About infotech

On the network tab/ipsec tunnels reading the console from left to right which status refers to the ike phase 1 and which refers to the ipsec phase 2 - with regard to the status green/red bubbles ... View more

there you go 2014-07-22 11:09:36 [PROTO_NOTIFY]: ====> PHASE-1 NEGOTIATION STARTED AS INITIATOR, MAIN MODE <==== ====> Initiated SA: 66.94.196.107[500]-66.94.196.108[500] cookie:44e50ec19a74237a:0000000000000000 <==== 2014-07-22 11:09:36 [INFO]: received Vendor ID: FRAGMENTATION 2014-07-22 11:09:36 [INFO]: received Vendor ID: CISCO-UNITY 2014-07-22 11:09:36 [INFO]: received Vendor ID: draft-ietf-ipsra-isakmp-xauth-06.txt 2014-07-22 11:09:36 [INFO]: received Vendor ID: DPD 2014-07-22 11:09:36 [PROTO_NOTIFY]: ====> PHASE-1 NEGOTIATION SUCCEEDED AS INITIATOR, MAIN MODE <==== ====> Established SA: 66.94.196.107[500]-66.94.196.108[500] cookie:44e50ec19a74237a:023e35f3a24f64d8 lifetime 28800 Sec <==== 2014-07-22 11:09:37 [INFO]: 0:66.94.196.107[0] - 66.94.196.108[0]:(nil):remote Parkway_Gateway_ITV3 passive mode specified for IKEv1, dropping acquire request 2014-07-22 11:09:41 [INFO]: 0:66.94.196.107[0] - 66.94.196.108[0]:(nil):remote Parkway_Gateway_ITV3 passive mode specified for IKEv1, dropping acquire request 2014-07-22 11:09:46 [INFO]: 0:66.94.196.107[0] - 66.94.196.108[0]:(nil):remote Parkway_Gateway_ITV3 passive mode specified for IKEv1, dropping acquire request 2014-07-22 11:10:00 [INFO]: 0:66.94.196.107[0] - 66.94.196.108[0]:(nil):remote Parkway_Gateway_ITV3 passive mode specified for IKEv1, dropping acquire request 2014-07-22 11:10:04 [INFO]: 0:66.94.196.107[0] - 66.94.196.108[0]:(nil):remote Parkway_Gateway_ITV3 passive mode specified for IKEv1, dropping acquire request 2014-07-22 11:10:09 [INFO]: 0:66.94.196.107[0] - 66.94.196.108[0]:(nil):remote Parkway_Gateway_ITV3 passive mode specified for IKEv1, dropping acquire request ... View more

I followed your suggestion and the tunnel still did not come up. As you look at the console it have status bubbles one on the left is red and the one on the right is green ... View more

I have enabled passive mode on the PA and am montoring the life of the tunnel. After that I am not sure what else can be done to fix the tunnel ... View more

The tunnel went down and here is the info you requested 2014-07-18 11:42:33 [PROTO_NOTIFY]: ====> PHASE-1 NEGOTIATION SUCCEEDED AS INITIATOR, MAIN MODE <==== ====> Established SA: 66.94.196.107[500]-66.94.196.108[500] cookie:0e6d9d81e004b9cf:3eae18911b8490b2 lifetime 28800 Sec <==== 2014-07-18 11:42:33 [PROTO_NOTIFY]: ====> PHASE-2 NEGOTIATION STARTED AS INITIATOR, (QUICK MODE) <==== ====> Initiated SA: 66.94.196.107[500]-66.94.196.108[500] message id:0xB10E2AC9 <==== 2014-07-18 11:42:33 [PROTO_NOTIFY]: ====> PHASE-2 NEGOTIATION STARTED AS INITIATOR, (QUICK MODE) <==== ====> Initiated SA: 66.94.196.107[500]-66.94.196.108[500] message id:0xDE276D28 <==== 2014-07-18 11:42:33 [PROTO_NOTIFY]: ====> PHASE-2 NEGOTIATION STARTED AS INITIATOR, (QUICK MODE) <==== ====> Initiated SA: 66.94.196.107[500]-66.94.196.108[500] message id:0xC9287FC3 <==== 2014-07-18 11:42:33 [PROTO_NOTIFY]: ====> PHASE-2 NEGOTIATION STARTED AS INITIATOR, (QUICK MODE) <==== ====> Initiated SA: 66.94.196.107[500]-66.94.196.108[500] message id:0x5F793423 <==== 2014-07-18 11:42:33 [PROTO_NOTIFY]: notification message 14:NO-PROPOSAL-CHOSEN, doi=1 proto_id=3 spi=0e6d9d81e004b9cf 3eae18911b8490b2 (size=16). 2014-07-18 11:42:33 [PROTO_NOTIFY]: ====> PHASE-2 NEGOTIATION STARTED AS INITIATOR, (QUICK MODE) <==== ====> Initiated SA: 66.94.196.107[500]-66.94.196.108[500] message id:0xF3641853 <==== 2014-07-18 11:42:34 [INFO]: IPsec-SA request for 66.94.196.108 queued since no phase1 found 2014-07-18 11:42:34 [PROTO_NOTIFY]: ====> PHASE-1 NEGOTIATION STARTED AS INITIATOR, MAIN MODE <==== ====> Initiated SA: 66.94.196.107[500]-66.94.196.108[500] cookie:dac938cd5be069b6:0000000000000000 <==== 2014-07-18 11:42:34 [INFO]: ====> PHASE-1 SA LIFETIME EXPIRED <==== ====> Expired SA: 66.94.196.107[500]-66.94.196.108[500] cookie:0e6d9d81e004b9cf:3eae18911b8490b2 <==== 2014-07-18 11:42:34 [INFO]: request for establishing IPsec-SA was queued since phase1 is not mature 2014-07-18 11:42:34 [INFO]: received Vendor ID: FRAGMENTATION 2014-07-18 11:42:34 [INFO]: received Vendor ID: CISCO-UNITY 2014-07-18 11:42:34 [INFO]: received Vendor ID: draft-ietf-ipsra-isakmp-xauth-06.txt 2014-07-18 11:42:34 [INFO]: received Vendor ID: DPD 2014-07-18 11:42:34 [PROTO_NOTIFY]: ====> PHASE-1 NEGOTIATION SUCCEEDED AS INITIATOR, MAIN MODE <==== ====> Established SA: 66.94.196.107[500]-66.94.196.108[500] cookie:dac938cd5be069b6:1dac1591732f729e lifetime 28800 Sec <==== 2014-07-18 11:42:34 [PROTO_NOTIFY]: ====> PHASE-2 NEGOTIATION STARTED AS INITIATOR, (QUICK MODE) <==== ====> Initiated SA: 66.94.196.107[500]-66.94.196.108[500] message id:0xAA2ED1DE <==== 2014-07-18 11:42:34 [PROTO_NOTIFY]: ====> PHASE-2 NEGOTIATION STARTED AS INITIATOR, (QUICK MODE) <==== ====> Initiated SA: 66.94.196.107[500]-66.94.196.108[500] message id:0x1F9D29F4 <==== 2014-07-18 11:42:34 [PROTO_NOTIFY]: notification message 14:NO-PROPOSAL-CHOSEN, doi=1 proto_id=3 spi=dac938cd5be069b6 1dac1591732f729e (size=16). 2014-07-18 11:42:35 [INFO]: ====> PHASE-1 SA LIFETIME EXPIRED <==== ====> Expired SA: 66.94.196.107[500]-66.94.196.108[500] cookie:dac938cd5be069b6:1dac1591732f729e <==== 2014-07-18 11:42:40 [PROTO_NOTIFY]: ====> PHASE-2 NEGOTIATION FAILED AS INITIATOR, (QUICK MODE) <==== ====> Failed SA: 66.94.196.107[500]-66.94.196.108[500] message id:0x76E9B64A <==== Due to negotiation timeout. 2014-07-18 11:42:41 [INFO]: ====> PHASE-1 SA LIFETIME EXPIRED <==== ====> Expired SA: 66.94.196.107[500]-66.94.196.108[500] cookie:ffae7dd6fe0f629a:ee14338fde5e99e3 <==== 2014-07-18 11:42:41 [INFO]: ====> PHASE-1 SA DELETED <==== ====> Deleted SA: 66.94.196.107[500]-66.94.196.108[500] cookie:ffae7dd6fe0f629a:ee14338fde5e99e3 <==== 2014-07-18 11:42:42 [INFO]: IPsec-SA request for 66.94.196.108 queued since no phase1 found 2014-07-18 11:42:42 [PROTO_NOTIFY]: ====> PHASE-1 NEGOTIATION STARTED AS INITIATOR, MAIN MODE <==== ====> Initiated SA: 66.94.196.107[500]-66.94.196.108[500] cookie:843c80e97d7cb413:0000000000000000 <==== 2014-07-18 11:42:42 [INFO]: received Vendor ID: FRAGMENTATION 2014-07-18 11:42:42 [INFO]: received Vendor ID: CISCO-UNITY 2014-07-18 11:42:42 [INFO]: received Vendor ID: draft-ietf-ipsra-isakmp-xauth-06.txt 2014-07-18 11:42:42 [INFO]: received Vendor ID: DPD 2014-07-18 11:42:42 [PROTO_NOTIFY]: ====> PHASE-1 NEGOTIATION SUCCEEDED AS INITIATOR, MAIN MODE <==== ====> Established SA: 66.94.196.107[500]-66.94.196.108[500] cookie:843c80e97d7cb413:e9b044e0557608b9 lifetime 28800 Sec <==== 2014-07-18 11:42:42 [PROTO_NOTIFY]: ====> PHASE-2 NEGOTIATION STARTED AS INITIATOR, (QUICK MODE) <==== ====> Initiated SA: 66.94.196.107[500]-66.94.196.108[500] message id:0xF07BE6F3 <==== 2014-07-18 11:42:42 [PROTO_NOTIFY]: notification message 14:NO-PROPOSAL-CHOSEN, doi=1 proto_id=3 spi=843c80e97d7cb413 e9b044e0557608b9 (size=16). 2014-07-18 11:42:43 [INFO]: ====> PHASE-1 SA LIFETIME EXPIRED <==== ====> Expired SA: 66.94.196.107[500]-66.94.196.108[500] cookie:f855cc03a1a32ab2:904aa5dae3200d46 <==== 2014-07-18 11:42:43 [INFO]: ====> PHASE-1 SA LIFETIME EXPIRED <==== ====> Expired SA: 66.94.196.107[500]-66.94.196.108[500] cookie:843c80e97d7cb413:e9b044e0557608b9 <==== 2014-07-18 11:42:44 [INFO]: ====> PHASE-1 SA LIFETIME EXPIRED <==== ====> Expired SA: 66.94.196.107[500]-66.94.196.108[500] cookie:0e6d9d81e004b9cf:3eae18911b8490b2 <==== 2014-07-18 11:42:45 [INFO]: ====> PHASE-1 SA LIFETIME EXPIRED <==== ====> Expired SA: 66.94.196.107[500]-66.94.196.108[500] cookie:dac938cd5be069b6:1dac1591732f729e <==== ... View more

I had it set to nothing originally but the Cisco had a setting so to make them match I added it. So far it hasn't change the behavior of the tunnel at all ... View more

I do not see a proxy id mismatch error I have already checked. The tunnel does come up and stay up for at least 8 hours and then drops for a period of time around 12 -16 hours ... View more

Sorry I thought I entered that information earlier in this post, the tunnel is currently up and running but should failed later this afternoon ... View more

I have checked this more times than I can count but here it is ipsec crypto settings on PA   encryption -aes256 authentication -sha1   DH group - group1   lifetime 8 hours   lifesize – 4800 mb Cisco 5505 ipsec crypto settings   encryption-AES256   Authentication -sha   DH - group1   SA lifetime settings - 8 hours   Traffic volume -4608000 KB ... View more

I am not getting a proxy id mismatch error I am getting no proposal chosen for phase 2 and phase 1 works fine ... View more

So what if the proxy id's on the cisco side aren;t really subnets that are used in order to make both sides match do you still have to add them to the PA side? Seems like if they did not match the tunnel would not come up at all. ... View more

I don't understand what you are saying. ... View more

What if the proxy ids on the cisco side are really being used do you still have to add them to the PA? ... View more

I will check that out ... View more