:  10.2.2.0  mask 255.255.255.0 Protocol 0  Port 0
       Remote subnet: 10.1.1.0  Mask 255.255.255.0 Protocol 0  Port 0
    Feb 13 23:48:56 [IKEv1 DECODE]Group = 192.168.1.1, IP = 192.168.1.1,
     IKE Initiator sending Initial Contact
    Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1,
     IP = 192.168.1.1, constructing qm hash payload
    Feb 13 23:48:56 [IKEv1 DECODE]Group = 192.168.1.1,
     IP = 192.168.1.1, IKE Initiator sending 1st QM pkt: msg id = 4c073b21
    Feb 13 23:48:56 [IKEv1]IP = 192.168.1.1, IKE_DECODE SENDING Message (msgid=4c073b21)
     with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + ID (5) + ID (5) +
     NOTIFY (11) + NONE (0) total length : 200
    Feb 13 23:48:56 [IKEv1]IKE Receiver: Packet received on 172.16.1.1:500
     from 192.168.1.1:500
    Feb 13 23:48:56 [IKEv1]IP = 192.168.1.1, IKE_DECODE RECEIVED Message (msgid=4c073b21)
     with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + ID (5) + ID (5) + NONE (0)
     total length : 172
    Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
     processing hash payload
    Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
     processing SA payload
    Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
     processing nonce payload
    Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
     processing ID payload
    Feb 13 23:48:56 [IKEv1 DECODE]Group = 192.168.1.1, IP = 192.168.1.1,
     ID_IPV4_ADDR_SUBNET ID received--10.2.2.0--255.255.255.0
    Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
     processing ID payload
    Feb 13 23:48:56 [IKEv1 DECODE]Group = 192.168.1.1, IP = 192.168.1.1,
     ID_IPV4_ADDR_SUBNET ID received--10.1.1.0--255.255.255.0
    Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
     loading all IPSEC SAs
    Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
     Generating Quick Mode Key!
    Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
     NP encrypt rule look up for crypto map outside_map 20 matching ACL
     100: returned cs_id=6ef246d0; encrypt_rule=752972d0;
     tunnelFlow_rule=75ac8020
    Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1,
     Generating Quick Mode Key!
    IPSEC: New embryonic SA created @ 0x6f0e03f0,
       SCB: 0x75B6DD00,
       Direction: outbound
       SPI      : 0x1BA0C55C
       Session ID: 0x00004000
       VPIF num  : 0x00000002
       Tunnel type: l2l
       Protocol   : esp
       Lifetime   : 240 seconds
    IPSEC: Completed host OBSA update, SPI 0x1BA0C55C
    IPSEC: Creating outbound VPN context, SPI 0x1BA0C55C
       Flags: 0x00000005
       SA   : 0x6f0e03f0
       SPI  : 0x1BA0C55C
       MTU  : 1500 bytes
       VCID : 0x00000000
       Peer : 0x00000000
       SCB  : 0x0B47D387
       Channel: 0x6ef0a5c0
    IPSEC: Completed outbound VPN context, SPI 0x1BA0C55C
       VPN handle: 0x0000f614
    IPSEC: New outbound encrypt rule, SPI 0x1BA0C55C
       Src addr: 10.2.2.0
       Src mask: 255.255.255.0
       Dst addr: 10.1.1.0
       Dst mask: 255.255.255.0
       Src ports
         Upper: 0
         Lower: 0
         Op   : ignore
       Dst ports
         Upper: 0
         Lower: 0
         Op   : ignore
       Protocol: 0
       Use protocol: false
       SPI: 0x00000000
       Use SPI: false
    IPSEC: Completed outbound encrypt rule, SPI 0x1BA0C55C
       Rule ID: 0x74e1c558
    IPSEC: New outbound permit rule, SPI 0x1BA0C55C
       Src addr: 172.16.1.1
       Src mask: 255.255.255.255
       Dst addr: 192.168.1.1
       Dst mask: 255.255.255.255
       Src ports
         Upper: 0
         Lower: 0
         Op   : ignore
       Dst ports
         Upper: 0
         Lower: 0
         Op   : ignore
       Protocol: 50
       Use protocol: true
       SPI: 0x1BA0C55C
       Use SPI: true
    IPSEC: Completed outbound permit rule, SPI 0x1BA0C55C
       Rule ID: 0x6f0dec80
    Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1, NP encrypt rule
     look up for crypto map outside_map 20 matching ACL 100: returned cs_id=6ef246d0;
     encrypt_rule=752972d0; tunnelFlow_rule=75ac8020
    Feb 13 23:48:56 [IKEv1]Group = 192.168.1.1, IP = 192.168.1.1, Security negotiation
     complete for LAN-to-LAN Group (192.168.1.1)  Initiator, Inbound SPI = 0x03fc9db7,
     Outbound SPI = 0x1ba0c55c
    Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1, oakley
     constructing final quick mode
    Feb 13 23:48:56 [IKEv1 DECODE]Group = 192.168.1.1, IP = 192.168.1.1, IKE Initiator
     sending 3rd QM pkt: msg id = 4c073b21
    Feb 13 23:48:56 [IKEv1]IP = 192.168.1.1, IKE_DECODE SENDING Message (msgid=4c073b21)
     with payloads : HDR + HASH (8) + NONE (0) total length : 76
    Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1, IKE got a KEY_ADD
     msg for SA: SPI = 0x1ba0c55c
    IPSEC: New embryonic SA created @ 0x75298588,
       SCB: 0x75C34F18,
       Direction: inbound
       SPI      : 0x03FC9DB7
       Session ID: 0x00004000
       VPIF num  : 0x00000002
       Tunnel type: l2l
       Protocol   : esp
       Lifetime   : 240 seconds
    IPSEC: Completed host IBSA update, SPI 0x03FC9DB7
    IPSEC: Creating inbound VPN context, SPI 0x03FC9DB7
       Flags: 0x00000006
       SA   : 0x75298588
       SPI  : 0x03FC9DB7
       MTU  : 0 bytes
       VCID : 0x00000000
       Peer : 0x0000F614
       SCB  : 0x0B4707C7
       Channel: 0x6ef0a5c0
    IPSEC: Completed inbound VPN context, SPI 0x03FC9DB7
       VPN handle: 0x00011f6c
    IPSEC: Updating outbound VPN context 0x0000F614, SPI 0x1BA0C55C
       Flags: 0x00000005
       SA   : 0x6f0e03f0
       SPI  : 0x1BA0C55C
       MTU  : 1500 bytes
       VCID : 0x00000000
       Peer : 0x00011F6C
       SCB  : 0x0B47D387
       Channel: 0x6ef0a5c0
    IPSEC: Completed outbound VPN context, SPI 0x1BA0C55C
       VPN handle: 0x0000f614
    IPSEC: Completed outbound inner rule, SPI 0x1BA0C55C
       Rule ID: 0x74e1c558
    IPSEC: Completed outbound outer SPD rule, SPI 0x1BA0C55C
       Rule ID: 0x6f0dec80
    IPSEC: New inbound tunnel flow rule, SPI 0x03FC9DB7
       Src addr: 10.1.1.0
       Src mask: 255.255.255.0
       Dst addr: 10.2.2.0
       Dst mask: 255.255.255.0
       Src ports
         Upper: 0
         Lower: 0
         Op   : ignore
       Dst ports
         Upper: 0
         Lower: 0
         Op   : ignore
       Protocol: 0
       Use protocol: false
       SPI: 0x00000000
       Use SPI: false
    IPSEC: Completed inbound tunnel flow rule, SPI 0x03FC9DB7
       Rule ID: 0x74e1b4a0
    IPSEC: New inbound decrypt rule, SPI 0x03FC9DB7
       Src addr: 192.168.1.1
       Src mask: 255.255.255.255
       Dst addr: 172.16.1.1
       Dst mask: 255.255.255.255
       Src ports
         Upper: 0
         Lower: 0
         Op   : ignore
       Dst ports
         Upper: 0
         Lower: 0
         Op   : ignore
       Protocol: 50
       Use protocol: true
       SPI: 0x03FC9DB7
       Use SPI: true
    IPSEC: Completed inbound decrypt rule, SPI 0x03FC9DB7
       Rule ID: 0x6f0de830
    IPSEC: New inbound permit rule, SPI 0x03FC9DB7
       Src addr: 192.168.1.1
       Src mask: 255.255.255.255
       Dst addr: 172.16.1.1
       Dst mask: 255.255.255.255
       Src ports
         Upper: 0
         Lower: 0
         Op   : ignore
       Dst ports
         Upper: 0
         Lower: 0
         Op   : ignore
       Protocol: 50
       Use protocol: true
       SPI: 0x03FC9DB7
       Use SPI: true
    IPSEC: Completed inbound permit rule, SPI 0x03FC9DB7
       Rule ID: 0x6f0de8d8
    Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1, Pitcher:
     received KEY_UPDATE, spi 0x3fc9db7
    Feb 13 23:48:56 [IKEv1 DEBUG]Group = 192.168.1.1, IP = 192.168.1.1, Starting
     P2 rekey timer: 24480 seconds.
    Feb 13 23:48:56 [IKEv1]Group = 192.168.1.1, IP = 192.168.1.1, PHASE 2
     COMPLETED (msgid=4c073b21)

    ASA Versions 8.3 and Earlier

    Enter these debug commands in order to determine the location of the tunnel failure:

      

    • debug crypto isakmp 127 (Phase 1)

    • debug crypto ipsec 127 (Phase 2)

    Here is a complete example debug output:

    Feb 13 04:19:53 [IKEv1]: IP = 172.16.1.1, IKE_DECODE RECEIVED Message (msgid=0) with
     payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) +
     NONE (0) total length : 172
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, processing SA payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, Oakley proposal is acceptable
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, processing VID payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, Received NAT-Traversal ver 02 VID
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, processing VID payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, Received NAT-Traversal ver 03 VID
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, processing VID payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, Received NAT-Traversal RFC VID
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, processing VID payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, Received Fragmentation VID
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, IKE Peer included IKE fragmentation
     capability flags:  Main Mode:        True  Aggressive Mode:  True
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, processing IKE SA payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, IKE SA Proposal # 1, Transform # 1
     acceptable  Matches global IKE entry # 1
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, constructing ISAKMP SA payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, constructing NAT-Traversal VID ver
     02 payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, constructing Fragmentation VID +
     extended capabilities payload
    Feb 13 04:19:53 [IKEv1]: IP = 172.16.1.1, IKE_DECODE SENDING Message (msgid=0) with
     payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 132
    Feb 13 04:19:53 [IKEv1]: IP = 172.16.1.1, IKE_DECODE RECEIVED Message (msgid=0) with
     payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) +
     VENDOR (13) + NAT-D (130) + NAT-D (130) + NONE (0) total length : 304
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, processing ke payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, processing ISA_KE payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, processing nonce payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, processing VID payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, Received Cisco Unity client VID
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, processing VID payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, Received xauth V6 VID
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, processing VID payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, Processing VPN3000/ASA spoofing IOS
     Vendor ID payload (version: 1.0.0, capabilities: 20000001)
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, processing VID payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, Received Altiga/Cisco VPN3000/Cisco
     ASA GW VID
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, processing NAT-Discovery payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, computing NAT Discovery hash
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, processing NAT-Discovery payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, computing NAT Discovery hash
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, constructing ke payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, constructing nonce payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, constructing Cisco Unity VID payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, constructing xauth V6 VID payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, Send IOS VID
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, Constructing ASA spoofing IOS Vendor
     ID payload (version: 1.0.0, capabilities: 20000001)
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, constructing VID payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, Send Altiga/Cisco VPN3000/Cisco
     ASA GW VID
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, constructing NAT-Discovery payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, computing NAT Discovery hash
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, constructing NAT-Discovery payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, computing NAT Discovery hash
    Feb 13 04:19:53 [IKEv1]: IP = 172.16.1.1, Connection landed on tunnel_group 172.16.1.1
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, Generating keys
     for Responder...
    Feb 13 04:19:53 [IKEv1]: IP = 172.16.1.1, IKE_DECODE SENDING Message (msgid=0) with
     payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) +
     VENDOR (13) + NAT-D (130) + NAT-D (130) + NONE (0) total length : 304
    Feb 13 04:19:53 [IKEv1]: IP = 172.16.1.1, IKE_DECODE RECEIVED Message (msgid=0) with
     payloads : HDR + ID (5) + HASH (8) + IOS KEEPALIVE (128) + VENDOR (13) + NONE (0)
     total length : 96
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, processing
     ID payload
    Feb 13 04:19:53 [IKEv1 DECODE]: Group = 172.16.1.1, IP = 172.16.1.1, ID_IPV4_ADDR
     ID received 172.16.1.1
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, processing
     hash payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, Computing
     hash for ISAKMP
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, Processing IOS keep alive payload:
     proposal=32767/32767 sec.
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, processing
     VID payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, Received DPD VID
    Feb 13 04:19:53 [IKEv1]: Group = 172.16.1.1, IP = 172.16.1.1, Automatic NAT Detection
     Status:     Remote end is NOT behind a NAT device     This   end is NOT behind
     a NAT device
    Feb 13 04:19:53 [IKEv1]: IP = 172.16.1.1, Connection landed on tunnel_group 172.16.1.1
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1,
     constructing ID payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1,
     constructing hash payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1,
     Computing hash for ISAKMP
    Feb 13 04:19:53 [IKEv1 DEBUG]: IP = 172.16.1.1, Constructing IOS keep alive payload:
     proposal=32767/32767 sec.
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1,
     constructing dpd vid payload
    Feb 13 04:19:53 [IKEv1]: IP = 172.16.1.1, IKE_DECODE SENDING Message (msgid=0) with
     payloads : HDR + ID (5) + HASH (8) + IOS KEEPALIVE (128) + VENDOR (13) + NONE (0)
     total length : 96
    Feb 13 04:19:53 [IKEv1]: Group = 172.16.1.1, IP = 172.16.1.1, PHASE 1 COMPLETED
    Feb 13 04:19:53 [IKEv1]: IP = 172.16.1.1, Keep-alive type for this connection: DPD
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, Starting P1
     rekey timer: 82080 seconds.
    Feb 13 04:19:53 [IKEv1 DECODE]: IP = 172.16.1.1, IKE Responder starting QM: msg id =
     4c073b21
    Feb 13 04:19:53 [IKEv1]: IP = 172.16.1.1, IKE_DECODE RECEIVED Message
     (msgid=4c073b21) with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + ID (5) +
     ID (5) + NOTIFY (11) + NONE (0) total length : 200
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1,
     processing hash payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1,
     processing SA payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1,
     processing nonce payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1,
     processing ID payload
    Feb 13 04:19:53 [IKEv1 DECODE]: Group = 172.16.1.1, IP = 172.16.1.1,
     ID_IPV4_ADDR_SUBNET ID received--10.2.2.0--255.255.255.0
    Feb 13 04:19:53 [IKEv1]: Group = 172.16.1.1, IP = 172.16.1.1, Received remote IP
     Proxy Subnet data in ID Payload:   Address 10.2.2.0, Mask 255.255.255.0,
     Protocol 0, Port 0
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1,
     processing ID payload
    Feb 13 04:19:53 [IKEv1 DECODE]: Group = 172.16.1.1, IP = 172.16.1.1,
     ID_IPV4_ADDR_SUBNET ID received--10.1.1.0--255.255.255.0
    Feb 13 04:19:53 [IKEv1]: Group = 172.16.1.1, IP = 172.16.1.1, Received local IP
     Proxy Subnet data in ID Payload:   Address 10.1.1.0, Mask 255.255.255.0,
     Protocol 0, Port 0
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, processing
     notify payload
    Feb 13 04:19:53 [IKEv1]: Group = 172.16.1.1, IP = 172.16.1.1, QM IsRekeyed old sa
     not found by addr
    Feb 13 04:19:53 [IKEv1]: Group = 172.16.1.1, IP = 172.16.1.1, Static Crypto Map
     check, checking map = outside_map, seq = 20...
    Feb 13 04:19:53 [IKEv1]: Group = 172.16.1.1, IP = 172.16.1.1, Static Crypto Map
     check, map outside_map, seq = 20 is a successful match
    Feb 13 04:19:53 [IKEv1]: Group = 172.16.1.1, IP = 172.16.1.1, IKE Remote Peer
     configured for crypto map: outside_map
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, processing
     IPSec SA payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, IPSec SA
     Proposal # 1, Transform # 1 acceptable  Matches global IPSec SA entry # 20
    Feb 13 04:19:53 [IKEv1]: Group = 172.16.1.1, IP = 172.16.1.1, IKE: requesting SPI!
    IPSEC: New embryonic SA created @ 0xAB5C63A8,
        SCB: 0xABD54E98,
        Direction: inbound
        SPI      : 0x1BA0C55C
        Session ID: 0x00004000
        VPIF num  : 0x00000001
        Tunnel type: l2l
        Protocol   : esp
        Lifetime   : 240 seconds
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, IKE got SPI
     from key engine: SPI = 0x1ba0c55c
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, oakley
     constucting quick mode
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, constructing
     blank hash payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, constructing
     IPSec SA payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, constructing
     IPSec nonce payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, constructing
     proxy ID
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, Transmitting
     Proxy Id:
       Remote subnet: 10.2.2.0  Mask 255.255.255.0 Protocol 0  Port 0
       Local subnet:  10.1.1.0  mask 255.255.255.0 Protocol 0  Port 0
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, constructing
     qm hash payload
    Feb 13 04:19:53 [IKEv1 DECODE]: Group = 172.16.1.1, IP = 172.16.1.1, IKE Responder
     sending 2nd QM pkt: msg id = 4c073b21
    Feb 13 04:19:53 [IKEv1]: IP = 172.16.1.1, IKE_DECODE SENDING Message
     (msgid=4c073b21) with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + ID (5) +
     ID (5) + NONE (0) total length : 172
    Feb 13 04:19:53 [IKEv1]: IP = 172.16.1.1, IKE_DECODE RECEIVED Message
     (msgid=4c073b21) with payloads : HDR + HASH (8) + NONE (0) total length : 52
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, processing
     hash payload
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, loading all
     IPSEC SAs
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, Generating
     Quick Mode Key!
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, NP encrypt
     rule look up for crypto map outside_map 20 matching ACL 100: returned
     cs_id=ab9302f0; rule=ab9309b0
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, Generating
     Quick Mode Key!
    IPSEC: New embryonic SA created @ 0xAB570B58,
        SCB: 0xABD55378,
        Direction: outbound
        SPI      : 0x03FC9DB7
        Session ID: 0x00004000
        VPIF num  : 0x00000001
        Tunnel type: l2l
        Protocol   : esp
        Lifetime   : 240 seconds
    IPSEC: Completed host OBSA update, SPI 0x03FC9DB7
    IPSEC: Creating outbound VPN context, SPI 0x03FC9DB7
        Flags: 0x00000005
        SA   : 0xAB570B58
        SPI  : 0x03FC9DB7
        MTU  : 1500 bytes
        VCID : 0x00000000
        Peer : 0x00000000
        SCB  : 0x01512E71
        Channel: 0xA7A98400
    IPSEC: Completed outbound VPN context, SPI 0x03FC9DB7
        VPN handle: 0x0000F99C
    IPSEC: New outbound encrypt rule, SPI 0x03FC9DB7
        Src addr: 10.1.1.0
        Src mask: 255.255.255.0
        Dst addr: 10.2.2.0
        Dst mask: 255.255.255.0
        Src ports
          Upper: 0
          Lower: 0
          Op   : ignore
        Dst ports
          Upper: 0
          Lower: 0
          Op   : ignore
        Protocol: 0
        Use protocol: false
        SPI: 0x00000000
        Use SPI: false
    IPSEC: Completed outbound encrypt rule, SPI 0x03FC9DB7
        Rule ID: 0xABD557B0
    IPSEC: New outbound permit rule, SPI 0x03FC9DB7
        Src addr: 192.168.1.1
        Src mask: 255.255.255.255
        Dst addr: 172.16.1.1
        Dst mask: 255.255.255.255
        Src ports
          Upper: 0
          Lower: 0
          Op   : ignore
        Dst ports
          Upper: 0
          Lower: 0
          Op   : ignore
        Protocol: 50
        Use protocol: true
        SPI: 0x03FC9DB7
        Use SPI: true
    IPSEC: Completed outbound permit rule, SPI 0x03FC9DB7
        Rule ID: 0xABD55848
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, NP encrypt rule
     look up for crypto map outside_map 20 matching ACL 100: returned cs_id=ab9302f0;
     rule=ab9309b0
    Feb 13 04:19:53 [IKEv1]: Group = 172.16.1.1, IP = 172.16.1.1, Security negotiation
     complete for LAN-to-LAN Group (172.16.1.1)  Responder, Inbound SPI = 0x1ba0c55c,
     Outbound SPI = 0x03fc9db7
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, IKE got a
     KEY_ADD msg for SA: SPI = 0x03fc9db7
    IPSEC: Completed host IBSA update, SPI 0x1BA0C55C
    IPSEC: Creating inbound VPN context, SPI 0x1BA0C55C
        Flags: 0x00000006
        SA   : 0xAB5C63A8
        SPI  : 0x1BA0C55C
        MTU  : 0 bytes
        VCID : 0x00000000
        Peer : 0x0000F99C
        SCB  : 0x0150B419
        Channel: 0xA7A98400
    IPSEC: Completed inbound VPN context, SPI 0x1BA0C55C
        VPN handle: 0x0001169C
    IPSEC: Updating outbound VPN context 0x0000F99C, SPI 0x03FC9DB7
        Flags: 0x00000005
        SA   : 0xAB570B58
        SPI  : 0x03FC9DB7
        MTU  : 1500 bytes
        VCID : 0x00000000
        Peer : 0x0001169C
        SCB  : 0x01512E71
        Channel: 0xA7A98400
    IPSEC: Completed outbound VPN context, SPI 0x03FC9DB7
        VPN handle: 0x0000F99C
    IPSEC: Completed outbound inner rule, SPI 0x03FC9DB7
        Rule ID: 0xABD557B0
    IPSEC: Completed outbound outer SPD rule, SPI 0x03FC9DB7
        Rule ID: 0xABD55848
    IPSEC: New inbound tunnel flow rule, SPI 0x1BA0C55C
        Src addr: 10.2.2.0
        Src mask: 255.255.255.0
        Dst addr: 10.1.1.0
        Dst mask: 255.255.255.0
        Src ports
          Upper: 0
          Lower: 0
          Op   : ignore
        Dst ports
          Upper: 0
          Lower: 0
          Op   : ignore
        Protocol: 0
        Use protocol: false
        SPI: 0x00000000
        Use SPI: false
    IPSEC: Completed inbound tunnel flow rule, SPI 0x1BA0C55C
        Rule ID: 0xAB8D98A8
    IPSEC: New inbound decrypt rule, SPI 0x1BA0C55C
        Src addr: 172.16.1.1
        Src mask: 255.255.255.255
        Dst addr: 192.168.1.1
        Dst mask: 255.255.255.255
        Src ports
          Upper: 0
          Lower: 0
          Op   : ignore
        Dst ports
          Upper: 0
          Lower: 0
          Op   : ignore
        Protocol: 50
        Use protocol: true
        SPI: 0x1BA0C55C
        Use SPI: true
    IPSEC: Completed inbound decrypt rule, SPI 0x1BA0C55C
        Rule ID: 0xABD55CB0
    IPSEC: New inbound permit rule, SPI 0x1BA0C55C
        Src addr: 172.16.1.1
        Src mask: 255.255.255.255
        Dst addr: 192.168.1.1
        Dst mask: 255.255.255.255
        Src ports
          Upper: 0
          Lower: 0
          Op   : ignore
        Dst ports
          Upper: 0
          Lower: 0
          Op   : ignore
        Protocol: 50
        Use protocol: true
        SPI: 0x1BA0C55C
        Use SPI: true
    IPSEC: Completed inbound permit rule, SPI 0x1BA0C55C
        Rule ID: 0xABD55D48
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, Pitcher: received
     KEY_UPDATE, spi 0x1ba0c55c
    Feb 13 04:19:53 [IKEv1 DEBUG]: Group = 172.16.1.1, IP = 172.16.1.1, Starting P2 rekey
     timer: 27360 seconds.
    Feb 13 04:19:53 [IKEv1]: Group = 172.16.1.1, IP = 172.16.1.1, PHASE 2 COMPLETED
     (msgid=4c073b21)
    TAC Authored

    Contributed by Cisco Engineers

    • Venkata Aditya B
      Cisco TAC Engineer
    • Rahul Govindan
      Cisco TAC Engineer

    Was this Document Helpful?

    FeedbackFeedback

    Contact Cisco

    Related Cisco Community Discussions

    This Document Applies to These Products

    About Us
    Contact Us
    Work with Us