Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Android Gingerbread has added support for true IPsec VPN, and I'm trying to get this to work with my Cisco ASA 5510 appliance. On the device, I've selected PSK v1 with Xauth as the connection method. I'm seeing "all IPsec SA proposals found unacceptable" when the device attempts to connect on the ASA's debug log, and the devices says "IKE negotiation failed". The transform-sets currently applied to my outside interface are ESP-AES-256-SHA, and ESP-AES-256-MD5. Does anybody know the correct transform-set that I need to apply to allow Android devices to connect?

share|improve this question
Excuse me, what Android version do you have exactly? I have Gingerbread version 2.3.4 here (CyanogenMod 7.1.0.RC12) and no such true IPSec is supported (only L2TP-over-IPSec). – joechip Jul 30 '11 at 9:28
This is on a Motorola Atrix 4G on ATT. System Version: 4.5.91.MB860.ATT.en.US, Android Version 2.3.4, Build Number 4.5.91. – BenGC Jul 30 '11 at 12:45
This update apparently supports true IPsec at AES-128, using either PSK or Certificate. I'm using it with PSK (group name/password). – BenGC Jul 30 '11 at 12:47
up vote 1 down vote accepted

The issue was that perfect forward secrecy needed to be disabled.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.