3DES CBC mode

My task to create a class that take 2 parameters 1)String Key, 2)String text then encrypt the string using the giving key and retrun the base64 encoding. My class seem working but the remote server did not decrypted.
one thing of the vendor specification is the IV should match \0\0\0\0\ (8 bytes of null) I think I did not know what to do there :)
here is the requirement:
1- use padding of type "[PKCS5] PKCS #5, Password-Based Encryption Standard" (see http://www.di-mgt.com.au/cryptopad.html). Microsoft .NET automatically pads the string as needed by default.
2- Encrypt the above resultant string using the Cipher Block Chaining (CBC) feedback mode of triple-DES encryption with an initial value for the feedback loop set to eight consecutive NUL (ASCII code 0) characters. The key to be used for this encryption is the key1. The cipher block chaining (CBC) feedback mode supports an additional, optional parameter named IV, which you'll need to implement as follows:
*     The IV property contains the initial value which will be used to
start a cipher feedback mode; it will always be a string of exactly one block in length. After encrypting or decrypting a string, this value is updated to reflect the modified feedback text. The parameter is read-only, and cannot be assigned a new value.
*     If the mode property is set to MODE_CBC or MODE_CFB, the IV property
must be provided and must be a string of the same length as the block size. Not providing a value for the IV property will result in a ValueError exception.
*     The IV property must be an 8-byte string and its value must be:
'\0\0\0\0\0\0\0\0' (a string of eight NUL characters)
here is my code:
import javax.crypto.*;
import javax.crypto.spec.*;
import java.security.*;
import java.io.*;
import javax.crypto.spec.IvParameterSpec;
import java.security.spec.AlgorithmParameterSpec;
public class TDESStringEncryptor
// private static int BLOCK_SIZE = 8;
     public static void main(String[] args)
          try
               TDESStringEncryptor enc = new TDESStringEncryptor();
               String value = enc.Encrypt(args[0], args[1]);
               System.err.println(value);
          catch (Exception ex)
               System.err.println(ex);
     public String Encrypt(String inkey, String data)
          throws Exception
          //--------------------- start ----------------------------
          //byte[] iv = new byte[]{(byte)0x8E, 0x12, 0x39, (byte)0x9C,0x07, 0x72, 0x6F, 0x5A};
          byte [] iv = {0x40,0x40,0x40,0x40,0x40,0x40,0x40,0x40};
     AlgorithmParameterSpec paramSpec = new IvParameterSpec(iv);
          // convert key to byte array and get it into a key object
          byte[] rawkey = inkey.getBytes();
          DESedeKeySpec keyspec = new DESedeKeySpec(rawkey);
          SecretKeyFactory keyfactory = SecretKeyFactory.getInstance("DESede");
          SecretKey key = keyfactory.generateSecret(keyspec);
Cipher c2 = Cipher.getInstance( "DESede/CBC/PKCS5Padding" );
//----------------start ---------------
c2.init(Cipher.ENCRYPT_MODE, key, paramSpec);
//c2.init( Cipher.ENCRYPT_MODE, key );
byte encodedParameters[] = c2.getParameters().getEncoded();
byte[] out = c2.doFinal(data.getBytes() );
          Cipher cipher = Cipher.getInstance("DESede/ECB/PKCS5Padding");
          cipher.init(Cipher.ENCRYPT_MODE, key);
          //byte[] out = cipher.doFinal( padString(data).getBytes() );
          byte[] out = cipher.doFinal(data.getBytes() );
          //String tst = byteArrayToHexString( out );
     return new sun.misc.BASE64Encoder().encode(out);
     //return byteArrayToHexString( out );
     private String byteArrayToHexString(byte in[])
          byte ch = 0x00;
          int i = 0;
          if ( in == null || in.length <= 0 )
               return null;
          String pseudo[] = {"0", "1", "2", "3", "4", "5", "6", "7", "8",
               "9", "A", "B", "C", "D", "E", "F"};
          StringBuffer out = new StringBuffer( in.length * 2 );
          while ( i < in.length )
               ch = (byte) ( in[i] & 0xF0 );
               ch = (byte) ( ch >>> 4 );
               ch = (byte) ( ch & 0x0F );
               out.append( pseudo[ (int) ch] );
               ch = (byte) ( in[i] & 0x0F );
               out.append( pseudo[ (int) ch] );
               i++;
          String rslt = new String( out );
          return rslt;
}

Thanks for your help, I am just lost. can you explian
to me what I need to use? I try to change DESede to
DES but I get an eror. with the current setting the
encryption work with no error.
I appreciated if you refer to me a good source in the
Internet to what I am missing.
here is a test I did:
C:\>java TDESStringEncryptor
A7B08F3958039D5F23D5F5243563541D4792E501272B3486
"This is a Test"
and the result was: w/Ubo4XBYUQjmzI+6QVA==
the developer at the other end whom using .NET send
his result which is: HMueLH8gSr9y9sUZXfRFlw==I think I give up! DES or DESede are symetric algorithms and only have a 'secret' key. They do not have a 'public' key and a 'private' key.
You need to start reading - http://www.cacr.math.uwaterloo.ca/hac/

Similar Messages

  • How to get the fixed result in a DES/CBC mode with fixed input data and fix

    How to get the fixed result in a DES/CBC mode with fixed input data and fixed key. Below is my program , I tried to get the checksum of the DESInputData with the DESKeyData, but each time the result is different.
    below is my code:
    byte[] DESKeyData = {(byte)0x01 ,(byte)0x01 ,(byte)0x01 ,(byte)0x01, (byte)0x01 ,(byte)0x01 ,(byte)0x01 ,(byte)0x01 };
    byte[] DESInputData = {(byte)0x31 ,(byte)0x31 ,(byte)0x31 ,(byte)0x31,(byte)0x31 ,(byte)0x31 ,(byte)0x31 ,(byte)0x31 };
    SecretKeySpec skey = new SecretKeySpec( DESKeyData, "DES" );
    Cipher cipher = Cipher.getInstance("DES/CBC/NoPadding");
    cipher.init( Cipher.ENCRYPT_MODE, skey );
    byte[] result = cipher.doFinal( DESInputData );

    Use class javax.crypto.spec.IvParameterSpec to specify IV for CBC mode cipher:
    // Create CBC-mode triple-DES cipher.
    Cipher c = Cipher.getInstance("DESede/CBC/PKCS5Padding");
    // Specify IV.
    IvParameterSpec iv = new IvParameterSpec(new byte[] { (byte)0x01, (byte)0x23, (byte)0x45, (byte)0x67, (byte)0x89, (byte)0xAB, (byte)0xCD, (byte)0xEF });
    // Initialize cipher with proper IV.
    c.init(Cipher.ENCRYPT_MODE, yourKey, iv);
    // Encrypt and decrypt should work ok now.
    For more info about cryptography, search the Internet for IntroToCrypto.pdf from mr. Phil Zimmerman. This document is also part of PGP (http://www.pgp.com).
    An excellent book is 'Applied Cryptography' from Bruce Schneier (http://www.counterpane.com/applied.html).
    Regards,
    Ronald Maas

  • 3DES from Java - CryptoAPI

    Hi All,
    I'm facing a problem that is:
    I encrypt data in Java client using 3DES algorithm("DESede/ECB/NoPadding" for the Cipher object and "DESede" for the SecretKey one). Our server is made on C# and it decrypts the data using .NET TripleDESCryptoServiceProvider class. No problem at all...
    The problem appears when this encrypted data (by Java) is passed to C++ client (GINA) that uses CryptoAPI with CALG_3DES parameter for data decryption. The "key base" is exactly the same byte array of 24 elements that's used for Java SecretKey creation. But the result of CryptDecrypt() is 0x80090005 that means "Bad Data". I've tried this with thew most simple data (i.e. BYTE data[] = {1,2,3,4,5,6,7,8}).
    What can be the problem ? The key or the Data or maybe some initialization parameter ( inspite of using deafult key parameters in CryptoAPI)???
    Thanx a lot for any clue.
    P.S. I've also tried to encrypt in Java with PKCS5Padding since
    "The only padding method currently defined is
    PKCS5_PADDING" appears in MS SDK.
    But the result is the same....

    1. Both sides use 3DES algorithm with CBC mode, the same IV and PKCS5 padding (DESede/CBC/PKCS5Padding).
    2. At the java side the key is produced in the following manner:
    DESedeKeySpec keyspec = new DESedeKeySpec(key);
    SecretKeyFactory keyfactory = SecretKeyFactory.getInstance(keyAlg);
    SecretKey secretKey = keyfactory.generateSecret(keyspec);where key is a byte array of 24 elements and keyAlg = "DESede".
    3. At CryptoAPI side I use the same settings for the key and the algorithm but the key itself is not derived (as I've tried before) but is packed to PLAINTEXTKEYBLOB and then imported via CryptImportKey(). The key data that is inserted to this blob is exactly the same 24 bytes from the previous paragraph.
    Good luck to all ! :-)

  • One file  Encrypt in VB using 3DES how to  Decrypt in Java ?

    one file Encrypt in VB using 3DES how to Decrypt in Java ?
    plese give me code
    shrinath

    My problem is something similar to him, but mine is in Tandem C. I have a encrypted text, which was encrypted in Tandem C using OpenSSL. I used CBC mode with no padding, i just wrote the encrypted text to a file & i tried reading the cipher from a Java program, so as to decrypt using the same CBC mode & no padding mode. but it is not decrypted as intended to be.
    can u pls give ur comment? if u have any code can u pls share it here?

  • Upgrading Wireless Suite to TLS 1.x and changing CBC to CTR or GCM

    To anyone who may have a solution,
    Is there anyone who has successfully upgraded an ISE Server, MSE 3355, WLC 5508, and/or Prime Infrastructure to rid themselves of the vulnerabilities mentioned in the title?  I have to upgrade these devices from SSL version (x) to TLS and change the CBC mode cipher encryption and enable CTR or GCM cipher mode.  I'm having a very difficult time finding documentation on how to do this.  Would fixing this require me to have a particular account with Cisco for them to look into and work (I honestly don't know)?  Would the current licensing on any of these devices effect these vulnerabilities?
    Humbly,
    Sam

    1. Have you done a hard reset on the router?
                      I've done a hard reset many many times and still the problem exists.
    If the problem still exists after doing a hard reset and not making any other changes, then you have a bad router.
                    Replaced the router and the problem still exists.
    What you describe is not impossible.  The image for the router's firmware is stored in EPROM.
    It can happen that bits get "stuck" in EPROM resulting in a corrupt firmware image.
                   I KNOW the problem is in the firmware BUT I am not able to get it through the thick heads of tech support who "might" be able to spell "IP". Actiontec will not speak with me about it since I am NOT a Verizon Tech Support person. Verizon Tech Support tells me that it is impossible for the IP address to be 10.168.1.X. 
    My cell phone wireless has been allocated an IP address of 10.168.1.101 by the router that Verizon tech spport says can't happen and Tech Support is coming to my house this mornnig to check my system. They will see 1st hand the impossible.
    One Tech Support guy said the problem is that I have a switch downstream of my router and it is allocating the incorrect IP addresses. Not sure how a network switch that has been working properly for years can all of a sudden start telling a router to allocate IP addresses all on its own. BTW, this happened AFTER an update to the firmware.

  • Need explanation for DES/CBC/NoPadding

    Hallo,
    I have the following problem:
    when I try do use the encryption mode DES/CBC/NoPadding my program fails to decrypt
    first 8 bytes. (I implement my own padding)
    (may be I could just before encrypting the plain text insert
    in the beginning of the message 8 bits of random data, but hasnot the
    the function of the API do that stuff instead of me?)
    I'd like to understand just this case, so please don't advice using another scheme or PKxxx
    padding.
    thanks in advance!
    the code I use to encrypt:
    private static byte[] encryptionCBC(byte[] baToEncode, SecretKey desKey, IvParameterSpec IV)
            throws  IllegalBlockSizeException, BadPaddingException,
                    NoSuchAlgorithmException, NoSuchPaddingException,
                    InvalidAlgorithmParameterException,
                    InvalidKeyException, ShortBufferException 
        Cipher c = Cipher.getInstance("DES/CBC/NoPadding");
        c.init(Cipher.ENCRYPT_MODE, desKey, IV);
        byte[] toEncrypt = transformToPadded(baToEncode);
        byte[] encrypted = new byte[(toEncrypt.length / 64) * c.getOutputSize(64)];
        for (int i = 0; i < toEncrypt.length/64; i++) {
            byte[] encryptedBlock = new byte[c.getOutputSize(64)];
            c.update(toEncrypt,i,64,encryptedBlock);
            System.arraycopy(encryptedBlock, 0, encrypted, c.getOutputSize(64) * i,
                                 c.getOutputSize(64));
        c.doFinal();
        return encrypted;
    }//encryptionCBCthe code I use to decrypt:
    private static byte[] decryptionCBC(byte[] baToDecode, SecretKey desKey, IvParameterSpec IV)
            throws  IllegalBlockSizeException, BadPaddingException,
                    NoSuchAlgorithmException, NoSuchPaddingException,
                    InvalidAlgorithmParameterException,
                    InvalidKeyException, ShortBufferException 
        Cipher c = Cipher.getInstance("DES/CBC/NoPadding");
        c.init(Cipher.DECRYPT_MODE, desKey, IV);
        byte[] decrypted = new byte[64 * baToDecode.length / c.getOutputSize(64)];
        for (int i = 0; i < baToDecode.length / c.getOutputSize(64); i++) {
            byte[] decryptedBlock = new byte[64];
            c.update(baToDecode, i, c.getOutputSize(64), decryptedBlock);
            System.arraycopy(decryptedBlock, 0, decrypted, 64 * i, 64);
        c.doFinal();
        boolean flag = false;
        // remove padding if exists
        for(int i = 0; i<decrypted.length; i++){
            if (flag) {
                decrypted[i] = 0x20; // padding with space
            //find the end of the message = Ctrl+Z
            if (!flag && decrypted[i] == 0x1A){
                    decrypted=0x20; // the end of the message reached we can
    flag = true; // pad the rest with space
    // byte[] iv = IV.getIV();
    // for (int i=0; i<8; i++)
    // decrypted[i] = (byte)(decrypted[i] ^ iv[i]);
    return decrypted;
    }//decryptionCBC
    // to implement simple padding
    // using ctrl-z to designate the end of the cleartext
    private static byte[] transformToPadded(byte[] x) {
         if (x.length % 64 == 0)
              return x;
         else{
              byte[] tail = new byte[64 - x.length % 64];
              java.util.Random rand = new java.util.Random();
              rand.nextBytes(tail);
              tail[0] = 0x1A; // Ctrl+Z
              byte[] result = new byte[x.length + tail.length];
              System.arraycopy(x, 0, result, 0, x.length);
              System.arraycopy(tail, 0, result, x.length, tail.length);
              return result;               
    }// transform

    Hi,
    In most cases the initialization vectors are wrong when the decryption of the first 8 bytes fails with CBC mode encryption.
    Two suggestions:
    1) Try changing CBC mode to ECB mode (just for testing). If ECB mode works, you know the problem has something to do with the IV.
    2) Ensure that the IV passed to encryption and decryption are identical.
    Regards,
    Ronald Maas

  • OpenSSL bf-cbc encrypted Keyfile HOOK for LUKS

    I modified the this HOOK that maxim_ posted here. That dose not work.
    https://bbs.archlinux.org/viewtopic.php … 05#p947805
    This one uses Blowfish in CBC mode instead of AES-256.
    The password is hashed 1000 times with Whirlpool.
    gen-cryptkey adds a a Salt to the encrypted keyfile
    https://github.com/tdwyer/bfkeyfile
    /lib/initcpio/hooks
    #!/usr/bin/ash
    run_hook ()
    local encfile decfile iteration attempts prompt badpassword dev arg1 arg2 retcode password passwordHash
    if [ "x${bfkf}" != "x" ]; then
    encfile="/enc_keyfile.bin"
    decfile="/crypto_keyfile.bin"
    iteration=1000
    attempts=5
    prompt="Enter password: "
    badpassword="Password incorrect"
    dev="$(echo "${bfkf}" | cut -d: -f1)"
    arg1="$(echo "${bfkf}" | cut -d: -f2)"
    arg2="$(echo "${bfkf}" | cut -d: -f3)"
    if poll_device "${dev}" "${rootdelay}"; then
    case "${arg1}" in
    *[!0-9]*)
    mkdir /mntkey
    mount -r -t "${arg1}" "${dev}" /mntkey
    dd if="/mntkey/${arg2}" of="${encfile}" >/dev/null 2>&1
    umount /mntkey
    rm -rf /mntkey
    dd if="${dev}" of="${encfile}" bs=1 skip="${arg1}" count="${arg2}" >/dev/null 2>&1
    esac
    fi
    if [ -f "${encfile}" ]; then
    while true; do
    read -rsp "${prompt}" password
    i=0
    while [ ${i} -lt ${iteration} ]; do
    password=`echo -n "${password}" | openssl dgst -whirlpool -hex 2> /dev/null | cut -d ' ' -f 2`
    i=$(( ${i} + 1 ))
    done
    openssl bf-cbc -pass pass:"${password}" -d -in "${encfile}" -out "${decfile}" >/dev/null 2>&1
    retcode="$?"
    if [ "${retcode}" != "0" ]; then
    echo -e "\n${badpassword}\n"
    attempts=$(( ${attempts} - 1 ))
    [ "${attempts}" == "0" ] && echo "Keyfile could not be decrypted" && break
    else
    break
    fi
    done
    rm -f "${encfile}"
    else
    echo "Encrypted keyfile could not be opened. Reverting to 'encrypt' hook."
    fi
    fi
    /lib/initcpio/install
    #!/bin/bash
    build() {
    add_binary /usr/bin/openssl
    add_runscript
    help ()
    cat<<HELPEOF
    This hook allows for an openssl (bf-cbc) encrypted keyfile for LUKS.
    It relies on standard 'encrypt' hook providing decrypted '/crypto_keyfile.bin' for it.
    You must use gen-cryptkey create the encrypted enc_keyfile.bin
    The password is hashed with Whirlpool 1000 times
    Then your password Hash is used to encrypt the keyfile
    mkinitcpio.conf:
    MODULES: add ext4 vfat or whatever the type of filesystem the keyfile is on
    HOOKS=" ... bfkf encrypt ... filesystems ..."
    Kernel Parameters:
    There is no need for cryptkey=
    Two options are supported:
    1) Using a file on the device:
    bfkf=<device>:<fs-type>:<path>
    2) Reading raw data from the block device:
    bfkf=<device>:<offset>:<size>
    Example: /etc/default/grub
    GRUB_CMDLINE_LINUX="bfkf=/dev/sdb1:ext4:/keyfile.bin cryptdevice=/dev/sda2:root"
    HELPEOF
    # vim: set ft=sh ts=4 sw=4 et:
    /usr/bin/gen-cryptkey
    #!/bin/bash
    # GPLv3
    # Thomas Dwyer
    # tomd.tel
    iteration=1000
    create_msg='Create: gen-cryptkey create'
    decrypt_msg='Decrypt: gen-cryptkey decrypt PATH_TO_KEYFILE'
    main () {
    action=$1
    if [ -z $action ]; then
    echo -e "Usage:\n$create_msg\n$decrypt_msg"
    elif [ $action == "create" ]; then
    crypt
    elif [ $action == "decrypt" ]; then
    if [ -z $2 ]; then
    echo -e "Usage:\n$create_msg\n$decrypt_msg"
    else
    decrypt $2
    fi
    else
    echo -e "Usage:\n$create_msg\n$decrypt_msg"
    fi
    exit 0
    crypt () {
    encfile="enc_keyfile.bin"
    echo "$encfile encrypted keyfile will be created"
    echo ''
    read -rsp "Enter password: " password
    password1=`echo -n "$password" | openssl dgst -whirlpool -hex | cut -d ' ' -f 2`
    echo ''
    read -rsp "Enter password Again: " verify
    password2=`echo -n "$verify" | openssl dgst -whirlpool -hex | cut -d ' ' -f 2`
    if [[ "$password1" == "$password2" ]]; then
    for (( i=1; i<=$iteration; i++ )); do
    password=`echo -n "$password" | openssl dgst -whirlpool -hex | cut -d ' ' -f 2`
    done
    dd if=/dev/urandom bs=1k count=256 | openssl bf-cbc -pass pass:"${password}" -salt -out "${encfile}"
    else
    echo "Passwords did not match"
    fi
    decrypt () {
    encfile=$1
    decfile="crypto_keyfile.bin"
    echo "$encfile Will be decrypted to crypto_keyfile.bin"
    echo ''
    read -rsp "Enter password: " password
    for (( i=1; i<=$iteration; i++ )); do
    password=`echo -n "$password" | openssl dgst -whirlpool -hex | cut -d ' ' -f 2`
    done
    openssl bf-cbc -pass pass:"${password}" -d -in "${encfile}" -out "${decfile}"
    main $@
    Last edited by hunterthomson (2013-01-01 00:01:20)

    Well, it is working now, so feel free to use it.
    If you do use it, make darn sure to keep "at least" 3 backups of the keyfile on 3 different devices.
    You will also want to leave your passphrase enabled until you are sure the keyfile is working as it should.
    However, I am not going to use this anymore and will no longer be working on it. I will subscribe to this thread and answer any questions. I don't really see a whole lot of added security in this, and it would be kind of a pain to use a keyfile in a Live CD/USB. I think it is good enough to make use of the --iter-time flag when using luksFormat or luksAddKey.  It was a fun ride learning how to write this hook for initcpio
    Note: Anyone who wants to write a hook should install busybox and symlink /usr/local/bin/ash to it for testing the HOOK script. The HOOKS use busybox ash not 'sh' nor 'bash', and ash is strange. If your HOOK script has an error you will get a kernel panic.
    Last edited by hunterthomson (2012-12-31 23:57:24)

  • Setting up site to site vpn with cisco asa 5505

    I have a cisco asa 5505 that needs to be set up for site to site vpn to a cisco asa 5500. The 5505 is the remote office and the 5500 is the main office.
    IP of remote office router is 71.37.178.142
    IP of the main office firewall is 209.117.141.82
    Can someone tell me if my config is correct, this is the first time I am setting this up and it can not be tested until I set it up at the remote office. I would rather know its correct before I go.
    ciscoasa# show run
    : Saved
    ASA Version 7.2(4)
    hostname ciscoasa
    domain-name default.domain.invalid
    enable password TMACBloMlcBsq1kp encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    ftp mode passive
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    access-list outside_1_cryptomap extended permit ip host 71.37.178.142 host 209.117.141.82
    access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 host 209.117.141.82
    access-list inside_nat0_outbound extended permit ip host 71.37.178.142 host 209.117.141.82
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-524.bin
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set pfs group5
    crypto map outside_map 1 set peer 209.117.141.82
    crypto map outside_map 1 set transform-set ESP-AES-256-SHA
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption aes-256
    hash sha
    group 5
    lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    vpdn username [email protected] password ********* store-local
    dhcpd auto_config outside
    dhcpd address 192.168.1.2-192.168.1.129 inside
    dhcpd enable inside
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:7e338fb2bf32a9ceb89560b314a5ef6c
    : end
    ciscoasa#
    Thanks!

    Hi Mandy,
    By using following access list define Peer IP as source and destination
    access-list outside_1_cryptomap extended permit ip host 71.37.178.142 host 209.117.141.82
    you are not defining the interesting traffic / subnets from both ends.
    Make some number ACL 101 as you do not have to write the extended keyword then if you like as follows, or else NAME aCL will also work:
    access-list outside_1_cryptomap extended ip 192.168.200.0 0.0.0.255 192.168.100.0 0.0.0.255
    access-list outside_1_cryptomap extended ip 192.168.200.0 0.0.0.255 192.168.100.0 0.0.0.255
    access-list 101 remark CCP_ACL Category=4 access-list 101 remark IPSEC Rule
    !.1..source subnet(called local encryption domain) at your end  192.168.200.0
    !..2.and destination subnet(called remote encryption domain)at other end 192.168.100.0 !.3..I mean you have to define what subnets you need to communicate between which are behind these firewalls
    !..4...Local Subnets behind IP of the main office firewall is 209.117.141.82 say
    !...at your end  192.168.200.0
    !..5.Remote Subnets behind IP of remote office router is 71.37.178.142 say
    !...at other end 192.168.100.0
    Please use Baisc Steps as follows:
    A. Configuration in your MAIN office  having IP = 209.117.141.82  (follow step 1 to 6)
    Step 1.
    Define Crypto ACL/ mirror ACL for other end (change source to destination and destination to source in other side router or VPN device and thats why they are called mirror ACL/ or also called Proxy ID or also called Proxy ACL, your interesting traffic , that you want to encrypt / trave/enter in the tunnel)
    access-list outside_1_cryptomap extended ip 192.168.200.0 0.0.0.255 192.168.100.0 0.0.0.255
    Step 2.
    Config ISAKMP Policy with minimum 4 parameters are to be config for
    crypto isakmp policy 10
    authentication pre-share  ---> Ist parameter of setting Authentication type ISAKMP Policy is OK
    encryption aes-256   --->2nd parameter of ISAKMP Policy is OK
    hash sha   --->  3rd parameter of ISAKMP Policy is OK
    group 5  --->  4th parameter of ISAKMP Policy is OK
    lifetime 86400  ------ >  this 5th parameter is optional , and will negotiate for the less value at either end or by default is will be taken 86400
    Step 3.
    Define Preshared key or PKI which you will use with other side Peer address 71.37.178.142, either key type 0 is Plain text anyone can see it over internet, or use key type 6 for encrypted key , say your password is CISCO123
    Here in your case in step 2 Authentication is using PSK, looks you have not defines Password
    Use following command:
    crypto isakmp key 0 CISCO123 address 71.37.178.142
    or , but not both
    crypto isakmp key 6 CISCO123 address71.37.178.142
    step 4.
    Define Transform set , which will be used for phase 2 tunnel parameters, if you use ESP it can have to sets one cor encryption and other for Authentication.
    Here is yours one:
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    this is correct but give name somthing easier to remember /distinguish it is a transform set , like TSET1 instead of ESP-AES-256-SHA ,try following (here you are using ESP so for encryption we use first set as esp-des and for authentication we use second set esp-sha-hmac)
    crypto ipsec transform-set TSET1 esp-des esp-sha-hmac
    or
    crypto ipsec transform-set TSET1 esp-aes-256 esp-sha-hmac
    Suppose you are using only AH then as AH does not support encryption or confidentiality hence it always use onle one set not 2 sets like ESP(remember the difference) say for example only one set for auth etc but no set for encryption hence AH have no such sets like ah-des or ah-3des or ah-aes, it has only second set for authentication like
    ah-sha-hmac or  ah-md5-hmac
    crypto ipsec transform-set TSET1 ah-sha-hmac
    or
    crypto ipsec transform-set TSET1 ah-md5-hmac
    Step 5.
    Now configure Crypto MAP as follows and only one CMPA can be applied to OUTSIDE Interface as VPN tunnel is alsways applied for traffic from inside subnets to outside subnets and only once Cryptomap can be applied to OUTSIDE Interface and hence for several VPN peers from different vendors we use seq no 10, 2 30 for different tunnels in one single CMAP:
    crypto map ipsec-isakmp
    1. Define peer -- called WHO to set tunnel with
    2. Define or call WHICH - Transform Set
    3. Define WHAT to call interesting traffic define in your ACL or Proxy ID or Proxy ACL in step 1 using match address
    Like in your case it is but ipsec-isakmp keyword missing in the ;ast
    crypto map outside_map 10 ipsec-isakmp
    1. set peer 209.117.141.82  -----> is correct as this is your other side peer called WHO in my step
    2. set transform-set TSET1  -----> is correct as this is WHICH, and only one transform set can be called
    !..In you case it is correct
    !...set transform-set ESP-AES-256-SHA (also correct)
    3.  match address outside_1_cryptomap  ---->Name of the extended ACL define as WHAT to pass through this tunnel
    4. set pfs group5 (this is optional but if config at one end same has to be config at other side peer as well)
    Step 6.
    Now apply this one crypto MAP to your OUTSIDE interface always
    interface outside
    crypto map outside_map
    Configure the same but just change ACL on other end in step one  by reversing source and destination
    and also set the peer IP of this router in other end.
    So other side config should look as follows:
    B.  Configuration in oyur Remote PEER IP having IP = 71.37.178.142 (follow step 7 to 12)
    Step 7.
    Define Crypto ACL/ mirror ACL for other end (change source to destination and destination to source in other side router or VPN device and thats why they are called mirror ACL/ or also called Proxy ID or also called Proxy ACL, your interesting traffic , that you want to encrypt / trave/enter in the tunnel)
    access-list outside_1_cryptomap extended ip 192.168.100.0 0.0.0.255 192.168.200.0 0.0.0.255
    Step 8.
    Config ISAKMP Policy with minimum 4 parameters are to be config for
    crypto isakmp policy 10
    authentication pre-share  ---> Ist parameter of setting Authentication type ISAKMP Policy is OK
    encryption aes-256   --->2nd parameter of ISAKMP Policy is OK
    hash sha   --->  3rd parameter of ISAKMP Policy is OK
    group 5  --->  4th parameter of ISAKMP Policy is OK
    lifetime 86400  ------ >  this 5th parameter is optional , and will negotiate for the less value at either end or by default is will be taken 86400
    Step 9.
    Define Preshared key or PKI which you will use with other side Peer address key type 0 is Plain text anyone can see it over internet, or use key type 6 for encrypted key , say your password is CISCO123
    Here in your case in step 8 Authentication is using PSK, looks you have not defines Password
    Use following command:
    crypto isakmp key 0 CISCO123 address 209.117.141.82
    or , but not both
    crypto isakmp key 6 CISCO123 address 209.117.141.82
    step 10.
    Define Transform set , which will be used for phase 2 tunnel parameters, if you use ESP it can have to sets one cor encryption and other for Authentication.
    Here is yours one:
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    this is correct but give name somthing easier to remember /distinguish it is a transform set , like TSET1 instead of ESP-AES-256-SHA ,try following (here you are using ESP so for encryption we use first set as esp-des and for authentication we use second set esp-sha-hmac)
    crypto ipsec transform-set TSET1 esp-des esp-sha-hmac
    or
    crypto ipsec transform-set TSET1 esp-aes-256 esp-sha-hmac
    Suppose you are using only AH then as AH does not support encryption or confidentiality hence it always use onle one set not 2 sets like ESP(remember the difference) say for example only one set for auth etc but no set for encryption hence AH have no such sets like ah-des or ah-3des or ah-aes, it has only second set for authentication like
    ah-sha-hmac or  ah-md5-hmac
    crypto ipsec transform-set TSET1 ah-sha-hmac
    or
    crypto ipsec transform-set TSET1 ah-md5-hmac
    Step 11.
    Now configure Crypto MAP as follows and only one CMPA can be applied to OUTSIDE Interface as VPN tunnel is alsways applied for traffic from inside subnets to outside subnets and only once Cryptomap can be applied to OUTSIDE Interface and hence for several VPN peers from different vendors we use seq no 10, 2 30 for different tunnels in one single CMAP:
    crypto map    ipsec-isakmp
    1. Define peer -- called WHO to set tunnel with
    2. Define or call WHICH - Transform Set, only one is permissible
    3. Define WHAT to call interesting traffic define in your ACL or Proxy ID or Proxy ACL in step 1 using match address
    Like in your case it is but ipsec-isakmp keyword missing in the ;ast
    crypto map outside_map 10 ipsec-isakmp
    1. set peer 209.117.141.82  -----> is correct as this is your other side peer called WHO in my step
    2. set transform-set TSET1  -----> is correct as this is WHICH, and only one transform set can be called
    !..In you case it is correct
    !...set transform-set ESP-AES-256-SHA (also correct)
    3.  match address outside_1_cryptomap  ---->Name of the extended ACL define as WHAT to pass through this tunnel
    4. set pfs group5 (this is optional but if config at one end same has to be config at other side peer as well)
    Step 12.
    Now apply this one crypto MAP to your OUTSIDE interface always
    interface outside
    crypto map outside_map
    Now initite a ping
    Here is for your summary:
    IPSec: Site to Site - Routers
    Configuration Steps
    Phase 1
    Step 1: Configure Mirrored ACL/Crypto ACL       for Interesting Traffic
    Step 2: Configure ISAKMP Policy
    Step 3: Configure ISAKMP Key
    Phase 2
    Step 4: Configure Transform Set
    Step 5: Configure Crypto Map
    Step 6: Apply Crypto Map to an Interface
    To debug for Phase 1 and Phase 2. Store it in buffer without displaying logs on terminal.
    Router#debug crpyto isakmp
    Router#debug crpyto ipsec
    Router(config)# logging buffer 7
    Router(config)# logging buffer 99999
    Router(config)# logging console 6
    Router# clear logging
    Configuration
    In R1:
    (config)# access-list 101 permit ipo host 10.1.1.1 host      10.1.2.1
    (config)# crypto isakmp policy 10
    (config-policy)# encryption 3des
    (config-policy)# authentication pre-share
    (config-policy)# group 2
    (config-policy)# hash sha1
    (config)# crypto isakmp key 0 cisco address 2.2.2.1
    (config)# crypto ipsec transform-set TSET esp-3des      sha-aes-hmac
    (config)# crypto map CMAP 10 ipsec-isakmp
    (config-crypto-map)# set peer 2.2.2.1
    (config-crypto-map)# match address 101
    (config-crypto-map)# set transform-set TSET
    (config)# int f0/0
    (config-if)# crypto map CMAP
    Similarly in R2
    Verification Commands
    #show crypto isakmp SA
    #show crypto ipsec SA
    Change to Transport Mode, add the following command in Step 4:
    (config-tranform-set)# mode transport
    Even after  doing this change, the ipsec negotiation will still be done through  tunnel mode if pinged from Loopback to Loopback. To overcome this we  make changes to ACL.
    Change to Aggressive Mode, replace the Step 3 command with these commands in R1:
    (config)# crypto isakmp peer address 2.2.2.1
    (config-peer)# set aggressive-mode password cisco
    (config-peer)# set aggressive-mode clien-endpoint       ipv4-address 2.2.2.1
    Similarly on R2.
    The below process is for the negotiation using RSA-SIG (PKI) as authentication type
    Debug Process:
    After  we debug, we can see the negotiation between the two peers. The first  packet of the interesting traffic triggers the ISAKMP (Phase1)  negotiation. Important messages are marked in BOLD and explanation in  RED
    R2(config)#do ping 10.1.1.1 so lo0 // Interesting Traffic
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
    Packet sent with a source address of 2.2.2.2
    Mar  2 16:18:42.939: ISAKMP:(0): SA request profile is (NULL) //  Router tried to find any IPSec SA matching the outgoing connection but  no valid SA has been found in Security Association Database (SADB)
    Mar  2 16:18:42.939: ISAKMP: Created a peer struct for 20.1.1.10, peer port 500
    Mar  2 16:18:42.939: ISAKMP: New peer created peer = 0x46519678 peer_handle = 0x8000000D
    Mar  2 16:18:42.939: ISAKMP: Locking peer struct 0x46519678, refcount 1 for isakmp_initiator
    Mar  2 16:18:42.939: ISAKMP: local port 500, remote port 500
    Mar  2 16:18:42.939: ISAKMP: set new node 0 to QM_IDLE    
    Mar  2 16:18:42.939: ISAKMP:(0):insert sa successfully sa = 4542B818
    Mar  2 16:18:42.939: ISAKMP:(0):Can not start Aggressive mode, trying Main mode. // Not an error. By default it is configured for Main Mode
    Mar  2 16:18:42.939: ISAKMP:(0):No pre-shared key with 20.1.1.10! // Since we are using RSA Signature, this message. If we use pre-share, this is where it would indicate so!
    Mar  2 16:18:42.939: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID
    Mar  2 16:18:42.939: ISAKMP:(0): constructed NAT-T vendor-07 ID
    Mar  2 16:18:42.939: ISAKMP:(0): constructed NAT-T vendor-03 ID
    Mar  2 16:18:42.939: ISAKMP:(0): constructed NAT-T vendor-02 ID
    Mar  2 16:18:42.939: ISAKMP:(0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
    Mar  2 16:18:42.939: ISAKMP:(0):Old State = IKE_READY  New State = IKE_I_MM1
    Mar  2 16:18:42.943: ISAKMP:(0): beginning Main Mode exchange
    Mar  2 16:18:42.943: ISAKMP:(0): sending packet to 20.1.1.10 my_port 500 peer_port 500 (I) MM_NO_STATE // Sending ISAKMP Policy to peer
    Mar  2 16:18:42.943: ISAKMP:(0):Sending an IKE IPv4 Packet.
    Mar  2 16:18:42.943: ISAKMP (0): received packet from 20.1.1.10 dport 500 sport 500 Global (I) MM_NO_STATE // Sending ISAKMP Policy to peer
    Mar  2 16:18:42.947: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    Mar  2 16:18:42.947: ISAKMP:(0):Old State = IKE_I_MM1  New State = IKE_I_MM2
    Mar  2 16:18:42.947: ISAKMP:(0): processing SA payload. message ID = 0
    Mar  2 16:18:42.947: ISAKMP:(0): processing vendor id payload
    Mar  2 16:18:42.947: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch // Do not worry about this! Not an ERROR!
    Mar  2 16:18:42.947: ISAKMP:(0): vendor ID is NAT-T v2
    Mar  2 16:18:42.947:.!!!!
    Success rate is 80 percent (4/5), round-trip min/avg/max = 1/2/4 ms
    R2(config)# ISAKMP:(0): processing vendor id payload
    Mar  2 16:18:42.947: ISAKMP:(0): processing IKE frag vendor id payload
    Mar  2 16:18:42.947: ISAKMP:(0):Support for IKE Fragmentation not enabled
    Mar  2 16:18:42.947: ISAKMP : Scanning profiles for xauth ...
    Mar  2 16:18:42.947: ISAKMP:(0):Checking ISAKMP transform 1 against priority 10 policy
    Mar  2 16:18:42.947: ISAKMP:      encryption 3DES-CBC
    Mar  2 16:18:42.947: ISAKMP:      hash SHA
    Mar  2 16:18:42.947: ISAKMP:      default group 2
    Mar  2 16:18:42.947: ISAKMP:      auth RSA sig
    Mar  2 16:18:42.947: ISAKMP:      life type in seconds
    Mar  2 16:18:42.947: ISAKMP:      life duration (VPI) of  0x0 0x1 0x51 0x80
    Mar  2 16:18:42.947: ISAKMP:(0):atts are acceptable. Next payload is 0
    Mar  2 16:18:42.947: ISAKMP:(0):Acceptable atts:actual life: 0
    Mar  2 16:18:42.947: ISAKMP:(0):Acceptable atts:life: 0
    Mar  2 16:18:42.947: ISAKMP:(0):Fill atts in sa vpi_length:4
    Mar  2 16:18:42.947: ISAKMP:(0):Fill atts in sa life_in_seconds:86400
    Mar  2 16:18:42.947: ISAKMP:(0):Returning Actual lifetime: 86400
    Mar  2 16:18:42.947: ISAKMP:(0)::Started lifetime timer: 86400.
    Mar  2 16:18:42.947: ISAKMP:(0): processing vendor id payload
    Mar  2 16:18:42.947: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch
    Mar  2 16:18:42.947: ISAKMP:(0): vendor ID is NAT-T v2
    Mar  2 16:18:42.947: ISAKMP:(0): processing vendor id payload
    Mar  2 16:18:42.951: ISAKMP:(0): processing IKE frag vendor id payload
    Mar  2 16:18:42.951: ISAKMP:(0):Support for IKE Fragmentation not enabled
    Mar  2 16:18:42.951: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    Mar  2 16:18:42.951: ISAKMP:(0):Old State = IKE_I_MM2  New State = IKE_I_MM2
    Mar  2 16:18:42.951: ISAKMP (0): constructing CERT_REQ for issuer cn=ca_server OU=cisco C=India S=Karnataka L=Bangalore
    Mar  2 16:18:42.951: ISAKMP:(0): sending packet to 20.1.1.10 my_port 500 peer_port 500 (I) MM_SA_SETUP // Sending Key Exchange Information to peer
    Mar  2 16:18:42.951: ISAKMP:(0):Sending an IKE IPv4 Packet.
    Mar  2 16:18:42.951: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    Mar  2 16:18:42.951: ISAKMP:(0):Old State = IKE_I_MM2  New State = IKE_I_MM3
    Mar  2 16:18:42.955: ISAKMP (0): received packet from 20.1.1.10 dport 500 sport 500 Global (I) MM_SA_SETUP // Receive key exchange information from peer
    Mar  2 16:18:42.955: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    Mar  2 16:18:42.955: ISAKMP:(0):Old State = IKE_I_MM3  New State = IKE_I_MM4
    Mar  2 16:18:42.959: ISAKMP:(0): processing KE payload. message ID = 0
    Mar  2 16:18:43.003: ISAKMP:(0): processing NONCE payload. message ID = 0
    Mar  2 16:18:43.007: ISAKMP:(1008): processing CERT_REQ payload. message ID = 0
    Mar  2 16:18:43.007: ISAKMP:(1008): peer wants a CT_X509_SIGNATURE cert
    Mar  2 16:18:43.007: ISAKMP:(1008): peer wants cert issued by cn=ca_server OU=cisco C=India S=Karnataka L=Bangalore
    Mar  2 16:18:43.007:  Choosing trustpoint CA_Server as issuer
    Mar  2 16:18:43.007: ISAKMP:(1008): processing vendor id payload
    Mar  2 16:18:43.007: ISAKMP:(1008): vendor ID is Unity
    Mar  2 16:18:43.007: ISAKMP:(1008): processing vendor id payload
    Mar  2 16:18:43.007: ISAKMP:(1008): vendor ID seems Unity/DPD but major 180 mismatch
    Mar  2 16:18:43.007: ISAKMP:(1008): vendor ID is XAUTH
    Mar  2 16:18:43.007: ISAKMP:(1008): processing vendor id payload
    Mar  2 16:18:43.007: ISAKMP:(1008): speaking to another IOS box!
    Mar  2 16:18:43.007: ISAKMP:(1008): processing vendor id payload
    Mar  2 16:18:43.007: ISAKMP:(1008):vendor ID seems Unity/DPD but hash mismatch
    Mar  2 16:18:43.007: ISAKMP:received payload type 20
    Mar  2 16:18:43.007: ISAKMP (1008): His hash no match - this node outside NAT
    Mar  2 16:18:43.007: ISAKMP:received payload type 20
    Mar  2 16:18:43.007: ISAKMP (1008): No NAT Found for self or peer
    Mar  2 16:18:43.007: ISAKMP:(1008):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    Mar  2 16:18:43.007: ISAKMP:(1008):Old State = IKE_I_MM4  New State = IKE_I_MM4
    Mar  2 16:18:43.011: ISAKMP:(1008):Send initial contact
    Mar  2 16:18:43.011: ISAKMP:(1008):My ID configured as IPv4 Addr, but Addr not in Cert!
    Mar  2 16:18:43.011: ISAKMP:(1008):Using FQDN as My ID
    Mar  2 16:18:43.011: ISAKMP:(1008):SA is doing RSA signature authentication using id type ID_FQDN
    Mar  2 16:18:43.011: ISAKMP (1008): ID payload
              next-payload : 6
              type         : 2
              FQDN name    : R2
              protocol     : 17
              port         : 500
              length       : 10
    Mar  2 16:18:43.011: ISAKMP:(1008):Total payload length: 10
    Mar  2 16:18:43.019: ISAKMP (1008): constructing CERT payload for hostname=R2+serialNumber=FHK1502F2H8
    Mar  2 16:18:43.019: ISAKMP:(1008): using the CA_Server trustpoint's keypair to sign
    Mar  2 16:18:43.035: ISAKMP:(1008): sending packet to 20.1.1.10 my_port 500 peer_port 500 (I) MM_KEY_EXCH
    Mar  2 16:18:43.035: ISAKMP:(1008):Sending an IKE IPv4 Packet.
    Mar  2 16:18:43.035: ISAKMP:(1008):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    Mar  2 16:18:43.035: ISAKMP:(1008):Old State = IKE_I_MM4  New State = IKE_I_MM5
    Mar  2 16:18:43.047: ISAKMP (1008): received packet from 20.1.1.10 dport 500 sport 500 Global (I) MM_KEY_EXCH
    // "MM_KEY_EXCH" indicates that the peers have exchanged DH Public keys and generated a shared secret!
    Mar  2 16:18:43.047: ISAKMP:(1008): processing ID payload. message ID = 0
    Mar  2 16:18:43.047: ISAKMP (1008): ID payload
              next-payload : 6
              type         : 2
              FQDN name    : ASA1
              protocol     : 0
              port         : 0
              length       : 12
    Mar  2 16:18:43.047: ISAKMP:(0):: peer matches *none* of the profiles // Normal Message! Not an error!
    Mar  2 16:18:43.047: ISAKMP:(1008): processing CERT payload. message ID = 0
    Mar  2 16:18:43.047: ISAKMP:(1008): processing a CT_X509_SIGNATURE cert
    Mar  2 16:18:43.051: ISAKMP:(1008): peer's pubkey isn't cached
    Mar  2 16:18:43.059: ISAKMP:(1008): Unable to get DN from certificate!
    Mar  2 16:18:43.059: ISAKMP:(1008): Cert presented by peer contains no OU field.
    Mar  2 16:18:43.059: ISAKMP:(0):: peer matches *none* of the profiles
    Mar  2 16:18:43.063: ISAKMP:(1008): processing SIG payload. message ID = 0
    Mar  2 16:18:43.067: ISAKMP:received payload type 17
    Mar  2 16:18:43.067: ISAKMP:(1008): processing vendor id payload
    Mar  2 16:18:43.067: ISAKMP:(1008): vendor ID is DPD
    Mar  2 16:18:43.067: ISAKMP:(1008):SA authentication status:
              authenticated
    Mar  2 16:18:43.067: ISAKMP:(1008):SA has been authenticated with 20.1.1.10
    Mar  2 16:18:43.067: ISAKMP: Trying to insert a peer 40.1.1.1/20.1.1.10/500/,  and inserted successfully 46519678. // SA inserted into SADB
    Mar  2 16:18:43.067: ISAKMP:(1008):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    Mar  2 16:18:43.067: ISAKMP:(1008):Old State = IKE_I_MM5  New State = IKE_I_MM6
    Mar  2 16:18:43.067: ISAKMP:(1008):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    Mar  2 16:18:43.067: ISAKMP:(1008):Old State = IKE_I_MM6  New State = IKE_I_MM6
    Mar  2 16:18:43.071: ISAKMP:(1008):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    Mar  2 16:18:43.071: ISAKMP:(1008):Old State = IKE_I_MM6  New State = IKE_P1_COMPLETE
    Mar  2 16:18:43.071: ISAKMP:(1008):beginning Quick Mode exchange, M-ID of -1523793378
    Mar  2 16:18:43.071: ISAKMP:(1008):QM Initiator gets spi
    Mar  2 16:18:43.075: ISAKMP:(1008): sending packet to 20.1.1.10 my_port 500 peer_port 500 (I) QM_IDLE    
    Mar  2 16:18:43.075: ISAKMP:(1008):Sending an IKE IPv4 Packet.
    Mar  2 16:18:43.075: ISAKMP:(1008):Node -1523793378, Input = IKE_MESG_INTERNAL, IKE_INIT_QM
    Mar  2 16:18:43.075: ISAKMP:(1008):Old State = IKE_QM_READY  New State = IKE_QM_I_QM1
    Mar  2 16:18:43.075: ISAKMP:(1008):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
    Mar  2 16:18:43.075: ISAKMP:(1008):Old State = IKE_P1_COMPLETE  New State = IKE_P1_COMPLETE
    Mar  2 16:18:43.079: ISAKMP (1008): received packet from 20.1.1.10 dport 500 sport 500 Global (I) QM_IDLE // IPSec Policies
    Mar  2 16:18:43.079: ISAKMP:(1008): processing HASH payload. message ID = -1523793378
    Mar  2 16:18:43.079: ISAKMP:(1008): processing SA payload. message ID = -1523793378
    Mar  2 16:18:43.079: ISAKMP:(1008):Checking IPSec proposal 1
    Mar  2 16:18:43.079: ISAKMP: transform 1, ESP_3DES
    Mar  2 16:18:43.079: ISAKMP:   attributes in transform:
    Mar  2 16:18:43.079: ISAKMP:      SA life type in seconds
    Mar  2 16:18:43.079: ISAKMP:      SA life duration (basic) of 3600
    Mar  2 16:18:43.079: ISAKMP:      SA life type in kilobytes
    Mar  2 16:18:43.079: ISAKMP:      SA life duration (VPI) of  0x0 0x46 0x50 0x0
    Mar  2 16:18:43.079: ISAKMP:      encaps is 1 (Tunnel)
    Mar  2 16:18:43.079: ISAKMP:      authenticator is HMAC-SHA
    Mar  2 16:18:43.079: ISAKMP:(1008):atts are acceptable. // IPSec attributes are acceptable!
    Mar  2 16:18:43.079: ISAKMP:(1008): processing NONCE payload. message ID = -1523793378
    Mar  2 16:18:43.079: ISAKMP:(1008): processing ID payload. message ID = -1523793378
    Mar  2 16:18:43.079: ISAKMP:(1008): processing ID payload. message ID = -1523793378
    Mar  2 16:18:43.083: ISAKMP:(1008): Creating IPSec SAs
    Mar  2 16:18:43.083:         inbound SA from 20.1.1.10 to 40.1.1.1 (f/i)  0/ 0
              (proxy 1.1.1.1 to 2.2.2.2)
    Mar  2 16:18:43.083:         has spi 0xA9A66D46 and conn_id 0
    Mar  2 16:18:43.083:         lifetime of 3600 seconds
    Mar  2 16:18:43.083:         lifetime of 4608000 kilobytes
    Mar  2 16:18:43.083:         outbound SA from 40.1.1.1 to 20.1.1.10 (f/i) 0/0
              (proxy 2.2.2.2 to 1.1.1.1)
    Mar  2 16:18:43.083:         has spi  0x2B367FB4 and conn_id 0
    Mar  2 16:18:43.083:         lifetime of 3600 seconds
    Mar  2 16:18:43.083:         lifetime of 4608000 kilobytes
    Mar  2 16:18:43.083: ISAKMP:(1008): sending packet to 20.1.1.10 my_port 500 peer_port 500 (I) QM_IDLE    
    Mar  2 16:18:43.083: ISAKMP:(1008):Sending an IKE IPv4 Packet.
    Mar  2 16:18:43.083: ISAKMP:(1008):deleting node -1523793378 error FALSE reason "No Error"
    Mar  2 16:18:43.083: ISAKMP:(1008):Node -1523793378, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
    Mar  2 16:18:43.083: ISAKMP:(1008):Old State = IKE_QM_I_QM1  New State = IKE_QM_PHASE2_COMPLETE // At this point tunnels are up and ready to pass traffic!
    Verification Commands
    #show crypto isakmp SA
    #show crypto ipsec SA
    Kindly rate if you find the explanation useful !!
    Best Regards
    Sachin Garg

  • Unable to pass traffic for new vpn connection

    Scenario:
    I have three sites all connected ( full mesh) with IPsec/GRE tunnels and these work fine. I attempted to add a satellite office to one our sites. The sat device is a 3rd party device and is behind a rotuer/fw device. The IPSec tunnel  (non-gre) appears to come up but no traffic passes.
    When I ping 192.168.3.1 from the sat device (monitored using tcpdump), it cause the tunnel to come up but I don't see the Cisco side replying back.
    The 192.168.180.0/24 network is at the Sat office and the 192.168.3.0/24 network is at the main office.
    If I initiate a ping from the Cisco side, it doesn't prompt the tunnel to come up. ???? Any ideas?
    Cisco config
    crypto isakmp policy 10
    encr 3des
    hash md5
    authentication pre-share
    group 2
    crypto isakmp key secret address x.x.x.x
    crypto isakmp key secret address x.x.x.x
    crypto isakmp key secret address 7.7.7.7
    crypto isakmp keepalive 10 5 periodic
    crypto ipsec security-association lifetime seconds 86400
    crypto ipsec security-association replay window-size 1024
    crypto ipsec transform-set vpn_set esp-3des esp-md5-hmac
    crypto ipsec transform-set f5_set esp-3des esp-sha-hmac
    crypto map vpnmap 31 ipsec-isakmp
    set peer x.x.x.x
    set transform-set vpn_set
    match address 131
    crypto map vpnmap 32 ipsec-isakmp
    set peer x.x.x.x
    set transform-set vpn_set
    match address 132
    crypto map vpnmap 33 ipsec-isakmp
    set peer 7.7.7.7
    set transform-set f5_set
    match address 133
    interface Tunnel31
    bandwidth 1200000
    ip address 172.16.31.34 255.255.255.252
    ip mtu 1400
    ip tcp adjust-mss 1360
    tunnel source 5.5.5.5
    tunnel destination x.x.x.x
    interface Tunnel32
    bandwidth 1200000
    ip address 172.16.31.57 255.255.255.252
    ip mtu 1400
    ip tcp adjust-mss 1360
    tunnel source 5.5.5.5
    tunnel destination x.x.x.x
    interface FastEthernet0/1
    bandwidth 51200
    ip address 50.50.50.1
    ip access-group 101 in
    ip flow ingress
    ip flow egress
    ip nat outside
    ip inspect ISP2-cbac out
    ip virtual-reassembly
    duplex auto
    speed auto
    crypto map vpnmap
    ip nat inside source route-map nonat interface FastEthernet0/1 overload
    partial acl
    access-list 101 permit udp host 7.7.7.7 any eq isakmp
    access-list 101 permit udp host 7.7.7.7 eq isakmp any
    access-list 101 permit esp host 7.7.7.7 any
    route-map nonat permit 41
    match ip address 175
    access-list 133 permit ip 192.168.3.0 0.0.0.255 192.168.180.0 0.0.0.255
    access-list 175 deny   ip 192.168.3.0 0.0.0.255 192.168.60.0 0.0.0.255
    access-list 175 deny   ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255
    access-list 175 deny   ip 192.168.3.0 0.0.0.255 192.168.2.0 0.0.0.255
    access-list 175 deny   ip 192.168.3.0 0.0.0.255 192.168.180.0 0.0.0.255
    access-list 175 permit ip 192.168.3.0 0.0.0.255 any
    ip route 0.0.0.0 0.0.0.0 50.50.50.x
    ip route 10.1.0.0 255.255.0.0 Tunnel32
    ip route 172.18.1.0 255.255.255.0 192.168.3.254
    ip route 172.18.2.0 255.255.255.0 192.168.3.254
    ip route 172.18.3.2 255.255.255.255 Service-Engine0/0
    ip route 192.168.1.0 255.255.255.0 Tunnel31
    ip route 192.168.2.0 255.255.255.0 Tunnel32
    ip route 192.168.10.0 255.255.255.0 192.168.3.254
    sh cry isa sa
    IPv4 Crypto ISAKMP SA
    dst             src             state          conn-id status
    50.50.50.1     7.7.7.7   QM_IDLE           1003 ACTIVE
    sh crypto isa sa
    protected vrf: (none)
       local  ident (addr/mask/prot/port): (192.168.3.0/255.255.255.0/0/0)
       remote ident (addr/mask/prot/port): (192.168.180.0/255.255.255.0/0/0)
       current_peer 7.7.7.7 port 35381
         PERMIT, flags={origin_is_acl,}
        #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
        #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
        #pkts compressed: 0, #pkts decompressed: 0
        #pkts not compressed: 0, #pkts compr. failed: 0
        #pkts not decompressed: 0, #pkts decompress failed: 0
        #send errors 0, #recv errors 0
         local crypto endpt.: 50.50.50.1, remote crypto endpt.: 7.7.7.7
         path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/1
         current outbound spi: 0xFF024E3E(4278341182)
         PFS (Y/N): Y, DH group: group2
         inbound esp sas:
          spi: 0x8E538667(2387838567)
            transform: esp-3des esp-sha-hmac ,
            in use settings ={Tunnel, }
            conn id: 2007, flow_id: FPGA:7, sibling_flags 80000046, crypto map: vpnmap
            sa timing: remaining key lifetime (k/sec): (4493323/82118)
            IV size: 8 bytes
            replay detection support: Y  replay window size: 1024
            Status: ACTIVE
         inbound ah sas:
         inbound pcp sas:
         outbound esp sas:
          spi: 0xFF024E3E(4278341182)
            transform: esp-3des esp-sha-hmac ,
            in use settings ={Tunnel, }
            conn id: 2008, flow_id: FPGA:8, sibling_flags 80000046, crypto map: vpnmap
            sa timing: remaining key lifetime (k/sec): (4493323/82118)
            IV size: 8 bytes
            replay detection support: Y  replay window size: 1024
            Status: ACTIVE
         outbound ah sas:
         outbound pcp sas:
    DEBUG
    #show debug
    Cryptographic Subsystem:
      Crypto ISAKMP debugging is on
      Crypto ISAKMP Error debugging is on
      Crypto IPSEC debugging is on
      Crypto IPSEC Error debugging is on
    #sh log | inc 7.7.7.7
    000202: *Aug 12 02:20:16.006: ISAKMP:(1003): sending packet to 7.7.7.7 my_port 500 peer_port 35381
    (R) QM_IDLE
    000207: *Aug 12 02:20:16.046: ISAKMP (1003): received packet from 7.7.7.7 dport 500 sport 35381
    Global (R) QM_IDLE
    000211: *Aug 12 02:20:16.046: ISAKMP:(1003): DPD/R_U_THERE_ACK received from peer 7.7.7.7,
    sequence 0x1C6F72FD
    000287: *Aug 12 02:20:25.962: ISAKMP:(1003): sending packet to 7.7.7.7 my_port 500 peer_port 35381
    (R) QM_IDLE
    000292: *Aug 12 02:20:25.998: ISAKMP (1003): received packet from 7.7.7.7 dport 500 sport 35381
    Global (R) QM_IDLE
    000296: *Aug 12 02:20:25.998: ISAKMP:(1003): DPD/R_U_THERE_ACK received from peer 7.7.7.7,
    sequence 0x1C6F72FE
    000389: *Aug 12 02:20:35.542: ISAKMP:(1003): sending packet to 7.7.7.7 my_port 500 peer_port 35381
    (R) QM_IDLE
    000394: *Aug 12 02:20:35.578: ISAKMP (1003): received packet from 7.7.7.7 dport 500 sport 35381
    Global (R) QM_IDLE
    000398: *Aug 12 02:20:35.582: ISAKMP:(1003): DPD/R_U_THERE_ACK received from peer 7.7.7.7,
    sequence 0x1C6F72FF
    000402: *Aug 12 02:20:36.582: ISAKMP (1003): received packet from 7.7.7.7 dport 500 sport 35381
    Global (R) QM_IDLE
    000409: *Aug 12 02:20:36.586: ISAKMP:(1003):DPD/R_U_THERE received from peer 7.7.7.7, sequence
    0x5FF
    000413: *Aug 12 02:20:36.586: ISAKMP:(1003): sending packet to 7.7.7.7 my_port 500 peer_port 35381
    (R) QM_IDLE
    #sh log | inc 7.7.7.7
    000847: *Aug 12 02:21:24.163: ISAKMP:(1003): sending packet to 7.7.7.7 my_port 500 peer_port 35381
    (R) QM_IDLE
    000852: *Aug 12 02:21:24.203: ISAKMP (1003): received packet from 7.7.7.7 dport 500 sport 35381
    Global (R) QM_IDLE
    3rd party device:
    #  racoonctl -l show-sa isakmp
    Destination            Cookies                           ST S  V E Created             Phase2
    50.50.50.1.500        e1866e9ee2830764:575a7489971701ad  9 I 10 M 2013-08-11 20:04:57      1
    [root@ltm1:Active:Disconnected] log #  racoonctl -l show-sa isakmp
    Destination            Cookies                           ST S  V E Created             Phase2
    50.50.50.1.500        e1866e9ee2830764:575a7489971701ad  9 I 10 M 2013-08-11 20:04:57      1
    # racoonctl -l show-sa ipsec
    192.168.180.5 50.50.50.1
            esp mode=tunnel spi=2387838567(0x8e538667) reqid=62829(0x0000f56d)
            E: 3des-cbc  74583bf5 4fe29310 07603be7 d52516d6 7269c35f 51b24a52
            A: hmac-sha1  c0d2254c ea2ec11a 6a22bf41 dad35582 00d91a30
            seq=0x00000000 replay=64 flags=0x00000000 state=mature
            created: Aug 11 20:04:59 2013   current: Aug 11 21:18:57 2013
            diff: 4438(s)   hard: 5184000(s)        soft: 4147200(s)
            last: Aug 11 21:18:56 2013      hard: 0(s)      soft: 0(s)
            current: 421660(bytes)  hard: 0(bytes)  soft: 0(bytes)
            allocated: 3635 hard: 0 soft: 0
            sadb_seq=1 pid=8526 refcnt=0
    50.50.50.1 192.168.180.5
            esp mode=tunnel spi=4278341182(0xff024e3e) reqid=62828(0x0000f56c)
            E: 3des-cbc  3bc26d98 0a230000 54c64896 e1a68815 6c696a15 f6779541
            A: hmac-sha1  96de21a0 b5f52539 0616acfa b5a09994 03306e92
            seq=0x00000000 replay=64 flags=0x00000000 state=mature
            created: Aug 11 20:04:59 2013   current: Aug 11 21:18:57 2013
            diff: 4438(s)   hard: 5184000(s)        soft: 4147200(s)
            last:                           hard: 0(s)      soft: 0(s)
            current: 0(bytes)       hard: 0(bytes)  soft: 0(bytes)
            allocated: 0    hard: 0 soft: 0
            sadb_seq=0 pid=8526 refcnt=0

    Scenario:
    I have three sites all connected ( full mesh) with IPsec/GRE tunnels and these work fine. I attempted to add a satellite office to one our sites. The sat device is a 3rd party device and is behind a rotuer/fw device. The IPSec tunnel  (non-gre) appears to come up but no traffic passes.
    When I ping 192.168.3.1 from the sat device (monitored using tcpdump), it cause the tunnel to come up but I don't see the Cisco side replying back.
    The 192.168.180.0/24 network is at the Sat office and the 192.168.3.0/24 network is at the main office.
    If I initiate a ping from the Cisco side, it doesn't prompt the tunnel to come up. ???? Any ideas?
    Cisco config
    crypto isakmp policy 10
    encr 3des
    hash md5
    authentication pre-share
    group 2
    crypto isakmp key secret address x.x.x.x
    crypto isakmp key secret address x.x.x.x
    crypto isakmp key secret address 7.7.7.7
    crypto isakmp keepalive 10 5 periodic
    crypto ipsec security-association lifetime seconds 86400
    crypto ipsec security-association replay window-size 1024
    crypto ipsec transform-set vpn_set esp-3des esp-md5-hmac
    crypto ipsec transform-set f5_set esp-3des esp-sha-hmac
    crypto map vpnmap 31 ipsec-isakmp
    set peer x.x.x.x
    set transform-set vpn_set
    match address 131
    crypto map vpnmap 32 ipsec-isakmp
    set peer x.x.x.x
    set transform-set vpn_set
    match address 132
    crypto map vpnmap 33 ipsec-isakmp
    set peer 7.7.7.7
    set transform-set f5_set
    match address 133
    interface Tunnel31
    bandwidth 1200000
    ip address 172.16.31.34 255.255.255.252
    ip mtu 1400
    ip tcp adjust-mss 1360
    tunnel source 5.5.5.5
    tunnel destination x.x.x.x
    interface Tunnel32
    bandwidth 1200000
    ip address 172.16.31.57 255.255.255.252
    ip mtu 1400
    ip tcp adjust-mss 1360
    tunnel source 5.5.5.5
    tunnel destination x.x.x.x
    interface FastEthernet0/1
    bandwidth 51200
    ip address 50.50.50.1
    ip access-group 101 in
    ip flow ingress
    ip flow egress
    ip nat outside
    ip inspect ISP2-cbac out
    ip virtual-reassembly
    duplex auto
    speed auto
    crypto map vpnmap
    ip nat inside source route-map nonat interface FastEthernet0/1 overload
    partial acl
    access-list 101 permit udp host 7.7.7.7 any eq isakmp
    access-list 101 permit udp host 7.7.7.7 eq isakmp any
    access-list 101 permit esp host 7.7.7.7 any
    route-map nonat permit 41
    match ip address 175
    access-list 133 permit ip 192.168.3.0 0.0.0.255 192.168.180.0 0.0.0.255
    access-list 175 deny   ip 192.168.3.0 0.0.0.255 192.168.60.0 0.0.0.255
    access-list 175 deny   ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255
    access-list 175 deny   ip 192.168.3.0 0.0.0.255 192.168.2.0 0.0.0.255
    access-list 175 deny   ip 192.168.3.0 0.0.0.255 192.168.180.0 0.0.0.255
    access-list 175 permit ip 192.168.3.0 0.0.0.255 any
    ip route 0.0.0.0 0.0.0.0 50.50.50.x
    ip route 10.1.0.0 255.255.0.0 Tunnel32
    ip route 172.18.1.0 255.255.255.0 192.168.3.254
    ip route 172.18.2.0 255.255.255.0 192.168.3.254
    ip route 172.18.3.2 255.255.255.255 Service-Engine0/0
    ip route 192.168.1.0 255.255.255.0 Tunnel31
    ip route 192.168.2.0 255.255.255.0 Tunnel32
    ip route 192.168.10.0 255.255.255.0 192.168.3.254
    sh cry isa sa
    IPv4 Crypto ISAKMP SA
    dst             src             state          conn-id status
    50.50.50.1     7.7.7.7   QM_IDLE           1003 ACTIVE
    sh crypto isa sa
    protected vrf: (none)
       local  ident (addr/mask/prot/port): (192.168.3.0/255.255.255.0/0/0)
       remote ident (addr/mask/prot/port): (192.168.180.0/255.255.255.0/0/0)
       current_peer 7.7.7.7 port 35381
         PERMIT, flags={origin_is_acl,}
        #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
        #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
        #pkts compressed: 0, #pkts decompressed: 0
        #pkts not compressed: 0, #pkts compr. failed: 0
        #pkts not decompressed: 0, #pkts decompress failed: 0
        #send errors 0, #recv errors 0
         local crypto endpt.: 50.50.50.1, remote crypto endpt.: 7.7.7.7
         path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/1
         current outbound spi: 0xFF024E3E(4278341182)
         PFS (Y/N): Y, DH group: group2
         inbound esp sas:
          spi: 0x8E538667(2387838567)
            transform: esp-3des esp-sha-hmac ,
            in use settings ={Tunnel, }
            conn id: 2007, flow_id: FPGA:7, sibling_flags 80000046, crypto map: vpnmap
            sa timing: remaining key lifetime (k/sec): (4493323/82118)
            IV size: 8 bytes
            replay detection support: Y  replay window size: 1024
            Status: ACTIVE
         inbound ah sas:
         inbound pcp sas:
         outbound esp sas:
          spi: 0xFF024E3E(4278341182)
            transform: esp-3des esp-sha-hmac ,
            in use settings ={Tunnel, }
            conn id: 2008, flow_id: FPGA:8, sibling_flags 80000046, crypto map: vpnmap
            sa timing: remaining key lifetime (k/sec): (4493323/82118)
            IV size: 8 bytes
            replay detection support: Y  replay window size: 1024
            Status: ACTIVE
         outbound ah sas:
         outbound pcp sas:
    DEBUG
    #show debug
    Cryptographic Subsystem:
      Crypto ISAKMP debugging is on
      Crypto ISAKMP Error debugging is on
      Crypto IPSEC debugging is on
      Crypto IPSEC Error debugging is on
    #sh log | inc 7.7.7.7
    000202: *Aug 12 02:20:16.006: ISAKMP:(1003): sending packet to 7.7.7.7 my_port 500 peer_port 35381
    (R) QM_IDLE
    000207: *Aug 12 02:20:16.046: ISAKMP (1003): received packet from 7.7.7.7 dport 500 sport 35381
    Global (R) QM_IDLE
    000211: *Aug 12 02:20:16.046: ISAKMP:(1003): DPD/R_U_THERE_ACK received from peer 7.7.7.7,
    sequence 0x1C6F72FD
    000287: *Aug 12 02:20:25.962: ISAKMP:(1003): sending packet to 7.7.7.7 my_port 500 peer_port 35381
    (R) QM_IDLE
    000292: *Aug 12 02:20:25.998: ISAKMP (1003): received packet from 7.7.7.7 dport 500 sport 35381
    Global (R) QM_IDLE
    000296: *Aug 12 02:20:25.998: ISAKMP:(1003): DPD/R_U_THERE_ACK received from peer 7.7.7.7,
    sequence 0x1C6F72FE
    000389: *Aug 12 02:20:35.542: ISAKMP:(1003): sending packet to 7.7.7.7 my_port 500 peer_port 35381
    (R) QM_IDLE
    000394: *Aug 12 02:20:35.578: ISAKMP (1003): received packet from 7.7.7.7 dport 500 sport 35381
    Global (R) QM_IDLE
    000398: *Aug 12 02:20:35.582: ISAKMP:(1003): DPD/R_U_THERE_ACK received from peer 7.7.7.7,
    sequence 0x1C6F72FF
    000402: *Aug 12 02:20:36.582: ISAKMP (1003): received packet from 7.7.7.7 dport 500 sport 35381
    Global (R) QM_IDLE
    000409: *Aug 12 02:20:36.586: ISAKMP:(1003):DPD/R_U_THERE received from peer 7.7.7.7, sequence
    0x5FF
    000413: *Aug 12 02:20:36.586: ISAKMP:(1003): sending packet to 7.7.7.7 my_port 500 peer_port 35381
    (R) QM_IDLE
    #sh log | inc 7.7.7.7
    000847: *Aug 12 02:21:24.163: ISAKMP:(1003): sending packet to 7.7.7.7 my_port 500 peer_port 35381
    (R) QM_IDLE
    000852: *Aug 12 02:21:24.203: ISAKMP (1003): received packet from 7.7.7.7 dport 500 sport 35381
    Global (R) QM_IDLE
    3rd party device:
    #  racoonctl -l show-sa isakmp
    Destination            Cookies                           ST S  V E Created             Phase2
    50.50.50.1.500        e1866e9ee2830764:575a7489971701ad  9 I 10 M 2013-08-11 20:04:57      1
    [root@ltm1:Active:Disconnected] log #  racoonctl -l show-sa isakmp
    Destination            Cookies                           ST S  V E Created             Phase2
    50.50.50.1.500        e1866e9ee2830764:575a7489971701ad  9 I 10 M 2013-08-11 20:04:57      1
    # racoonctl -l show-sa ipsec
    192.168.180.5 50.50.50.1
            esp mode=tunnel spi=2387838567(0x8e538667) reqid=62829(0x0000f56d)
            E: 3des-cbc  74583bf5 4fe29310 07603be7 d52516d6 7269c35f 51b24a52
            A: hmac-sha1  c0d2254c ea2ec11a 6a22bf41 dad35582 00d91a30
            seq=0x00000000 replay=64 flags=0x00000000 state=mature
            created: Aug 11 20:04:59 2013   current: Aug 11 21:18:57 2013
            diff: 4438(s)   hard: 5184000(s)        soft: 4147200(s)
            last: Aug 11 21:18:56 2013      hard: 0(s)      soft: 0(s)
            current: 421660(bytes)  hard: 0(bytes)  soft: 0(bytes)
            allocated: 3635 hard: 0 soft: 0
            sadb_seq=1 pid=8526 refcnt=0
    50.50.50.1 192.168.180.5
            esp mode=tunnel spi=4278341182(0xff024e3e) reqid=62828(0x0000f56c)
            E: 3des-cbc  3bc26d98 0a230000 54c64896 e1a68815 6c696a15 f6779541
            A: hmac-sha1  96de21a0 b5f52539 0616acfa b5a09994 03306e92
            seq=0x00000000 replay=64 flags=0x00000000 state=mature
            created: Aug 11 20:04:59 2013   current: Aug 11 21:18:57 2013
            diff: 4438(s)   hard: 5184000(s)        soft: 4147200(s)
            last:                           hard: 0(s)      soft: 0(s)
            current: 0(bytes)       hard: 0(bytes)  soft: 0(bytes)
            allocated: 0    hard: 0 soft: 0
            sadb_seq=0 pid=8526 refcnt=0

  • IpSec VPN and NAT don't work togheter on HP MSR 20 20

    Hi People,
    I'm getting several issues, let me explain:
    I have a Router HP MSR with 2 ethernet interfaces, Eth 0/0 - WAN (186.177.159.98) and Eth 0/1 LAN (192.168.100.0 /24). I have configured a VPN site to site thru the internet, and it works really well. The other site has the subnet 10.10.10.0 and i can reache the network thru the VPN Ipsec. The issue is that the network 192.168.100.0 /24 needs to reach internet with the same public address, so I have set a basic NT configuration, when I put the nat configuration into Eth 0/0 all network 192.168.100.0 can go to internet, but the VPN goes down, when I remove the NAT from Eth 0/0 the VPN goes Up, but the network 192.168.100.0 Can't go to internet.
    I'm missing something but i don't know what it is !!!!, See below the configuration.
    Can anyone help me qith that, I need to send te traffic with target 10.10.10.0 thru the VPN, and all other traffic to internet, Basically I need that NAT and VPN work fine at same time.
    Note: I just have only One public Ip address.
    version 5.20, Release 2207P41, Standard
    sysname HP
    nat address-group 1 186.177.159.93 186.177.159.93
    domain default enable system
    dns proxy enable
    telnet server enable
    dar p2p signature-file cfa0:/p2p_default.mtd
    port-security enable
    acl number 2001
    rule 0 permit source 192.168.100.0 0.0.0.255
    rule 5 deny
    acl number 3000
    rule 0 permit ip source 192.168.100.0 0.0.0.255 destination 10.10.10.0 0.0.0.255
    vlan 1
    domain system
    access-limit disable
    state active
    idle-cut disable
    self-service-url disable
    ike proposal 1
    encryption-algorithm 3des-cbc
    dh group2
    ike proposal 10
    encryption-algorithm 3des-cbc
    dh group2
    ike peer vpn-test
    proposal 1
    pre-shared-key cipher wrWR2LZofLx6g26QyYjqBQ==
    remote-address <Public Ip from VPN Peer>
    local-address 186.177.159.93
    nat traversal
    ipsec proposal vpn-test
    esp authentication-algorithm sha1
    esp encryption-algorithm 3des
    ipsec policy vpntest 30 isakmp
    connection-name vpntest.30
    security acl 3000
    pfs dh-group2
    ike-peer vpn-test
    proposal vpn-test
    dhcp server ip-pool vlan1 extended
    network mask 255.255.255.0
    user-group system
    group-attribute allow-guest
    local-user admin
    password cipher .]@USE=B,53Q=^Q`MAF4<1!!
    authorization-attribute level 3
    service-type telnet
    service-type web
    cwmp
    undo cwmp enable
    interface Aux0
    async mode flow
    link-protocol ppp
    interface Cellular0/0
    async mode protocol
    link-protocol ppp
    interface Ethernet0/0
    port link-mode route
    nat outbound 2001 address-group 1
    nat server 1 protocol tcp global current-interface 3389 inside 192.168.100.20 3389
    ip address dhcp-alloc
    ipsec policy vpntest
    interface Ethernet0/1
    port link-mode route
    ip address 192.168.100.1 255.255.255.0
    interface NULL0
    interface Vlan-interface1
    undo dhcp select server global-pool
    dhcp server apply ip-pool vlan1

    ewaller wrote:
    What is under the switches tab?
    Oh -- By the way, that picture is over the size limit defined in the forum rules in tems of pixels, but the file size is okay.  I'll let it slide.  Watch the bumping as well.
    If you want to post the switches tab, upload it to someplace like http://img3.imageshack.us/, copy the thumbnail (which has the link to the original)  back here, and you are golden.
    I had a bear of a time getting the microphone working on my HP DV4, but it does work.  I'll look at the set up when I get home tonight [USA-PDT].
    Sorry for the picture and the "bumping"... I have asked in irc in arch and alsa channels and no luck yet... one guy from alsa said I had to wait for the alsa-driver-1.0.24 package (currently I have alsa-driver-1.0.23) but it is weird because the microphone worked some months ago...
    So here is what it is under the switches tab

  • DMVPN-Why received packet doesn't use UDP port 4500 but 500?

    Hello everyone
    I got a problem with my DMVPN. Spoke is behind a NAT device. x.x.x.x is an public IP address which hub uses. I don't know why it discovered that the hub is also inside a NAT device. And after it sends a packet using port 4500, the received packet from hub was not using port 4500 but 500. I'm confused now. Any advise would be much appreciated.
    *Sep 10 08:56:02 UTC: ISAKMP:(0): beginning Main Mode exchange
    *Sep 10 08:56:02 UTC: ISAKMP:(0): sending packet to x.x.x.x my_port 500 peer_port 500 (I) MM_NO_STATE
    *Sep 10 08:56:02 UTC: ISAKMP:(0):Sending an IKE IPv4 Packet.
    *Sep 10 08:56:02 UTC: ISAKMP (0): received packet from x.x.x.x dport 500 sport 500 Global (I) MM_NO_STATE
    *Sep 10 08:56:02 UTC: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    *Sep 10 08:56:02 UTC: ISAKMP:(0):Old State = IKE_I_MM1  New State = IKE_I_MM2 
    *Sep 10 08:56:02 UTC: ISAKMP:(0): processing SA payload. message ID = 0
    *Sep 10 08:56:02 UTC: ISAKMP:(0): processing vendor id payload
    *Sep 10 08:56:02 UTC: ISAKMP:(0): vendor ID seems Unity/DPD but major 69 mismatch
    *Sep 10 08:56:02 UTC: ISAKMP (0): vendor ID is NAT-T RFC 3947
    *Sep 10 08:56:02 UTC: ISAKMP:(0):found peer pre-shared key matching 
    *Sep 10 08:56:02 UTC: ISAKMP:(0): local preshared key found
    *Sep 10 08:56:02 UTC: ISAKMP : Scanning profiles for xauth ...
    *Sep 10 08:56:02 UTC: ISAKMP:(0):Checking ISAKMP transform 1 against priority 1 policy
    *Sep 10 08:56:02 UTC: ISAKMP:      encryption 3DES-CBC
    *Sep 10 08:56:02 UTC: ISAKMP:      hash MD5
    *Sep 10 08:56:02 UTC: ISAKMP:      default group 1
    *Sep 10 08:56:02 UTC: ISAKMP:      auth pre-share
    *Sep 10 08:56:02 UTC: ISAKMP:      life type in seconds
    *Sep 10 08:56:02 UTC: ISAKMP:      life duration (VPI) of  0x0 0x1 0x51 0x80 
    *Sep 10 08:56:02 UTC: ISAKMP:(0):atts are acceptable. Next payload is 0
    *Sep 10 08:56:02 UTC: ISAKMP:(0):Acceptable atts:actual life: 0
    *Sep 10 08:56:02 UTC: ISAKMP:(0):Acceptable atts:life: 0
    *Sep 10 08:56:02 UTC: ISAKMP:(0):Fill atts in sa vpi_length:4
    *Sep 10 08:56:02 UTC: ISAKMP:(0):Fill atts in sa life_in_seconds:86400
    *Sep 10 08:56:02 UTC: ISAKMP:(0):Returning Actual lifetime: 86400
    *Sep 10 08:56:02 UTC: ISAKMP:(0)::Started lifetime timer: 86400.
    *Sep 10 08:56:02 UTC: ISAKMP:(0): processing vendor id payload
    *Sep 10 08:56:02 UTC: ISAKMP:(0): vendor ID seems Unity/DPD but major 69 mismatch
    *Sep 10 08:56:02 UTC: ISAKMP (0): vendor ID is NAT-T RFC 3947
    *Sep 10 08:56:02 UTC: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    *Sep 10 08:56:02 UTC: ISAKMP:(0):Old State = IKE_I_MM2  New State = IKE_I_MM2 
    *Sep 10 08:56:02 UTC: ISAKMP:(0): sending packet to x.x.x.x my_port 500 peer_port 500 (I) MM_SA_SETUP
    *Sep 10 08:56:02 UTC: ISAKMP:(0):Sending an IKE IPv4 Packet.
    *Sep 10 08:56:02 UTC: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    *Sep 10 08:56:02 UTC: ISAKMP:(0):Old State = IKE_I_MM2  New State = IKE_I_MM3 
    *Sep 10 08:56:02 UTC: ISAKMP (0): received packet from x.x.x.x dport 500 sport 500 Global (I) MM_SA_SETUP
    *Sep 10 08:56:02 UTC: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    *Sep 10 08:56:02 UTC: ISAKMP:(0):Old State = IKE_I_MM3  New State = IKE_I_MM4 
    *Sep 10 08:56:02 UTC: ISAKMP:(0): processing KE payload. message ID = 0
    *Sep 10 08:56:02 UTC: ISAKMP:(0): processing NONCE payload. message ID = 0
    *Sep 10 08:56:02 UTC: ISAKMP:(0):found peer pre-shared key matching x.x.x.x
    *Sep 10 08:56:02 UTC: ISAKMP:(2746): processing vendor id payload
    *Sep 10 08:56:02 UTC: ISAKMP:(2746): vendor ID is Unity
    *Sep 10 08:56:02 UTC: ISAKMP:(2746): processing vendor id payload
    *Sep 10 08:56:02 UTC: ISAKMP:(2746): vendor ID is DPD
    *Sep 10 08:56:02 UTC: ISAKMP:(2746): processing vendor id payload
    *Sep 10 08:56:02 UTC: ISAKMP:(2746): speaking to another IOS box!
    *Sep 10 08:56:02 UTC: ISAKMP:received payload type 20
    *Sep 10 08:56:02 UTC: ISAKMP (2746): NAT found, both nodes inside NAT
    *Sep 10 08:56:02 UTC: ISAKMP:received payload type 20
    *Sep 10 08:56:02 UTC: ISAKMP (2746): My hash no match -  this node inside NAT
    *Sep 10 08:56:02 UTC: ISAKMP:(2746):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    *Sep 10 08:56:02 UTC: ISAKMP:(2746):Old State = IKE_I_MM4  New State = IKE_I_MM4 
    *Sep 10 08:56:02 UTC: ISAKMP:(2746):Send initial contact
    *Sep 10 08:56:02 UTC: ISAKMP:(2746):SA is doing pre-shared key authentication using id type ID_IPV4_ADDR
    *Sep 10 08:56:02 UTC: ISAKMP (2746): ID payload 
    next-payload : 8
    type         : 1 
    address      : 192.168.1.101 
    protocol     : 17 
    port         : 0 
    length       : 12
    *Sep 10 08:56:02 UTC: ISAKMP:(2746):Total payload length: 12
    *Sep 10 08:56:02 UTC: ISAKMP:(2746): sending packet to x.x.x.x my_port 4500 peer_port 4500 (I) MM_KEY_EXCH
    *Sep 10 08:56:02 UTC: ISAKMP:(2746):Sending an IKE IPv4 Packet.
    *Sep 10 08:56:02 UTC: ISAKMP:(2746):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    *Sep 10 08:56:02 UTC: ISAKMP:(2746):Old State = IKE_I_MM4  New State = IKE_I_MM5 
    *Sep 10 08:56:03 UTC: ISAKMP (2746): received packet from x.x.x.x dport 500 sport 500 Global (I) MM_KEY_EXCH
    *Sep 10 08:56:03 UTC: ISAKMP:(2746): phase 1 packet is a duplicate of a previous packet.
    *Sep 10 08:56:03 UTC: ISAKMP:(2746): retransmitting due to retransmit phase 1
    *Sep 10 08:56:04 UTC: ISAKMP:(2746): retransmitting phase 1 MM_KEY_EXCH...
    *Sep 10 08:56:04 UTC: ISAKMP (2746): incrementing error counter on sa, attempt 1 of 5: retransmit phase 1
    *Sep 10 08:56:04 UTC: ISAKMP:(2746): retransmitting phase 1 MM_KEY_EXCH
    *Sep 10 08:56:04 UTC: ISAKMP:(2746): sending packet to x.x.x.x my_port 4500 peer_port 4500 (I) MM_KEY_EXCH
    *Sep 10 08:56:04 UTC: ISAKMP:(2746):Sending an IKE IPv4 Packet.

    This could be because the port 4500 packet that is being sent is not being received by the peer side or it is ignoring that packet. 
    Since the port 500 packet that you are receiving is a duplicate of the previous packet it is definitely not a reply packet for the port 4500 packet. 
    If you can get the debugs from the other end, then you could see if the peer side is receiving the udp port 4500 packets.
    If not that then this could be a UDP port 4500 block with the ISP.

  • Site-to-site VPN failover via 3G HWIC

    Small problem.  Branch utilizes a 2811 router connected via MPLS to core via serial interface.  If serial ip sla reachability fails, fire up the cell interface, dial out and connect to the internet.  Establish ipsec tunnel to a peer ASA and pass local LAN traffic over the tunnel.  Problem is the tunnel does come up and I am 'briefly' able to communicate across the tunnel but then *poof*.  No more communication.  Tried multiple ideas and thoughts (different encypt, authentication etc).  I am thinking that per my config, the IPSEC session is trying to establish before the dialer session is fully up, thus potentially causing problems with the authentication to the peer.  Any help would be appreciated.  Here is the debug of isakmp, ipsec, dialer and ppp when I manually kill the serial interface:
    14th_Street(config)#int s0/1/0:0
    14th_Street(config-if)#shut
    14th_Street(config-if)#
    *Nov 25 17:44:55.011 UTC: %BGP-5-ADJCHANGE: neighbor xxx.xxx.xxx.xxx Down Interface flap
    *Nov 25 17:44:55.911 UTC: IPSEC(sa_initiate): Kicking the dialer interface
    *Nov 25 17:44:55.911 UTC: Ce0/0/0 DDR: place call
    *Nov 25 17:44:55.911 UTC: Ce0/0/0 DDR: Dialing cause ip (s=xxx.xxx.xxx.xxx, d=xxx.xxx.xxx.xxx)
    *Nov 25 17:44:55.911 UTC: Ce0/0/0 DDR: Attempting to dial cdma
    *Nov 25 17:44:55.911 UTC: CHAT0/0/0: Attempting async line dialer script
    *Nov 25 17:44:55.911 UTC: CHAT0/0/0: Dialing using Modem script: cdma & System script: none
    *Nov 25 17:44:55.911 UTC: CHAT0/0/0: process started
    *Nov 25 17:44:55.911 UTC: CHAT0/0/0: Asserting DTR
    *Nov 25 17:44:55.911 UTC: CHAT0/0/0: Chat script cdma started
    *Nov 25 17:44:55.915 UTC: IPSEC(sa_initiate): Kicking the dialer interface
    *Nov 25 17:44:56.999 UTC: %LINK-5-CHANGED: Interface Serial0/1/0:0, changed state to administratively down
    *Nov 25 17:44:56.999 UTC: Se0/1/0:0 PPP: Sending Acct Event[Down] id[1]
    *Nov 25 17:44:56.999 UTC: Se0/1/0:0 CDPCP: State is Closed
    *Nov 25 17:44:56.999 UTC: Se0/1/0:0 IPCP: State is Closed
    *Nov 25 17:44:57.003 UTC: Se0/1/0:0 PPP: Phase is TERMINATING
    *Nov 25 17:44:57.003 UTC: Se0/1/0:0 LCP: State is Closed
    *Nov 25 17:44:57.003 UTC: Se0/1/0:0 PPP: Phase is DOWN
    *Nov 25 17:44:57.003 UTC: Se0/1/0:0 IPCP: Remove route to xxx.xxx.xxx.xxx
    *Nov 25 17:44:57.007 UTC: IPSEC(sa_initiate): Kicking the dialer interface
    *Nov 25 17:44:57.099 UTC: %TRACKING-5-STATE: 1 ip sla 1 reachability Up->Down
    *Nov 25 17:44:57.811 UTC: CHAT0/0/0: Chat script cdma finished, status = Success
    *Nov 25 17:44:58.031 UTC: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/1/0:0, changed state to down
    *Nov 25 17:44:58.031 UTC: IPSEC(sa_initiate): Kicking the dialer interface
    *Nov 25 17:44:58.035 UTC: IPSEC(sa_initiate): Kicking the dialer interface
    *Nov 25 17:44:58.911 UTC: IPSEC(sa_initiate): Kicking the dialer interface
    *Nov 25 17:45:00.027 UTC: %LINK-3-UPDOWN: Interface Cellular0/0/0, changed state to up
    *Nov 25 17:45:00.027 UTC: Ce0/0/0 DDR: Dialer statechange to up
    *Nov 25 17:45:00.027 UTC: Ce0/0/0 DDR: Dialer call has been placed
    *Nov 25 17:45:00.031 UTC: Ce0/0/0 PPP: Using dialer call direction
    *Nov 25 17:45:00.031 UTC: Ce0/0/0 PPP: Treating connection as a callout
    *Nov 25 17:45:00.031 UTC: Ce0/0/0 PPP: Session handle[FD000001] Session id[2]
    *Nov 25 17:45:00.031 UTC: Ce0/0/0 PPP: Phase is ESTABLISHING, Active Open
    *Nov 25 17:45:00.031 UTC: Ce0/0/0 PPP: Authorization NOT required
    *Nov 25 17:45:00.031 UTC: Ce0/0/0 PPP: No remote authentication for call-out
    *Nov 25 17:45:00.031 UTC: Ce0/0/0 LCP: O CONFREQ [Closed] id 1 len 20
    *Nov 25 17:45:00.031 UTC: Ce0/0/0 LCP:    ACCM 0x000A0000 (0x0206000A0000)
    *Nov 25 17:45:00.031 UTC: Ce0/0/0 LCP:    MagicNumber 0x13255539 (0x050613255539)
    *Nov 25 17:45:00.031 UTC: Ce0/0/0 LCP:    PFC (0x0702)
    *Nov 25 17:45:00.031 UTC: Ce0/0/0 LCP:    ACFC (0x0802)
    *Nov 25 17:45:00.031 UTC: IPSEC(sa_initiate): Kicking the dialer interface
    *Nov 25 17:45:00.035 UTC: Ce0/0/0 LCP: I CONFREQ [REQsent] id 0 len 24
    *Nov 25 17:45:00.035 UTC: Ce0/0/0 LCP:    MRU 1500 (0x010405DC)
    *Nov 25 17:45:00.035 UTC: Ce0/0/0 LCP:    ACCM 0x00000000 (0x020600000000)
    *Nov 25 17:45:00.035 UTC: Ce0/0/0 LCP:    MagicNumber 0xCD87E220 (0x0506CD87E220)
    *Nov 25 17:45:00.035 UTC: Ce0/0/0 LCP:    PFC (0x0702)
    *Nov 25 17:45:00.035 UTC: Ce0/0/0 LCP:    ACFC (0x0802)
    *Nov 25 17:45:00.035 UTC: Ce0/0/0 LCP: O CONFACK [REQsent] id 0 len 24
    *Nov 25 17:45:00.035 UTC: Ce0/0/0 LCP:    MRU 1500 (0x010405DC)
    *Nov 25 17:45:00.035 UTC: Ce0/0/0 LCP:    ACCM 0x00000000 (0x020600000000)
    *Nov 25 17:45:00.035 UTC: Ce0/0/0 LCP:    MagicNumber 0xCD87E220 (0x0506CD87E220)
    *Nov 25 17:45:00.035 UTC: Ce0/0/0 LCP:    PFC (0x0702)
    *Nov 25 17:45:00.035 UTC: Ce0/0/0 LCP:    ACFC (0x0802)
    *Nov 25 17:45:00.035 UTC: Ce0/0/0 LCP: I CONFACK [ACKsent] id 1 len 20
    *Nov 25 17:45:00.035 UTC: Ce0/0/0 LCP:    ACCM 0x000A0000 (0x0206000A0000)
    *Nov 25 17:45:00.035 UTC: Ce0/0/0 LCP:    MagicNumber 0x13255539 (0x050613255539)
    *Nov 25 17:45:00.035 UTC: Ce0/0/0 LCP:    PFC (0x0702)
    *Nov 25 17:45:00.035 UTC: Ce0/0/0 LCP:    ACFC (0x0802)
    *Nov 25 17:45:00.035 UTC: Ce0/0/0 LCP: State is Open
    *Nov 25 17:45:00.035 UTC: Ce0/0/0 PPP: Phase is FORWARDING, Attempting Forward
    *Nov 25 17:45:00.035 UTC: Ce0/0/0 PPP: Phase is ESTABLISHING, Finish LCP
    *Nov 25 17:45:00.039 UTC: Ce0/0/0 PPP: Phase is UP
    *Nov 25 17:45:00.039 UTC: Ce0/0/0 IPCP: O CONFREQ [Closed] id 1 len 22
    *Nov 25 17:45:00.039 UTC: Ce0/0/0 IPCP:    Address 0.0.0.0 (0x030600000000)
    *Nov 25 17:45:00.039 UTC: Ce0/0/0 IPCP:    PrimaryDNS 0.0.0.0 (0x810600000000)
    *Nov 25 17:45:00.039 UTC: Ce0/0/0 IPCP:    SecondaryDNS 0.0.0.0 (0x830600000000)
    *Nov 25 17:45:00.039 UTC: Ce0/0/0 PPP: Process pending ncp packets
    *Nov 25 17:45:00.039 UTC: Ce0/0/0 IPCP: I CONFREQ [REQsent] id 0 len 10
    *Nov 25 17:45:00.039 UTC: Ce0/0/0 IPCP:    Address xxx.xxx.xxx.xxx (0x030642AEA8C0)
    *Nov 25 17:45:00.039 UTC: Ce0/0/0 IPCP: O CONFACK [REQsent] id 0 len 10
    *Nov 25 17:45:00.039 UTC: Ce0/0/0 IPCP:    Address xxx.xxx.xxx.xxx (0x030642AEA8C0)
    *Nov 25 17:45:00.043 UTC: Ce0/0/0 IPCP: I CONFNAK [ACKsent] id 1 len 22
    *Nov 25 17:45:00.043 UTC: Ce0/0/0 IPCP:    Address xxx.xxx.xxx.xxx (0x0306A69F5EA9)
    *Nov 25 17:45:00.043 UTC: Ce0/0/0 IPCP:    PrimaryDNS xxx.xxx.xxx.xxx (0x810642AE4721)
    *Nov 25 17:45:00.043 UTC: Ce0/0/0 IPCP:    SecondaryDNS xxx.xxx.xxx.xxx (0x8306454E600E)
    *Nov 25 17:45:00.043 UTC: Ce0/0/0 IPCP: O CONFREQ [ACKsent] id 2 len 22
    *Nov 25 17:45:00.043 UTC: Ce0/0/0 IPCP:    Address xxx.xxx.xxx.xxx (0x0306A69F5EA9)
    *Nov 25 17:45:00.043 UTC: Ce0/0/0 IPCP:    PrimaryDNS xxx.xxx.xxx.xxx (0x810642AE4721)
    *Nov 25 17:45:00.043 UTC: Ce0/0/0 IPCP:    SecondaryDNS xxx.xxx.xxx.xxx (0x8306454E600E)
    *Nov 25 17:45:00.043 UTC: Ce0/0/0 IPCP: I CONFNAK [ACKsent] id 2 len 4
    *Nov 25 17:45:00.043 UTC: Ce0/0/0 IPCP: O CONFREQ [ACKsent] id 3 len 22
    *Nov 25 17:45:00.043 UTC: Ce0/0/0 IPCP:    Address xxx.xxx.xxx.xxx (0x0306A69F5EA9)
    *Nov 25 17:45:00.043 UTC: Ce0/0/0 IPCP:    PrimaryDNS xxx.xxx.xxx.xxx (0x810642AE4721)
    *Nov 25 17:45:00.047 UTC: Ce0/0/0 IPCP:    SecondaryDNS xxx.xxx.xxx.xxx (0x8306454E600E)
    *Nov 25 17:45:00.047 UTC: Ce0/0/0 IPCP: I CONFNAK [ACKsent] id 3 len 4
    *Nov 25 17:45:00.047 UTC: Ce0/0/0 IPCP: O CONFREQ [ACKsent] id 4 len 22
    *Nov 25 17:45:00.047 UTC: Ce0/0/0 IPCP:    Address xxx.xxx.xxx.xxx (0x0306A69F5EA9)
    *Nov 25 17:45:00.047 UTC: Ce0/0/0 IPCP:    PrimaryDNS xxx.xxx.xxx.xxx (0x810642AE4721)
    *Nov 25 17:45:00.047 UTC: Ce0/0/0 IPCP:    SecondaryDNS xxx.xxx.xxx.xxx (0x8306454E600E)
    *Nov 25 17:45:00.051 UTC: Ce0/0/0 IPCP: I CONFACK [ACKsent] id 4 len 22
    *Nov 25 17:45:00.051 UTC: Ce0/0/0 IPCP:    Address xxx.xxx.xxx.xxx (0x0306A69F5EA9)
    *Nov 25 17:45:00.051 UTC: Ce0/0/0 IPCP:    PrimaryDNS xxx.xxx.xxx.xxx (0x810642AE4721)
    *Nov 25 17:45:00.051 UTC: Ce0/0/0 IPCP:    SecondaryDNS xxx.xxx.xxx.xxx (0x8306454E600E)
    *Nov 25 17:45:00.051 UTC: Ce0/0/0 IPCP: State is Open
    *Nov 25 17:45:00.051 UTC: Ce0/0/0 IPCP: Install negotiated IP interface address xxx.xxx.xxx.xxx
    *Nov 25 17:45:00.059 UTC: IPSEC(recalculate_mtu): reset sadb_root 4975A1A8 mtu to 1500
    *Nov 25 17:45:00.063 UTC: Ce0/0/0 IPCP: Install route to xxx.xxx.xxx.xxx
    *Nov 25 17:45:00.063 UTC: Ce0/0/0 DDR: dialer protocol up
    *Nov 25 17:45:00.067 UTC: Ce0/0/0 IPCP: Add link info for cef entry xxx.xxx.xxx.xxx
    *Nov 25 17:45:01.027 UTC: %LINEPROTO-5-UPDOWN: Line protocol on Interface Cellular0/0/0, changed state to up
    *Nov 25 17:45:29.763 UTC:  DDR: IP Address is (xxx.xxx.xxx.xxx) for (Ce0/0/0)
    *Nov 25 17:45:29.763 UTC: IPSEC(sa_request): ,
      (key eng. msg.) OUTBOUND local= xxx.xxx.xxx.xxx, remote= xxx.xxx.xxx.xxx,
        local_proxy= 192.168.221.0/255.255.255.0/0/0 (type=4),
        remote_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4),
        protocol= ESP, transform= esp-3des esp-sha-hmac  (Tunnel),
        lifedur= 86400s and 4608000kb,
        spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x0
    *Nov 25 17:45:29.767 UTC: ISAKMP:(0): SA request profile is (NULL)
    *Nov 25 17:45:29.767 UTC: ISAKMP: Created a peer struct for xxx.xxx.xxx.xxx, peer port 500
    *Nov 25 17:45:29.767 UTC: ISAKMP: New peer created peer = 0x47AC3A08 peer_handle = 0x80000002
    *Nov 25 17:45:29.767 UTC: ISAKMP: Locking peer struct 0x47AC3A08, refcount 1 for isakmp_initiator
    *Nov 25 17:45:29.767 UTC: ISAKMP: local port 500, remote port 500
    *Nov 25 17:45:29.767 UTC: ISAKMP: set new node 0 to QM_IDLE     
    *Nov 25 17:45:29.771 UTC: insert sa successfully sa = 4B6322B8
    *Nov 25 17:45:29.771 UTC: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
    *Nov 25 17:45:29.771 UTC: ISAKMP:(0):found peer pre-shared key matching xxx.xxx.xxx.xxx
    *Nov 25 17:45:29.771 UTC: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID
    *Nov 25 17:45:29.771 UTC: ISAKMP:(0): constructed NAT-T vendor-07 ID
    *Nov 25 17:45:29.771 UTC: ISAKMP:(0): constructed NAT-T vendor-03 ID
    *Nov 25 17:45:29.771 UTC: ISAKMP:(0): constructed NAT-T vendor-02 ID
    *Nov 25 17:45:29.771 UTC: ISAKMP:(0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
    *Nov 25 17:45:29.771 UTC: ISAKMP:(0):Old State = IKE_READY  New State = IKE_I_MM1
    *Nov 25 17:45:29.771 UTC: ISAKMP:(0): beginning Main Mode exchange
    *Nov 25 17:45:29.771 UTC: ISAKMP:(0): sending packet to xxx.xxx.xxx.xxx my_port 500 peer_port 500 (I) MM_NO_STATE
    *Nov 25 17:45:29.771 UTC: ISAKMP:(0):Sending an IKE IPv4 Packet.
    *Nov 25 17:45:29.927 UTC: ISAKMP (0:0): received packet from xxx.xxx.xxx.xxx dport 500 sport 500 Global (I) MM_NO_STATE
    *Nov 25 17:45:29.927 UTC: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    *Nov 25 17:45:29.931 UTC: ISAKMP:(0):Old State = IKE_I_MM1  New State = IKE_I_MM2
    *Nov 25 17:45:29.931 UTC: ISAKMP:(0): processing SA payload. message ID = 0
    *Nov 25 17:45:29.931 UTC: ISAKMP:(0): processing vendor id payload
    *Nov 25 17:45:29.931 UTC: ISAKMP:(0): processing IKE frag vendor id payload
    *Nov 25 17:45:29.931 UTC: ISAKMP:(0):Support for IKE Fragmentation not enabled
    *Nov 25 17:45:29.931 UTC: ISAKMP:(0):found peer pre-shared key matching xxx.xxx.xxx.xxx
    *Nov 25 17:45:29.931 UTC: ISAKMP:(0): local preshared key found
    *Nov 25 17:45:29.931 UTC: ISAKMP : Scanning profiles for xauth ...
    *Nov 25 17:45:29.931 UTC: ISAKMP:(0):Checking ISAKMP transform 1 against priority 1 policy
    *Nov 25 17:45:29.931 UTC: ISAKMP:      encryption 3DES-CBC
    *Nov 25 17:45:29.931 UTC: ISAKMP:      hash SHA
    *Nov 25 17:45:29.931 UTC: ISAKMP:      default group 2
    *Nov 25 17:45:29.931 UTC: ISAKMP:      auth pre-share
    *Nov 25 17:45:29.931 UTC: ISAKMP:      life type in seconds
    *Nov 25 17:45:29.931 UTC: ISAKMP:      life duration (VPI) of  0x0 0x1 0x51 0x80
    *Nov 25 17:45:29.931 UTC: ISAKMP:(0):atts are acceptable. Next payload is 0
    *Nov 25 17:45:29.931 UTC: ISAKMP:(0):Acceptable atts:actual life: 0
    *Nov 25 17:45:29.931 UTC: ISAKMP:(0):Acceptable atts:life: 0
    *Nov 25 17:45:29.931 UTC: ISAKMP:(0):Fill atts in sa vpi_length:4
    *Nov 25 17:45:29.931 UTC: ISAKMP:(0):Fill atts in sa life_in_seconds:86400
    *Nov 25 17:45:29.931 UTC: ISAKMP:(0):Returning Actual lifetime: 86400
    *Nov 25 17:45:29.931 UTC: ISAKMP:(0)::Started lifetime timer: 86400.
    *Nov 25 17:45:29.971 UTC: ISAKMP:(0): processing vendor id payload
    *Nov 25 17:45:29.971 UTC: ISAKMP:(0): processing IKE frag vendor id payload
    *Nov 25 17:45:29.971 UTC: ISAKMP:(0):Support for IKE Fragmentation not enabled
    *Nov 25 17:45:29.971 UTC: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    *Nov 25 17:45:29.971 UTC: ISAKMP:(0):Old State = IKE_I_MM2  New State = IKE_I_MM2
    *Nov 25 17:45:29.971 UTC: ISAKMP:(0): sending packet to xxx.xxx.xxx.xxx my_port 500 peer_port 500 (I) MM_SA_SETUP
    *Nov 25 17:45:29.975 UTC: ISAKMP:(0):Sending an IKE IPv4 Packet.
    *Nov 25 17:45:29.975 UTC: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    *Nov 25 17:45:29.975 UTC: ISAKMP:(0):Old State = IKE_I_MM2  New State = IKE_I_MM3
    *Nov 25 17:45:30.171 UTC: ISAKMP (0:0): received packet from xxx.xxx.xxx.xxx dport 500 sport 500 Global (I) MM_SA_SETUP
    *Nov 25 17:45:30.171 UTC: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    *Nov 25 17:45:30.171 UTC: ISAKMP:(0):Old State = IKE_I_MM3  New State = IKE_I_MM4
    *Nov 25 17:45:30.171 UTC: ISAKMP:(0): processing KE payload. message ID = 0
    *Nov 25 17:45:30.219 UTC: ISAKMP:(0): processing NONCE payload. message ID = 0
    *Nov 25 17:45:30.219 UTC: ISAKMP:(0):found peer pre-shared key matching xxx.xxx.xxx.xxx
    *Nov 25 17:45:30.223 UTC: ISAKMP:(1001): processing vendor id payload
    *Nov 25 17:45:30.223 UTC: ISAKMP:(1001): vendor ID is Unity
    *Nov 25 17:45:30.223 UTC: ISAKMP:(1001): processing vendor id payload
    *Nov 25 17:45:30.223 UTC: ISAKMP:(1001): vendor ID seems Unity/DPD but major 71 mismatch
    *Nov 25 17:45:30.223 UTC: ISAKMP:(1001): vendor ID is XAUTH
    *Nov 25 17:45:30.223 UTC: ISAKMP:(1001): processing vendor id payload
    *Nov 25 17:45:30.223 UTC: ISAKMP:(1001): speaking to another IOS box!
    *Nov 25 17:45:30.223 UTC: ISAKMP:(1001): processing vendor id payload
    *Nov 25 17:45:30.223 UTC: ISAKMP:(1001):vendor ID seems Unity/DPD but hash mismatch
    *Nov 25 17:45:30.223 UTC: ISAKMP:(1001):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    *Nov 25 17:45:30.223 UTC: ISAKMP:(1001):Old State = IKE_I_MM4  New State = IKE_I_MM4
    *Nov 25 17:45:30.223 UTC: ISAKMP:(1001):Send initial contact
    *Nov 25 17:45:30.223 UTC: ISAKMP:(1001):SA is doing pre-shared key authentication using id type ID_IPV4_ADDR
    *Nov 25 17:45:30.223 UTC: ISAKMP (0:1001): ID payload
            next-payload : 8
            type         : 1
            address      : xxx.xxx.xxx.xxx
            protocol     : 17
            port         : 500
            length       : 12
    *Nov 25 17:45:30.223 UTC: ISAKMP:(1001):Total payload length: 12
    *Nov 25 17:45:30.227 UTC: ISAKMP:(1001): sending packet to xxx.xxx.xxx.xxx my_port 500 peer_port 500 (I) MM_KEY_EXCH
    *Nov 25 17:45:30.227 UTC: ISAKMP:(1001):Sending an IKE IPv4 Packet.
    *Nov 25 17:45:30.227 UTC: ISAKMP:(1001):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    *Nov 25 17:45:30.227 UTC: ISAKMP:(1001):Old State = IKE_I_MM4  New State = IKE_I_MM5
    *Nov 25 17:45:30.495 UTC: ISAKMP (0:1001): received packet from xxx.xxx.xxx.xxx dport 500 sport 500 Global (I) MM_KEY_EXCH
    *Nov 25 17:45:30.495 UTC: ISAKMP:(1001): processing ID payload. message ID = 0
    *Nov 25 17:45:30.495 UTC: ISAKMP (0:1001): ID payload
            next-payload : 8
            type         : 1
            address      : xxx.xxx.xxx.xxx
            protocol     : 17
            port         : 500
            length       : 12
    *Nov 25 17:45:30.495 UTC: ISAKMP:(0):: peer matches *none* of the profiles
    *Nov 25 17:45:30.495 UTC: ISAKMP:(1001): processing HASH payload. message ID = 0
    *Nov 25 17:45:30.495 UTC: ISAKMP:received payload type 17
    *Nov 25 17:45:30.495 UTC: ISAKMP:(1001): processing vendor id payload
    *Nov 25 17:45:30.495 UTC: ISAKMP:(1001): vendor ID is DPD
    *Nov 25 17:45:30.495 UTC: ISAKMP:(1001):SA authentication status:
            authenticated
    *Nov 25 17:45:30.495 UTC: ISAKMP:(1001):SA has been authenticated with xxx.xxx.xxx.xxx
    *Nov 25 17:45:30.495 UTC: ISAKMP: Trying to insert a peer xxx.xxx.xxx.xxx/xxx.xxx.xxx.xxx/500/,  and inserted successfully 47AC3A08.
    *Nov 25 17:45:30.495 UTC: ISAKMP:(1001):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    *Nov 25 17:45:30.499 UTC: ISAKMP:(1001):Old State = IKE_I_MM5  New State = IKE_I_MM6
    *Nov 25 17:45:30.499 UTC: ISAKMP:(1001):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    *Nov 25 17:45:30.499 UTC: ISAKMP:(1001):Old State = IKE_I_MM6  New State = IKE_I_MM6
    *Nov 25 17:45:30.499 UTC: ISAKMP:(1001):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    *Nov 25 17:45:30.499 UTC: ISAKMP:(1001):Old State = IKE_I_MM6  New State = IKE_P1_COMPLETE
    *Nov 25 17:45:30.499 UTC: ISAKMP:(1001):beginning Quick Mode exchange, M-ID of 458622291
    *Nov 25 17:45:30.503 UTC: ISAKMP:(1001):QM Initiator gets spi
    *Nov 25 17:45:30.503 UTC: ISAKMP:(1001): sending packet to xxx.xxx.xxx.xxx my_port 500 peer_port 500 (I) QM_IDLE     
    *Nov 25 17:45:30.503 UTC: ISAKMP:(1001):Sending an IKE IPv4 Packet.
    *Nov 25 17:45:30.503 UTC: ISAKMP:(1001):Node 458622291, Input = IKE_MESG_INTERNAL, IKE_INIT_QM
    *Nov 25 17:45:30.503 UTC: ISAKMP:(1001):Old State = IKE_QM_READY  New State = IKE_QM_I_QM1
    *Nov 25 17:45:30.503 UTC: ISAKMP:(1001):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
    *Nov 25 17:45:30.503 UTC: ISAKMP:(1001):Old State = IKE_P1_COMPLETE  New State = IKE_P1_COMPLETE
    *Nov 25 17:45:30.715 UTC: ISAKMP (0:1001): received packet from xxx.xxx.xxx.xxx dport 500 sport 500 Global (I) QM_IDLE     
    *Nov 25 17:45:30.715 UTC: ISAKMP:(1001): processing HASH payload. message ID = 458622291
    *Nov 25 17:45:30.715 UTC: ISAKMP:(1001): processing SA payload. message ID = 458622291
    *Nov 25 17:45:30.715 UTC: ISAKMP:(1001):Checking IPSec proposal 1
    *Nov 25 17:45:30.715 UTC: ISAKMP: transform 1, ESP_3DES
    *Nov 25 17:45:30.715 UTC: ISAKMP:   attributes in transform:
    *Nov 25 17:45:30.715 UTC: ISAKMP:      SA life type in seconds
    *Nov 25 17:45:30.715 UTC: ISAKMP:      SA life duration (VPI) of  0x0 0x1 0x51 0x80
    *Nov 25 17:45:30.715 UTC: ISAKMP:      SA life type in kilobytes
    *Nov 25 17:45:30.715 UTC: ISAKMP:      SA life duration (VPI) of  0x0 0x46 0x50 0x0
    *Nov 25 17:45:30.715 UTC: ISAKMP:      encaps is 1 (Tunnel)
    *Nov 25 17:45:30.715 UTC: ISAKMP:      authenticator is HMAC-SHA
    *Nov 25 17:45:30.715 UTC: ISAKMP:(1001):atts are acceptable.
    *Nov 25 17:45:30.715 UTC: IPSEC(validate_proposal_request): proposal part #1
    *Nov 25 17:45:30.715 UTC: IPSEC(validate_proposal_request): proposal part #1,
      (key eng. msg.) INBOUND local= xxx.xxx.xxx.xxx, remote= xxx.xxx.xxx.xxx,
        local_proxy= 192.168.221.0/255.255.255.0/0/0 (type=4),
        remote_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4),
        protocol= ESP, transform= NONE  (Tunnel),
        lifedur= 0s and 0kb,
        spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x0
    *Nov 25 17:45:30.715 UTC: Crypto mapdb : proxy_match
            src addr     : 192.168.221.0
            dst addr     : 0.0.0.0
            protocol     : 0
            src port     : 0
            dst port     : 0
    *Nov 25 17:45:30.715 UTC: ISAKMP:(1001): processing NONCE payload. message ID = 458622291
    *Nov 25 17:45:30.715 UTC: ISAKMP:(1001): processing ID payload. message ID = 458622291
    *Nov 25 17:45:30.715 UTC: ISAKMP:(1001): processing ID payload. message ID = 458622291
    *Nov 25 17:45:30.719 UTC: ISAKMP:(1001): processing NOTIFY RESPONDER_LIFETIME protocol 3
            spi 399189113, message ID = 458622291, sa = 4B6322B8
    *Nov 25 17:45:30.719 UTC: ISAKMP:(1001):SA authentication status:
            authenticated
    *Nov 25 17:45:30.719 UTC: ISAKMP:(1001): processing responder lifetime
    *Nov 25 17:45:30.719 UTC: ISAKMP (1001): responder lifetime of 28800s
    *Nov 25 17:45:30.719 UTC: ISAKMP:(1001): Creating IPSec SAs
    *Nov 25 17:45:30.719 UTC:         inbound SA from xxx.xxx.xxx.xxx to xxx.xxx.xxx.xxx (f/i)  0/ 0
            (proxy 0.0.0.0 to 192.168.221.0)
    *Nov 25 17:45:30.719 UTC:         has spi 0x498026E2 and conn_id 0
    *Nov 25 17:45:30.719 UTC:         lifetime of 28790 seconds
    *Nov 25 17:45:30.719 UTC:         lifetime of 4608000 kilobytes
    *Nov 25 17:45:30.719 UTC:         outbound SA from xxx.xxx.xxx.xxx to xxx.xxx.xxx.xxx (f/i) 0/0
            (proxy 192.168.221.0 to 0.0.0.0)
    *Nov 25 17:45:30.719 UTC:         has spi  0x17CB2479 and conn_id 0
    *Nov 25 17:45:30.719 UTC:         lifetime of 28790 seconds
    *Nov 25 17:45:30.719 UTC:         lifetime of 4608000 kilobytes
    *Nov 25 17:45:30.719 UTC: ISAKMP:(1001): sending packet to xxx.xxx.xxx.xxx my_port 500 peer_port 500 (I) QM_IDLE     
    *Nov 25 17:45:30.719 UTC: ISAKMP:(1001):Sending an IKE IPv4 Packet.
    *Nov 25 17:45:30.723 UTC: ISAKMP:(1001):deleting node 458622291 error FALSE reason "No Error"
    *Nov 25 17:45:30.723 UTC: ISAKMP:(1001):Node 458622291, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
    *Nov 25 17:45:30.723 UTC: ISAKMP:(1001):Old State = IKE_QM_I_QM1  New State = IKE_QM_PHASE2_COMPLETE
    *Nov 25 17:45:30.723 UTC: IPSEC(key_engine): got a queue event with 1 KMI message(s)
    *Nov 25 17:45:30.723 UTC: Crypto mapdb : proxy_match
            src addr     : 192.168.221.0
            dst addr     : 0.0.0.0
            protocol     : 0
            src port     : 0
            dst port     : 0
    *Nov 25 17:45:30.723 UTC: IPSEC(crypto_ipsec_sa_find_ident_head): reconnecting with the same proxies and peer xxx.xxx.xxx.xxx
    *Nov 25 17:45:30.723 UTC: IPSEC(policy_db_add_ident): src 192.168.221.0, dest 0.0.0.0, dest_port 0
    *Nov 25 17:45:30.723 UTC: IPSEC(create_sa): sa created,
      (sa) sa_dest= xxx.xxx.xxx.xxx, sa_proto= 50,
        sa_spi= 0x498026E2(1233135330),
        sa_trans= esp-3des esp-sha-hmac , sa_conn_id= 2001
    *Nov 25 17:45:30.723 UTC: IPSEC(create_sa): sa created,
      (sa) sa_dest= xxx.xxx.xxx.xxx, sa_proto= 50,
        sa_spi= 0x17CB2479(399189113),
        sa_trans= esp-3des esp-sha-hmac , sa_conn_id= 2002
    *Nov 25 17:45:30.723 UTC: IPSEC(update_current_outbound_sa): updated peer xxx.xxx.xxx.xxx current outbound sa to SPI 17CB2479
    *Nov 25 17:45:46.935 UTC: ISAKMP (0:1001): received packet from xxx.xxx.xxx.xxx dport 500 sport 500 Global (I) QM_IDLE     
    *Nov 25 17:45:46.935 UTC: ISAKMP: set new node -1909459720 to QM_IDLE     
    *Nov 25 17:45:46.939 UTC: ISAKMP:(1001): processing HASH payload. message ID = -1909459720
    *Nov 25 17:45:46.939 UTC: ISAKMP:(1001): processing NOTIFY DPD/R_U_THERE protocol 1
            spi 0, message ID = -1909459720, sa = 4B6322B8
    *Nov 25 17:45:46.939 UTC: ISAKMP:(1001):deleting node -1909459720 error FALSE reason "Informational (in) state 1"
    *Nov 25 17:45:46.939 UTC: ISAKMP:(1001):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY
    *Nov 25 17:45:46.939 UTC: ISAKMP:(1001):Old State = IKE_P1_COMPLETE  New State = IKE_P1_COMPLETE
    *Nov 25 17:45:46.939 UTC: ISAKMP:(1001):DPD/R_U_THERE received from peer xxx.xxx.xxx.xxx, sequence 0x7BDFE4C6
    *Nov 25 17:45:46.939 UTC: ISAKMP: set new node -777989143 to QM_IDLE     
    *Nov 25 17:45:46.939 UTC: ISAKMP:(1001):Sending NOTIFY DPD/R_U_THERE_ACK protocol 1
            spi 1224841120, message ID = -777989143
    *Nov 25 17:45:46.939 UTC: ISAKMP:(1001): seq. no 0x7BDFE4C6
    *Nov 25 17:45:46.939 UTC: ISAKMP:(1001): sending packet to xxx.xxx.xxx.xxx my_port 500 peer_port 500 (I) QM_IDLE     
    *Nov 25 17:45:46.939 UTC: ISAKMP:(1001):Sending an IKE IPv4 Packet.
    *Nov 25 17:45:46.939 UTC: ISAKMP:(1001):purging node -777989143
    *Nov 25 17:45:46.943 UTC: ISAKMP:(1001):Input = IKE_MESG_FROM_PEER, IKE_MESG_KEEP_ALIVE
    *Nov 25 17:45:46.943 UTC: ISAKMP:(1001):Old State = IKE_P1_COMPLETE  New State = IKE_P1_COMPLETE
    And here is the config:
    Building configuration...
    Current configuration : 10137 bytes
    version 12.4
    service pad to-xot
    service tcp-keepalives-in
    service tcp-keepalives-out
    service timestamps debug datetime msec show-timezone
    service timestamps log datetime msec show-timezone
    service password-encryption
    hostname Test
    boot-start-marker
    boot-end-marker
    card type t1 0 1
    logging message-counter syslog
    logging buffered 4096
    aaa new-model
    aaa authentication login default local
    aaa authentication ppp network local-case
    aaa authorization console
    aaa authorization exec default local
    aaa session-id common
    clock timezone EST -5
    clock summer-time EDT recurring
    network-clock-participate wic 1
    network-clock-select 1 T1 0/1/0
    dot11 syslog
    no ip source-route
    ip cef
    no ip dhcp use vrf connected
    ip dhcp excluded-address 192.168.121.1 192.168.121.99
    ip dhcp excluded-address 192.168.121.200 192.168.121.254
    ip dhcp excluded-address 192.168.221.1 192.168.221.99
    ip dhcp excluded-address 192.168.221.200 192.168.221.254
    ip dhcp pool Voice
       network 192.168.121.0 255.255.255.0
       option 150 ip 10.101.90.6
       default-router 192.168.121.254
    ip dhcp pool Data
       network 192.168.221.0 255.255.255.0
       default-router 192.168.221.254
       dns-server 10.1.90.189 10.5.100.30
    no ip bootp server
    no ip domain lookup
    ip domain name xxxxxx
    ip multicast-routing
    no ipv6 cef
    multilink bundle-name authenticated
    chat-script cdma "" "ATDT#777" TIMEOUT 60 "CONNECT"
    voice service voip
    allow-connections h323 to h323
    allow-connections h323 to sip
    allow-connections sip to h323
    allow-connections sip to sip
    no supplementary-service sip moved-temporarily
    fax protocol pass-through g711ulaw
    no fax-relay sg3-to-g3
    h323
    modem passthrough nse codec g711ulaw
    sip
      header-passing error-passthru
       outbound-proxy ipv4:xxx.xxx.xxx.xxx
      early-offer forced
      midcall-signaling passthru
    voice class codec 1
    codec preference 1 g711ulaw
    codec preference 2 g729r8
    voice class h323 1
    h225 timeout tcp establish 3
    voice translation-rule 1
    rule 1 // // type any international
    voice translation-rule 3
    rule 1 /^8/ //
    voice translation-profile International
    translate called 1
    voice translation-profile OutboundRedirecting
    translate called 3
    voice-card 0
    no dspfarm
    dsp services dspfarm
    username xx
    archive
    log config
      hidekeys
    crypto isakmp policy 1
    encr 3des
    authentication pre-share
    crypto isakmp key xxxxxxxxx address xxx.xxx.xxx.xxx
    crypto ipsec transform-set CellFOSet esp-3des esp-sha-hmac
    crypto map CellFOMap 1 ipsec-isakmp
    set peer xxx.xxx.xxx.xxx
    set security-association lifetime seconds 190
    set transform-set CellFOSet
    match address 100
    controller T1 0/1/0
    framing esf
    linecode b8zs
    cablelength long 0db
    channel-group 0 timeslots 1-24
    ip tftp source-interface FastEthernet0/0.1
    track 1 ip sla 1 reachability
    class-map match-all VOICE
    match ip dscp ef
    class-map match-any VOICE-CTRL
    match ip dscp af31
    match ip dscp cs3
    policy-map WAN-EDGE
    class VOICE
        priority 384
      set ip dscp ef
    class VOICE-CTRL
      set ip dscp af21
        bandwidth 32
    class class-default
        fair-queue
      set ip dscp default
    interface Loopback0
    ip address 192.168.222.21 255.255.255.255
    h323-gateway voip interface
    h323-gateway voip bind srcaddr 192.168.222.21
    interface FastEthernet0/0
    description Physical Interface for Data VLAN 10 and Voice VLAN 20
    no ip address
    ip flow ingress
    ip pim sparse-dense-mode
    no ip route-cache cef
    duplex auto
    speed auto
    interface FastEthernet0/0.1
    description Interface to Data VLAN 10
    encapsulation dot1Q 10
    ip address 192.168.221.254 255.255.255.0
    no ip redirects
    no ip unreachables
    ip flow ingress
    ip flow egress
    ip pim sparse-dense-mode
    ip virtual-reassembly
    no cdp enable
    interface FastEthernet0/0.2
    description Interface to Voice VLAN 20
    encapsulation dot1Q 20
    ip address 192.168.121.254 255.255.255.0
    no ip redirects
    no ip unreachables
    ip flow ingress
    ip flow egress
    ip pim sparse-dense-mode
    no cdp enable
    interface FastEthernet0/1
    description Unused port
    no ip address
    shutdown
    duplex auto
    speed auto
    no cdp enable
    interface Cellular0/0/0
    ip address negotiated
    ip virtual-reassembly
    encapsulation ppp
    dialer in-band
    dialer string cdma
    dialer-group 1
    async mode interactive
    ppp chap hostname [email protected]
    ppp chap password 7 xxxxxxxxxxxxxxxx
    ppp ipcp dns request
    crypto map CellFOMap
    interface Serial0/1/0:0
    ip address xxx.xxx.xxx.xxx 255.255.255.252
    ip flow ingress
    ip flow egress
    encapsulation ppp
    service-policy output WAN-EDGE
    router bgp 65000
    no synchronization
    bgp log-neighbor-changes
    bgp suppress-inactive
    network xxx.xxx.xxx.xxx mask 255.255.255.252
    network 192.168.121.0
    network 192.168.221.0
    network 192.168.222.21 mask 255.255.255.255
    neighbor xxx.xxx.xxx.xxx remote-as 15270
    default-information originate
    no auto-summary
    ip forward-protocol nd
    ip route 0.0.0.0 0.0.0.0 Serial0/1/0:0 track 1
    ip route 0.0.0.0 0.0.0.0 Cellular0/0/0 20
    no ip http server
    no ip http secure-server
    ip flow-export source FastEthernet0/0.1
    ip flow-export version 5
    ip flow-export destination 10.1.90.25 2055
    ip nat inside source list 100 interface Cellular0/0/0 overload
    ip access-list standard MON_SNMP_RO
    permit xxx.xxx.xxx.xxx
    permit xxx.xxx.xxx.xxx
    permit xxx.xxx.xxx.xxx
    permit xxx.xxx.xxx.xxx
    ip radius source-interface FastEthernet0/0.1
    ip sla 1
    icmp-echo xxx.xxx.xxx.xxx
    timeout 1000
    threshold 2
    frequency 3
    ip sla schedule 1 life forever start-time now
    logging trap notifications
    logging 10.1.90.167
    access-list 100 remark = FO to C0/0/0 for Branch =
    access-list 100 permit ip 192.168.221.0 0.0.0.255 any
    access-list 100 permit ip any any
    access-list 100 deny   eigrp any any
    access-list 100 deny   igmp any any
    dialer-list 1 protocol ip list 100
    snmp-server community xxx RO
    snmp-server enable traps tty
    <----------  Truncated to remove VoIP Rules -------------->
    banner motd ^C
    This is a proprietary system.
    ^C
    line con 0
    line aux 0
    line 0/0/0
    script dialer cdma
    modem InOut
    no exec
    rxspeed 3100000
    txspeed 1800000
    line vty 0 4
    transport input telnet
    line vty 5 15
    transport input telnet
    scheduler allocate 20000 1000
    ntp server 10.1.99.5
    end

    Hi,
    Here is configurations from my Lab ASA5520 with Dual ISP
    interface GigabitEthernet0/0
    description Primary ISP
    nameif WAN-1
    security-level 0
    ip address 192.168.101.2 255.255.255.0
    interface GigabitEthernet0/1
    description Secondary ISP
    nameif WAN-2
    security-level 0
    ip address 192.168.102.2 255.255.255.0
    interface GigabitEthernet0/2
    description LAN
    nameif LAN
    security-level 100
    ip address 10.0.20.2 255.255.255.0
    route WAN-1 0.0.0.0 0.0.0.0 192.168.101.1 1 track 200
    route WAN-2 0.0.0.0 0.0.0.0 192.168.102.1 254
    route LAN 10.0.0.0 255.255.255.0 10.0.20.1 1
    access-list L2L-VPN-CRYPTOMAP remark Encryption Domain
    access-list L2L-VPN-CRYPTOMAP extended permit ip 10.0.0.0 255.255.255.0 10.10.10.0 255.255.255.0
    access-list LAN-NAT0 extended permit ip 10.0.0.0 255.255.255.0 10.10.10.0 255.255.255.0
    nat (LAN) 0 access-list LAN-NAT0
    sla monitor 200
    type echo protocol ipIcmpEcho 192.168.101.1 interface WAN-1
    num-packets 3
    timeout 1000
    frequency 5
    sla monitor schedule 200 life forever start-time now
    track 200 rtr 200 reachability
    crypto ipsec transform-set AES-256 esp-aes-256 esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map CRYPTOMAP 10 match address L2L-VPN-CRYPTOMAP
    crypto map CRYPTOMAP 10 set peer 192.168.103.2
    crypto map CRYPTOMAP 10 set transform-set AES-256
    crypto map CRYPTOMAP interface WAN-1
    crypto map CRYPTOMAP interface WAN-2
    crypto isakmp enable WAN-1
    crypto isakmp enable WAN-2
    crypto isakmp policy 10
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 28800
    tunnel-group 192.168.103.2 type ipsec-l2l
    tunnel-group 192.168.103.2 ipsec-attributes
    pre-shared-key *****
    Hope this helps
    - Jouni

  • Site to Site VPN on Cisco ASA

    Hello,
    I'm trying to set up a site to site VPN. I've never done this before and can't get it to work. I've watched training vids online and thought it looked straight forward enough. My problem appears to be that th ASA is not trying to create a tunnel. It doesn't seem to know that this traffic should be sent over the tunnel. Both the outside interfaces can ping one another and are on the same subnet.
    I've pasted the two configs below. They're just base configs with all the VPN commands having been created by the wizard. I've not put any routes in as the two devices are on the same subnet. If you can see my mistake I'd be very grateful to you if you could point it out or even point me in the right direction.
    Cheers,
    Tormod
    ciscoasa1
    : Saved
    : Written by enable_15 at 05:11:30.489 UTC Wed Jun 19 2013
    ASA Version 8.2(5)13
    hostname ciscoasa1
    enable password 8Ry2YjIyt7RRXU24 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface GigabitEthernet0/0
    nameif outside
    security-level 0
    ip address 1.1.1.1 255.255.255.0
    interface GigabitEthernet0/1
    nameif inside
    security-level 100
    ip address 10.1.1.1 255.255.255.0
    interface GigabitEthernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    shutdown
    no nameif
    no security-level
    no ip address
    ftp mode passive
    access-list outside_1_cryptomap extended permit ip 10.1.1.0 255.255.255.0 10.1.2.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.1.1.0 255.255.255.0 10.1.2.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    nat (inside) 0 access-list inside_nat0_outbound
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 0.0.0.0 0.0.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set pfs group1
    crypto map outside_map 1 set peer 1.1.1.2
    crypto map outside_map 1 set transform-set ESP-3DES-SHA
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 65535
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 inside
    ssh timeout 5
    console timeout 0
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    username cisco password 3USUcOPFUiMCO4Jk encrypted privilege 15
    tunnel-group 1.1.1.2 type ipsec-l2l
    tunnel-group 1.1.1.2 ipsec-attributes
    pre-shared-key ciscocisco
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny 
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip 
      inspect xdmcp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:29e3cdb2d704736b7fbbc477e8418d65
    : end
    ciscoasa2
    : Saved
    : Written by enable_15 at 15:40:31.509 UTC Wed Jun 19 2013
    ASA Version 8.2(5)13
    hostname ciscoasa2
    enable password 8Ry2YjIyt7RRXU24 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
    nameif outside
    security-level 0
    ip address 1.1.1.2 255.255.255.0
    interface Ethernet0/1
    nameif inside
    security-level 100
    ip address 10.1.2.1 255.255.255.0
    interface Ethernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface Ethernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    shutdown
    no nameif
    no security-level
    no ip address
    ftp mode passive
    access-list outside_1_cryptomap extended permit ip 10.1.2.0 255.255.255.0 10.1.1.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.1.2.0 255.255.255.0 10.1.1.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    nat (inside) 0 access-list inside_nat0_outbound
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 0.0.0.0 0.0.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set pfs group1
    crypto map outside_map 1 set peer 1.1.1.1
    crypto map outside_map 1 set transform-set ESP-3DES-SHA
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 65535
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 inside
    ssh timeout 5
    console timeout 0
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    username cisco password 3USUcOPFUiMCO4Jk encrypted privilege 15
    tunnel-group 1.1.1.1 type ipsec-l2l
    tunnel-group 1.1.1.1 ipsec-attributes
    pre-shared-key ciscocisco
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny 
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip 
      inspect xdmcp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:92dca65f5c2cf16486aa7d564732b0e1
    : end

    Thanks very much for your help Jouni. I came in this morning and ran the crypto map outside_map 1 set reverse-route command and everything started to work. I'm surprised the wizard didn't include that command but maybe it's because I didn't have a default route set.
    However, I now have a new problem. We're working towards migrating from ASA8.2 to 9.1. In order to prepare for this I've created a mock of our environment and am testing that everything works prior to making the changes. I can't get this site to site VPN to work. (The one I posted yesterday was just to get a basic site to site VPN working so that I could go from there)
    I've posted the debug from the ASA to which I'm trying to connect. To my undtrained eye it looks like it completes phase one but fails to match a vpn tunnel map. I'm coming from 10.99.99.99 going to 10.1.1.57
    Hope you can help as I'm going nuts here. Although I will of course understand if you've something better to do with your time than bail me out.
    access-list 1111_cryptomap extended permit ip 10.1.1.0 255.255.255.0 Private1 255.255.255.0
    access-list 1111_cryptomap extended permit ip 10.99.99.0 255.255.255.0 10.1.1.0 255.255.255.0
    crypto map vpntunnelmap 1 match address 1111_cryptomap
    crypto map vpntunnelmap 1 set pfs
    crypto map vpntunnelmap 1 set peer 1.1.1.1
    crypto map vpntunnelmap 1 set transform-set ESP-3DES-MD5
    ciscoasa# debug crypto isakmp 255
    IKE Recv RAW packet dump
    db 86 ce 3f 3a a9 e7 0a 00 00 00 00 00 00 00 00    |  ...?:...........
    01 10 02 00 00 00 00 00 00 00 00 f4 0d 00 00 84    |  ................
    00 00 00 01 00 00 00 01 00 00 00 78 01 01 00 03    |  ...........x....
    03 00 00 24 01 01 00 00 80 04 00 02 80 01 00 05    |  ...$............
    80 02 00 02 80 03 00 01 80 0b 00 01 00 0c 00 04    |  ................
    00 00 70 80 03 00 00 28 02 01 00 00 80 04 00 02    |  ..p....(........
    80 01 00 07 80 0e 00 c0 80 02 00 02 80 03 00 01    |  ................
    80 0b 00 01 00 0c 00 04 00 00 70 80 00 00 00 24    |  ..........p....$
    03 01 00 00 80 04 00 02 80 01 00 05 80 02 00 01    |  ................
    80 03 00 01 80 0b 00 01 00 0c 00 04 00 01 51 80    |  ..............Q.
    0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 81 b5    |  ........>.in.c..
    ec 42 7b 1f 0d 00 00 14 7d 94 19 a6 53 10 ca 6f    |  .B{.....}...S..o
    2c 17 9d 92 15 52 9d 56 0d 00 00 14 4a 13 1c 81    |  ,....R.V....J...
    07 03 58 45 5c 57 28 f2 0e 95 45 2f 00 00 00 18    |  ..XE\W(...E/....
    40 48 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 c2 d3    |  @H..n...%.....
    c0 00 00 00                                        |  ....
    RECV PACKET from 1.1.1.2
    ISAKMP Header
      Initiator COOKIE: db 86 ce 3f 3a a9 e7 0a
      Responder COOKIE: 00 00 00 00 00 00 00 00
      Next Payload: Security Association
      Version: 1.0
      Exchange Type: Identity Protection (Main Mode)
      Flags: (none)
      MessageID: 00000000
      Length: 244
      Payload Security Association
        Next Payload: Vendor ID
        Reserved: 00
        Payload Length: 132
        DOI: IPsec
        Situation:(SIT_IDENTITY_ONLY)
        Payload Proposal
          Next Payload: None
          Reserved: 00
          Payload Length: 120
          Proposal #: 1
          Protocol-Id: PROTO_ISAKMP
          SPI Size: 0
          # of transforms: 3
          Payload Transform
            Next Payload: Transform
            Reserved: 00
            Payload Length: 36
            Transform #: 1
            Transform-Id: KEY_IKE
            Reserved2: 0000
            Group Description: Group 2
            Encryption Algorithm: 3DES-CBC
            Hash Algorithm: SHA1
            Authentication Method: Preshared key
            Life Type: seconds
            Life Duration (Hex): 00 00 70 80
          Payload Transform
            Next Payload: Transform
            Reserved: 00
            Payload Length: 40
            Transform #: 2
            Transform-Id: KEY_IKE
            Reserved2: 0000
            Group Description: Group 2
            Encryption Algorithm: AES-CBC
            Key Length: 192
            Hash Algorithm: SHA1
            Authentication Method: Preshared key
            Life Type: seconds
            Life Duration (Hex): 00 00 70 80
          Payload Transform
            Next Payload: None
            Reserved: 00
            Payload Length: 36
            Transform #: 3
            Transform-Id: KEY_IKE
            Reserved2: 0000
            Group Description: Group 2
            Encryption Algorithm: 3DES-CBC
            Hash Algorithm: MD5
            Authentication Method: Preshared key
            Life Type: seconds
            Life Duration (Hex): 00 01 51 80
      Payload Vendor ID
        Next Payload: Vendor ID
        Reserved: 00
        Payload Length: 20
        Data (In Hex):
          90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 7b 1f
      Payload Vendor ID
        Next Payload: Vendor ID
        Reserved: 00
        Payload Length: 20
        Data (In Hex):
          7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56
      Payload Vendor ID
        Next Payload: Vendor ID
        Reserved: 00
        Payload Length: 20
        Data (In Hex):
          4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f
      Payload Vendor ID
        Next Payload: None
        Reserved: 00
        Payload Length: 24
        Data (In Hex):
          40 48 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 c2 d3
          c0 00 00 00
    Jun 20 16:29:42 [IKEv1]: IP = 1.1.1.2, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 244
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing SA payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Oakley proposal is acceptable
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing VID payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Received NAT-Traversal ver 02 VID
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing VID payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Received NAT-Traversal ver 03 VID
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing VID payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Received NAT-Traversal RFC VID
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing VID payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Received Fragmentation VID
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, IKE Peer included IKE fragmentation capability flags:  Main Mode:        True  Aggressive Mode:  True
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing IKE SA payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, IKE SA Proposal # 1, Transform # 1 acceptable  Matches global IKE entry # 1
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, constructing ISAKMP SA payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, constructing Fragmentation VID + extended capabilities payload
    Jun 20 16:29:42 [IKEv1]: IP = 1.1.1.2, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 104
    SENDING PACKET to 1.1.1.2
    ISAKMP Header
      Initiator COOKIE: db 86 ce 3f 3a a9 e7 0a
      Responder COOKIE: 6c 4d 2c ce 68 03 55 58
      Next Payload: Security Association
      Version: 1.0
      Exchange Type: Identity Protection (Main Mode)
      Flags: (none)
      MessageID: 00000000
      Length: 104
      Payload Security Association
        Next Payload: Vendor ID
        Reserved: 00
        Payload Length: 52
        DOI: IPsec
        Situation:(SIT_IDENTITY_ONLY)
        Payload Proposal
          Next Payload: None
          Reserved: 00
          Payload Length: 40
          Proposal #: 1
          Protocol-Id: PROTO_ISAKMP
          SPI Size: 0
          # of transforms: 1
          Payload Transform
            Next Payload: None
            Reserved: 00
            Payload Length: 32
            Transform #: 1
            Transform-Id: KEY_IKE
            Reserved2: 0000
            Encryption Algorithm: 3DES-CBC
            Hash Algorithm: SHA1
            Group Description: Group 2
            Authentication Method: Preshared key
            Life Type: seconds
            Life Duration (Hex): 70 80
      Payload Vendor ID
        Next Payload: None
        Reserved: 00
        Payload Length: 24
        Data (In Hex):
          40 48 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 c2 d3
          c0 00 00 00
    IKE Recv RAW packet dump
    db 86 ce 3f 3a a9 e7 0a 6c 4d 2c ce 68 03 55 58    |  ...?:...lM,.h.UX
    04 10 02 00 00 00 00 00 00 00 01 00 0a 00 00 84    |  ................
    00 c8 2a 4d bf 63 9f 5c d3 b6 e9 fb 1e c9 61 b3    |  ..*M.c.\......a.
    f9 09 19 75 63 23 3f 59 ef c2 57 4b 59 9f 60 53    |  ...uc#?Y..WKY.`S
    0d d2 b5 2b b5 31 e8 75 46 57 ed 5b 4c f3 96 aa    |  ...+.1.uFW.[L...
    a5 c9 4a e7 62 68 e3 55 4c 54 ac 79 73 be ba f0    |  ..J.bh.ULT.ys...
    09 fe d0 5a 3f 9c 9c 2e 90 88 4d db b0 7b 7c f4    |  ...Z?.....M..{|.
    cc b4 07 1a 11 30 5b 2f 4f bd 56 b5 07 a3 9a cb    |  .....0[/O.V.....
    b3 e3 c8 10 20 a5 41 3a f9 fe 1b ed f0 d7 fa 05    |  .... .A:........
    fa df ef 8a 03 e9 4a 1c 09 ad 05 e6 02 f1 0a fa    |  ......J.........
    0d 00 00 18 bc d2 18 cc 37 f5 cb 77 b6 e2 0a 04    |  ........7..w....
    de c9 d3 1a b0 6f ee a8 0d 00 00 14 12 f5 f2 8c    |  .....o..........
    45 71 68 a9 70 2d 9f e2 74 cc 01 00 0d 00 00 0c    |  Eqh.p-..t.......
    09 00 26 89 df d6 b7 12 0d 00 00 14 2e 41 69 22    |  ..&..........Ai"
    3a a8 e7 0a cd 38 ba 43 ed f2 db 2c 00 00 00 14    |  :....8.C...,....
    1f 07 f7 0e aa 65 14 d3 b0 fa 96 54 2a 50 01 00    |  .....e.....T*P..
    RECV PACKET from 1.1.1.2
    ISAKMP Header
      Initiator COOKIE: db 86 ce 3f 3a a9 e7 0a
      Responder COOKIE: 6c 4d 2c ce 68 03 55 58
      Next Payload: Key Exchange
      Version: 1.0
      Exchange Type: Identity Protection (Main Mode)
      Flags: (none)
      MessageID: 00000000
      Length: 256
      Payload Key Exchange
        Next Payload: Nonce
        Reserved: 00
        Payload Length: 132
        Data:
          00 c8 2a 4d bf 63 9f 5c d3 b6 e9 fb 1e c9 61 b3
          f9 09 19 75 63 23 3f 59 ef c2 57 4b 59 9f 60 53
          0d d2 b5 2b b5 31 e8 75 46 57 ed 5b 4c f3 96 aa
          a5 c9 4a e7 62 68 e3 55 4c 54 ac 79 73 be ba f0
          09 fe d0 5a 3f 9c 9c 2e 90 88 4d db b0 7b 7c f4
          cc b4 07 1a 11 30 5b 2f 4f bd 56 b5 07 a3 9a cb
          b3 e3 c8 10 20 a5 41 3a f9 fe 1b ed f0 d7 fa 05
          fa df ef 8a 03 e9 4a 1c 09 ad 05 e6 02 f1 0a fa
      Payload Nonce
        Next Payload: Vendor ID
        Reserved: 00
        Payload Length: 24
        Data:
          bc d2 18 cc 37 f5 cb 77 b6 e2 0a 04 de c9 d3 1a
          b0 6f ee a8
      Payload Vendor ID
        Next Payload: Vendor ID
        Reserved: 00
        Payload Length: 20
        Data (In Hex):
          12 f5 f2 8c 45 71 68 a9 70 2d 9f e2 74 cc 01 00
      Payload Vendor ID
        Next Payload: Vendor ID
        Reserved: 00
        Payload Length: 12
        Data (In Hex): 09 00 26 89 df d6 b7 12
      Payload Vendor ID
        Next Payload: Vendor ID
        Reserved: 00
        Payload Length: 20
        Data (In Hex):
          2e 41 69 22 3a a8 e7 0a cd 38 ba 43 ed f2 db 2c
      Payload Vendor ID
        Next Payload: None
        Reserved: 00
        Payload Length: 20
        Data (In Hex):
          1f 07 f7 0e aa 65 14 d3 b0 fa 96 54 2a 50 01 00
    Jun 20 16:29:42 [IKEv1]: IP = 1.1.1.2, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 256
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing ke payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing ISA_KE payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing nonce payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing VID payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Received Cisco Unity client VID
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing VID payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Received xauth V6 VID
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing VID payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Processing VPN3000/ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing VID payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Received Altiga/Cisco VPN3000/Cisco ASA GW VID
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, constructing ke payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, constructing nonce payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, constructing Cisco Unity VID payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, constructing xauth V6 VID payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Send IOS VID
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Constructing ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, constructing VID payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Send Altiga/Cisco VPN3000/Cisco ASA GW VID
    Jun 20 16:29:42 [IKEv1]: IP = 1.1.1.2, Connection landed on tunnel_group 1.1.1.2
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, Generating keys for Responder...
    Jun 20 16:29:42 [IKEv1]: IP = 1.1.1.2, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 256
    SENDING PACKET to 1.1.1.2
    ISAKMP Header
      Initiator COOKIE: db 86 ce 3f 3a a9 e7 0a
      Responder COOKIE: 6c 4d 2c ce 68 03 55 58
      Next Payload: Key Exchange
      Version: 1.0
      Exchange Type: Identity Protection (Main Mode)
      Flags: (none)
      MessageID: 00000000
      Length: 256
      Payload Key Exchange
        Next Payload: Nonce
        Reserved: 00
        Payload Length: 132
        Data:
          27 62 7f 00 84 06 59 07 28 a1 05 9f 2a 13 ad ff
          47 10 99 27 68 01 2a c8 06 52 b8 55 0c 7d 82 3d
          31 94 0d 68 aa 98 5e 60 ee 2b 37 a5 0f ca 06 5c
          2a f7 83 bb 2e 8b 53 13 49 8b 4e 4c bf d1 34 67
          df ff 50 5b ab e9 f2 12 cb bd c2 0c ab 95 3a 39
          ca 60 31 7a d4 80 80 b6 0c 85 3e f5 16 fb f5 f8
          27 5d 28 b9 b1 2e b3 35 79 1a 9e f7 fd 13 8f f4
          5f 5d 53 93 74 6d d1 60 97 ca d2 bc b3 b4 e6 03
      Payload Nonce
        Next Payload: Vendor ID
        Reserved: 00
        Payload Length: 24
        Data:
          a7 f8 48 c1 98 b4 cb 02 79 de ae 6e 59 3d 23 cb
          4c a1 7b 44
      Payload Vendor ID
        Next Payload: Vendor ID
        Reserved: 00
        Payload Length: 20
        Data (In Hex):
          12 f5 f2 8c 45 71 68 a9 70 2d 9f e2 74 cc 01 00
      Payload Vendor ID
        Next Payload: Vendor ID
        Reserved: 00
        Payload Length: 12
        Data (In Hex): 09 00 26 89 df d6 b7 12
      Payload Vendor ID
        Next Payload: Vendor ID
        Reserved: 00
        Payload Length: 20
        Data (In Hex):
          99 8a 8b d3 68 02 55 58 44 16 79 1c 51 be 23 8f
      Payload Vendor ID
        Next Payload: None
        Reserved: 00
        Payload Length: 20
        Data (In Hex):
          1f 07 f7 0e aa 65 14 d3 b0 fa 96 54 2a 50 01 00
    IKE Recv RAW packet dump
    db 86 ce 3f 3a a9 e7 0a 6c 4d 2c ce 68 03 55 58    |  ...?:...lM,.h.UX
    05 10 02 01 00 00 00 00 00 00 00 64 8f a8 6e 03    |  ...........d..n.
    81 b9 24 e5 f0 ba ca 1a 0f fa 5a a1 3c 2d 61 1a    |  ..$.......Z.<-a.
    7d 48 b0 0c 7f 09 bc 82 9b b1 25 b4 f6 04 45 a0    |  }H......%...E.
    13 12 27 ff 7a 41 9f e9 8e 96 c2 80 b9 59 b0 ec    |  ..'.zA.......Y..
    40 e3 95 4d 96 ef eb ce e2 fb d9 45 83 50 0d e7    |  @..M.......E.P..
    9c c7 70 7f                                        |  ..
    RECV PACKET from 1.1.1.2
    ISAKMP Header
      Initiator COOKIE: db 86 ce 3f 3a a9 e7 0a
      Responder COOKIE: 6c 4d 2c ce 68 03 55 58
      Next Payload: Identification
      Version: 1.0
      Exchange Type: Identity Protection (Main Mode)
      Flags: (Encryption)
      MessageID: 00000000
      Length: 100
    AFTER DECRYPTION
    ISAKMP Header
      Initiator COOKIE: db 86 ce 3f 3a a9 e7 0a
      Responder COOKIE: 6c 4d 2c ce 68 03 55 58
      Next Payload: Identification
      Version: 1.0
      Exchange Type: Identity Protection (Main Mode)
      Flags: (Encryption)
      MessageID: 00000000
      Length: 100
      Payload Identification
        Next Payload: Hash
        Reserved: 00
        Payload Length: 12
        ID Type: IPv4 Address (1)
        Protocol ID (UDP/TCP, etc...): 17
        Port: 500
        ID Data: 1.1.1.2
      Payload Hash
        Next Payload: IOS Proprietary Keepalive or CHRE
        Reserved: 00
        Payload Length: 24
        Data:
          f4 40 eb 6b 55 f0 19 cd 10 81 e6 53 cf 23 75 c5
          45 ab 7f 3d
      Payload IOS Proprietary Keepalive or CHRE
        Next Payload: Vendor ID
        Reserved: 00
        Payload Length: 12
        Default Interval: 32767
        Retry Interval: 32767
      Payload Vendor ID
        Next Payload: None
        Reserved: 00
        Payload Length: 20
        Data (In Hex):
          af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00
    Jun 20 16:29:42 [IKEv1]: IP = 1.1.1.2, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + IOS KEEPALIVE (128) + VENDOR (13) + NONE (0) total length : 96
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing ID payload
    Jun 20 16:29:42 [IKEv1 DECODE]: Group = 1.1.1.2, IP = 1.1.1.2, ID_IPV4_ADDR ID received
    1.1.1.2
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing hash payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, Computing hash for ISAKMP
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Processing IOS keep alive payload: proposal=32767/32767 sec.
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing VID payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, Received DPD VID
    Jun 20 16:29:42 [IKEv1]: IP = 1.1.1.2, Connection landed on tunnel_group 1.1.1.2
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, constructing ID payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, constructing hash payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, Computing hash for ISAKMP
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Constructing IOS keep alive payload: proposal=32767/32767 sec.
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, constructing dpd vid payload
    Jun 20 16:29:42 [IKEv1]: IP = 1.1.1.2, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + IOS KEEPALIVE (128) + VENDOR (13) + NONE (0) total length : 96
    BEFORE ENCRYPTION
    RAW PACKET DUMP on SEND
    db 86 ce 3f 3a a9 e7 0a 6c 4d 2c ce 68 03 55 58    |  ...?:...lM,.h.UX
    05 10 02 00 00 00 00 00 1c 00 00 00 08 00 00 0c    |  ................
    01 11 01 f4 c2 9f 09 02 80 00 00 18 58 00 80 06    |  ............X...
    e9 66 ba 20 1e ba 79 c8 16 85 2d 2f a0 96 b4 e5    |  .f. ..y...-/....
    0d 00 00 0c 80 00 7f ff 80 00 7f ff 00 00 00 14    |  ............
    af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00    |  ....h...k...wW..
    ISAKMP Header
      Initiator COOKIE: db 86 ce 3f 3a a9 e7 0a
      Responder COOKIE: 6c 4d 2c ce 68 03 55 58
      Next Payload: Identification
      Version: 1.0
      Exchange Type: Identity Protection (Main Mode)
      Flags: (none)
      MessageID: 00000000
      Length: 469762048
      Payload Identification
        Next Payload: Hash
        Reserved: 00
        Payload Length: 12
        ID Type: IPv4 Address (1)
        Protocol ID (UDP/TCP, etc...): 17
        Port: 500
        ID Data: 1.1.1.1
      Payload Hash
        Next Payload: IOS Proprietary Keepalive or CHRE
        Reserved: 00
        Payload Length: 24
        Data:
          58 00 80 06 e9 66 ba 20 1e ba 79 c8 16 85 2d 2f
          a0 96 b4 e5
      Payload IOS Proprietary Keepalive or CHRE
        Next Payload: Vendor ID
        Reserved: 00
        Payload Length: 12
        Default Interval: 32767
        Retry Interval: 32767
      Payload Vendor ID
        Next Payload: None
        Reserved: 00
        Payload Length: 20
        Data (In Hex):
          af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00
    SENDING PACKET to 1.1.1.2
    ISAKMP Header
      Initiator COOKIE: db 86 ce 3f 3a a9 e7 0a
      Responder COOKIE: 6c 4d 2c ce 68 03 55 58
      Next Payload: Identification
      Version: 1.0
      Exchange Type: Identity Protection (Main Mode)
      Flags: (Encryption)
      MessageID: 00000000
      Length: 100
    Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, PHASE 1 COMPLETED
    Jun 20 16:29:42 [IKEv1]: IP = 1.1.1.2, Keep-alive type for this connection: DPD
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, Starting P1 rekey timer: 27360 seconds.
    IKE Recv RAW packet dump
    db 86 ce 3f 3a a9 e7 0a 6c 4d 2c ce 68 03 55 58    |  ...?:...lM,.h.UX
    08 10 20 01 56 e5 a4 1e 00 00 01 4c d2 44 3e 24    |  .. .V......L.D>$
    87 96 a1 fe d1 a3 d3 a3 ed 59 45 2d 53 be 17 9f    |  .........YE-S...
    42 72 2b a3 5f f8 5e 41 5a 62 25 0c 5d bf 6c 2a    |  Br+._.^AZb%.].l*
    e6 e0 1f 77 d5 ed c8 1c 06 cb ef f2 58 07 1d 35    |  ...w........X..5
    a9 d5 7b 86 24 05 88 32 e7 33 6f f2 f7 9d 70 07    |  ..{.$..2.3o...p.
    18 40 51 77 7d 7e 6c 77 55 d9 18 7a 57 5d b9 88    |  .@Qw}~lwU..zW]..
    6c a6 d5 f3 60 5e 14 4f da cb 42 65 88 d6 75 0e    |  l...`^.O..Be..u.
    22 1c bb 89 1f 57 bd c2 f2 46 30 31 30 9c 63 e6    |  "....W...F010.c.
    e2 e9 5b 68 71 f2 ed 69 f1 eb a7 65 2d b2 31 85    |  ..[hq..i...e-.1.
    31 93 0a c1 21 44 57 de ad 8b 79 5e 3d 36 5c 44    |  1...!DW...y^=6\D
    88 23 a8 44 76 2c d6 c2 ed 31 2d 69 b1 50 26 9f    |  .#.Dv,...1-i.P&.
    ee 48 3e c4 dd 0d 40 8f 65 d2 fb 82 19 42 b7 0f    |  .H>[email protected]..
    a0 74 b3 e6 df dd 16 c4 fa ca bf d2 b6 33 b0 5f    |  .t...........3._
    d6 59 4f 6a 84 9e 0d 76 a4 d6 d3 94 67 bc 9c df    |  .YOj...v....g...
    33 20 48 61 d7 80 b6 97 0d a9 32 48 7d 5b 79 8b    |  3 Ha......2H}[y.
    7b bc e0 9b b4 5d ed 49 04 6b 5d 72 d7 5b 82 90    |  {....].I.k]r.[..
    47 e5 65 64 a9 25 ce 2f 3f a2 ca 98 b1 0b ff 01    |  G.ed.%./?.......
    9c 32 64 5c dd 9c 26 71 c4 59 cd 52 da 1f b9 23    |  .2d\..&q.Y.R...#
    32 dd d8 a5 d1 1c 2a d0 0f ef 2b 26 66 c0 14 48    |  2.....*...+&f..H
    52 35 3a ee 36 a6 00 df a5 d6 6b 42                |  R5:.6.....kB
    RECV PACKET from 1.1.1.2
    ISAKMP Header
      Initiator COOKIE: db 86 ce 3f 3a a9 e7 0a
      Responder COOKIE: 6c 4d 2c ce 68 03 55 58
      Next Payload: Hash
      Version: 1.0
      Exchange Type: Quick Mode
      Flags: (Encryption)
      MessageID: 56E5A41E
      Length: 332
    Jun 20 16:29:42 [IKEv1 DECODE]: IP = 1.1.1.2, IKE Responder starting QM: msg id = 56e5a41e
    AFTER DECRYPTION
    ISAKMP Header
      Initiator COOKIE: db 86 ce 3f 3a a9 e7 0a
      Responder COOKIE: 6c 4d 2c ce 68 03 55 58
      Next Payload: Hash
      Version: 1.0
      Exchange Type: Quick Mode
      Flags: (Encryption)
      MessageID: 56E5A41E
      Length: 332
      Payload Hash
        Next Payload: Security Association
        Reserved: 00
        Payload Length: 24
        Data:
          78 09 81 d2 54 22 37 a1 b0 a8 53 cf df d4 1e fb
          4a 7b 99 f7
      Payload Security Association
        Next Payload: Nonce
        Reserved: 00
        Payload Length: 64
        DOI: IPsec
        Situation:(SIT_IDENTITY_ONLY)
        Payload Proposal
          Next Payload: None
          Reserved: 00
          Payload Length: 52
          Proposal #: 1
          Protocol-Id: PROTO_IPSEC_ESP
          SPI Size: 4
          # of transforms: 1
          SPI: b2 c1 66 6e
          Payload Transform
            Next Payload: None
            Reserved: 00
            Payload Length: 40
            Transform #: 1
            Transform-Id: ESP_3DES
            Reserved2: 0000
            Life Type: Seconds
            Life Duration (Hex): 70 80
            Life Type: Kilobytes
            Life Duration (Hex): 00 46 50 00
            Encapsulation Mode: Tunnel
            Authentication Algorithm: MD5
            Group Description: Group 2
      Payload Nonce
        Next Payload: Key Exchange
        Reserved: 00
        Payload Length: 24
        Data:
          1e 43 34 fa cc 9f 77 65 45 7c b6 18 2f 18 fd a9
          86 e6 58 42
      Payload Key Exchange
        Next Payload: Identification
        Reserved: 00
        Payload Length: 132
        Data:
          3c 26 4c 94 68 33 4b 2d ce 37 4a d2 8c 62 ab 6b
          e6 d4 d2 8a df 70 bc 67 62 ca 96 8c 3b 30 cd 58
          54 55 71 0f 9e bc da 63 a9 68 86 fd ba 7a 13 f3
          e9 51 e9 a4 13 b0 b0 20 45 cf 1f 36 1e 95 95 c9
          dd 92 c9 cd 2b 33 2d 4b 7e bd ed d4 ec bf 54 b9
          6e 13 7f 17 dc 28 61 5d 46 fe 1d ba 88 e5 ca 70
          40 59 12 c1 0c 3a 51 7f ae 5f e2 95 73 bc c9 16
          67 ce 38 82 e7 b3 1b 6a 39 05 46 71 b8 da c3 57
      Payload Identification
        Next Payload: Identification
        Reserved: 00
        Payload Length: 16
        ID Type: IPv4 Subnet (4)
        Protocol ID (UDP/TCP, etc...): 0
        Port: 0
        ID Data: 10.99.99.0/255.255.255.0
      Payload Identification
        Next Payload: Notification
        Reserved: 00
        Payload Length: 16
        ID Type: IPv4 Subnet (4)
        Protocol ID (UDP/TCP, etc...): 0
        Port: 0
        ID Data: 10.1.1.0/255.255.255.0
      Payload Notification
        Next Payload: None
        Reserved: 00
        Payload Length: 28
        DOI: IPsec
        Protocol-ID: PROTO_ISAKMP
        Spi Size: 16
        Notify Type: STATUS_INITIAL_CONTACT
        SPI:
          db 86 ce 3f 3a a9 e7 0a 6c 4d 2c ce 68 03 55 58
    Jun 20 16:29:42 [IKEv1]: IP = 1.1.1.2, IKE_DECODE RECEIVED Message (msgid=56e5a41e) with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + KE (4) + ID (5) + ID (5) + NOTIFY (11) + NONE (0) total length : 332
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing hash payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing SA payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing nonce payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing ke payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing ISA_KE for PFS in phase 2
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing ID payload
    Jun 20 16:29:42 [IKEv1 DECODE]: Group = 1.1.1.2, IP = 1.1.1.2, ID_IPV4_ADDR_SUBNET ID received--10.99.99.0--255.255.255.0
    Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Received remote IP Proxy Subnet data in ID Payload:   Address 10.99.99.0, Mask 255.255.255.0, Protocol 0, Port 0
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing ID payload
    Jun 20 16:29:42 [IKEv1 DECODE]: Group = 1.1.1.2, IP = 1.1.1.2, ID_IPV4_ADDR_SUBNET ID received--10.1.1.0--255.255.255.0
    Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Received local IP Proxy Subnet data in ID Payload:   Address 10.1.1.0, Mask 255.255.255.0, Protocol 0, Port 0
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing notify payload
    Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, QM IsRekeyed old sa not found by addr
    Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, checking map = vpntunnelmap, seq = 1...
    Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, map = vpntunnelmap, seq = 1, ACL does not match proxy IDs src:10.99.99.0 dst:10.1.1.0
    Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, checking map = vpntunnelmap, seq = 2...
    Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, map = vpntunnelmap, seq = 2, ACL does not match proxy IDs src:10.99.99.0 dst:10.1.1.0
    Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, checking map = vpntunnelmap, seq = 3...
    Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, map = vpntunnelmap, seq = 3, ACL does not match proxy IDs src:10.99.99.0 dst:10.1.1.0
    Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, checking map = vpntunnelmap, seq = 35...
    Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, map = vpntunnelmap, seq = 35, ACL does not match proxy IDs src:10.99.99.0 dst:10.1.1.0
    Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, checking map = vpntunnelmap, seq = 40...
    Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, map = vpntunnelmap, seq = 40, ACL does not match proxy IDs src:10.99.99.0 dst:10.1.1.0
    Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, checking map = vpntunnelmap, seq = 41...
    Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, map = vpntunnelmap, seq = 41, ACL does not match proxy IDs src:10.99.99.0 dst:10.1.1.0
    Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Rejecting IPSec tunnel: no matching crypto map entry for remote proxy 10.99.99.0/255.255.255.0/0/0 local proxy 10.1.1.0/255.255.255.0/0/0 on interface thus
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, sending notify message
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, constructing blank hash payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, constructing qm hash payload
    Jun 20 16:29:42 [IKEv1]: IP = 1.1.1.2, IKE_DECODE SENDING Message (msgid=7ecccf15) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 384
    BEFORE ENCRYPTION
    RAW PACKET DUMP on SEND
    db 86 ce 3f 3a a9 e7 0a 6c 4d 2c ce 68 03 55
    IKE Recv RAW packet dump

  • Remote Access VPN with existing site-to-site tunnel

    Hi there!
    I have successfully configured my Cisco router to create a VPN tunnel to Azure. This is working fine. Now I am trying to add a remote access VPN for clients. I want to use IPsec and not PPTP.
    I'm not a networking guy, but from what I've read, you basically need to add a dynamic crypto map for the remote access VPN to the crypto map on the external interface (AzureCryptoMap in this case). I've read that the dynamic crypto map should be applied after the non-dynamic maps.
    The problem is that the VPN clients do not successfully negotiate phase 1. It's almost like the router does not try the dynamic map. I have tried specifying it to come ahead of the static crypto map policy, but this doesn't change anything. Here is some output from the debugging ipsec and isakmp:
    murasaki#
    *Oct 6 08:06:43: ISAKMP (0): received packet from 1.158.149.255 dport 500 sport 500 Global (N) NEW SA
    *Oct 6 08:06:43: ISAKMP: Created a peer struct for 1.158.149.255, peer port 500
    *Oct 6 08:06:43: ISAKMP: New peer created peer = 0x87B97490 peer_handle = 0x80000082
    *Oct 6 08:06:43: ISAKMP: Locking peer struct 0x87B97490, refcount 1 for crypto_isakmp_process_block
    *Oct 6 08:06:43: ISAKMP: local port 500, remote port 500
    *Oct 6 08:06:43: ISAKMP:(0):insert sa successfully sa = 886954D0
    *Oct 6 08:06:43: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    *Oct 6 08:06:43: ISAKMP:(0):Old State = IKE_READY New State = IKE_R_MM1
    *Oct 6 08:06:43: ISAKMP:(0): processing SA payload. message ID = 0
    *Oct 6 08:06:43: ISAKMP:(0): processing vendor id payload
    *Oct 6 08:06:43: ISAKMP:(0): vendor ID seems Unity/DPD but major 69 mismatch
    *Oct 6 08:06:43: ISAKMP (0): vendor ID is NAT-T RFC 3947
    *Oct 6 08:06:43: ISAKMP:(0): processing vendor id payload
    *Oct 6 08:06:43: ISAKMP:(0): vendor ID seems Unity/DPD but major 198 mismatch
    *Oct 6 08:06:43: ISAKMP:(0): processing vendor id payload
    *Oct 6 08:06:43: ISAKMP:(0): vendor ID seems Unity/DPD but major 29 mismatch
    *Oct 6 08:06:43: ISAKMP:(0): processing vendor id payload
    *Oct 6 08:06:43: ISAKMP:(0): vendor ID seems Unity/DPD but major 245 mismatch
    *Oct 6 08:06:43: ISAKMP (0): vendor ID is NAT-T v7
    *Oct 6 08:06:43: ISAKMP:(0): processing vendor id payload
    *Oct 6 08:06:43: ISAKMP:(0): vendor ID seems Unity/DPD but major 114 mismatch
    *Oct 6 08:06:43: ISAKMP:(0): processing vendor id payload
    *Oct 6 08:06:43: ISAKMP:(0): vendor ID seems Unity/DPD but major 227 mismatch
    *Oct 6 08:06:43: ISAKMP:(0): processing vendor id payload
    *Oct 6 08:06:43: ISAKMP:(0): vendor ID seems Unity/DPD but major 250 mismatch
    *Oct 6 08:06:43: ISAKMP:(0): processing vendor id payload
    *Oct 6 08:06:43: ISAKMP:(0): vendor ID seems Unity/DPD but major 157 mismatch
    *Oct 6 08:06:43: ISAKMP:(0): vendor ID is NAT-T v3
    *Oct 6 08:06:43: ISAKMP:(0): processing vendor id payload
    *Oct 6 08:06:43: ISAKMP:(0): vendor ID seems Unity/DPD but major 164 mismatch
    *Oct 6 08:06:43: ISAKMP:(0): processing vendor id payload
    *Oct 6 08:06:43: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch
    *Oct 6 08:06:43: ISAKMP:(0): vendor ID is NAT-T v2
    *Oct 6 08:06:43: ISAKMP:(0): processing vendor id payload
    *Oct 6 08:06:43: ISAKMP:(0): vendor ID seems Unity/DPD but major 242 mismatch
    *Oct 6 08:06:43: ISAKMP:(0): vendor ID is XAUTH
    *Oct 6 08:06:43: ISAKMP:(0): processing vendor id payload
    *Oct 6 08:06:43: ISAKMP:(0): vendor ID is Unity
    *Oct 6 08:06:43: ISAKMP:(0): processing vendor id payload
    *Oct 6 08:06:43: ISAKMP:(0): processing IKE frag vendor id payload
    *Oct 6 08:06:43: ISAKMP:(0):Support for IKE Fragmentation not enabled
    *Oct 6 08:06:43: ISAKMP:(0): processing vendor id payload
    *Oct 6 08:06:43: ISAKMP:(0): vendor ID is DPD
    *Oct 6 08:06:43: ISAKMP:(0):No pre-shared key with 1.158.149.255!
    *Oct 6 08:06:43: ISAKMP : Scanning profiles for xauth ... Client-VPN
    *Oct 6 08:06:43: ISAKMP:(0): Authentication by xauth preshared
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 1 against priority 1 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption AES-CBC
    *Oct 6 08:06:43: ISAKMP: keylength of 256
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash SHA
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 2 against priority 1 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption AES-CBC
    *Oct 6 08:06:43: ISAKMP: keylength of 128
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash SHA
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 3 against priority 1 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption AES-CBC
    *Oct 6 08:06:43: ISAKMP: keylength of 256
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash MD5
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 4 against priority 1 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption AES-CBC
    *Oct 6 08:06:43: ISAKMP: keylength of 128
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash MD5
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 5 against priority 1 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption 3DES-CBC
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash SHA
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Xauth authentication by pre-shared key offered but does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 6 against priority 1 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption 3DES-CBC
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash MD5
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Hash algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 7 against priority 1 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption DES-CBC
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash SHA
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 8 against priority 1 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption DES-CBC
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash MD5
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 0
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 1 against priority 2 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption AES-CBC
    *Oct 6 08:06:43: ISAKMP: keylength of 256
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash SHA
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 2 against priority 2 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption AES-CBC
    *Oct 6 08:06:43: ISAKMP: keylength of 128
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash SHA
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 3 against priority 2 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption AES-CBC
    *Oct 6 08:06:43: ISAKMP: keylength of 256
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash MD5
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 4 against priority 2 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption AES-CBC
    *Oct 6 08:06:43: ISAKMP: keylength of 128
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash MD5
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 5 against priority 2 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption 3DES-CBC
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash SHA
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Hash algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 6 against priority 2 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption 3DES-CBC
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash MD5
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Xauth authentication by pre-shared key offered but does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 7 against priority 2 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption DES-CBC
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash SHA
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 8 against priority 2 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption DES-CBC
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash MD5
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 0
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 1 against priority 10 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption AES-CBC
    *Oct 6 08:06:43: ISAKMP: keylength of 256
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash SHA
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Xauth authentication by pre-shared key offered but does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 2 against priority 10 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption AES-CBC
    *Oct 6 08:06:43: ISAKMP: keylength of 128
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash SHA
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Proposed key length does not match policy
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 3 against priority 10 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption AES-CBC
    *Oct 6 08:06:43: ISAKMP: keylength of 256
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash MD5
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Hash algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 4 against priority 10 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption AES-CBC
    *Oct 6 08:06:43: ISAKMP: keylength of 128
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash MD5
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Hash algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 5 against priority 10 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption 3DES-CBC
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash SHA
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 6 against priority 10 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption 3DES-CBC
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash MD5
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 7 against priority 10 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption DES-CBC
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash SHA
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct 6 08:06:43: ISAKMP:(0):Checking ISAKMP transform 8 against priority 10 policy
    *Oct 6 08:06:43: ISAKMP: life type in seconds
    *Oct 6 08:06:43: ISAKMP: life duration (basic) of 3600
    *Oct 6 08:06:43: ISAKMP: encryption DES-CBC
    *Oct 6 08:06:43: ISAKMP: auth XAUTHInitPreShared
    *Oct 6 08:06:43: ISAKMP: hash MD5
    *Oct 6 08:06:43: ISAKMP: default group 2
    *Oct 6 08:06:43: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct 6 08:06:43: ISAKMP:(0):atts are not acceptable. Next payload is 0
    *Oct 6 08:06:43: ISAKMP:(0):no offers accepted!
    *Oct 6 08:06:43: ISAKMP:(0): phase 1 SA policy not acceptable! (local x.x.x.x remote 1.158.149.255)
    *Oct 6 08:06:43: ISAKMP (0): incrementing error counter on sa, attempt 1 of 5: construct_fail_ag_init
    *Oct 6 08:06:43: ISAKMP:(0): Failed to construct AG informational message.
    *Oct 6 08:06:43: ISAKMP:(0): sending packet to 1.158.149.255 my_port 500 peer_port 500 (R) MM_NO_STATE
    *Oct 6 08:06:43: ISAKMP:(0):Sending an IKE IPv4 Packet.
    *Oct 6 08:06:43: ISAKMP:(0):peer does not do paranoid keepalives.
    *Oct 6 08:06:43: ISAKMP:(0):deleting SA reason "Phase1 SA policy proposal not accepted" state (R) MM_NO_STATE (peer 1.158.149.255)
    *Oct 6 08:06:43: ISAKMP (0): FSM action returned error: 2
    *Oct 6 08:06:43: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    *Oct 6 08:06:43: ISAKMP:(0):Old State = IKE_R_MM1 New State = IKE_R_MM1
    *Oct 6 08:06:43: ISAKMP:(0):deleting SA reason "Phase1 SA policy proposal not accepted" state (R) MM_NO_STATE (peer 1.158.149.255)
    *Oct 6 08:06:43: ISAKMP: Unlocking peer struct 0x87B97490 for isadb_mark_sa_deleted(), count 0
    *Oct 6 08:06:43: ISAKMP: Deleting peer node by peer_reap for 1.158.149.255: 87B97490
    *Oct 6 08:06:43: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
    *Oct 6 08:06:43: ISAKMP:(0):Old State = IKE_R_MM1 New State = IKE_DEST_SA
    *Oct 6 08:06:43: IPSEC(key_engine): got a queue event with 1 KMI message(s)
    *Oct 6 08:06:47: ISAKMP (0): received packet from 1.158.149.255 dport 500 sport 500 Global (R) MM_NO_STATEmurasaki#
    *Oct 6 08:06:43: ISAKMP (0): received packet from 1.158.149.255 dport 500 sport 500 Global (N) NEW SA
    *Oct 6 08:06:43: ISAKMP: Created a peer struct for 1.158.149.255, peer port 500
    *Oct 6 08:06:43: ISAKMP: New peer created peer = 0x87B97490 peer_handle = 0x80000082
    *Oct 6 08:06:43: ISAKMP: Locking peer struct 0x87B97490, refcount 1 for crypto_isakmp_process_block
    *Oct 6 08:06:43: ISAKMP: local port 500, remote port 500
    *Oct 6 08:06:43: ISAKMP:(0):insert sa successfully sa = 886954D0
    *Oct 6 08:06:43: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    *Oct 6 08:06:43: ISAKMP:(0):Old State = IKE_READY New State = IKE_R_MM1
    If I specify my key like a site-to-site VPN key like this:
    crypto isakmp key xxx address 0.0.0.0
    Then it does complete phase 1 (and then fails to find the client configuration). This suggests to me that the dynamic map is not being tried.
    Configuration:
    ! Last configuration change at 07:55:02 AEDT Mon Oct 6 2014 by timothy
    version 15.2
    no service pad
    service timestamps debug datetime localtime
    service timestamps log datetime localtime
    service password-encryption
    no service dhcp
    hostname murasaki
    boot-start-marker
    boot-end-marker
    logging buffered 51200 warnings
    aaa new-model
    aaa authentication login client_vpn_authentication local
    aaa authorization network default local
    aaa authorization network client_vpn_authorization local
    aaa session-id common
    wan mode dsl
    clock timezone AEST 10 0
    clock summer-time AEDT recurring 1 Sun Oct 2:00 1 Sun Apr 3:00
    ip inspect name normal_traffic tcp
    ip inspect name normal_traffic udp
    ip domain name router.xxx
    ip name-server xxx
    ip name-server xxx
    ip cef
    ipv6 unicast-routing
    ipv6 cef
    crypto pki trustpoint TP-self-signed-591984024
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-591984024
    revocation-check none
    rsakeypair TP-self-signed-591984024
    crypto pki trustpoint TP-self-signed-4045734018
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-4045734018
    revocation-check none
    rsakeypair TP-self-signed-4045734018
    crypto pki certificate chain TP-self-signed-591984024
    crypto pki certificate chain TP-self-signed-4045734018
    object-group network CLOUD_SUBNETS
    description Azure subnet
    172.16.0.0 255.252.0.0
    object-group network INTERNAL_LAN
    description All Internal subnets which should be allowed out to the Internet
    192.168.1.0 255.255.255.0
    192.168.20.0 255.255.255.0
    username timothy privilege 15 secret 5 xxx
    controller VDSL 0
    ip ssh version 2
    no crypto isakmp default policy
    crypto isakmp policy 1
    encr 3des
    authentication pre-share
    group 2
    lifetime 3600
    crypto isakmp policy 2
    encr 3des
    hash md5
    authentication pre-share
    group 2
    lifetime 3600
    crypto isakmp policy 10
    encr aes 256
    authentication pre-share
    group 2
    lifetime 28800
    crypto isakmp key xxx address xxxx no-xauth
    crypto isakmp client configuration group VPN_CLIENTS
    key xxx
    dns 192.168.1.24 192.168.1.20
    domain xxx
    pool Client-VPN-Pool
    acl CLIENT_VPN
    crypto isakmp profile Client-VPN
    description Remote Client IPSec VPN
    match identity group VPN_CLIENTS
    client authentication list client_vpn_authentication
    isakmp authorization list client_vpn_authorization
    client configuration address respond
    crypto ipsec transform-set AzureIPSec esp-aes 256 esp-sha-hmac
    mode tunnel
    crypto ipsec transform-set TRANS_3DES_SHA esp-3des esp-sha-hmac
    mode tunnel
    crypto dynamic-map ClientVPNCryptoMap 1
    set transform-set TRANS_3DES_SHA
    set isakmp-profile Client-VPN
    reverse-route
    qos pre-classify
    crypto map AzureCryptoMap 12 ipsec-isakmp
    set peer xxxx
    set security-association lifetime kilobytes 102400000
    set transform-set AzureIPSec
    match address AzureEastUS
    crypto map AzureCryptoMap 65535 ipsec-isakmp dynamic ClientVPNCryptoMap
    bridge irb
    interface ATM0
    mtu 1492
    no ip address
    no atm ilmi-keepalive
    pvc 8/35
    encapsulation aal5mux ppp dialer
    dialer pool-member 1
    interface Ethernet0
    no ip address
    shutdown
    interface FastEthernet0
    switchport mode trunk
    no ip address
    interface FastEthernet1
    no ip address
    spanning-tree portfast
    interface FastEthernet2
    switchport mode trunk
    no ip address
    spanning-tree portfast
    interface FastEthernet3
    no ip address
    interface GigabitEthernet0
    switchport mode trunk
    no ip address
    interface GigabitEthernet1
    no ip address
    shutdown
    duplex auto
    speed auto
    interface Vlan1
    description Main LAN
    ip address 192.168.1.97 255.255.255.0
    ip nat inside
    ip virtual-reassembly in
    ip tcp adjust-mss 1452
    interface Dialer1
    mtu 1492
    ip address negotiated
    ip access-group PORTS_ALLOWED_IN in
    ip flow ingress
    ip inspect normal_traffic out
    ip nat outside
    ip virtual-reassembly in
    encapsulation ppp
    ip tcp adjust-mss 1350
    dialer pool 1
    dialer-group 1
    ipv6 address autoconfig
    ipv6 enable
    ppp chap hostname xxx
    ppp chap password 7 xxx
    ppp ipcp route default
    no cdp enable
    crypto map AzureCryptoMap
    ip local pool Client-VPN-Pool 192.168.20.10 192.168.20.15
    no ip forward-protocol nd
    no ip http server
    no ip http secure-server
    ip nat translation timeout 360
    ip nat inside source list SUBNETS_AND_PROTOCOLS_ALLOWED_OUT interface Dialer1 overload
    ip nat inside source static tcp 192.168.1.43 55663 interface Dialer1 55663
    ip nat inside source static tcp 192.168.1.43 22 interface Dialer1 22
    ip nat inside source static udp 192.168.1.43 55663 interface Dialer1 55663
    ip access-list extended AzureEastUS
    permit ip 192.168.20.0 0.0.0.255 172.16.0.0 0.15.255.255
    permit ip 192.168.1.0 0.0.0.255 172.16.0.0 0.15.255.255
    ip access-list extended CLIENT_VPN
    permit ip 172.16.0.0 0.0.0.255 192.168.20.0 0.0.0.255
    permit ip 192.168.1.0 0.0.0.255 192.168.20.0 0.0.0.255
    ip access-list extended PORTS_ALLOWED_IN
    remark List of ports which are allowed IN
    permit gre any any
    permit esp any any
    permit udp any any eq non500-isakmp
    permit udp any any eq isakmp
    permit tcp any any eq 55663
    permit udp any any eq 55663
    permit tcp any any eq 22
    permit tcp any any eq 5723
    permit tcp any any eq 1723
    permit tcp any any eq 443
    permit icmp any any echo-reply
    permit icmp any any traceroute
    permit icmp any any port-unreachable
    permit icmp any any time-exceeded
    deny ip any any
    ip access-list extended SUBNETS_AND_PROTOCOLS_ALLOWED_OUT
    deny tcp object-group INTERNAL_LAN any eq smtp
    deny ip object-group INTERNAL_LAN object-group CLOUD_SUBNETS
    permit tcp object-group INTERNAL_LAN any
    permit udp object-group INTERNAL_LAN any
    permit icmp object-group INTERNAL_LAN any
    deny ip any any
    mac-address-table aging-time 16
    no cdp run
    ipv6 route ::/0 Dialer1
    route-map NoNAT permit 10
    match ip address AzureEastUS CLIENT_VPN
    route-map NoNAT permit 15
    banner motd Welcome to Murasaki
    line con 0
    privilege level 15
    no modem enable
    line aux 0
    line vty 0
    privilege level 15
    no activation-character
    transport preferred none
    transport input ssh
    line vty 1 4
    privilege level 15
    transport input ssh
    scheduler max-task-time 5000
    scheduler allocate 60000 1000
    ntp update-calendar
    ntp server au.pool.ntp.org
    end
    Any ideas on what I'm doing wrong?

    Hi Marius,
    I finally managed to try with the official Cisco VPN client on Windows. It still fails at phase 1, but now talks about 'aggressive mode', which didn't seem to be mentioned in the previous logs. Any ideas?
    *Oct  9 20:43:16: ISAKMP (0): received packet from 192.168.1.201 dport 500 sport 49727 Global (N) NEW SA
    *Oct  9 20:43:16: ISAKMP: Created a peer struct for 192.168.1.201, peer port 49727
    *Oct  9 20:43:16: ISAKMP: New peer created peer = 0x878329F0 peer_handle = 0x80000087
    *Oct  9 20:43:16: ISAKMP: Locking peer struct 0x878329F0, refcount 1 for crypto_isakmp_process_block
    *Oct  9 20:43:16: ISAKMP: local port 500, remote port 49727
    *Oct  9 20:43:16: ISAKMP:(0):insert sa successfully sa = 886697E0
    *Oct  9 20:43:16: ISAKMP:(0): processing SA payload. message ID = 0
    *Oct  9 20:43:16: ISAKMP:(0): processing ID payload. message ID = 0
    *Oct  9 20:43:16: ISAKMP (0): ID payload
        next-payload : 13
        type         : 11
        group id     : timothy
        protocol     : 17
        port         : 500
        length       : 15
    *Oct  9 20:43:16: ISAKMP:(0):: peer matches *none* of the profiles
    *Oct  9 20:43:16: ISAKMP:(0): processing vendor id payload
    *Oct  9 20:43:16: ISAKMP:(0): vendor ID seems Unity/DPD but major 215 mismatch
    *Oct  9 20:43:16: ISAKMP:(0): vendor ID is XAUTH
    *Oct  9 20:43:16: ISAKMP:(0): processing vendor id payload
    *Oct  9 20:43:16: ISAKMP:(0): vendor ID is DPD
    *Oct  9 20:43:16: ISAKMP:(0): processing vendor id payload
    *Oct  9 20:43:16: ISAKMP:(0): processing IKE frag vendor id payload
    *Oct  9 20:43:16: ISAKMP:(0):Support for IKE Fragmentation not enabled
    *Oct  9 20:43:16: ISAKMP:(0): processing vendor id payload
    *Oct  9 20:43:16: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch
    *Oct  9 20:43:16: ISAKMP:(0): vendor ID is NAT-T v2
    *Oct  9 20:43:16: ISAKMP:(0): processing vendor id payload
    *Oct  9 20:43:16: ISAKMP:(0): vendor ID is Unity
    *Oct  9 20:43:16: ISAKMP : Scanning profiles for xauth ... Client-VPN
    *Oct  9 20:43:16: ISAKMP:(0): Authentication by xauth preshared
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 1 against priority 1 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 256
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 2 against priority 1 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 256
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 3 against priority 1 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 256
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 4 against priority 1 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 256
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 5 against priority 1 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 128
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 6 against priority 1 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 128
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 7 against priority 1 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 128
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 8 against priority 1 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 128
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 9 against priority 1 policy
    *Oct  9 20:43:16: ISAKMP:      encryption 3DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Xauth authentication by pre-shared key offered but does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 10 against priority 1 policy
    *Oct  9 20:43:16: ISAKMP:      encryption 3DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Hash algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 11 against priority 1 policy
    *Oct  9 20:43:16: ISAKMP:      encryption 3DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Preshared authentication offered but does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 12 against priority 1 policy
    *Oct  9 20:43:16: ISAKMP:      encryption 3DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Hash algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 13 against priority 1 policy
    *Oct  9 20:43:16: ISAKMP:      encryption DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 14 against priority 1 policy
    *Oct  9 20:43:16: ISAKMP:      encryption DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 0
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 1 against priority 2 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 256
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 2 against priority 2 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 256
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 3 against priority 2 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 256
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 4 against priority 2 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 256
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 5 against priority 2 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 128
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 6 against priority 2 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 128
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 7 against priority 2 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 128
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 8 against priority 2 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 128
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 9 against priority 2 policy
    *Oct  9 20:43:16: ISAKMP:      encryption 3DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Hash algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 10 against priority 2 policy
    *Oct  9 20:43:16: ISAKMP:      encryption 3DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Xauth authentication by pre-shared key offered but does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 11 against priority 2 policy
    *Oct  9 20:43:16: ISAKMP:      encryption 3DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Hash algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 12 against priority 2 policy
    *Oct  9 20:43:16: ISAKMP:      encryption 3DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Preshared authentication offered but does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 13 against priority 2 policy
    *Oct  9 20:43:16: ISAKMP:      encryption DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 14 against priority 2 policy
    *Oct  9 20:43:16: ISAKMP:      encryption DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 0
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 1 against priority 10 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 256
    *Oct  9 20:43:16: ISAKMP:(0):Xauth authentication by pre-shared key offered but does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 2 against priority 10 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 256
    *Oct  9 20:43:16: ISAKMP:(0):Hash algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 3 against priority 10 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 256
    *Oct  9 20:43:16: ISAKMP:(0):Preshared authentication offered but does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 4 against priority 10 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 256
    *Oct  9 20:43:16: ISAKMP:(0):Hash algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 5 against priority 10 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 128
    *Oct  9 20:43:16: ISAKMP:(0):Proposed key length does not match policy
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 6 against priority 10 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 128
    *Oct  9 20:43:16: ISAKMP:(0):Hash algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 7 against priority 10 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 128
    *Oct  9 20:43:16: ISAKMP:(0):Proposed key length does not match policy
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 8 against priority 10 policy
    *Oct  9 20:43:16: ISAKMP:      encryption AES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:      keylength of 128
    *Oct  9 20:43:16: ISAKMP:(0):Hash algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 9 against priority 10 policy
    *Oct  9 20:43:16: ISAKMP:      encryption 3DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 10 against priority 10 policy
    *Oct  9 20:43:16: ISAKMP:      encryption 3DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 11 against priority 10 policy
    *Oct  9 20:43:16: ISAKMP:      encryption 3DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash SHA
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 12 against priority 10 policy
    *Oct  9 20:43:16: ISAKMP:      encryption 3DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 13 against priority 10 policy
    *Oct  9 20:43:16: ISAKMP:      encryption DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth XAUTHInitPreShared
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 3
    *Oct  9 20:43:16: ISAKMP:(0):Checking ISAKMP transform 14 against priority 10 policy
    *Oct  9 20:43:16: ISAKMP:      encryption DES-CBC
    *Oct  9 20:43:16: ISAKMP:      hash MD5
    *Oct  9 20:43:16: ISAKMP:      default group 2
    *Oct  9 20:43:16: ISAKMP:      auth pre-share
    *Oct  9 20:43:16: ISAKMP:      life type in seconds
    *Oct  9 20:43:16: ISAKMP:      life duration (VPI) of  0x0 0x20 0xC4 0x9B
    *Oct  9 20:43:16: ISAKMP:(0):Encryption algorithm offered does not match policy!
    *Oct  9 20:43:16: ISAKMP:(0):atts are not acceptable. Next payload is 0
    *Oct  9 20:43:16: ISAKMP:(0):no offers accepted!
    *Oct  9 20:43:16: ISAKMP:(0): phase 1 SA policy not acceptable! (local xxxx remote 192.168.1.201)
    *Oct  9 20:43:16: ISAKMP (0): incrementing error counter on sa, attempt 1 of 5: construct_fail_ag_init
    *Oct  9 20:43:16: ISAKMP:(0): Failed to construct AG informational message.
    *Oct  9 20:43:16: ISAKMP:(0): sending packet to 192.168.1.201 my_port 500 peer_port 49727 (R) AG_NO_STATE
    *Oct  9 20:43:16: ISAKMP:(0):Sending an IKE IPv4 Packet.
    *Oct  9 20:43:16: ISAKMP:(0):peer does not do paranoid keepalives.
    *Oct  9 20:43:16: ISAKMP:(0):deleting SA reason "Phase1 SA policy proposal not accepted" state (R) AG_NO_STATE (peer 192.168.1.201)
    *Oct  9 20:43:16: ISAKMP:(0): processing KE payload. message ID = 0
    *Oct  9 20:43:16: ISAKMP:(0): group size changed! Should be 0, is 128
    *Oct  9 20:43:16: ISAKMP (0): incrementing error counter on sa, attempt 2 of 5: reset_retransmission
    *Oct  9 20:43:16: ISAKMP (0): Unknown Input IKE_MESG_FROM_PEER, IKE_AM_EXCH:  state = IKE_READY
    *Oct  9 20:43:16: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_AM_EXCH
    *Oct  9 20:43:16: ISAKMP:(0):Old State = IKE_READY  New State = IKE_READY
    *Oct  9 20:43:16: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Aggressive mode failed with peer at 192.168.1.201
    *Oct  9 20:43:16: ISAKMP:(0):deleting SA reason "Phase1 SA policy proposal not accepted" state (R) AG_NO_STATE (peer 192.168.1.201)
    *Oct  9 20:43:16: ISAKMP: Unlocking peer struct 0x878329F0 for isadb_mark_sa_deleted(), count 0
    *Oct  9 20:43:16: ISAKMP: Deleting peer node by peer_reap for 192.168.1.201: 878329F0
    *Oct  9 20:43:16: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
    *Oct  9 20:43:16: ISAKMP:(0):Old State = IKE_READY  New State = IKE_DEST_SA
    *Oct  9 20:43:16: IPSEC(key_engine): got a queue event with 1 KMI message(s)
    *Oct  9 20:43:21: ISAKMP (0): received packet from 192.168.1.201 dport 500 sport 49727 Global (R) MM_NO_STATE
    *Oct  9 20:43:26: ISAKMP (0): received packet from 192.168.1.201 dport 500 sport 49727 Global (R) MM_NO_STATE

  • SSH - Failure to connect, does not prompt for password,

    I have been using SSH on this iMac with 10.5.4 for over a year, upgraded to Leopard when it came out, never a problem with SSH, but now for no apparent reason, SSH fails when trying to connect through VPN into work.
    I can still connect to other systems on the internet that are not through the VPN.
    I don't suspect this to be a VPN issue because no other employees are having this problem with the VPN, using Mac, Windows or Linux. I can connect vi putty on my windows from the same network... below is my config.
    Here is what I'm getting:
    I connect as- ssh me@hostname and it returns "Permission denied (publickey)." It makes to attempt to prompt me for a password. I do not use a key on this system so it should prompt me for a password. I changed nothing on the system to cause ssh to break, But it's possible that a apple security update caused something to break.
    I have added the following to my ~/.ssh/config file
    PasswordAuthentication yes
    My /etc/ssh_config file is as follows:
    cat /etc/ssh_config
    # $OpenBSD: ssh_config,v 1.22 2006/05/29 12:56:33 dtucker Exp $
    # This is the ssh client system-wide configuration file. See
    # ssh_config(5) for more information. This file provides defaults for
    # users, and the values can be changed in per-user configuration files
    # or on the command line.
    # Configuration data is parsed as follows:
    # 1. command line options
    # 2. user-specific file
    # 3. system-wide file
    # Any configuration value is only changed the first time it is set.
    # Thus, host-specific definitions should be at the beginning of the
    # configuration file, and defaults at the end.
    # Site-wide defaults for some commonly used options. For a comprehensive
    # list of available options, their meanings and defaults, please see the
    # ssh_config(5) man page.
    # Host *
    # ForwardAgent no
    # ForwardX11 no
    # RhostsRSAAuthentication no
    # RSAAuthentication yes
    PasswordAuthentication yes
    # HostbasedAuthentication no
    # GSSAPIAuthentication no
    # GSSAPIDelegateCredentials no
    # GSSAPIKeyExchange no
    # GSSAPITrustDNS no
    # BatchMode no
    # CheckHostIP yes
    # AddressFamily any
    # ConnectTimeout 0
    # StrictHostKeyChecking ask
    # IdentityFile ~/.ssh/identity
    # IdentityFile ~/.ssh/id_rsa
    # IdentityFile ~/.ssh/id_dsa
    # Port 22
    # Protocol 2,1
    # Cipher 3des
    # Ciphers aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
    # EscapeChar ~
    # Tunnel no
    # TunnelDevice any:any
    PermitLocalCommand yes
    My /etc/sshd_config is:
    cat /etc/sshd_config
    # $OpenBSD: sshd_config,v 1.72 2005/07/25 11:59:40 markus Exp $
    # This is the sshd server system-wide configuration file. See
    # sshd_config(5) for more information.
    # This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
    # The strategy used for options in the default sshd_config shipped with
    # OpenSSH is to specify options with their default value where
    # possible, but leave them commented. Uncommented options change a
    # default value.
    #Port 22
    #Protocol 2,1
    Protocol 2
    #AddressFamily any
    #ListenAddress 0.0.0.0
    #ListenAddress ::
    # HostKey for protocol version 1
    #HostKey /etc/sshhostkey
    # HostKeys for protocol version 2
    #HostKey /etc/sshhost_rsakey
    #HostKey /etc/sshhost_dsakey
    # Lifetime and size of ephemeral version 1 server key
    #KeyRegenerationInterval 1h
    #ServerKeyBits 768
    # Logging
    # obsoletes QuietMode and FascistLogging
    SyslogFacility AUTHPRIV
    #LogLevel INFO
    # Authentication:
    #LoginGraceTime 2m
    #PermitRootLogin yes
    PermitRootLogin no
    #StrictModes yes
    #MaxAuthTries 6
    #RSAAuthentication yes
    #PubkeyAuthentication yes
    #AuthorizedKeysFile .ssh/authorized_keys
    # For this to work you will also need host keys in /etc/sshknownhosts
    #RhostsRSAAuthentication no
    # similar for protocol version 2
    #HostbasedAuthentication no
    # Change to yes if you don't trust ~/.ssh/known_hosts for
    # RhostsRSAAuthentication and HostbasedAuthentication
    #IgnoreUserKnownHosts no
    # Don't read the user's ~/.rhosts and ~/.shosts files
    #IgnoreRhosts yes
    # To disable tunneled clear text passwords, change to no here!
    #PasswordAuthentication yes
    #PermitEmptyPasswords no
    # SACL options
    #SACLSupport yes
    # Change to no to disable s/key passwords
    #ChallengeResponseAuthentication yes
    # Kerberos options
    #KerberosAuthentication no
    #KerberosOrLocalPasswd yes
    #KerberosTicketCleanup yes
    #KerberosGetAFSToken no
    # GSSAPI options
    #GSSAPIStrictAcceptorCheck yes
    #GSSAPIKeyExchange yes
    # GSSAPI options
    #GSSAPIAuthentication yes
    #GSSAPICleanupCredentials yes
    # Set this to 'yes' to enable PAM authentication, account processing,
    # and session processing. If this is enabled, PAM authentication will
    # be allowed through the ChallengeResponseAuthentication mechanism.
    # Depending on your PAM configuration, this may bypass the setting of
    # PasswordAuthentication, PermitEmptyPasswords, and
    # "PermitRootLogin without-password". If you just want the PAM account and
    # session checks to run without PAM authentication, then enable this but set
    # ChallengeResponseAuthentication=no
    #UsePAM yes
    #AllowTcpForwarding yes
    #GatewayPorts no
    #X11Forwarding no
    #X11DisplayOffset 10
    #X11UseLocalhost yes
    #PrintMotd yes
    #PrintLastLog yes
    #TCPKeepAlive yes
    #UseLogin no
    #UsePrivilegeSeparation yes
    #PermitUserEnvironment no
    #Compression delayed
    #ClientAliveInterval 0
    #ClientAliveCountMax 3
    #UseDNS yes
    #PidFile /var/run/sshd.pid
    #MaxStartups 10
    #PermitTunnel no
    # no default banner path
    #Banner /some/path
    # override default of no subsystems
    Subsystem sftp /usr/libexec/sftp-server
    # Example of overriding settings on a per-user basis
    #Match User anoncvs
    # X11Forwarding no
    # AllowTcpForwarding no
    # ForceCommand cvs server

    Also I forgot to mention, I have nulled out the known_hosts file to eliminate any conflicts there, I have verified .ssh is 700 and files config and known_hosts are 600
    output using ssh -v
    debug1: Reading configuration data /Users/<me>/.ssh/config
    debug1: Reading configuration data /etc/ssh_config
    debug1: Connecting to pshx4105a [216.255.177.213] port 22.
    debug1: Connection established.
    debug1: identity file /Users/<me>/.ssh/identity type -1
    debug1: identity file /Users/<me>/.ssh/id_rsa type -1
    debug1: identity file /Users/<me>/.ssh/id_dsa type -1
    debug1: Remote protocol version 2.0, remote software version OpenSSH_4.5p1 FreeBSD-20061110
    debug1: match: OpenSSH_4.5p1 FreeBSD-20061110 pat OpenSSH*
    debug1: Enabling compatibility mode for protocol 2.0
    debug1: Local version string SSH-2.0-OpenSSH_4.7
    debug1: SSH2MSGKEXINIT sent
    debug1: SSH2MSGKEXINIT received
    debug1: kex: server->client aes128-cbc hmac-md5 none
    debug1: kex: client->server aes128-cbc hmac-md5 none
    debug1: SSH2MSG_KEX_DH_GEXREQUEST(1024<1024<8192) sent
    debug1: expecting SSH2MSG_KEX_DH_GEXGROUP
    debug1: SSH2MSG_KEX_DH_GEXINIT sent
    debug1: expecting SSH2MSG_KEX_DH_GEXREPLY
    debug1: Host 'pshx4105a' is known and matches the DSA host key.
    debug1: Found key in /Users/<me>/.ssh/known_hosts:3
    debug1: sshdssverify: signature correct
    debug1: SSH2MSGNEWKEYS sent
    debug1: expecting SSH2MSGNEWKEYS
    debug1: SSH2MSGNEWKEYS received
    debug1: SSH2MSG_SERVICEREQUEST sent
    debug1: SSH2MSG_SERVICEACCEPT received
    debug1: Authentications that can continue: publickey
    debug1: Next authentication method: publickey
    debug1: Trying private key: /Users/<me>/.ssh/identity
    debug1: Trying private key: /Users/<me>/.ssh/id_rsa
    debug1: Trying private key: /Users/<me>/.ssh/id_dsa
    debug1: No more authentication methods to try.

Maybe you are looking for

  • Finder: graphic issues while in icon view

    Hi there, my Macbook Pro becomes more and more sluggish since i upgraded to Yosemite. Worst thing i noticed is icon view in Finder. It does not show up correctly and has some weird graphic issues. I made a video while using the guest account: http://

  • What is a .abbu file?  And what do I do with it?

    There is a file that has appeared on my desktop with the following name: "Address Book - 2010-02-22.abbu". If I double click the file, I get a dialog box that says "Are you sure you want to replace all of the contacts in your address book with the co

  • Can you specify the port for default services when installing OEG?

    Hi everyone, The default installation of OEG 11g uses 8090 port for management services, and 8080 for the virtualized services that you register in the gateway. After installation, you can change the ports by editing gateway's Profile Repository in P

  • Simple use of variables in query

    Hi, i've just started using PL/SQL and as a long time user of TSQL the syntax is a bit confusing for me. I'm trying to test a simple query - using a variable to select some rows from a table. Lest assume that we have a table with data from different

  • Symbol Font Doesn't Display

    Is there a way to use greek letters from the Symbol fontset in iWeb?