Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Community Member

Problem between ASA and Strongswan in L2L configuration

We are using ASA 5510 with 8.2(5)  and trying to have a L2L session with Strongswan at the other side.

We get phase 1 established but ASA rejects phase 2 due to crypto match policy not found. We expect them to hide under their public address and whenever they try to do that phase 2 fails (they seem to come under their private address) but their VPN administrator says the Strongswan is configured to hide behind the public address. Is this a known problem between ASA & Strongswan?

Thank you

Darius.Fariborz@cgi.com

 

2 REPLIES

Hi Darius ,  Below URL should

Hi Darius , 

 Below URL should support your requirement .

http://www.cisco.com/c/en/us/support/docs/ip/internet-key-exchange-ike/117258-config-l2l.html

 

StrongSwan ipsec.conf:
config setup
charonstart=yes
plutostart=yes
conn %default
keyexchange=ikev2
ike=aes256-sha1-modp1536

conn siteA
left=3.3.3.3
leftsubnet=10.179.128.0/19
leftid=3.3.3.3
leftauth=psk
right=2.2.2.2
rightsubnet=10.10.0.0/16
rightid=2.2.2.2
rightauth=psk
auto=add

include /var/lib/strongswan/ipsec.conf.inc

StrongSwan ipsec.secrets:

include /var/lib/strongswan/ipsec.secrets.inc
2.2.2.2 : PSK "12345"
3.3.3.3 : PSK "12345"

ASA Config:
crypto map Outside_map 8 match address Outside_cryptomap_10
crypto map Outside_map 8 set pfs group5
crypto map Outside_map 8 set peer 3.3.3.3
crypto map Outside_map 8 set ikev2 ipsec-proposal AES256
crypto map Outside_map 8 set ikev2 pre-shared-key 12345

tunnel-group 3.3.3.3 type ipsec-l2l
tunnel-group 3.3.3.3 general-attributes
default-group-policy policy-3.3.3.3
tunnel-group 3.3.3.3 ipsec-attributes
ikev2 remote-authentication pre-shared-key 12345
ikev2 local-authentication pre-shared-key 12345

group-policy policy-3.3.3.3 internal
group-policy policy-3.3.3.3
vpn-tunnel-protocol ikev2

crypto ikev2 policy 1
encryption aes-256
integrity sha
group 5
prf sha
lifetime seconds 86400

 

Let me know if you need further help . 

 

HTH

Sandy

Hi Darius, What is the error

Hi Darius,

 

What is the error you are getting on ASA end? What is the crypto ACL you have defined @ your ASA end??? what is the crypto rules or encryption domain @ strongswan end??

 

If possible provide your end configs as well as strongswan end configs that are related to vpn....

 

Regards

Karthik

 

1458
Views
0
Helpful
2
Replies
CreatePlease to create content