IKE v2 ASA vs. PA

Retired Member — Fri, 14 Sep 2018 07:01:40 GMT

Hi together,

at the beginning of this week I ran into the following challenge.

I’ve to setup an IKE v2 Tunnel between a Cisco ASA and a PA-850 running on 8.0.12.

During the configuration the Cisco Partner send me the local and remote tunnel pre-shared key.

After a few seconds of confusion, we started a funny discussion and 30 minutes of try and error later, we ended with the result, that IKE v1 is safe enough at this moment and we have to do some researching how to solve this issue.

Does anybody have the same challenge or maybe a solution? (Replacing the ASA is NOT a solution)

Kind regards

Sven

Re: IKE v2 ASA vs. PA

BPry — Fri, 14 Sep 2018 15:04:02 GMT

What do the logs say? Are you positive that the IKE Crypto maps actually matched; were you using IKEv2 only mode or IKEv2 preferred.

Really this boils down to the logs files, you need to be able to look at those and determine why exactly it was failing fairly easily.

Re: IKE v2 ASA vs. PA

Retired Member — Tue, 30 Oct 2018 13:31:36 GMT

Hi together,

sorry for being so quiet but the customer has changed prios und IKEv1 is working, so ...

Now I've some time and I'm back in this business.

We checked all proposals and reduced these to a minimum, everything fine.

We checked the ikemgr.log and see one error but for me it was very generally:

2018-10-30 07:45:31.339 +0100 [DEBG]: processing isakmp packet

2018-10-30 07:45:31.339 +0100 [DEBG]: ===

2018-10-30 07:45:31.339 +0100 [DEBG]: 798 bytes message received from 7.8.9.10[500]

2018-10-30 07:45:31.339 +0100 [INFO]: { 16: }: received IKE request 7.8.9.10[500] to 1.2.3.4[500], found IKE gateway customer1

2018-10-30 07:45:31.340 +0100 [PNTF]: { 16: }: ====> IKEv2 IKE SA NEGOTIATION STARTED AS RESPONDER, non-rekey; gateway customer1 <====

====> Initiated SA: 1.2.3.4[500]-7.8.9.10[500] SPI:249143bd726de95a:71c6b29a83fbac26 SN:27 <====

2018-10-30 07:45:31.340 +0100 [PWRN]: { 16: }: 1.2.3.4[500] - 7.8.9.10[500]:0x104ca350 vendor id payload ignored

2018-10-30 07:45:31.340 +0100 [DEBG]: { 16: }: received Notify type NAT_DETECTION_SOURCE_IP

2018-10-30 07:45:31.340 +0100 [PWRN]: { 16: }: 1.2.3.4[500] - 7.8.9.10[500]:0x104ca350 ignoring unauthenticated notify payload (NAT_DETECTION_SOURCE_IP)

2018-10-30 07:45:31.340 +0100 [DEBG]: { 16: }: received Notify type NAT_DETECTION_DESTINATION_IP

2018-10-30 07:45:31.340 +0100 [PWRN]: { 16: }: 1.2.3.4[500] - 7.8.9.10[500]:0x104ca350 ignoring unauthenticated notify payload (NAT_DETECTION_DESTINATION_IP)

2018-10-30 07:45:31.340 +0100 [DEBG]: { 16: }: received Notify type 16430

2018-10-30 07:45:31.340 +0100 [PWRN]: { 16: }: 1.2.3.4[500] - 7.8.9.10[500]:0x104ca350 ignoring unauthenticated notify payload (16430)

2018-10-30 07:45:31.341 +0100 [PWRN]: { 16: }: 1.2.3.4[500] - 7.8.9.10[500]:0x104ca350 vendor id payload ignored

2018-10-30 07:45:31.341 +0100 [DEBG]: proposal #1 len=52

2018-10-30 07:45:31.341 +0100 [DEBG]: proposal #2 len=44

2018-10-30 07:45:31.341 +0100 [DEBG]: proposal #3 len=44

2018-10-30 07:45:31.341 +0100 [DEBG]: proposal #4 len=44

2018-10-30 07:45:31.341 +0100 [DEBG]: proposal #5 len=52

2018-10-30 07:45:31.341 +0100 [DEBG]: proposal #6 len=52

2018-10-30 07:45:31.341 +0100 [DEBG]: proposal #7 len=44

2018-10-30 07:45:31.341 +0100 [DEBG]: { 16: }: see whether there's matching transform

2018-10-30 07:45:31.341 +0100 [DEBG]: { 16: }: found same ID. compare attributes

2018-10-30 07:45:31.341 +0100 [DEBG]: { 16: }: OK; advance to next of my transform type