Cant get Remote tunnel to establish

Question

It has been several years since I last setup a site to site tunnel.  Have been trying to set on up today and I must be missing something.
Here is the config for the site to site tunnel on the remote ASA -
access-list nonat extended permit ip 172.16.1.0 255.255.255.0 10.34.155.0 255.255.255.0
access-list nonat extended permit ip 172.16.1.0 255.255.255.0 10.34.150.0 255.255.255.0
access-list 100 extended permit ip 172.16.1.0 255.255.255.0 10.34.155.0 255.255.255.0
access-list 100 extended permit ip 172.16.1.0 255.255.255.0 10.34.150.0 255.255.255.0
global (outside) 1 interface
nat (Inside) 0 access-list nonat
nat (Inside) 1 0.0.0.0 0.0.0.0
crypto map outside_map 20 match address 100
crypto map outside_map 20 set peer x.x.x.x
crypto map outside_map 20 set transform-set myset
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
tunnel-group x.x.x.x type ipsec-l2l
tunnel-group x.x.x.x ipsec-attributes
pre-shared-key *****
When I do a debug crypto isakmp 7 and debug crypto ipsec 7, I am seeing this in the debug output -
Mar 05 14:09:04 [IKEv1]: IP = x.x.x.x, Received an un-encrypted INVALID_COOKIE notify message, dropping
Mar 05 14:09:04 [IKEv1]: IP = x.x.x.x, Information Exchange processing failed
Mar 05 14:09:12 [IKEv1 DEBUG]: IP = x.x.x.x, IKE MM Initiator FSM error history (struct &0xc960fce8)  <state>, <event>:  MM_DONE, EV_ERROR-->MM_WAIT_MSG4, EV_TIMEOUT-->MM_WAIT_MSG4, NullEvent-->MM_SND_MSG3, EV_SND_MSG-->MM_SND_MSG3, EV_START_TMR-->MM_SND_MSG3, EV_RESEND_MSG-->MM_WAIT_MSG4, EV_TIMEOUT-->MM_WAIT_MSG4, NullEvent
I have re-entered the pre-shared-key and still get this message.  I think I am missing something else but not having much luck in identifying the problem.  I looked at my notes and not having a lot of luck in this area. 
The problem may be at the datacenter end.  I am trying to set this up where the remote this config is for will be dhcp assigned and the datacenter will be static.  It is probably something simple.
Would appreciate any suggestions

Answer 1

Hello Ronald,
Thanks for the information!
On the configuration attached for the Data Center I could see that you are trying to use the DefaultL2LGroup tunnel group, which means that the remore site of the VPN tunnel will have a dynamic ip address. If that's the case we do not need to specify any peer on the crypto map since we do not know the ip address  were the client will be coming from. Phase 1 and 2 parameters will be offered by the remote site and then we will match those parameters with the ones configured on the DataCenter ASA. Also, you are missing the dynamic crypto map.
Below you will find an example to configure the dynamic crypto map:
crypto dynamic-map dynmap 655 set transform-set esp-3des
crypto map outside_map 655 ipsec-isakmp dynamic dynmap
You should be able to remove the commands applied previously:
no crypto map outside_map 20 match address 100
no crypto map outside_map 20 set transform-set esp-3des
Now, if both peers have static IP address you would need to following configuration on the DataCenter:
crypto map outside_map 20 match address 100
crypto map outside_map 20 set transform-set esp-3des
crypto map outside_map 20 set peer x.x.x.x (remote peer IP address)
tunnel-group x.x.x.x type ipsec-l2l
tunnel-group x.x.x.x ipsec-attributes
pre-shared-key *****
AnyConnect should not cause any problems.
Hope this help you out,
Luis.