Hello everyone,

We upgraded our ASA from 7.2(5) to 9.1(7) and non Cisco Cisco IKEv1 Remote Access VPN now fail.

Phase 1 is OK, AAA user auth is successful but we have the following errors in ASDM :
Group = XXX, Username = XXXX, IP = 80.12.X.Y, QM FSM error (P2 struct &0x7659d900, mess id 0x60ecf534)!
Group = XXX, Username = XXXX, IP = 80.12.X.Y, Aborting Connection: IKEv1 RA client which did not request an assigned IP is attempting to establish a phase 2 SA for 10.59.Z.Z.

IP of client at the other end of tunnel (10.59.Z.Z) is static, there is NO client address assignement policy :
no vpn-addr-assign aaa
no vpn-addr-assign dhcp
no vpn-addr-assign local

We can't change this behavior/configuration on remote devices.

I found on bug search tool this bug CSCuo45321 "ASA allows IKEv1 clients to bypass address assignment, causing conflict" which is "fix" on my version.
I don't find a way to bypass address assignment now.
Could you help us, please ?
Thanks !


Philippe