topic IKE phase 2 failing with an asa5505 in General Topics

IKE phase 2 failing with an asa5505

LCMember1607 — Wed, 02 Mar 2011 21:01:53 GMT

Message =

IKE phase-1 negotiation is succeeded as initiator, main mode. Established SA:

IKE phase-2 negotiation is started as initiator, quick mode. Initiated SA:

IKE protocol notification message received: INVALID-ID-INFORMATION (18).

Re: IKE phase 2 failing with an asa5505

gswcowboy — Wed, 02 Mar 2011 21:53:48 GMT

Hi,

Confirm we have the correct local and remote proxy Id's from the ASA configured on the PAN.
If we can get the tunnel to be initiated from the ASA the PAN system logs should give us more detail as to the configuration option we need to adjust.

*Proxy id's are needed when building a tunnel to other devices that use policy based VPN, we use route based vpn's

*There would have to be a proxy id entry for each network

Here's an example of PAN to ISA config:

https://live.paloaltonetworks.com/docs/DOC-1328

-Renato

Re: IKE phase 2 failing with an asa5505

dagibbs — Wed, 02 Mar 2011 22:03:23 GMT

Also, get the ASA5505 administrator to confirm he hasn't done soemthing "funky' with the tunnel name.

There's a "feature" in Cisco firewalls which require the tunnel ID ont he PIX/ASA to be the IP address of the remote end - just the IP address, *not* a name or anything else - or else phase 2 fails.

This one bit me in the backside badly in a past life.

Cheers.

Re: IKE phase 2 failing with an asa5505

James — Wed, 02 Mar 2011 22:31:30 GMT

I have found in previous tests I need to set the exchange mode to aggressive mode.

Then, even though aggressive mode expects the IP address as the authentication, Cisco will send an FQDN instead.

This command might give you some more info :

less mp-log ikemgr.log (see whole log)

tail mp-log ikemgr.log (go to end of log)

tail follow yes mp-log ikemgr.log (show log in real time)

There are further CLI commands to check the VPN status in the VPN config/tech note docs.

Thanks

James

Re: IKE phase 2 failing with an asa5505

LCMember1607 — Thu, 03 Mar 2011 19:53:32 GMT

Thanks, I set up the proxies and the tunnel is up.

Now I think I may have a nat issue.

Any NAT configs on hand for asa<->pan?

Thanks.

Re: IKE phase 2 failing with an asa5505

leole — Wed, 28 Sep 2011 16:20:43 GMT

Hi Bill,

How did you set up the proxies? I got the same error between PAN4020 and ASA5510

Thanks.

Leo

lle@socccd.edu

Re: IKE phase 2 failing with an asa5505

LCMember1607 — Wed, 28 Sep 2011 16:37:28 GMT

IPSec tunnel.

Show advanced options

select the correct IKE Gateway, under IPSec Crypto Profile add a Proxy ID with the Local ID being either a subnet or device IP that you are allowing access to on the PAN side and a Remote ID being either a subnet or device IP on the ASA side.

Re: IKE phase 2 failing with an asa5505

friento — Thu, 29 Sep 2011 13:36:13 GMT

FYI

There's limit of 10 Proxy per tunnel.

Re: IKE phase 2 failing with an asa5505

leole — Thu, 29 Sep 2011 17:21:09 GMT

Thank you Bill,

It works for me.

Leo