0

I am making site-to-site vpn connection using amazon ec2 linux and cisco asa router ( please note i donot have access to router only configuration is provided.)

CISCO ASA CONFIGURATION :

    Palisades Peer:                 xx.xx.xxx.xxx

    Palisades Local:                 6x.xx.xxx.2xx/29

    Pre-Shared key:               IKE v1     123456   

    No Device Certificates
Phase 1    
    IKE Policy 
    DH Group- 5
    IKE Version- 1
    Authentication: Pre-share
    Hash:                      SHA
    Encryption:                3DES
    Lifetime                   28800
Phase 2

               Encryption- 3DES
                Authentication- SHA1
                PFS- Disabled
                Keylife- 1800
    IPSec Proposal             ESP-DES-MD5
    Perfect Forward Secrecy:   Disable

I have installed openswan.

Configuration :

conn vpc-to-asa
        type=tunnel
        authby=secret
        left=%defaultroute
        leftid=xx.xx.xx.82
        leftnexthop=%defaultroute
        leftsubnet=200.3.2.0/24
        right=xx.xx.xxx.xxx
        rightsubnet=6x.xx.xxx.2xx/29
        keyexchange=ike
        ike=3des-sha;modp1536
        ikelifetime=28800s
        phase2=esp
        phase2alg=3des-md5
        aggrmode=no
        keyingtries=3
        rekey=no
        salifetime=28800s
        pfs=no
        auto=start

After doing above configuration i have fired these command :

service ipsec restart
ipsec auto --add vpc-to-asa
ipsec auto --up vpc-to-asa

when i am running ipsec auto --up vpc-to-asa command i am getting this error :

104 "vpc-to-asa" #2: STATE_MAIN_I1: initiate
003 "vpc-to-asa" #2: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] method set to=106
003 "vpc-to-asa" #2: ignoring Vendor ID payload [Cisco IKE Fragmentation]
003 "vpc-to-asa" #2: next payload type of ISAKMP NAT-D Payload has an unknown value: 130
032 "vpc-to-asa" #2: STATE_MAIN_I1: internal error
003 "vpc-to-asa" #2: discarding duplicate packet; already STATE_MAIN_I1
003 "vpc-to-asa" #2: discarding duplicate packet; already STATE_MAIN_I1
003 "vpc-to-asa" #2: discarding duplicate packet; already STATE_MAIN_I1
My tunnel is not up.

I Have tired this command ipsec auto --status output :

000 using kernel interface: netkey
000 interface lo/lo ::1
000 interface lo/lo 127.0.0.1
000 interface lo/lo 127.0.0.1
000 interface eth0/eth0 200.3.2.26
000 interface eth0/eth0 200.3.2.26
000 %myid = (none)
000 debug none
000
000 virtual_private (%priv):
000 - allowed 1 subnet: 200.3.2.0/24
000 - disallowed 0 subnets:
000 WARNING: Disallowed subnets in virtual_private= is empty. If you have
000          private address space in internal use, it should be excluded!
000
000 algorithm ESP encrypt: id=2, name=ESP_DES, ivlen=8, keysizemin=64, keysizemax=64
000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=8, keysizemin=192, keysizemax=192
000 algorithm ESP encrypt: id=6, name=ESP_CAST, ivlen=8, keysizemin=40, keysizemax=128
000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH, ivlen=8, keysizemin=40, keysizemax=448
000 algorithm ESP encrypt: id=11, name=ESP_NULL, ivlen=0, keysizemin=0, keysizemax=0
000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=13, name=ESP_AES_CTR, ivlen=8, keysizemin=160, keysizemax=288
000 algorithm ESP encrypt: id=14, name=ESP_AES_CCM_A, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=15, name=ESP_AES_CCM_B, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=16, name=ESP_AES_CCM_C, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=18, name=ESP_AES_GCM_A, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=19, name=ESP_AES_GCM_B, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=20, name=ESP_AES_GCM_C, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=22, name=ESP_CAMELLIA, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=252, name=ESP_SERPENT, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=253, name=ESP_TWOFISH, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128
000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160, keysizemax=160
000 algorithm ESP auth attr: id=5, name=AUTH_ALGORITHM_HMAC_SHA2_256, keysizemin=256, keysizemax=256
000 algorithm ESP auth attr: id=6, name=AUTH_ALGORITHM_HMAC_SHA2_384, keysizemin=384, keysizemax=384
000 algorithm ESP auth attr: id=7, name=AUTH_ALGORITHM_HMAC_SHA2_512, keysizemin=512, keysizemax=512
000 algorithm ESP auth attr: id=8, name=AUTH_ALGORITHM_HMAC_RIPEMD, keysizemin=160, keysizemax=160
000 algorithm ESP auth attr: id=9, name=AUTH_ALGORITHM_AES_CBC, keysizemin=128, keysizemax=128
000 algorithm ESP auth attr: id=251, name=(null), keysizemin=0, keysizemax=0
000
000 algorithm IKE encrypt: id=0, name=(null), blocksize=16, keydeflen=131
000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8, keydeflen=192
000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16, keydeflen=128
000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16
000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20
000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024
000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536
000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048
000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072
000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096
000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144
000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192
000 algorithm IKE dh group: id=22, name=OAKLEY_GROUP_DH22, bits=1024
000 algorithm IKE dh group: id=23, name=OAKLEY_GROUP_DH23, bits=2048
000 algorithm IKE dh group: id=24, name=OAKLEY_GROUP_DH24, bits=2048
000
000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,2,64} trans={0,2,3072} attrs={0,2,2048}
000
000 "vpc-to-asa": 200.3.2.0/24===200.3.2.26[<MY_SERVER_PUBLIC_IP>,+S=C]---200.3.2.1...REMOTE_VPN_PUBLIC_IP_ADDRESS<REMOTE_VPN_PUBLIC_IP_ADDRESS>[+S=C]===REMOTE_LOCAL_NETOWORK_IP/29; unrouted; eroute owner: #0
000 "vpc-to-asa":     myip=unset; hisip=unset;
000 "vpc-to-asa":   ike_life: 28800s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 3
000 "vpc-to-asa":   policy: PSK+ENCRYPT+TUNNEL+DONTREKEY+UP+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 24,29; interface: eth0;
000 "vpc-to-asa":   newest ISAKMP SA: #0; newest IPsec SA: #0;
000 "vpc-to-asa":   IKE algorithms wanted: 3DES_CBC(5)_000-SHA1(2)_000-MODP1536(5); flags=-strict
000 "vpc-to-asa":   IKE algorithms found:  3DES_CBC(5)_192-SHA1(2)_160-MODP1536(5)
000 "vpc-to-asa":   ESP algorithms wanted: 3DES(3)_000-MD5(1)_000; flags=-strict
000 "vpc-to-asa":   ESP algorithms loaded: 3DES(3)_192-MD5(1)_128
000
000

Can anyone help me on this . How i make connection between openswan and cisco asa using above mentioned configuration.

  • Can anyone Help , Please Its little Urgent ..... – Himanshu Singhal Apr 4 '15 at 6:07
  • I am able to make Tunnel up but not able to ping client side network – Himanshu Singhal Apr 4 '15 at 17:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.