About infotech

But shouldn't I be able to bring it back up by doing a test and shouldn't the other used tunnels with the same configuration do the same thing? ... View more

there isn't continuous traffic flowing down the tunnel. I haven't identifiy a specific pattern but it does seem to go down int he afternoon and is up again the next morning. I would be so concerned but none of the other tunnels configured similiar configuration and traffic ... View more

Yes I have contacted support for assistance with my issue thanks ... View more

No didn't know I had to be, I have never done cisco or PA before I took this job so I am still learning a lot ... View more

I do not find an option for show network on the PA 3020 unless I am in the wrong place in the cli ... View more

This may take me awhile I tried to do a show network ike crypto-profiles ike-crypto-profiles on the 3020 it gave me an invalid syntax ... View more

right now its this one set network ike crypto-profiles ipsec-crypto-profiles Herget_Standard_IPSec_Crypto lifetime hours 1 But I also tried this one too set network ike crypto-profiles ipsec-crypto-profiles Herget_Standard_IPSec_Crypto-1 dh-group group1 ... View more

Here is from the PA [edit] admin@PA-3020_DR# show network ike crypto-profiles ipsec-crypto-profiles profiles [edit] admin@PA-3020_DR# show network ike crypto-profiles ipsec-crypto-profiles set network ike crypto-profiles ipsec-crypto-profiles default esp encryption [ aes128 3des ] set network ike crypto-profiles ipsec-crypto-profiles default esp authentication sha1 set network ike crypto-profiles ipsec-crypto-profiles default dh-group group2 set network ike crypto-profiles ipsec-crypto-profiles default lifetime hours 1 set network ike crypto-profiles ipsec-crypto-profiles Peoria_IPSec_Profile esp authentication sha1 set network ike crypto-profiles ipsec-crypto-profiles Peoria_IPSec_Profile esp encryption aes256 set network ike crypto-profiles ipsec-crypto-profiles Peoria_IPSec_Profile lifetime hours 8 set network ike crypto-profiles ipsec-crypto-profiles Peoria_IPSec_Profile dh-group group1 set network ike crypto-profiles ipsec-crypto-profiles Herget_Standard_IPSec_Crypto esp authentication sha1 set network ike crypto-profiles ipsec-crypto-profiles Herget_Standard_IPSec_Crypto esp encryption aes256 set network ike crypto-profiles ipsec-crypto-profiles Herget_Standard_IPSec_Crypto lifetime hours 1 set network ike crypto-profiles ipsec-crypto-profiles Herget_Standard_IPSec_Crypto dh-group group1 set network ike crypto-profiles ipsec-crypto-profiles Herget_Standard_IPSec_Crypto-1 esp authentication sha1 set network ike crypto-profiles ipsec-crypto-profiles Herget_Standard_IPSec_Crypto-1 esp encryption aes256 set network ike crypto-profiles ipsec-crypto-profiles Herget_Standard_IPSec_Crypto-1 lifetime hours 8 set network ike crypto-profiles ipsec-crypto-profiles Herget_Standard_IPSec_Crypto-1 dh-group group1 [edit] admin@PA-3020_DR# Cisco - I am not 100% sure what you are asking me to do here so I just look in the ASDM under site to site vpn\configuration cryptop maps transform set ikev1 ESP-AES-256-SHA ... View more

I have the ipsec crypto set to group 1 ... View more

What is the transform set on the ASA for this network? ESP-AES-256-SHA (IKEv1) PFS-group1 (looking in the crypto maps) What is your corresponding IPSEC policy on the 3020? ESP-AES-Sha1 (ipsec crypto) ... View more

Here is the result of running less mp-log ikemge.log 2014-06-04 21:11:32 [INFO]: ====> PHASE-1 SA LIFETIME EXPIRED <==== ====> Expired SA: 66.94.196.107[500]-66.94.196.108[500] cookie:00299ee1552db716:80142a8d6f5a61d8 <==== 2014-06-04 21:11:42 [INFO]: ====> PHASE-1 SA LIFETIME EXPIRED <==== ====> Expired SA: 66.94.196.107[500]-66.94.196.108[500] cookie:00299ee1552db716:80142a8d6f5a61d8 <==== 2014-06-04 21:11:45 [PROTO_NOTIFY]: notification message 36136:R-U-THERE, doi=1 proto_id=1 spi=69d80199e1a26574 e572d79797571b2d (size=16). 2014-06-04 21:11:52 [INFO]: ====> PHASE-1 SA LIFETIME EXPIRED <==== ====> Expired SA: 66.94.196.107[500]-66.94.196.108[500] cookie:00299ee1552db716:80142a8d6f5a61d8 <==== 2014-06-04 21:12:01 [PROTO_NOTIFY]: ====> PHASE-2 NEGOTIATION FAILED AS INITIATOR, (QUICK MODE) <==== ====> Failed SA: 66.94.196.107[500]-66.94.196.108[500] message id:0x17F5E673 <==== Due to negotiation timeout. 2014-06-04 21:12:01 [INFO]: IPsec-SA request for 66.94.196.108 queued since no phase1 found 2014-06-04 21:12:01 [PROTO_NOTIFY]: ====> PHASE-1 NEGOTIATION STARTED AS INITIATOR, MAIN MODE <==== ====> Initiated SA: 66.94.196.107[500]-66.94.196.108[500] cookie:880e62bac918006c:0000000000000000 <==== 2014-06-04 21:12:01 [INFO]: received Vendor ID: FRAGMENTATION 2014-06-04 21:12:01 [INFO]: received Vendor ID: CISCO-UNITY 2014-06-04 21:12:01 [INFO]: received Vendor ID: draft-ietf-ipsra-isakmp-xauth-06.txt 2014-06-04 21:12:01 [INFO]: received Vendor ID: DPD 2014-06-04 21:12:01 [PROTO_NOTIFY]: ====> PHASE-1 NEGOTIATION SUCCEEDED AS INITIATOR, MAIN MODE <==== ====> Established SA: 66.94.196.107[500]-66.94.196.108[500] cookie:880e62bac918006c:454780c80ace55a4 lifetime 28800 Sec <==== 2014-06-04 21:12:01 [PROTO_NOTIFY]: ====> PHASE-2 NEGOTIATION STARTED AS INITIATOR, (QUICK MODE) <==== ====> Initiated SA: 66.94.196.107[500]-66.94.196.108[500] message id:0x23521A9E <==== 2014-06-04 21:12:01 [PROTO_NOTIFY]: notification message 14:NO-PROPOSAL-CHOSEN, doi=1 proto_id=3 spi=880e62bac918006c 454780c80ace55a4 (size=16). 2014-06-04 21:12:02 [INFO]: ====> PHASE-1 SA LIFETIME EXPIRED <==== ====> Expired SA: 66.94.196.107[500]-66.94.196.108[500] cookie:00299ee1552db716:80142a8d6f5a61d8 <==== 2014-06-04 21:12:02 [INFO]: ====> PHASE-1 SA DELETED <==== ====> Deleted SA: 66.94.196.107[500]-66.94.196.108[500] cookie:00299ee1552db716:80142a8d6f5a61d8 <==== 2014-06-04 21:12:02 [INFO]: ====> PHASE-1 SA LIFETIME EXPIRED <==== ====> Expired SA: 66.94.196.107[500]-66.94.196.108[500] cookie:880e62bac918006c:454780c80ace55a4 <==== 2014-06-04 21:12:06 [PROTO_NOTIFY]: notification message 36136:R-U-THERE, doi=1 proto_id=1 spi=25802d7bf6eca062 ba158c53d96c1487 (size=16). 2014-06-04 21:12:12 [INFO]: ====> PHASE-1 SA LIFETIME EXPIRED <==== ====> Expired SA: 66.94.196.107[500]-66.94.196.108[500] cookie:880e62bac918006c:454780c80ace55a4 <==== 2014-06-04 21:12:22 [INFO]: ====> PHASE-1 SA LIFETIME EXPIRED <==== ====> Expired SA: 66.94.196.107[500]-66.94.196.108[500] cookie:880e62bac918006c:454780c80ace55a4 <==== 2014-06-04 21:12:31 [PROTO_NOTIFY]: ====> PHASE-2 NEGOTIATION FAILED AS INITIATOR, (QUICK MODE) <==== ====> Failed SA: 66.94.196.107[500]-66.94.196.108[500] message id:0x23521A9E <==== Due to negotiation timeout. 2014-06-04 21:12:32 [INFO]: ====> PHASE-1 SA LIFETIME EXPIRED <==== ====> Expired SA: 66.94.196.107[500]-66.94.196.108[500] cookie:880e62bac918006c:454780c80ace55a4 <==== 2014-06-04 21:12:32 [INFO]: ====> PHASE-1 SA DELETED <==== ====> Deleted SA: 66.94.196.107[500]-66.94.196.108[500] cookie:880e62bac918006c:454780c80ace55a4 <==== 2014-06-04 21:12:40 [INFO]: IPsec-SA request for 66.94.196.108 queued since no phase1 found 2014-06-04 21:12:40 [PROTO_NOTIFY]: ====> PHASE-1 NEGOTIATION STARTED AS INITIATOR, MAIN MODE <==== ====> Initiated SA: 66.94.196.107[500]-66.94.196.108[500] cookie:588677c88a7381ca:0000000000000000 <==== 2014-06-04 21:12:40 [INFO]: received Vendor ID: FRAGMENTATION 2014-06-04 21:12:40 [INFO]: received Vendor ID: CISCO-UNITY 2014-06-04 21:12:40 [INFO]: received Vendor ID: draft-ietf-ipsra-isakmp-xauth-06.txt 2014-06-04 21:12:40 [INFO]: received Vendor ID: DPD 2014-06-04 21:12:40 [PROTO_NOTIFY]: ====> PHASE-1 NEGOTIATION SUCCEEDED AS INITIATOR, MAIN MODE <==== ====> Established SA: 66.94.196.107[500]-66.94.196.108[500] cookie:588677c88a7381ca:ed7b7952f6d3b488 lifetime 28800 Sec <==== 2014-06-04 21:12:40 [PROTO_NOTIFY]: ====> PHASE-2 NEGOTIATION STARTED AS INITIATOR, (QUICK MODE) <==== ====> Initiated SA: 66.94.196.107[500]-66.94.196.108[500] message id:0xA0ED9187 <==== 2014-06-04 21:12:40 [PROTO_NOTIFY]: notification message 14:NO-PROPOSAL-CHOSEN, doi=1 proto_id=3 spi=588677c88a7381ca ed7b7952f6d3b488 (size=16). 2014-06-04 21:12:41 [INFO]: ====> PHASE-1 SA LIFETIME EXPIRED <==== ====> Expired SA: 66.94.196.107[500]-66.94.196.108[500] cookie:588677c88a7381ca:ed7b7952f6d3b488 <==== 2014-06-04 21:12:51 [INFO]: ====> PHASE-1 SA LIFETIME EXPIRED <==== ====> Expired SA: 66.94.196.107[500]-66.94.196.108[500] cookie:588677c88a7381ca:ed7b7952f6d3b488 <==== 2014-06-04 21:13:01 [INFO]: ====> PHASE-1 SA LIFETIME EXPIRED <==== ====> Expired SA: 66.94.196.107[500]-66.94.196.108[500] cookie:588677c88a7381ca:ed7b7952f6d3b488 <==== 2014-06-04 21:13:10 [PROTO_NOTIFY]: ====> PHASE-2 NEGOTIATION FAILED AS INITIATOR, (QUICK MODE) <==== ====> Failed SA: 66.94.196.107[500]-66.94.196.108[500] message id:0xA0ED9187 <==== Due to negotiation timeout. 2014-06-04 21:13:11 [INFO]: ====> PHASE-1 SA LIFETIME EXPIRED <==== 0% ... View more

That was my first thought and I could be missing something but they look the same as far as I can tell. It looks like to me it is failing on phase 2 any suggestion on where else to look on the PA or the Cisco I would appreciate ... View more

I cleared on the PA side but have to lookup how to do it on the Cisco side This is what I got when I did the test vpn ipsec-sa tunnel Initiate IPSec SA: Total 12 tunnels found. 12 ipsec sa found. ... View more