Hi all,

I am facing a peculiar issue with ISAKMP initialization.

I have configured Pre-shared keys in "derby" router to get registered with "KS" router.

Issue: "derby" is not able to initialie the SA saying "no pre-shared or cert key available for peer" though it's clearly there in the config.

I am pasting relevant configs of both routers as I could not able to upload the document.

--------

At Derby Router

ip host KS 19.1.1.1

!

!

ip vrf MBT

rd 100:1

route-target export 100:1

route-target import 100:1

!

ip vrf VC

rd 200:1

route-target export 200:1

route-target import 200:1

!

multilink bundle-name authenticated

!

!

archive

log config

  hidekeys

!

!

crypto isakmp policy 1

encr 3des

authentication pre-share

group 2

lifetime 3600

!

crypto isakmp policy 30

encr aes

authentication pre-share

group 2

lifetime 1200

crypto isakmp key Cisco address 19.1.1.1

crypto isakmp key Cisco hostname KS

crypto isakmp identity hostname

!

!

crypto ipsec transform-set rtpset-3des esp-3des esp-md5-hmac

mode transport

crypto ipsec transform-set test esp-3des esp-sha-hmac

mode transport

crypto ipsec df-bit clear

crypto gdoi group getvpn

identity number 1234

server address ipv4 19.1.1.1

!

!

crypto map getvpn-map 10 gdoi

set group getvpn

!

--------

At KS Router

ip cef

ip host derby 210.1.1.1

!

!

ip vrf exit

!

multilink bundle-name authenticated

!

!

archive

log config

  hidekeys

!

!

crypto isakmp policy 10

encr aes

authentication pre-share

group 2

crypto isakmp key Cisco address 200.1.1.1

crypto isakmp key Cisco address 210.1.1.1

!

!

crypto ipsec transform-set mygdoi-trans esp-3des esp-sha-hmac

!

crypto ipsec profile gdoi-profile-getvpn

set security-association lifetime seconds 7200

set transform-set mygdoi-trans

!

crypto gdoi group getvpn

identity number 1234

server local

  ! Incomplete unicast rekey configuration

  ! Rekey address is not configured

  rekey retransmit 40 number 2

  rekey authentication mypubkey rsa getvpn-export-general

  rekey transport unicast

  sa receive-only

  sa ipsec 1

   profile gdoi-profile-getvpn

   match address ipv4 199

   replay time window-size 5

!

---------

It's giving the following message in "debug crypto isakmp" output.

derby#clear crypto gdoi

% The Key Server and Group Member will destroy created and downloaded policies.

% All Group Members are required to re-register.

Are you sure you want to proceed ? [yes/no]: y

mahindra_bt_derby#

*Mar  1 00:42:23.547: %GDOI-4-GM_RE_REGISTER: The IPSec SA created for group get

vpn may have expired/been cleared, or didn't go through. Re-register to KS.

*Mar  1 00:42:23.551: %CRYPTO-5-GM_REGSTER: Start registration to KS 19.1.1.1 fo

r group getvpn using address 210.1.1.1

*Mar  1 00:42:23.555: ISAKMP:(0): SA request profile is (NULL)

*Mar  1 00:42:23.555: ISAKMP: Created a peer struct for 19.1.1.1, peer port 848

*Mar  1 00:42:23.555: ISAKMP: New peer created peer = 0x65D46EFC peer_handle = 0

x80000014

*Mar  1 00:42:23.555: ISAKMP: Locking peer struct 0x65D46EFC, refcount 1 for isa

kmp_initiator

*Mar  1 00:42:23.555: ISAKMP: local port 848, remote port 848

*Mar  1 00:42:23.559: ISAKMP: set new node 0 to QM_IDLE

*Mar  1 00:42:23.559: ISAKMP:(0):Switching to SW IKE SA: sa is 668061FC, ce_id i

s 80000003

*Mar  1 00:42:23.559: insert sa successfully sa = 668061FC

*Mar  1 00:42:23.563: ISAKMP:(0):Can not start Aggressive mode, trying Main mode

.

*Mar  1 00:42:23.563: ISAKMP:(0):No pre-shared key with 19.1.1.1!

*Mar  1 00:42:23.563: ISAKMP:(0): No Cert or pre-shared address key.

*Mar  1 00:42:23.563: ISAKMP:(0): construct_initial_message: Can not start Main

mode

*Mar  1 00:42:23.567: ISAKMP: Unlocking peer struct 0x65D46EFC for isadb_unlock_

peer_delete_sa(), count 0

*Mar  1 00:42:23.567: ISAKMP: Deleting peer node by peer_reap for 19.1.1.1: 65D4

6EFC

*Mar  1 00:42:23.567: ISAKMP:(0):purging SA., sa=668061FC, delme=668061FC

*Mar  1 00:42:23.571: ISAKMP:(0):purging node 514398065

*Mar  1 00:42:23.571: ISAKMP:(0):cleaning up GDOI node 514398065

*Mar  1 00:42:23.571: ISAKMP: Error while processing SA request: Failed to initi

alize SA

*Mar  1 00:42:23.575: ISAKMP: Error while processing KMI message 0, error 2.

derby#

I have attached the relevant configs attached.

I had spent a lot of time to figure out any issue with configurations but could not able to locate any. And, it's pretty strange why it's saying "no PSK" is available for peer 19.1.1.1 when it is explicitly configured in the config.

After a lot of search in Google, I have found similar issue & the solution was with "ip host" commands. Unfortunately, this solution also didn't work.

Can somebody through light on this about solution or how we can troubleshoot this issue to find root cause?

Regards...

-Ashok.