Trouble with FlexVPN IKEV2 FVRF configuration

Unanswered Question
Sep 10th, 2014
User Badges:

I'm having some problems getting a basic IKEV2  Hub/Spoke lab working with the WAN interfaces in a FVRF
The tunnel comes up but the quickly comes down. On the spoke there is an invalid_SPI message 

%CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd IPSEC packet has invalid spi for destaddr=32.153.1.2, prot=50, spi=0x5BFAB28A(1543156362), srcaddr=32.65.1.2, input interface=Serial2/0

At this point, the hub drops the tunnel... The process cycles thru this every minute or so.

DPD is enabled on the spoke, not the hub.   

I've attached the configs and a diagram.   Very basic setup.

Would appreciate a 2nd set of eyes reviewing it. 


 

Hub Config

aaa new-model
!
ip vrf INET1
 rd 65011:3
!
ip vrf INET2
 rd 65011:4
!
ip vrf MPLS1
 rd 65011:1
!
ip vrf MPLS2
 rd 65011:2
!
 
crypto ikev2 authorization policy default
 route set interface
 route set remote ipv4 10.0.0.0 255.0.0.0
 route set remote ipv4 159.208.0.0 255.255.0.0
!
!
!
crypto ikev2 keyring KEY1
 peer PEER
  address 0.0.0.0 0.0.0.0
  pre-shared-key local cisco
  pre-shared-key remote cisco
 !
 peer HK
  address 32.153.1.2
  pre-shared-key local cisco
  pre-shared-key remote cisco
 !
!
!
crypto ikev2 profile default
 match fvrf MPLS1
 match identity remote any
 identity local fqdn wka00ar1.aa.com
 authentication remote pre-share
 authentication local pre-share
 keyring local KEY1
 virtual-template 2
!
!
!
!
!
!
!
!
!
!
interface Loopback0
 ip address 10.255.65.20 255.255.255.255
 ip pim sparse-mode
!
interface Tunnel100
 ip unnumbered Loopback0
 ip nhrp network-id 1
 ip nhrp redirect
 tunnel source Ethernet0/0
 tunnel destination 10.0.61.10
!
interface Ethernet0/0
 ip address 10.0.65.10 255.255.255.248
 no ip proxy-arp
 ip pim sparse-mode
 ip ospf dead-interval 8
 ip ospf hello-interval 1
 load-interval 30
!
!
interface Serial2/0
 ip vrf forwarding MPLS1
 ip address 32.65.1.2 255.255.255.0
 no ip proxy-arp
 ip ospf dead-interval 8
 ip ospf hello-interval 1
 load-interval 30
 serial restart-delay 0
!
!
interface Virtual-Template2 type tunnel
 ip unnumbered Loopback0
 ip pim nbma-mode
 ip pim sparse-mode
 ip nhrp network-id 1
 ip nhrp redirect
 tunnel vrf MPLS1
 tunnel protection ipsec profile default
!

 

SPOKE Config 


aaa new-model
!
!
!
!


!
ip vrf INET1
 rd 65011:3
!
ip vrf INET2
 rd 65011:4
!
ip vrf MPLS1
 rd 65011:1
!
ip vrf MPLS2
 rd 65011:2
!
!

crypto ikev2 authorization policy default
 route set interface Ethernet0/0
 route set interface Loopback0
 route set interface
!
!
!
crypto ikev2 keyring KEY1
 peer PEER
  address 0.0.0.0 0.0.0.0
  pre-shared-key local cisco
  pre-shared-key remote cisco
 !
 peer WK
  address 32.65.1.2
  pre-shared-key local cisco
  pre-shared-key remote cisco
 !
!
!
crypto ikev2 profile default
 match fvrf MPLS1
 match identity remote any
 identity local fqdn hkar1.aa.com
 authentication remote pre-share
 authentication local pre-share
 keyring local KEY1
 dpd 10 2 on-demand
 virtual-template 2
!
!
!
interface Loopback0
 ip address 10.255.153.20 255.255.255.255
 ip pim sparse-mode
!
interface Tunnel0
 ip unnumbered Loopback0
 ip nhrp network-id 1
 ip nhrp shortcut virtual-template 1
 shutdown
 tunnel source Serial2/0
 tunnel destination 32.65.1.2
 tunnel vrf MPLS1
 tunnel protection ipsec profile default
!
interface Tunnel1
 no ip address
!
interface Ethernet0/0
 ip address 10.153.240.2 255.255.255.248
 no ip proxy-arp
 ip pim sparse-mode
 ip ospf dead-interval 8
 ip ospf hello-interval 1
 load-interval 30
!
interface Serial2/0
 ip vrf forwarding MPLS1
 ip address 32.153.1.2 255.255.255.0
 no ip proxy-arp
 ip ospf dead-interval 8
 ip ospf hello-interval 1
 load-interval 30
 serial restart-delay 0
!
interface Virtual-Template1 type tunnel
 ip unnumbered Loopback0
 ip nhrp network-id 1
 ip nhrp shortcut virtual-template 1
 tunnel protection ipsec profile default

DEBUG from the HUB


*Sep 11 01:52:23.679: IKEv2:Received Packet [From 32.153.1.2:500/To 32.65.1.2:500/VRF i0:f3] 
Initiator SPI : 7DA7A7092A773A3A - Responder SPI : 0000000000000000 Message id: 0
IKEv2 IKE_SA_INIT Exchange REQUEST 
Payload contents: 
 SA KE N VID VID NOTIFY(NAT_DETECTION_SOURCE_IP) NOTIFY(NAT_DETECTION_DESTINATION_IP) 

*Sep 11 01:52:23.679: IKEv2:(SESSION ID = 29,SA ID = 1):Verify SA init message
*Sep 11 01:52:23.679: IKEv2:(SESSION ID = 29,SA ID = 1):Insert SA
*Sep 11 01:52:23.679: IKEv2:Searching Policy with fvrf 3, local address 32.65.1.2
*Sep 11 01:52:23.679: IKEv2:Using the Default Policy for Proposal
*Sep 11 01:52:23.679: IKEv2:Found Policy 'default'
*Sep 11 01:52:23.679: IKEv2:(SESSION ID = 29,SA ID = 1):Processing IKE_SA_INIT message
*Sep 11 01:52:23.679: IKEv2:(SA ID = 1):[IKEv2 -> PKI] Retrieve configured trustpoint(s)
*Sep 11 01:52:23.679: IKEv2:(SA ID = 1):[PKI -> IKEv2] Retrieved trustpoint(s): NONE
*Sep 11 01:52:23.679: IKEv2:Failed to retrieve Certificate Issuer list
*Sep 11 01:52:23.679: IKEv2:(SESSION ID = 29,SA ID = 1):[IKEv2 -> Crypto Engine] Computing DH public key, DH Group 5
*Sep 11 01:52:23.679: IKEv2:(SA ID = 1):[Crypto Engine -> IKEv2] DH key Computation PASSED
*Sep 11 01:52:23.679: IKEv2:(SESSION ID = 29,SA ID = 1):Request queued for computation of DH key
*Sep 11 01:52:23.679: IKEv2:(SESSION ID = 29,SA ID = 1):[IKEv2 -> Crypto Engine] Computing DH secret key, DH Group 5
*Sep 11 01:52:23.687: IKEv2:(SA ID = 1):[Crypto Engine -> IKEv2] DH key Computation PASSED
*Sep 11 01:52:23.687: IKEv2:(SESSION ID = 29,SA ID = 1):Request queued for computation of DH secret
*Sep 11 01:52:23.687: IKEv2:(SA ID = 1):[IKEv2 -> Crypto Engine] Calculate SKEYSEED and create rekeyed IKEv2 SA
*Sep 11 01:52:23.687: IKEv2:(SA ID = 1):[Crypto Engine -> IKEv2] SKEYSEED calculation and creation of rekeyed IKEv2 SA PASSED
*Sep 11 01:52:23.687: IKEv2:IKEv2 responder - no config data to send in IKE_SA_INIT exch
*Sep 11 01:52:23.687: IKEv2:(SESSION ID = 29,SA ID = 1):Generating IKE_SA_INIT message
*Sep 11 01:52:23.687: IKEv2:(SESSION ID = 29,SA ID = 1):IKE Proposal: 1, SPI size: 0 (initial negotiation), 
Num. transforms: 4
   AES-CBC   SHA512   SHA512   DH_GROUP_1536_MODP/Group 5
*Sep 11 01:52:23.687: IKEv2:(SA ID = 1):[IKEv2 -> PKI] Retrieve configured trustpoint(s)
*Sep 11 01:52:23.687: IKEv2:(SA ID = 1):[PKI -> IKEv2] Retrieved trustpoint(s): NONE
*Sep 11 01:52:23.687: IKEv2:Failed to retrieve Certificate Issuer list 

*Sep 11 01:52:23.687: IKEv2:(SESSION ID = 29,SA ID = 1):Sending Packet [To 32.153.1.2:500/From 32.65.1.2:500/VRF i0:f3] 
Initiator SPI : 7DA7A7092A773A3A - Responder SPI : F54F6345509E7401 Message id: 0
IKEv2 IKE_SA_INIT Exchange RESPONSE 
Payload contents: 
 SA KE N VID VID NOTIFY(NAT_DETECTION_SOURCE_IP) NOTIFY(NAT_DETECTION_DESTINATION_IP) 

*Sep 11 01:52:23.687: IKEv2:(SESSION ID = 29,SA ID = 1):Completed SA init exchange
*Sep 11 01:52:23.687: IKEv2:(SESSION ID = 29,SA ID = 1):Starting timer (30 sec) to wait for auth message 

*Sep 11 01:52:23.713: IKEv2:(SESSION ID = 29,SA ID = 1):Received Packet [From 32.153.1.2:500/To 32.65.1.2:500/VRF i0:f3] 
Initiator SPI : 7DA7A7092A773A3A - Responder SPI : F54F6345509E7401 Message id: 1
IKEv2 IKE_AUTH Exchange REQUEST 
Payload contents: 
 VID IDi AUTH CFG SA TSi TSr NOTIFY(INITIAL_CONTACT) NOTIFY(USE_TRANSPORT_MODE) NOTIFY(SET_WINDOW_SIZE) NOTIFY(ESP_TFC_NO_SUPPORT) NOTIFY(NON_FIRST_FRAGS) 

*Sep 11 01:52:23.713: IKEv2:(SESSION ID = 29,SA ID = 1):Stopping timer to wait for auth message
*Sep 11 01:52:23.713: IKEv2:(SESSION ID = 29,SA ID = 1):Checking NAT discovery
*Sep 11 01:52:23.713: IKEv2:(SESSION ID = 29,SA ID = 1):NAT not found
*Sep 11 01:52:23.713: IKEv2:(SESSION ID = 29,SA ID = 1):Searching policy based on peer's identity 'hkar1.aa.com' of type 'FQDN'
*Sep 11 01:52:23.713: IKEv2:found matching IKEv2 profile 'default'
*Sep 11 01:52:23.713: IKEv2:% Getting preshared key from profile keyring KEY1
*Sep 11 01:52:23.713: IKEv2:% Matched peer block 'HK'
*Sep 11 01:52:23.713: IKEv2:Searching Policy with fvrf 3, local address 32.65.1.2
*Sep 11 01:52:23.713: IKEv2:Using the Default Policy for Proposal
*Sep 11 01:52:23.713: IKEv2:Found Policy 'default'
*Sep 11 01:52:23.713: IKEv2:(SESSION ID = 29,SA ID = 1):Verify peer's policy
*Sep 11 01:52:23.713: IKEv2:(SESSION ID = 29,SA ID = 1):Peer's policy verified
*Sep 11 01:52:23.713: IKEv2:(SESSION ID = 29,SA ID = 1):Get peer's authentication method
*Sep 11 01:52:23.713: IKEv2:(SESSION ID = 29,SA ID = 1):Peer's authentication method is 'PSK'
*Sep 11 01:52:23.713: IKEv2:(SESSION ID = 29,SA ID = 1):Get peer's preshared key for hkar1.aa.com
*Sep 11 01:52:23.713: IKEv2:(SESSION ID = 29,SA ID = 1):Verify peer's authentication data
*Sep 11 01:52:23.713: IKEv2:(SESSION ID = 29,SA ID = 1):Use preshared key for id hkar1.aa.com, key len 5
*Sep 11 01:52:23.713: IKEv2:[IKEv2 -> Crypto Engine] Generate IKEv2 authentication data
*Sep 11 01:52:23.713: IKEv2:[Crypto Engine -> IKEv2] IKEv2 authentication data generation PASSED
*Sep 11 01:52:23.713: IKEv2:(SESSION ID = 29,SA ID = 1):Verification of peer's authenctication data PASSED
*Sep 11 01:52:23.713: IKEv2:(SESSION ID = 29,SA ID = 1):Processing INITIAL_CONTACT
*Sep 11 01:52:23.713: IKEv2:(SESSION ID = 29,SA ID = 1):Received valid config mode data
*Sep 11 01:52:23.713: IKEv2:Config data recieved:
*Sep 11 01:52:23.713: Config-type: Config-request
*Sep 11 01:52:23.713: Attrib type: ipv4-dns, length: 0
*Sep 11 01:52:23.713: Attrib type: ipv4-dns, length: 0
*Sep 11 01:52:23.713: Attrib type: ipv4-nbns, length: 0
*Sep 11 01:52:23.713: Attrib type: ipv4-nbns, length: 0
*Sep 11 01:52:23.713: Attrib type: ipv4-subnet, length: 0
*Sep 11 01:52:23.713: Attrib type: ipv6-dns, length: 0
*Sep 11 01:52:23.713: Attrib type: ipv6-subnet, length: 0
*Sep 11 01:52:23.713: Attrib type: app-version, length: 256, data: Cisco IOS Software, 
Copyright (c) 1986-2013 by Cisco Systems, Inc.
Compiled Sat 23-Nov-13 03:28 by prod_rel_team
*Sep 11 01:52:23.713: Attrib type: split-dns, length: 0
*Sep 11 01:52:23.713: Attrib type: banner, length: 0
*Sep 11 01:52:23.713: Attrib type: config-url, length: 0
*Sep 11 01:52:23.713: Attrib type: backup-gateway, length: 0
*Sep 11 01:52:23.713: Attrib type: def-domain, length: 0
*Sep 11 01:52:23.713: IKEv2:(SESSION ID = 29,SA ID = 1):Set received config mode data
*Sep 11 01:52:23.713: IKEv2:(SESSION ID = 29,SA ID = 1):Processing IKE_AUTH message
*Sep 11 01:52:23.713: IKEv2:% DVTI create request sent for profile default with PSH index 1.

*Sep 11 01:52:23.713: IKEv2:(SESSION ID = 29,SA ID = 1):
*Sep 11 01:52:23.713: IKEv2:(SESSION ID = 28,SA ID = 2):Deleting SA
*Sep 11 01:52:23.713: IPSEC(send_delete_notify_kmi): not sending KEY_ENGINE_DELETE_SAS
*Sep 11 01:52:23.713: IPSEC: sa null
*Sep 11 01:52:23.714: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access1, changed state to down
*Sep 11 01:52:23.714: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access2, changed state to down
*Sep 11 01:52:23.714: %LINK-3-UPDOWN: Interface Virtual-Access2, changed state to down

 

 

DEBUG from the SPOKE

hkar1(config)#int t0
hkar1(config-if)#no shut
hkar1(config-if)#
*Sep 11 01:52:23.670: insert of map into mapdb AVL failed, map + ace pair already exists on the mapdb
*Sep 11 01:52:23.670: IKEv2:% Getting preshared key from profile keyring KEY1
*Sep 11 01:52:23.670: IKEv2:% Matched peer block 'WK'
*Sep 11 01:52:23.670: IKEv2:Searching Policy with fvrf 3, local address 32.153.1.2
*Sep 11 01:52:23.670: IKEv2:Using the Default Policy for Proposal
*Sep 11 01:52:23.670: IKEv2:Found Policy 'default'
*Sep 11 01:52:23.670: IKEv2:(SESSION ID = 1,SA ID = 1):[IKEv2 -> Crypto Engine] Computing DH public key, DH Group 5
*Sep 11 01:52:23.670: IKEv2:(SA ID = 1):[Crypto Engine -> IKEv2] DH key Computation PASSED
*Sep 11 01:52:23.670: IKEv2:(SESSION ID = 1,SA ID = 1):Request queued for computation of DH key
*Sep 11 01:52:23.670: IKEv2:IKEv2 initiator - no config data to send in IKE_SA_INIT exch
*Sep 11 01:52:23.670: IKEv2:(SESSION ID = 1,SA ID = 1):Generating IKE_SA_INIT message
*Sep 11 01:52:23.670: IKEv2:(SESSION ID = 1,SA ID = 1):IKE Proposal: 1, SPI size: 0 (initial negotiation), 
Num. transforms: 15
   AES-CBC   AES-CBC   AES-CBC   SHA512   SHA384   SHA256   SHA1   MD5   SHA512   SHA384   SHA256   SHA96   MD596   DH_GROUP_1536_MODP/Group 5   DH_GROUP_1024_MODP/Group 2 

*Sep 11 01:52:23.671: IKEv2:(SESSION ID = 1,SA ID = 1):Sending Packet [To 32.65.1.2:500/From 32.153.1.2:500/VRF i3:f3] 
Initiator SPI : 7DA7A7092A773A3A - Responder SPI : 0000000000000000 Message id: 0
IKEv2 IKE_SA_INIT Exchange REQUEST 
Payload contents: 
 SA KE N VID VID NOTIFY(NAT_DETECTION_SOURCE_IP) NOTIFY(NAT_DETECTION_DESTINATION_IP) 

*Sep 11 01:52:23.671: IKEv2:(SESSION ID = 1,SA ID = 1):Insert SA 

*Sep 11 01:52:23.696: IKEv2:(SESSION ID = 1,SA ID = 1):Received Packet [From 32.65.1.2:500/To 32.153.1.2:500/VRF i3:f3] 
Initiator SPI : 7DA7A7092A773A3A - Responder SPI : F54F6345509E7401 Message id: 0
IKEv2 IKE_SA_INIT Exchange RESPONSE 
Payload contents: 
 SA KE N VID VID NOTIFY(NAT_DETECTION_SOURCE_IP) NOTIFY(NAT_DETECTION_DESTINATION_IP) 

*Sep 11 01:52:23.696: IKEv2:(SESSION ID = 1,SA ID = 1):Processing IKE_SA_INIT message
*Sep 11 01:52:23.696: IKEv2:(SESSION ID = 1,SA ID = 1):Verify SA init message
*Sep 11 01:52:23.696: IKEv2:(SESSION ID = 1,SA ID = 1):Processing IKE_SA_INIT message
*Sep 11 01:52:23.696: IKEv2:(SESSION ID = 1,SA ID = 1):Checking NAT discovery
*Sep 11 01:52:23.696: IKEv2:(SESSION ID = 1,SA ID = 1):NAT not found
*Sep 11 01:52:23.696: IKEv2:(SESSION ID = 1,SA ID = 1):[IKEv2 -> Crypto Engine] Computing DH secret key, DH Group 5
*Sep 11 01:52:23.704: IKEv2:(SA ID = 1):[Crypto Engine -> IKEv2] DH key Computation PASSED
*Sep 11 01:52:23.704: IKEv2:(SESSION ID = 1,SA ID = 1):Request queued for computation of DH secret
*Sep 11 01:52:23.704: IKEv2:(SA ID = 1):[IKEv2 -> Crypto Engine] Calculate SKEYSEED and create rekeyed IKEv2 SA
*Sep 11 01:52:23.704: IKEv2:(SA ID = 1):[Crypto Engine -> IKEv2] SKEYSEED calculation and creation of rekeyed IKEv2 SA PASSED
*Sep 11 01:52:23.704: IKEv2:(SESSION ID = 1,SA ID = 1):Completed SA init exchange
*Sep 11 01:52:23.704: IKEv2:Config data to send:
*Sep 11 01:52:23.704: Config-type: Config-request
*Sep 11 01:52:23.704: Attrib type: ipv4-dns, length: 0
*Sep 11 01:52:23.704: Attrib type: ipv4-dns, length: 0
*Sep 11 01:52:23.704: Attrib type: ipv4-nbns, length: 0
*Sep 11 01:52:23.704: Attrib type: ipv4-nbns, length: 0
*Sep 11 01:52:23.704: Attrib type: ipv4-subnet, length: 0
*Sep 11 01:52:23.704: Attrib type: ipv6-dns, length: 0
*Sep 11 01:52:23.704: Attrib type: ipv6-subnet, length: 0
*Sep 11 01:52:23.704: Attrib type: app-version, length: 256, data: Cisco IOS Software, Linux Software (I86BI_LINUX-ADVENTERPRISEK9-M), Version 15.4(1)T, DEVELOPMENT TEST SOFTWARE
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2013 by Cisco Systems, Inc.
Compiled Sat 23-Nov-13 03:28 by prod_rel_team
*Sep 11 01:52:23.704: Attrib type: split-dns, length: 0
*Sep 11 01:52:23.704: Attrib type: banner, length: 0
*Sep 11 01:52:23.704: Attrib type: config-url, length: 0
*Sep 11 01:52:23.704: Attrib type: backup-gateway, length: 0
*Sep 11 01:52:23.704: Attrib type: def-domain, length: 0
*Sep 11 01:52:23.704: IKEv2:(SESSION ID = 1,SA ID = 1):Have config mode data to send
*Sep 11 01:52:23.704: IKEv2:(SESSION ID = 1,SA ID = 1):Check for EAP exchange
*Sep 11 01:52:23.704: IKEv2:(SESSION ID = 1,SA ID = 1):Generate my authentication data
*Sep 11 01:52:23.704: IKEv2:(SESSION ID = 1,SA ID = 1):Use preshared key for id hkar1.aa.com, key len 5
*Sep 11 01:52:23.704: IKEv2:[IKEv2 -> Crypto Engine] Generate IKEv2 authentication data
*Sep 11 01:52:23.704: IKEv2:[Crypto Engine -> IKEv2] IKEv2 authentication data generation PASSED
*Sep 11 01:52:23.704: IKEv2:(SESSION ID = 1,SA ID = 1):Get my authentication method
*Sep 11 01:52:23.704: IKEv2:(SESSION ID = 1,SA ID = 1):My authentication method is 'PSK'
*Sep 11 01:52:23.704: IKEv2:(SESSION ID = 1,SA ID = 1):Check for EAP exchange
*Sep 11 01:52:23.704: IKEv2:(SESSION ID = 1,SA ID = 1):Generating IKE_AUTH message
*Sep 11 01:52:23.704: IKEv2:(SESSION ID = 1,SA ID = 1):Constructing IDi payload: 'hkar1.aa.com' of type 'FQDN'
*Sep 11 01:52:23.704: IKEv2:(SESSION ID = 1,SA ID = 1):ESP Proposal: 1, SPI size: 4 (IPSec negotiation), 
Num. transforms: 3
   AES-CBC   SHA96   Don't use ESN
*Sep 11 01:52:23.704: IKEv2:(SESSION ID = 1,SA ID = 1):Building packet for encryption.  
Payload contents: 
 VID IDi AUTH CFG SA TSi TSr NOTIFY(INITIAL_CONTACT) NOTIFY(USE_TRANSPORT_MODE) NOTIFY(SET_WINDOW_SIZE) NOTIFY(ESP_TFC_NO_SUPPORT) NOTIFY(NON_FIRST_FRAGS) 

*Sep 11 01:52:23.704: IKEv2:(SESSION ID = 1,SA ID = 1):Sending Packet [To 32.65.1.2:500/From 32.153.1.2:500/VRF i3:f3] 
Initiator SPI : 7DA7A7092A773A3A - Responder SPI : F54F6345509E7401 Message id: 1
IKEv2 IKE_AUTH Exchange REQUEST 
Payload contents: 
 ENCR 

 

*Sep 11 01:52:23.849: IKEv2:(SESSION ID = 1,SA ID = 1):Received Packet [From 32.65.1.2:500/To 32.153.1.2:500/VRF i3:f3] 
Initiator SPI : 7DA7A7092A773A3A - Responder SPI : F54F6345509E7401 Message id: 1
IKEv2 IKE_AUTH Exchange RESPONSE 
Payload contents: 
 VID IDr AUTH SA TSi TSr NOTIFY(USE_TRANSPORT_MODE) NOTIFY(SET_WINDOW_SIZE) NOTIFY(ESP_TFC_NO_SUPPORT) NOTIFY(NON_FIRST_FRAGS) 

*Sep 11 01:52:23.849: IKEv2:(SESSION ID = 1,SA ID = 1):Process auth response notify
*Sep 11 01:52:23.849: IKEv2:(SESSION ID = 1,SA ID = 1):Searching policy based on peer's identity 'wka00ar1.aa.com' of type 'FQDN'
*Sep 11 01:52:23.849: IKEv2:(SESSION ID = 1,SA ID = 1):: Failed to locate an item in the database
*Sep 11 01:52:23.849: IKEv2:(SESSION ID = 1,SA ID = 1):
hkar1(config-if)#Verification of peer's authentication data FAILED
*Sep 11 01:52:23.849: IKEv2:(SESSION ID = 1,SA ID = 1):Auth exchange failed
*Sep 11 01:52:23.849: IKEv2:(SESSION ID = 1,SA ID = 1):: Auth exchange failed
*Sep 11 01:52:23.849: IKEv2:(SESSION ID = 1,SA ID = 1):Abort exchange
*Sep 11 01:52:23.849: IKEv2:(SESSION ID = 1,SA ID = 1):Deleting SA
hkar1(config-if)#
*Sep 11 01:52:25.668: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to up
hkar1(config-if)#
*Sep 11 01:52:25.669: %LINK-3-UPDOWN: Interface Tunnel0, changed state to up
hkar1(config-if)#
*Sep 11 01:52:26.654: %CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd IPSEC packet has invalid spi for destaddr=32.153.1.2, prot=50, spi=0x6C2951F6(1814647286), srcaddr=32.65.1.2, input interface=Serial2/0
hkar1(config-if)#
hkar1(config-if)#
hkar1(config-if)#
hkar1(config-if)#
hkar1(config-if)#end
hkar1#
*Sep 11 01:52:47.325: %SYS-5-CONFIG_I: Configured from console by console
hkar1#sh cry sess
Crypto session current status

Interface: Tunnel0
Session status: DOWN
Peer: 32.65.1.2 port 500 
  IPSEC FLOW: permit 47 host 32.153.1.2 host 32.65.1.2 
        Active SAs: 0, origin: crypto map

hkar1#
hkar1#

 

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.

Actions

This Discussion