Hello
I am attempting to configure a Site to Site VPN between two separte sites using a Juniper SRX210H and Cisco ASA5550.
I can see that the ASA is able to sucessfully raise the tunnel, however when i attempt to raise the tunnel on the Juniper side it is unsucessful and i see the following errors throught the ASA debug crypto isakmp 255 command:
Nov 27 20:08:47 [IKEv1]: IP = XX.XX.XX.XX, IKE_DECODE RECEIVED Message (msgid=e76bed9e) with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + ID (5) + ID (5) + NONE (0) total length : 216
Nov 27 20:08:47 [IKEv1 DEBUG]: Group = XX.XX.XX.XX, IP = XX.XX.XX.XX, processing hash payload
Nov 27 20:08:47 [IKEv1 DEBUG]: Group = XX.XX.XX.XX, IP = XX.XX.XX.XX, processing SA payload
Nov 27 20:08:47 [IKEv1 DEBUG]: Group = XX.XX.XX.XX, IP = XX.XX.XX.XX, processing nonce payload
Nov 27 20:08:47 [IKEv1 DEBUG]: Group = XX.XX.XX.XX, IP = XX.XX.XX.XX, processing ID payload
Nov 27 20:08:47 [IKEv1 DECODE]: Group = XX.XX.XX.XX, IP = XX.XX.XX.XX, ID_IPV4_ADDR_SUBNET ID received--0.0.0.0--0.0.0.0
Nov 27 20:08:47 [IKEv1]: Group = XX.XX.XX.XX, IP = XX.XX.XX.XX, Received remote IP Proxy Subnet data in ID Payload: Address 0.0.0.0, Mask 0.0.0.0, Protocol 0, Port 0
Nov 27 20:08:47 [IKEv1 DEBUG]: Group = XX.XX.XX.XX, IP = XX.XX.XX.XX, processing ID payload
Nov 27 20:08:47 [IKEv1 DECODE]: Group = XX.XX.XX.XX, IP = XX.XX.XX.XX, ID_IPV4_ADDR_SUBNET ID received--0.0.0.0--0.0.0.0
Nov 27 20:08:47 [IKEv1]: Group = XX.XX.XX.XX, IP = XX.XX.XX.XX, Received local IP Proxy Subnet data in ID Payload: Address 0.0.0.0, Mask 0.0.0.0, Protocol 0, Port 0
Nov 27 20:08:47 [IKEv1]: Group = XX.XX.XX.XX, IP = XX.XX.XX.XX, QM IsRekeyed old sa not found by addr
Nov 27 20:08:47 [IKEv1]: Group = XX.XX.XX.XX, IP = XX.XX.XX.XX, Static Crypto Map check, checking map = hdd2vpn, seq = 10...
Nov 27 20:08:47 [IKEv1]: Group = XX.XX.XX.XX, IP = XX.XX.XX.XX, Static Crypto Map check, map = hdd2vpn, seq = 10, ACL does not match proxy IDs src:0.0.0.0 dst:0.0.0.0
Nov 27 20:08:47 [IKEv1]: Group = XX.XX.XX.XX, IP = XX.XX.XX.XX, Static Crypto Map check, checking map = hdd2vpn, seq = 20...
Nov 27 20:08:47 [IKEv1]: Group = XX.XX.XX.XX, IP = XX.XX.XX.XX, Static Crypto Map check, map = hdd2vpn, seq = 20, ACL does not match proxy IDs src:0.0.0.0 dst:0.0.0.0
Nov 27 20:08:47 [IKEv1]: Group = XX.XX.XX.XX, IP = XX.XX.XX.XX, Static Crypto Map check, checking map = hdd2vpn, seq = 30...
Nov 27 20:08:47 [IKEv1]: Group = XX.XX.XX.XX, IP = XX.XX.XX.XX, Static Crypto Map check, map = hdd2vpn, seq = 30, ACL does not match proxy IDs src:0.0.0.0 dst:0.0.0.0
Nov 27 20:08:47 [IKEv1]: Group = XX.XX.XX.XX, IP = XX.XX.XX.XX, Static Crypto Map check, checking map = hdd2vpn, seq = 40...
Nov 27 20:08:47 [IKEv1]: Group = XX.XX.XX.XX, IP = XX.XX.XX.XX, Static Crypto Map check, map = hdd2vpn, seq = 40, ACL does not match proxy IDs src:0.0.0.0 dst:0.0.0.0
Nov 27 20:08:47 [IKEv1]: Group = XX.XX.XX.XX, IP = XX.XX.XX.XX, Rejecting IPSec tunnel: no matching crypto map entry for remote proxy 0.0.0.0/0.0.0.0/0/0 local proxy 0.0.0.0/0.0.0.0/0/0 on interface internet_network
Nov 27 20:08:47 [IKEv1 DEBUG]: Group = XX.XX.XX.XX, IP = XX.XX.XX.XX, sending notify message
Nov 27 20:08:47 [IKEv1 DEBUG]: Group = XX.XX.XX.XX, IP = XX.XX.XX.XX, constructing blank hash payload
Nov 27 20:08:47 [IKEv1 DEBUG]: Group = XX.XX.XX.XX, IP = XX.XX.XX.XX, constructing qm hash payload
Nov 27 20:08:47 [IKEv1]: IP = XX.XX.XX.XX, IKE_DECODE SENDING Message (msgid=73f1f907) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 272
BEFORE ENCRYPTION
RAW PACKET DUMP on SEND
87 54 54 50 b0 8d 8b
ISAKMP Header
Initiator COOKIE: 87 54 54 50 b0 8d 8b 00
Responder COOKIE: 88 5c 31 46 b7 91 2d c2
Next Payload: Hash
Version: 1.0
Exchange Type: Informational
Flags: (none)
MessageID: 07F9F173
Length: 469762048
Payload Hash
Next Payload: Notification
Reserved: 00
Payload Length: 24
Data:
4b c0 59
Payload Notification
Next Payload: None
Reserved: 00
Payload Length: 220
DOI: IPsec
Protocol-ID: PROTO_ISAKMP
Spi Size: 16
Notify Type: INVALID_ID_INFO
SPI:
87 54 54 50 b0 8d 8b 00 88 5c 31 46 b7 91 2d c2
Data:
01 00 0
ISAKMP Header
Initiator COOKIE: 87 54 54 50 b0 8d 8b 00
Responder COOKIE: 88 5c 31 46 b7 91 2d c2
Next Payload: Hash
Version: 1.0
Exchange Type: Informational
Flags: (Encryption)
MessageID: 73F1F907
Length: 284
Nov 27 20:08:47 [IKEv1]: Group = XX.XX.XX.XX, IP = XX.XX.XX.XX, QM FSM error (P2 struct &0x76f64960, mess id 0xe76bed9e)!
Nov 27 20:08:47 [IKEv1 DEBUG]: Group = XX.XX.XX.XX, IP = XX.XX.XX.XX, IKE QM Responder FSM error history (struct &0x76f64960) <state>, <event>: QM_DONE, EV_ERROR-->QM_BLD_MSG2, EV_NEGO_SA-->QM_BLD_MSG2, EV_IS_REKEY-->QM_BLD_MSG2, EV_CONFIRM_SA-->QM_BLD_MSG2, EV_PROC_MSG-->QM_BLD_MSG2, EV_HASH_OK-->QM_BLD_MSG2, NullEvent-->QM_BLD_MSG2, EV_COMP_HASH
Nov 27 20:08:47 [IKEv1 DEBUG]: Group = XX.XX.XX.XX, IP = XX.XX.XX.XX, sending delete/delete with reason message
Nov 27 20:08:47 [IKEv1]: Group = XX.XX.XX.XX, IP = XX.XX.XX.XX, Removing peer from correlator table failed, no match!
Nov 27 20:08:47 [IKEv1 DEBUG]: Group = XX.XX.XX.XX, IP = XX.XX.XX.XX, IKE SA MM:46315c88 rcv'd Terminate: state MM_ACTIVE flags 0x00010042, refcnt 1, tuncnt 0
Nov 27 20:08:47 [IKEv1 DEBUG]: Group = XX.XX.XX.XX, IP = XX.XX.XX.XX, IKE SA MM:46315c88 terminating: flags 0x01010002, refcnt 0, tuncnt 0
Nov 27 20:08:47 [IKEv1 DEBUG]: Group = XX.XX.XX.XX, IP = XX.XX.XX.XX, sending delete/delete with reason message
Nov 27 20:08:47 [IKEv1 DEBUG]: Group = XX.XX.XX.XX, IP = XX.XX.XX.XX, constructing blank hash payload
Nov 27 20:08:47 [IKEv1 DEBUG]: Group = XX.XX.XX.XX, IP = XX.XX.XX.XX, constructing IKE delete payload
Nov 27 20:08:47 [IKEv1 DEBUG]: Group = XX.XX.XX.XX, IP = XX.XX.XX.XX, constructing qm hash payload
Nov 27 20:08:47 [IKEv1]: IP = XX.XX.XX.XX, IKE_DECODE SENDING Message (msgid=141a8205) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 80
BEFORE ENCRYPTION
RAW PACKET DUMP on SEND
87 54 54 50 b0 8d 8b 00 88 5c 31 46 b7 91 2d c2 | .TTP.....\1F..-.
08 10 05 00 05 82 1a 14 1c 00 00 00 0c 00 00 18 | ................
39 a3 02 fb 16 4b 04 f6 8d df 2f 5a 10 20 57 16 | 9....K..../Z. W.
8c ea 5e d4 00 00 00 1c 00 00 00 01 01 10 00 01 | ..^.............
87 54 54 50 b0 8d 8b 00 88 5c 31 46 b7 91 2d c2 | .TTP.....\1F..-.
ISAKMP Header
Initiator COOKIE: 87 54 54 50 b0 8d 8b 00
Responder COOKIE: 88 5c 31 46 b7 91 2d c2
Next Payload: Hash
Version: 1.0
Exchange Type: Informational
Flags: (none)
MessageID: 05821A14
Length: 469762048
Payload Hash
Next Payload: Delete
Reserved: 00
Payload Length: 24
Data:
39 a3 02 fb 16 4b 04 f6 8d df 2f 5a 10 20 57 16
8c ea 5e d4
Payload Delete
Next Payload: None
Reserved: 00
Payload Length: 28
DOI: IPsec
Protocol-ID: PROTO_ISAKMP
Spi Size: 16
# of SPIs: 1
SPI (Hex dump):
87 54 54 50 b0 8d 8b 00 88 5c 31 46 b7 91 2d c2
ISAKMP Header
Initiator COOKIE: 87 54 54 50 b0 8d 8b 00
Responder COOKIE: 88 5c 31 46 b7 91 2d c2
Next Payload: Hash
Version: 1.0
Exchange Type: Informational
Flags: (Encryption)
MessageID: 141A8205
Length: 92
Nov 27 20:08:47 [IKEv1]: Group = XX.XX.XX.XX, IP = XX.XX.XX.XX, Session is being torn down. Reason: crypto map policy not found
Nov 27 20:08:47 [IKEv1]: Ignoring msg to mark SA with dsID 13574144 dead because SA deleted
XX.XX.XX.XX being the external IP of the Juniper device.
Any help or adive would be much appreciated.
Thanks
Andrew