Re: IOS to PIX IPSec connection and debug

tato386 · ‎04-30-2003

I am having trouble establishing an IPSec connection from an IOS router to a PIX. I gathered some debugs from the router which I have pasted below. However, I cannot gather debugs from the PIX. On the PIX I am SSH'ed in, run "term mon" and "debug crypto isa" and "debug crypto ipsec" but nothing shows up?! Maybe the debug below from the router will be enough to figure this out.

Thanks,

Diego

00:24:36: ISAKMP (0:24): sending packet to 65.171.249.3 (I) MM_NO_STATE

00:24:45: ISAKMP (0:23): purging node 1839754454

00:24:45: ISAKMP (0:23): purging node -1360301828

00:24:46: ISAKMP (0:24): retransmitting phase 1 MM_NO_STATE...

00:24:46: ISAKMP (0:24): incrementing error counter on sa: retransmit phase 1

00:24:46: ISAKMP (0:24): retransmitting phase 1 MM_NO_STATE

00:24:46: ISAKMP (0:24): sending packet to 65.171.249.3 (I) MM_NO_STATE

00:24:55: ISAKMP (0:23): purging SA., sa=812CC748, delme=812CC748

00:24:56: ISAKMP: received ke message (3/1)

00:24:56: ISAKMP (0:24): peer does not do paranoid keepalives.

00:24:56: ISAKMP (0:24): deleting SA reason "gen_ipsec_isakmp_delete but doi isa

kmp" state (I) MM_NO_STATE (peer 65.171.249.3) input queue 0

00:24:56: ISAKMP (0:24): deleting SA reason "gen_ipsec_isakmp_delete but doi isa

kmp" state (I) MM_NO_STATE (peer 65.171.249.3) input queue 0

00:24:56: ISAKMP (0:24): deleting node -760159506 error TRUE reason "gen_ipsec_i

sakmp_delete but doi isakmp"

00:24:56: ISAKMP (0:24): deleting node -1735894751 error TRUE reason "gen_ipsec_

isakmp_delete but doi isakmp"

00:24:56: ISAKMP (0:24): Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL

Old State = IKE_I_MM1 New State = IKE_DEST_SA

00:24:56: ISAKMP: received ke message (1/1)

00:24:56: ISAKMP: local port 500, remote port 500

00:24:56: ISAKMP: set new node 0 to QM_IDLE

00:24:56: ISAKMP (0:25): Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM

Old State = IKE_READY New State = IKE_I_MM1

00:24:56: ISAKMP (0:25): beginning Main Mode exchange

00:24:56: ISAKMP (0:25): sending packet to 65.171.249.3 (I) MM_NO_STATE

00:25:06: ISAKMP (0:25): retransmitting phase 1 MM_NO_STATE...

00:25:06: ISAKMP (0:25): incrementing error counter on sa: retransmit phase 1

00:25:06: ISAKMP (0:25): retransmitting phase 1 MM_NO_STATE

gfullage · ‎04-30-2003

00:24:56: ISAKMP (0:25): sending packet to 65.171.249.3 (I) MM_NO_STATE

00:25:06: ISAKMP (0:25): retransmitting phase 1 MM_NO_STATE...

00:25:06: ISAKMP (0:25): incrementing error counter on sa: retransmit phase 1

00:25:06: ISAKMP (0:25): retransmitting phase 1 MM_NO_STATE

This shows the router sending out ISAKMP packets, but getting no response from the PIX, and then retransmitting them. We need to see the debug from the PIX to see if the packets are even getting there (if not, this is possibly why you're not seeing any debug on the PIX), or whether they're getting there, the PIX responds but the response doesn't make it back to the router.

On the PIX, make sure you have "logging on" and "logging console debug" and even " logging monitor debug" enabled. Try bringing up the tunnel from a host behind the PIX and see what output you get.