ISAKMP: illegal udp len

Unanswered Question
Jan 27th, 2010

Experts ,

I am trying to establish a Site 2 Site VPN  btw our  Pix 501 6.3(5) to   customer , pix 515 (8.x) , they have provided with following

DH Group

5

Authentication

ESP/SHA/HMAC-128

Encryption

3DES

IKE-Proposal

IKE-3DES-SHA

Digital Certificate

None (Preshare key used)

IPSec NAT-T

Enabled

Bandwidth Policy

None

So i have created the following config on my 501  ,

access-list outside_cryptomap_290 permit ip host a.a.a.a host x.x.x.x

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto map outside_map 290 ipsec-isakmp
crypto map outside_map 290 match address outside_cryptomap_290
crypto map outside_map 290 set peer P.Q.R.S
crypto map outside_map 290 set transform-set ESP-3DES-SHA

isakmp key ******** address P.Q.R.S netmask 255.255.255.255 no-xauth no-config-mode

isakmp policy 210 authentication pre-share
isakmp policy 210 encryption 3des
isakmp policy 210 hash sha
isakmp policy 210 group 5
isakmp policy 210 lifetime 86400

With this configuration , we are getting  "illegal UDP Length" when used "Debug Crypto Isakmp"

Below is the debug

ISAKMP msg received

crypto_isakmp_process_block:src:P.Q.R.S, dest:A.B.C.Dspt:500 dpt:500

gen_cookie:

fill_sa_key:isadb_search returned sa = 0xfc8a84

ipsec_db_get_ipsec_sa_list:

ipsec_db_add_ipsec_sa_list:

ipsec_db_get_ipsec_sa_list:

compute_quick_mode_iv:

isakmp_ce_decrypt_payload:

pix_des_decrypt: data 0x82c148, len 104

des_encdec:

validate_payload: len 132

valid_payload:

valid_payload:

ISAKMP_INFO exchange

process_isakmp_info:

verify_qm_hash:

ipsec_db_get_ipsec_sa_list:

process_isakmp_packet:

process_notify:

ISAKMP (0): processing NOTIFY payload 14 protocol 0

spi 0, message ID = 2754729373

ipsec_db_delete_ipsec_sa_list:

ipsec_db_delete_sa_list_entry:

return status is IKMP_NO_ERR_NO_TRANS

ipsec_db_delete_ipsec_sa_list:

PEER_REAPER_TIMER

ISAKMP (0): retransmitting phase 2 (0/0)... mess_id 0x2763fd48

send_response:

isakmp_send: ip P.Q.R.S, port 500

ISAKMP msg received

crypto_isakmp_process_block:src:P.Q.R.S, dest:A.B.C.D spt:500 dpt:500

ISAKMP: illegal udp len

Any help will be greatly appreciated .


I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Ivan Martinon Wed, 01/27/2010 - 08:20

Has this pix had any vpn configured on it before and already working or this is the first vpn configured on it? Can you post the whole vpn config where we can see where is the "isakmp enable outside" and the "crypto map XXXX interface outside"?

ciscosom Wed, 01/27/2010 - 21:38

Good Morning Ivan ,

First of Thanks for responding to my Question , Yes i have couple of VPN's that are working fine , Infact I got any e-mail back from the Customer saying that they had to change the IKE  Encryption  on thier PIX  After that VPN Came back up , So we are good Now . .

Again , Thanks a ton for your willlingness to Help .

Rds,

Som

Actions

This Discussion