cEdge supports standard IKE tunnels in 19.x. If the SA offers include different DH groups, KEi must be an element of the group the initiator expects the responder to accept. E.g. I think i have the problem with the Source Interface (i receive"IKEv2-ERROR:Address type not supported" in log). Consult your VPN device vendor specifications to verify that . Source Interface in my setup is the WAN Interface connected to the Internet. Customers Also Viewed These Support Documents, Branch router, ISR4451-X, version 16.12.1b. Router 2 builds the responder message for IKE_SA_INIT exchange, which is received by ASA1. Nonce Ni (optional): If the CHILD_SA is created as part of the initial exchange, a second KE payload and nonce must not be sent), KEi (Key-optional): The CREATE_CHILD_SA request might optionally contain a KE payload for an additional DH exchange to enable stronger guarantees of forward secrecy for the CHILD_SA. It seems like it's not passing domain information. All of the devices used in this document started with a cleared (default) configuration. In addition, this document provides information on how to translate certain debug lines in a configuration. They contain the source and destination address of the initiator and responder respectively for forwarding/receiving encrypted traffic. Responder sends the response for IKE_AUTH. To a remote end configured with encryption domains i wasnt sucessfull. This is reposted from the Networking Academy area since there were no replies. No action taken. if my config was wrong then tunnel shouldn't come up when Cisco ASA sending traffic. 05-18-2021 12:04 PM. Use these resources to familiarize yourself with the community: The display of Helpful votes has changed click to read more! Communication over the IPSec Tunnel should be done via VPN1. Router 2 builds the response to IKE_AUTH packet that it received from Router 1. I'm unsure if Viptela using IOS XE has this same capability. This response packet contains: ISAKMP Header(SPI/ version/flags), IDr(responder's identity), AUTH payload, SAr2(initiates the SA-similar to the phase 2 transform set exchange in IKEv1), and TSi and TSr(Initiator and Responder Traffic selectors). #pre-shared-key cisco1234. The difference between IKEv1 and IKEv2 is that, in the latter, the Child SAs are created as part of AUTH exchange itself. Cisco Community Technology and Support Security VPN Remote Access IKEv2 Auth exchange failed 33016 5 2 Remote Access IKEv2 Auth exchange failed Go to solution mustafa.chapal Beginner 08-08-2018 01:52 PM - edited 03-12-2019 05:29 AM Hi, Tunnel is up on the Initiator and the status shows. I believe it is specific to ISR4K's and being fixed in the November code release. If this CREATE_CHILD_SA exchange is rekeying an existing SA other than the IKE_SA, the leading N payload of type REKEY_SA must identify the SA being rekeyed. The address range specifies that all traffic to and from that range are tunnelled. If the proposal is acceptable to the responder, it sends identical TS payloads back. Doesn't work for me. You can also check the output of theshow crypto sessioncommand on both routers; this output shows the tunnel session status as UP-ACTIVE. A vulnerability in the Internet Key Exchange Version 2 (IKEv2) implementation in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to prevent IKEv2 from establishing new security associations. A Notify Payload may appear in a response message (usually specifying why a request was rejected), in an INFORMATIONAL Exchange (to report an error not in an IKE request), or in any other message to indicate sender capabilities or to modify the meaning of the request.If this CREATE_CHILD_SA exchange is rekeying an existing SA other than the IKE_SA, the leading N payload of type REKEY_SA MUST identify the SA being rekeyed. I've tried domain\user, [email protected] and just plain user. Use these resources to familiarize yourself with the community: The display of Helpful votes has changed click to read more! For a branch office VPN that uses IKEv1, the Phase 1 exchange can use Main Mode or Aggressive Mode. I notice the guide was written for the vEdge. Can you also post the config for the VPN template. 03-12-2019 Router 1 then inserts this SA into its SAD. In the IKEv1 Phase 1 settings, you can select one of these modes: Main Mode. Customers Also Viewed These Support Documents, https://www.cisco.com/c/en/us/support/docs/security/flexvpn/115907-config-flexvpn-wcca-00.html. Router 1 receives the IKE_SA_INIT response packet from Router 2. The first CHILD_SA is created for the proxy_ID pair that matches the trigger packet. Accepted Solutions. For more information on the differences and an explanation of the packet exchange, refer toIKEv2 Packet Exchange and Protocol Level Debugging. For more information, refer to IKEv2 Packet Exchange and Protocol Level Debugging. *Nov 11 19:30:34.835: IKEv2:KMI message 12 consumed. 0 Helpful Share Reply JW_UK Beginner In response to JW_UK Options 09-28-2019 03:19 AM Working output: #show crypto ikev2 profile IKEv2 profile: default Ref Count: 4 Match criteria: Fvrf: global Local address/interface: none Identities: none Certificate maps: mymap Local identity: none <----- Remote identity: none Conditions: FlexVPN No local identity configured, relaying on global default. I'd like to configure a IPSEC tunnel to Zscaler, the interface should be sourced from VPN0 so that i can use the public IP address attached to my DIA circuit. Let me ask you something - what format do you enter user/domain information in the client? As far as I'm aware that feature is not supported on cEdge platforms, you can only use IPsec tunnels on the Service Side VPN. Components Used The information in this document is based on these software and hardware versions: Internet Key Exchange Version 2 (IKEv2) Cisco IOS 15.1 (1)T or later Hence, you would see 'PFS (Y/N): N, DH group: none' until the first rekey. New here? BR12-1X(config)# crypto ikev2 profile apple, BR12-1X(config-ikev2-profile)# config-exchange request, BR12-1X(config-ikev2-profile)# no config-exchange request. tanyatamir53355. The VPN is not connecting at all. Refer toCisco Technical Tips Conventionsfor more information on document conventions. Description (partial) Symptom: Garbage value (non-comprehensible) seen in the ikev2 error line "Address type 4132115430 not supported" Conditions: When ikev2 error debugging is turned on. New here? KEi (Key-optional): The CREATE_CHILD_SA request might optionally contain a KE payload for an additional DH exchange to enable stronger guarantees of forward secrecy for the CHILD_SA. Cisco recommends that you have knowledge of the packet exchange for IKEv2. 08-08-2018 IKEv2 is the supporting protocol for IP Security Protocol (IPsec) and is used for performing mutual authentication and establishing and maintaining security associations (SAs). At the moment,you can use service side ipsec in cedge. In IKEv1 there was a clearly demarcated phase1 exchange that consisted of six (6) packets followed by a phase 2 exchange that consisted of three (3) packets; the IKEv2 exchange is variable. Same here. This document describes Internet Key Exchange version 2 (IKEv2) debugs on Cisco IOS when a pre-shared key (PSK) is used. 1 Accepted Solution. Bug Details Include Find answers to your questions by entering keywords or phrases in the Search bar above. Phase 1: AES256, SHA384, DH14, SA 28800 Phase 2: AES256, SHA256, PFS2048, SA 3600 I'm getting the error: encryption failure: Ike version: ikev2 not supported for peer I'm new to checkpoint. This is the CREATE_CHILD_SA response. Relevant Configuration:crypto ikev2 proposal PHASE1-prop encryption 3des aes-cbc-128 integrity sha1 group 2crypto ikev2 keyring KEYRNG peer peer1 address 10.0.0.2 255.255.255.0 hostname host1 pre-shared-key local cisco pre-shared-key remote cisco, *Nov 11 19:30:34.814: IKEv2:Got a packet from dispatcher *Nov 11 19:30:34.814: IKEv2:Processing an item off the pak queue *Nov 11 19:30:34.814: IKEv2:New ikev2 sa request admitted *Nov 11 19:30:34.814: IKEv2:Incrementing incoming negotiating sa count by one, *Nov 11 19:30:34.814: IKEv2:Next payload: SA, version: 2.0 Exchange type: IKE_SA_INIT, flags: INITIATOR Message id: 0, length: 344 Payload contents: SA Next payload: KE, reserved: 0x0, length: 56 last proposal: 0x0, reserved: 0x0, length: 52 Proposal: 1, Protocol id: IKE, SPI size: 0, #trans: 5 last transform: 0x3, reserved: 0x0: length: 8 type: 1, reserved: 0x0, id: 3DES last transform: 0x3, reserved: 0x0: length: 12 type: 1, reserved: 0x0, id: AES-CBC last transform: 0x3, reserved: 0x0: length: 8 type: 2, reserved: 0x0, id: SHA1 last transform: 0x3, reserved: 0x0: length: 8 type: 3, reserved: 0x0, id: SHA96 last transform: 0x0, reserved: 0x0: length: 8 type: 4, reserved: 0x0, id: DH_GROUP_1024_MODP/Group 2 KE Next payload: N, reserved: 0x0, length: 136 DH group: 2, Reserved: 0x0 N Next payload: VID, reserved: 0x0, length: 24 *Nov 11 19:30:34.814: IKEv2:Parse Vendor Specific Payload: CISCO-DELETE-REASON VID Next payload: VID, reserved: 0x0, length: 23 *Nov 11 19:30:34.814: IKEv2:Parse Vendor Specific Payload: (CUSTOM) VID Next payload: NOTIFY, reserved: 0x0, length: 21 *Nov 11 19:30:34.814: IKEv2:Parse Notify Payload: NAT_DETECTION_SOURCE_IP NOTIFY(NAT_DETECTION_SOURCE_IP) Next payload: NOTIFY, reserved: 0x0, length: 28 Security protocol id: IKE, spi size: 0, type: NAT_DETECTION_SOURCE_IP *Nov 11 19:30:34.814: IKEv2:Parse Notify Payload: NAT_DETECTION_DESTINATION_IP NOTIFY(NAT_DETECTION_DESTINATION_IP) Next payload: NONE, reserved: 0x0, length: 28 Security protocol id: IKE, spi size: 0, type: NAT_DETECTION_DESTINATION_IP, *Nov 11 19:30:34.814: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000000 CurState: IDLE Event:EV_RECV_INIT *Nov 11 19:30:34.814: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000000 CurState: R_INIT Event:EV_VERIFY_MSG *Nov 11 19:30:34.814: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000000 CurState: R_INIT Event:EV_INSERT_SA *Nov 11 19:30:34.814: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000000 CurState: R_INIT Event:EV_GET_IKE_POLICY *Nov 11 19:30:34.814: IKEv2:Adding Proposal default to toolkit policy *Nov 11 19:30:34.814: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000000 CurState: R_INIT Event:EV_PROC_MSG *Nov 11 19:30:34.814: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000000 CurState: R_INIT Event: EV_DETECT_NAT *Nov 11 19:30:34.814: IKEv2:(SA ID = 1):Process NAT discovery notify *Nov 11 19:30:34.814: IKEv2:(SA ID = 1):Processing nat detect src notify *Nov 11 19:30:34.814: IKEv2:(SA ID = 1):Remote address matched *Nov 11 19:30:34.814: IKEv2:(SA ID = 1):Processing nat detect dst notify *Nov 11 19:30:34.814: IKEv2:(SA ID = 1):Local address matched *Nov 11 19:30:34.814: IKEv2:(SA ID = 1):No NAT found *Nov 11 19:30:34.814: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000000 CurState: R_INIT Event: EV_CHK_CONFIG_MODE *Nov 11 19:30:34.814: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000000 CurState: R_BLD_INIT Event: EV_SET_POLICY *Nov 11 19:30:34.814: IKEv2:(SA ID = 1):Setting configured policies *Nov 11 19:30:34.814: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000000 CurState: R_BLD_INIT Event: EV_CHK_AUTH4PKI *Nov 11 19:30:34.814: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000000 CurState: R_BLD_INIT Event: EV_PKI_SESH_OPEN *Nov 11 19:30:34.814: IKEv2:(SA ID = 1):Opening a PKI session *Nov 11 19:30:34.815: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000000 CurState: R_BLD_INIT Event:EV_GEN_DH_KEY *Nov 11 19:30:34.815: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000000 CurState: R_BLD_INIT Event: EV_NO_EVENT *Nov 11 19:30:34.815: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000000 CurState: R_BLD_INIT Event:EV_OK_RECD_DH_PUBKEY_RESP *Nov 11 19:30:34.815: IKEv2:(SA ID = 1):Action: Action_Null *Nov 11 19:30:34.815: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000000 CurState: R_BLD_INIT Event:EV_GEN_DH_SECRET *Nov 11 19:30:34.822: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000000 CurState: R_BLD_INIT Event: EV_NO_EVENT *Nov 11 19:30:34.822: IKEv2:%Getting preshared key by address 10.0.0.1 *Nov 11 19:30:34.822: IKEv2:Adding Proposal default to toolkit policy *Nov 11 19:30:34.822: IKEv2:(2): Choosing IKE profile IKEV2-SETUP *Nov 11 19:30:34.822: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000000 CurState: R_BLD_INIT Event: EV_OK_RECD_DH_SECRET_RESP *Nov 11 19:30:34.822: IKEv2:(SA ID = 1):Action: Action_Null *Nov 11 19:30:34.822: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000000 CurState: R_BLD_INIT Event:EV_GEN_SKEYID *Nov 11 19:30:34.822: IKEv2:(SA ID = 1):Generate skeyid *Nov 11 19:30:34.822: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000000 CurState: R_BLD_INIT Event: EV_GET_CONFIG_MODE *Nov 11 19:30:34.822: IKEv2:IKEv2 responder - no config data to send in IKE_SA_INIT exch *Nov 11 19:30:34.822: IKEv2:No config data to send to toolkit: *Nov 11 19:30:34.822: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000000 CurState: R_BLD_INIT Event: EV_BLD_MSG *Nov 11 19:30:34.822: IKEv2:Construct Vendor Specific Payload: DELETE-REASON *Nov 11 19:30:34.822: IKEv2:Construct Vendor Specific Payload: (CUSTOM) *Nov 11 19:30:34.822: IKEv2:Construct Notify Payload: NAT_DETECTION_SOURCE_IP *Nov 11 19:30:34.822: IKEv2:Construct Notify Payload: NAT_DETECTION_DESTINATION_IP *Nov 11 19:30:34.822: IKEv2:Construct Notify Payload: HTTP_CERT_LOOKUP_SUPPORTED. description Cisco AnyConnect IKEv2 ip unnumbered GigabitEthernet0/0 tunnel mode ipsec ipv4 tunnel protection ipsec profile staff Take a break, you have now completed the main config on the router, and its time to move onto configuration relating to the client. currently using 4.8, seems to have solved all issues. The Responder tunnel usually comes up before the Initiator. Router 1 verifies and processes the authentication data in this packet. Keyring: configure the key will be exchanged to establish phase1 and the type which is in our example (pre-shared) Example: #crypto ikev2 keyring cisco. #proposal cisco. Initiator receives response from Responder. Has anyone been able to do this on a ISR4k? The connection uses a custom IPsec/IKE policy with the UsePolicyBasedTrafficSelectors option, as described in this article.. Can you point specifically on the vManage how we can do that? N (Notify payload-optional): The Notify Payload is used to transmit informational data, such as error conditions and state transitions, to an IKE peer. I am trying to remote access to my Cisco 897VA Router using pre shared key only through Windows 10, Mac OS X and iPhone builtin IKEv2 VPN. Beginner. You can configure IPsec on tunnels for VPN 1 through 65530, except for 512. https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/System-Interface/systems-interfaces-book/configure-interfaces.html. #address 10.0.0.2. Router 1 initiates the CHILD_SA exchange. This section lists the configurations used in this document. Template applied to Service VPN 1, Source interface from VPN 0 (Internet Interface with public IP to reach external Firewall via Internet). Local Address = 0.0.0.0. If the SA offers include different DH groups, KEi must be an element of the group the initiator expects the responder to accept. You cannot configure IKEv2 through the user interface. 189067: *Aug 8 14:01:22.433 Chicago: IKEv2:Config data recieved: 189068: *Aug 8 14:01:22.433 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Config-type: Config-request, 189069: *Aug 8 14:01:22.433 Chicago: IKEv2:IKEv2 responder - unsupported attrib unknown in cfg-req, 189070: *Aug 8 14:01:22.433 Chicago: IKEv2:IKEv2 responder - unsupported attrib unknown in cfg-req, 189071: *Aug 8 14:01:22.433 Chicago: IKEv2:IKEv2 responder - unsupported attrib unknown in cfg-req, 189072: *Aug 8 14:01:22.433 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Error in settig received config mode data, 189073: *Aug 8 14:01:22.433 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Auth exchange failed, 189074: *Aug 8 14:01:22.433 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):: Auth exchange failed, 189075: *Aug 8 14:01:22.433 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Abort exchange, 189076: *Aug 8 14:01:22.433 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Deleting SA, 189077: *Aug 8 14:01:25.429 Chicago: IKEv2:Couldn't find matching SA: Detected an invalid IKE SPI, 189078: *Aug 8 14:01:25.429 Chicago: IKEv2:(SESSION ID = 0,SA ID = 0):Received Packet [From 2.2.2.2:4500/To 1.1.1.1:4500/VRF i0:f0], 189079: *Aug 8 14:01:25.429 Chicago: IKEv2:: A supplied parameter is incorrect, 189080: *Aug 8 14:01:28.429 Chicago: IKEv2:Couldn't find matching SA: Detected an invalid IKE SPI, 189081: *Aug 8 14:01:28.429 Chicago: IKEv2:(SESSION ID = 0,SA ID = 0):Received Packet [From 2.2.2.2:4500/To 1.1.1.1:4500/VRF i0:f0], 189082: *Aug 8 14:01:28.429 Chicago: IKEv2:: A supplied parameter is incorrect, 189083: *Aug 8 14:01:31.433 Chicago: IKEv2:Couldn't find matching SA: Detected an invalid IKE SPI, 189084: *Aug 8 14:01:31.433 Chicago: IKEv2:(SESSION ID = 0,SA ID = 0):Received Packet [From 2.2.2.2:4500/To 1.1.1.1:4500/VRF i0:f0], 189085: *Aug 8 14:01:31.433 Chicago: IKEv2:: A supplied parameter is incorrect. IKEv2-ERROR:Address type 1622425149 not supported My assumption is that although the IPSEC is created on the service side, by sourcing the tunnel from the interface with a public IP address in VPN0, the cEdge would VRF jump to VPN0. Relevant Configuration:crypto ipsec ikev2 ipsec-proposal AES256 protocol esp encryption aes-256 protocol esp integrity sha-1 md5, *Nov 11 19:30:34.832: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_WAIT_AUTH Event: EV_RECV_AUTH *Nov 11 19:30:34.832: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_WAIT_AUTH Event: EV_CHK_NAT_T *Nov 11 19:30:34.832: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_WAIT_AUTH Event: EV_PROC_ID *Nov 11 19:30:34.832: IKEv2:(SA ID = 1):Received valid parameteres in process id *Nov 11 19:30:34.832: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_WAIT_AUTH Event: EV_CHK_IF_PEER_CERT_NEEDS_TO_BE_FETCHED_FOR_PROF_SEL *Nov 11 19:30:34.832: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_WAIT_AUTH Event: EV_GET_POLICY_BY_PEERID *Nov 11 19:30:34.833: IKEv2:(1): Choosing IKE profile IKEV2-SETUP *Nov 11 19:30:34.833: IKEv2:% Getting preshared key by address 10.0.0.1 *Nov 11 19:30:34.833: IKEv2:% Getting preshared key by address 10.0.0.1 *Nov 11 19:30:34.833: IKEv2:Adding Proposal default to toolkit policy *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):Using IKEv2 profile 'IKEV2-SETUP' *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_WAIT_AUTH Event: EV_SET_POLICY *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):Setting configured policies *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_WAIT_AUTH Event: EV_VERIFY_POLICY_BY_PEERID *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_WAIT_AUTH Event: EV_CHK_AUTH4EAP *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_WAIT_AUTH Event: EV_CHK_POLREQEAP *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_VERIFY_AUTH Event: EV_CHK_AUTH_TYPE *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_VERIFY_AUTH Event: EV_GET_PRESHR_KEY *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_VERIFY_AUTH Event: EV_VERIFY_AUTH *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_VERIFY_AUTH Event: EV_CHK4_IC *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_VERIFY_AUTH Event: EV_CHK_REDIRECT *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):Redirect check is not needed, skipping it *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_VERIFY_AUTH Event: EV_NOTIFY_AUTH_DONE *Nov 11 19:30:34.833: IKEv2:AAA group authorization is not configured *Nov 11 19:30:34.833: IKEv2:AAA user authorization is not configured *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_VERIFY_AUTH Event: EV_CHK_CONFIG_MODE *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_VERIFY_AUTH Event: EV_SET_RECD_CONFIG_MODE *Nov 11 19:30:34.833: IKEv2:Received config data from toolkit: *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_VERIFY_AUTH Event: EV_PROC_SA_TS *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_VERIFY_AUTH Event: EV_GET_CONFIG_MODE *Nov 11 19:30:34.833: IKEv2:Error constructing config reply *Nov 11 19:30:34.833: IKEv2:No config data to send to toolkit: *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_BLD_AUTH Event: EV_MY_AUTH_METHOD *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_BLD_AUTH Event: EV_GET_PRESHR_KEY *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_BLD_AUTH Event: EV_GEN_AUTH *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_BLD_AUTH Event: EV_CHK4_SIGN *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_BLD_AUTH Event: EV_OK_AUTH_GEN *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_BLD_AUTH Event: EV_SEND_AUTH *Nov 11 19:30:34.833: IKEv2:Construct Vendor Specific Payload: CISCO-GRANITE *Nov 11 19:30:34.833: IKEv2:Construct Notify Payload: SET_WINDOW_SIZE *Nov 11 19:30:34.833: IKEv2:Construct Notify Payload: ESP_TFC_NO_SUPPORT *Nov 11 19:30:34.833: IKEv2:Construct Notify Payload: NON_FIRST_FRAGS, *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):Next payload: ENCR, version: 2.0 Exchange type:IKE_AUTH, flags:RESPONDER MSG-RESPONSEMessage id: 1, length: 252 Payload contents: ENCR Next payload: VID, reserved: 0x0, length: 224 *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: AUTH_DONE Event: EV_OK *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):Action: Action_Null *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: AUTH_DONE Event: EV_PKI_SESH_CLOSE *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):Closing the PKI session *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: AUTH_DONE Event: EV_UPDATE_CAC_STATS *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: AUTH_DONE Event:EV_INSERT_IKE *Nov 11 19:30:34.834: IKEv2:Store mib index ikev2 1, platform 60 *Nov 11 19:30:34.834: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: AUTH_DONE Event: EV_GEN_LOAD_IPSEC *Nov 11 19:30:34.834: IKEv2:(SA ID = 1):Asynchronous request queued *Nov 11 19:30:34.834: IKEv2:(SA ID = 1): *Nov 11 19:30:34.834: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState:AUTH_DONEEvent: EV_NO_EVENT, *Nov 11 19:30:34.834: IKEv2:Got a packet from dispatcher *Nov 11 19:30:34.834: IKEv2:Processing an item off the pak queue, *Nov 11 19:30:34.840: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: AUTH_DONE Event: EV_OK_RECD_LOAD_IPSEC *Nov 11 19:30:34.840: IKEv2:(SA ID = 1):Action: Action_Null *Nov 11 19:30:34.840: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: AUTH_DONE Event: EV_START_ACCT *Nov 11 19:30:34.840: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: AUTH_DONE Event: EV_CHECK_DUPE *Nov 11 19:30:34.840: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: AUTH_DONE Event: EV_CHK4_ROLE, *Nov 11 19:30:34.834: IKEv2:(SA ID = 1):Next payload: ENCR, version: 2.0 Exchange type:IKE_AUTH, flags:RESPONDER MSG-RESPONSEMessage id: 1, length: 252 Payload contents: *Nov 11 19:30:34.834: IKEv2:Parse Vendor Specific Payload: (CUSTOM) VID Next payload: IDr, reserved: 0x0, length: 20 IDrNext payload: AUTH, reserved: 0x0, length: 12 Id type: IPv4 address, Reserved: 0x0 0x0 AUTHNext payload: SA, reserved: 0x0, length: 28 Auth method PSK, reserved: 0x0, reserved 0x0 SANext payload: TSi, reserved: 0x0, length: 40 last proposal: 0x0, reserved: 0x0, length: 36 Proposal: 1, Protocol id: ESP, SPI size: 4, #trans: 3 last transform: 0x3, reserved: 0x0: length: 8 type: 1, reserved: 0x0, id: 3DES last transform: 0x3, reserved: 0x0: length: 8 type: 3, reserved: 0x0, id: SHA96 last transform: 0x0, reserved: 0x0: length: 8 type: 5, reserved: 0x0, id: Don't use ESN TSiNext payload: TSr, reserved: 0x0, length: 24 Num of TSs: 1, reserved 0x0, reserved 0x0 TS type: TS_IPV4_ADDR_RANGE, proto id: 0, length: 16 start port: 0, end port: 65535 start addr: 0.0.0.0, end addr: 255.255.255.255 TSr Next payload: NOTIFY, reserved: 0x0, length: 24 Num of TSs: 1, reserved 0x0, reserved 0x0 TS type: TS_IPV4_ADDR_RANGE, proto id: 0, length: 16 start port: 0, end port: 65535 start addr: 0.0.0.0, end addr: 255.255.255.255 *Nov 11 19:30:34.834: IKEv2:Parse Notify Payload: SET_WINDOW_SIZE NOTIFY(SET_WINDOW_SIZE) Next payload: NOTIFY, reserved: 0x0, length: 12 Security protocol id: IKE, spi size: 0, type: SET_WINDOW_SIZE *Nov 11 19:30:34.834: IKEv2:Parse Notify Payload: ESP_TFC_NO_SUPPORT NOTIFY(ESP_TFC_NO_SUPPORT) Next payload: NOTIFY, reserved: 0x0, length: 8 Security protocol id: IKE, spi size: 0, type: ESP_TFC_NO_SUPPORT *Nov 11 19:30:34.834: IKEv2:Parse Notify Payload: NON_FIRST_FRAGS NOTIFY(NON_FIRST_FRAGS) Next payload: NONE, reserved: 0x0, length: 8 Security protocol id: IKE, spi size: 0, type: NON_FIRST_FRAGS *Nov 11 19:30:34.834: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: I_WAIT_AUTH Event:EV_RECV_AUTH *Nov 11 19:30:34.834: IKEv2:(SA ID = 1):Action: Action_Null *Nov 11 19:30:34.834: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: I_PROC_AUTH Event: EV_CHK4_NOTIFY *Nov 11 19:30:34.834: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: I_PROC_AUTH Event:EV_PROC_MSG *Nov 11 19:30:34.834: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: I_PROC_AUTH Event: EV_CHK_IF_PEER_CERT_NEEDS_TO_BE_FETCHED_FOR_PROF_SEL *Nov 11 19:30:34.834: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: I_PROC_AUTH Event: EV_GET_POLICY_BY_PEERID *Nov 11 19:30:34.834: IKEv2:Adding Proposal PHASE1-prop to toolkit policy *Nov 11 19:30:34.834: IKEv2:(SA ID = 1):Using IKEv2 profile 'IKEV2-SETUP' *Nov 11 19:30:34.834: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: I_PROC_AUTH Event: EV_VERIFY_POLICY_BY_PEERID *Nov 11 19:30:34.834: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: I_PROC_AUTH Event: EV_CHK_AUTH_TYPE *Nov 11 19:30:34.834: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: I_PROC_AUTH Event: EV_GET_PRESHR_KEY *Nov 11 19:30:34.835: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: I_PROC_AUTH Event:EV_VERIFY_AUTH *Nov 11 19:30:34.835: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: I_PROC_AUTH Event: EV_CHK_EAP *Nov 11 19:30:34.835: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: I_PROC_AUTH Event:EV_NOTIFY_AUTH_DONE *Nov 11 19:30:34.835: IKEv2:AAA group authorization is not configured *Nov 11 19:30:34.835: IKEv2:AAA user authorization is not configured *Nov 11 19:30:34.835: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: I_PROC_AUTH Event: EV_CHK_CONFIG_MODE *Nov 11 19:30:34.835: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: I_PROC_AUTH Event: EV_CHK4_IC *Nov 11 19:30:34.835: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: I_PROC_AUTH Event: EV_CHK_IKE_ONLY *Nov 11 19:30:34.835: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: I_PROC_AUTH Event: EV_PROC_SA_TS *Nov 11 19:30:34.835: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: AUTH_DONE Event: EV_OK *Nov 11 19:30:34.835: IKEv2:(SA ID = 1):Action: Action_Null *Nov 11 19:30:34.835: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: AUTH_DONE Event: EV_PKI_SESH_CLOSE *Nov 11 19:30:34.835: IKEv2:(SA ID = 1):Closing the PKI session *Nov 11 19:30:34.835: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: AUTH_DONE Event: EV_UPDATE_CAC_STATS *Nov 11 19:30:34.835: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: AUTH_DONE Event: EV_INSERT_IKE *Nov 11 19:30:34.835: IKEv2:Store mib index ikev2 1, platform 60 *Nov 11 19:30:34.835: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: AUTH_DONE Event: EV_GEN_LOAD_IPSEC *Nov 11 19:30:34.835: IKEv2:(SA ID = 1):Asynchronous request queued *Nov 11 19:30:34.835: IKEv2:(SA ID = 1): *Nov 11 19:30:34.835: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: AUTH_DONE Event: EV_NO_EVENT *Nov 11 19:30:34.835: IKEv2:KMI message 8 consumed.