Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

IPsec tunnel problems between Cisco router and WatchGuard Firebox

Hello,

I have a problem to establish a VPN connection between these two boxes. As a Cisco I use a 1721 router with the c1700-k8sy7-mz.122-15.T5.bin IOS.

A tunnel can be established only from Cisco box to WatchGuard Firebox. When Watchguard tries to establish a VPN connection, I get an error message on the Cisco

Aug 7 10:20:22.175: IPSEC(validate_proposal_request): proposal part #1,

(key eng. msg.) INBOUND local= 195.91.44.100, remote= 62.217.33.200,

local_proxy= 192.168.199.0/255.255.255.0/0/0 (type=4),

remote_proxy= 172.26.90.0/255.255.255.0/0/0 (type=4),

protocol= ESP, transform= esp-des esp-sha-hmac ,

lifedur= 0s and 0kb,

spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x2

Aug 7 10:20:22.175: IPSEC(kei_proxy): head = sycon, map->ivrf = , kei->ivrf =

Aug 7 10:20:22.175: IPSEC(validate_transform_proposal): invalid transform proposal flags -- 0x2

I have checked the transform-set settings on both devices and they were the same. Then I have changed the transorm-set from

crypto ipsec transform-set sycon-set esp-des esp-sha-hmac

to

crypto ipsec transform-set sycon-set esp-des esp-md5-hmac

but got the same error message.

The configuration on the router is simple

crypto isakmp policy 1

hash md5

authentication pre-share

crypto isakmp key xxxxxxx address xx.xxx.33.200

!

!

crypto ipsec transform-set sycon-set esp-des esp-md5-hmac

!

!

!

crypto map sycon local-address Loopback0

crypto map sycon 1 ipsec-isakmp

set peer 62.217.33.200

set security-association lifetime kilobytes 8192

set security-association lifetime seconds 86400

set transform-set sycon-set

set pfs group1

match address 110

!

interface Serial1.1 point-to-point

ip address xx.xx.44.106 255.255.255.252

frame-relay interface-dlci 16

crypto map sycon

!

access-list 110 permit ip xxx.xxxx.199.0 0.0.0.255 xxxx.26.90.0 0.0.0.255

If there is a problem with the transform-set, can someone explain me what are flags in "invalid transform proposal flags -- 0x2 " error message and their meaning?

I was in the belief, that when there is a problem with a tranform-set, I will get error message like this

IPSec (validate_proposal): transform proposal

(port 3, trans 2, hmac_alg 2) not supported

Thank you.

Peter

2 REPLIES
Bronze

Re: IPsec tunnel problems between Cisco router and WatchGuard Fi

New Member

Re: IPsec tunnel problems between Cisco router and WatchGuard Fi

I know about this link already, but did not find the answer in the document.

1229
Views
0
Helpful
2
Replies
CreatePlease to create content