0

I am trying to create a site to site IPSec tunnel between my pfSense and a Cisco ASA firewall / router.

On the pfSense side, LAN IP range is 10.3.0.0/14. pfSense has 3 interfaces:

  • LAN-->10.0.0.1/14
  • WAN-->x.x.48.78/24
  • OPT1-->10.139.136.178/29

On the Cisco side, their private IP range is 10.248.65.0/22

IPSec phase 1

  • Key Exchange version = V1
  • Internet Protocol = IPv4
  • Interface = x.x.48.78
  • Remote Gateway = [public IP of Cisco]
  • Authentication Method = Mutual PSK
  • Negotiation mode = Main
  • My identifier = My IP address
  • Peer identifier = Peer IP address
  • Pre-Shared Key = [secret]
  • Encryption Algorithm = 3DES (yes I know it's weak)
  • Hash Algorithm = SHA1
  • DH Group = 2
  • Lifetime (Seconds) = 28800
  • NAT Traversal = Auto
  • Dead Peer Detection = Enable DOD
  • Delay = 10
  • Max failures = 5

IPSec phase 2

  • Mode = Tunnel IPv4
  • Local Network = LAN subnet
  • NAT/BINAT translation = None
  • Remote Network = 10.248.65.0/22
  • Protocol = ESP
  • Encryption Algorithms = 3DES
  • Hash Algorithms = SHA1
  • PFS key group = 2
  • Lifetime = 3600

When I try to establish the tunnel from pfSense, for a second connection is established and then dropped. When I look into IPSec logs, I see something like this (bottom to top):

07[IKE] <con1000|16> deleting IKE_SA con1000[16] between x.x.48.78[x.x.48.78]...[public IP of Cisco][[public IP of Cisco]]
07[IKE] <con1000|16> received DELETE for IKE_SA con1000[16]
07[ENC] <con1000|16> parsed INFORMATIONAL_V1 request 3634372393 [ HASH D ]
07[NET] <con1000|16> received packet: from [public IP of Cisco][500] to x.x.48.78[500] (84 bytes)
11[IKE] <con1000|16> received INVALID_ID_INFORMATION error notify
11[ENC] <con1000|16> parsed INFORMATIONAL_V1 request 2181947022 [ HASH N(INVAL_ID) ]
11[NET] <con1000|16> received packet: from [public IP of Cisco][500] to x.x.48.78[500] (692 bytes)
11[ENC] <con1000|16> received fragment #2, reassembling fragmented IKE message
11[IKE] <con1000|16> INFORMATIONAL_V1 request with message ID 2181947022 processing failed
11[IKE] <con1000|16> ignore malformed INFORMATIONAL request
11[IKE] <con1000|16> integrity check failed
11[ENC] <con1000|16> could not decrypt payloads
11[ENC] <con1000|16> payload type FRAGMENT was not encrypted
11[NET] <con1000|16> received packet: from [public IP of Cisco][500] to x.x.48.78[500] (216 bytes)
07[ENC] <con1000|16> received fragment #1, waiting for complete IKE message
07[IKE] <con1000|16> INFORMATIONAL_V1 request with message ID 2181947022 processing failed
07[IKE] <con1000|16> ignore malformed INFORMATIONAL request
07[IKE] <con1000|16> integrity check failed
07[ENC] <con1000|16> could not decrypt payloads
07[ENC] <con1000|16> payload type FRAGMENT was not encrypted
07[NET] <con1000|16> received packet: from [public IP of Cisco][500] to x.x.48.78[500] (548 bytes)
11[NET] <con1000|16> sending packet: from x.x.48.78[500] to [public IP of Cisco][500] (176 bytes)
11[NET] <con1000|16> sending packet: from x.x.48.78[500] to [public IP of Cisco][500] (548 bytes)
11[ENC] <con1000|16> generating ID_PROT request 0 [ FRAG(2/2) ]
11[ENC] <con1000|16> generating ID_PROT request 0 [ FRAG(1) ]
11[ENC] <con1000|16> splitting IKE message with length of 652 bytes into 2 fragments
11[ENC] <con1000|16> generating QUICK_MODE request 2079340946 [ HASH SA No KE ID ID ]
11[IKE] <con1000|16> maximum IKE_SA lifetime 28698s
11[IKE] <con1000|16> scheduling reauthentication in 28158s
11[IKE] <con1000|16> IKE_SA con1000[16] established between x.x.48.78[x.x.48.78]...[public IP of Cisco][[public IP of Cisco]]
11[IKE] <con1000|16> received DPD vendor ID
11[ENC] <con1000|16> parsed ID_PROT response 0 [ ID HASH V ]
11[NET] <con1000|16> received packet: from [public IP of Cisco][500] to x.x.48.78[500] (84 bytes)
11[NET] <con1000|16> sending packet: from x.x.48.78[500] to [public IP of Cisco][500] (100 bytes)
11[ENC] <con1000|16> generating ID_PROT request 0 [ ID HASH N(INITIAL_CONTACT) ]
11[ENC] <con1000|16> received unknown vendor ID: 1f:07:f7:0e:aa:65:14:d3:b0:fa:96:54:2a:50:01:00
11[ENC] <con1000|16> received unknown vendor ID: 50:5e:26:5a:d5:6d:4e:bb:c0:33:d7:50:d5:f5:be:99
11[IKE] <con1000|16> received XAuth vendor ID
11[IKE] <con1000|16> received Cisco Unity vendor ID
11[ENC] <con1000|16> parsed ID_PROT response 0 [ KE No V V V V NAT-D NAT-D ]
11[NET] <con1000|16> received packet: from [public IP of Cisco][500] to x.x.48.78[500] (304 bytes)
15[NET] <con1000|16> sending packet: from x.x.48.78[500] to [public IP of Cisco][500] (244 bytes)
15[ENC] <con1000|16> generating ID_PROT request 0 [ KE No NAT-D NAT-D ]
15[IKE] <con1000|16> received FRAGMENTATION vendor ID
15[IKE] <con1000|16> received NAT-T (RFC 3947) vendor ID
15[ENC] <con1000|16> parsed ID_PROT response 0 [ SA V V ]
15[NET] <con1000|16> received packet: from [public IP of Cisco][500] to x.x.48.78[500] (124 bytes)
15[NET] <con1000|15> sending packet: from x.x.48.78[500] to [public IP of Cisco][500] (176 bytes)
15[ENC] <con1000|15> generating ID_PROT request 0 [ SA V V V V V ]
15[IKE] <con1000|15> initiating Main Mode IKE_SA con1000[16] to [public IP of Cisco]

Does anyone have any idea why doesn't Cisco like my pfSense and kills the connection?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.