cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
3065
Views
5
Helpful
2
Replies

RA-VPN and All SA proposals found unacceptable

andrew-susag
Level 1
Level 1

Hi all. I'm at a loss of what I've done to screw up this RA VPN. I had it all configured and working properly, then made some changes via ASDM which seemed to muck everything up.

Anyone willing to take a look at this and see where I screwed up? I left all the config in, including the other tunnel-groups. The one I'm concerned with though is the ipsec-ra tunnel.

I appreciate it, thanks.

Jan 08 08:07:57 [IKEv1]: IP = 64.x.x.x, Connection landed on tunnel_group caleavpn

Jan 08 08:07:57 [IKEv1 DEBUG]: Group = caleavpn, IP = 64.x.x.x, processing IKE SA payload

Jan 08 08:07:57 [IKEv1]: IP = 64.x.x.x, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + NOTIFY (11) + NONE (0) total length : 596

Jan 08 08:07:57 [IKEv1 DEBUG]: Group = caleavpn, IP = 64.x.x.x, All SA proposals found unacceptable

Jan 08 08:07:57 [IKEv1]: IP = 64.x.x.x, All IKE SA proposals found unacceptable!

Jan 08 08:07:57 [IKEv1 DEBUG]: Group = caleavpn, IP = 64.x.x.x, IKE AM Responder FSM error history (struct &0x39f8c00) <state>, <event>: AM_DONE, EV_ERROR-->AM_BLD_MSG2, EV_PROCESS_SA-->AM_BLD_MSG2, EV_GROUP_LOOKUP-->AM_BLD_MSG2, EV_PROCESS_MSG-->AM_BLD_MSG2, EV_CREATE_TMR-->AM_START, EV_RCV_MSG-->AM_START, EV_START_AM-->AM_START, EV_START_AM

Jan 08 08:07:57 [IKEv1 DEBUG]: Group = caleavpn, IP = 64.x.x.x, IKE SA AM:1e56eabb terminating: flags 0x0100c001, refcnt 0, tuncnt 0

Jan 08 08:07:57 [IKEv1 DEBUG]: Group = caleavpn, IP = 64.x.x.x, sending delete/delete with reason message

Jan 08 08:07:57 [IKEv1]: Group = caleavpn, IP = 64.x.x.x, Removing peer from peer table failed, no match!

Jan 08 08:07:57 [IKEv1]: Group = caleavpn, IP = 64.x.x.x, Error: Unable to remove PeerTblEntry

2 Replies 2

dominic.caron
Level 5
Level 5

Hi,

It's in your IKE config...

In asdm, in Remote Access VPN/advanced/ipsec/Ike policies

If I remember correctly, the IPsec vpn client work with md5 and not sha

Please rate helpful post

whanson
Level 2
Level 2

I don't believe the vpn client can support isakmp policy group 5. You need to add one with group 2. too much cpu churning

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: