topic Can't seem to connect to Cisco ASA in General Topics

Can't seem to connect to Cisco ASA

dclaro — Fri, 28 Oct 2016 15:23:08 GMT

Using the following Phase 1 settings:

I keep getting this error:

Received unencrypted notify payload (no proposal chosen) from IP x.x.x.x[500] to y.y.y.y[500], ignored...orIKE phase-1 negotiation is failed. Unable to process peer’s SA payload.

Check the IKE Crypto profile configuration to verify that the proposals on both sides have a common encryption, authentication, and DH Group proposal.

Re: Can't seem to connect to Cisco ASA

BPry — Fri, 28 Oct 2016 15:54:07 GMT

http://indeni.com/how-to-configure-ipsec-vpn-between-palo-alto-and-cisco-asa/

That is a pretty good guide on how to configure this correctly. I would run through that and actually verify that you have everythign configured corrrectly.

Re: Can't seem to connect to Cisco ASA

MohamedSharief — Mon, 31 Oct 2016 12:07:48 GMT

Try using 3des instead of aes-256-cbc and make sure its the same on ASA side. I got this issue recently and when changed to 3des phase1 was up.

Regards,

Sharief

Re: Can't seem to connect to Cisco ASA

pmc — Mon, 31 Oct 2016 23:09:26 GMT

3des is horribly insecure, I would not recommend it.