Troubleshooting VPN Connectivity and ISAKMP Initiation
Identify the traffic that should go across the VPN, check the ACL configuration, and troubleshoot ISAKMP initiation. Follow the protocol flow steps to ensure proper communication between peers using UDP/500 and UDP/4500. Monitor ISAKMP SA entries and debug outputs to resolve any authentication or negotiation issues.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
Identify the traffic that should go across the VPN. Check the ACL configuration Try to ping across the tunnel using a ping that matches the ACL We should see ISAKMP initiate. Check show crypto isakmp sa to see if an entry is created for us to the remote peer. PROTOCOL FLOW The router should send a UDP/500 packet towards the other peer. i.e. (IOS) IPv4 Crypto ISAKMP SA dst src state conn-id status 172.18.254.4 172.18.254.89 MM_NO_STATE 0 ACTIVE MM1 Check that the responder actually receives that UDP/500 packet. via: packet capture on the interface Hits on an permit entry for an interface ACL Inbound Netflow counters on the interface
The responder should receive the MM1 packet and also create an entry in it s table. Check the table and see if there is an entry. The responder should process the packet and negotiate which ISAKMP policy to choose. debug crypto isakmp 128 should show you this. PROTOCOL FLOW If not successful you ll [IKEv1 DEBUG]IP = 172.18.254.89, All SA proposals found unacceptable If successful you ll see : [IKEv1 DEBUG]IP = 172.18.254.89, IKE SA Proposal # 1, Transform # 1 acceptable Matches global IKE entry # 5 At this point the responder should send back UDP/500 Main Mode Message 2. You can see that with show cry isakmp sa MM2 i.e. (ASA) 1 IKE Peer: 172.18.254.89 Type : user Role : responder Rekey : no State : MM_WAIT_MSG3
The initiator should receive the MM2 packet (UDP/500) process it. Debugs on IOS show: *Feb 1 21:44:23.314: ISAKMP (0): received packet from 1.1.1.102 dport 500 sport 500 Global (I) MM_NO_STATE *Feb 1 21:44:23.314: ISAKMP:(0):Old State = IKE_I_MM1 New State = IKE_I_MM2 PROTOCOL FLOW MM3 The initiator should then send back MM3 (UDP/500) Debugs on IOS show: *Feb 1 21:44:23.315: ISAKMP:(0): sending packet to 1.1.1.102 my_port 500 peer_port 500 (I) MM_SA_SETUP *Feb 1 21:44:23.315: ISAKMP:(0):Sending an IKE IPv4 Packet. *Feb 1 21:44:23.315: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE *Feb 1 21:44:23.315: ISAKMP:(0):Old State = IKE_I_MM2 New State = IKE_I_MM3 The responder should get the MM3 packet (UDP/500) and Return MM4 (UDP/500) MM4 *Feb 1 21:44:23.315: (0): received packet from 1.1.1.102 dport 500 sport 500 Global (I) MM_SA_SETUP *Feb 1 21:44:23.315: (0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH *Feb 1 21:44:23.315: (0):Old State = IKE_I_MM3 New State = IKE_I_MM4
At this point the Initiator has enough information to determine whether either of the peers are behind NAT. If they are not communication remains to occur on UDP/500, however if they are then it switches to UDP/4500 The initiator should send Main Mode message 5. *Feb 1 21:44:23.315: ISAKMP:(1002):Total payload length: 12 *Feb 1 21:44:23.315: ISAKMP:(1002): sending packet to 1.1.1.102 my_port 500 peer_port 500 (I) MM_KEY_EXCH *Feb 1 21:44:23.315: ISAKMP:(1002):Sending an IKE IPv4 Packet. *Feb 1 21:44:23.315: ISAKMP:(1002):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE *Feb 1 21:44:23.315: ISAKMP:(1002):Old State = IKE_I_MM4 New State = IKE_I_MM5 PROTOCOL FLOW R100#show cry isa sa IPv4 Crypto ISAKMP SA dst src state conn-id status 1.1.1.102 1.1.1.100 MM_KEY_EXCH 1006 ACTIVE MM5 The Responder should receive MM5 and authenticate the Initiator. If responder successfully authenticates the peer it will send back MM6. If it fails the authentication the responder will re-transmit the last successful packet (i.e. MM4) back to the initiator.
*Feb 1 21:44:23.315: ISAKMP (1002): received packet from 1.1.1.102 dport 500 sport 500 Global (I) MM_KEY_EXCH *Feb 1 21:44:23.315: ISAKMP:(1002): processing ID payload. message ID = 0 *Feb 1 21:44:23.315: ISAKMP (1002): ID payload next-payload : 8 type : 1 address : 1.1.1.102 protocol : 17 port : 500 length : 12 *Feb 1 21:44:23.315: ISAKMP:(0):: peer matches *none* of the profiles *Feb 1 21:44:23.315: ISAKMP:(1002): processing HASH payload. message ID = 0 *Feb 1 21:44:23.315: ISAKMP:(1002):SA authentication status: authenticated *Feb 1 21:44:23.315: ISAKMP:(1002):SA has been authenticated with 1.1.1.102 *Feb 1 21:44:23.315: ISAKMP: Trying to insert a peer 1.1.1.101/1.1.1.102/500/, and inserted successfully 52F9320. *Feb 1 21:44:23.315: ISAKMP:(1002):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH *Feb 1 21:44:23.315: ISAKMP:(1002):Old State = IKE_I_MM5 New State = IKE_I_MM6 PROTOCOL FLOW *Feb 1 21:44:23.315: ISAKMP:(1002):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE *Feb 1 21:44:23.315: ISAKMP:(1002):Old State = IKE_I_MM6 New State = IKE_P1_COMPLETE MM6 Phase 1 COMPLETE The Phase 1 SA negotiation is complete and the initiator will now propose a phase 2 to protect traffic.
The initiator will send QM1 which contains the requested IPsec SA parameters. *Feb 1 21:44:24.315: ISAKMP:(1002):beginning Quick Mode exchange, M-ID of 196323019 *Feb 1 21:44:24.315: ISAKMP:(1002):QM Initiator gets spi *Feb 1 21:44:24.315: ISAKMP:(1002): sending packet to 1.1.1.102 my_port 500 peer_port 500 (I) QM_IDLE *Feb 1 21:44:24.315: ISAKMP:(1002):Sending an IKE IPv4 Packet. *Feb 1 21:44:24.315: ISAKMP:(1002):Node 196323019, Input = IKE_MESG_INTERNAL, IKE_INIT_QM *Feb 1 21:44:24.315: ISAKMP:(1002):Old State = IKE_QM_READY New State = IKE_QM_I_QM1 QM1 PROTOCOL FLOW The responder will validate the proposal. It will check the proposed SA against it s ACL, peer, and transform configuration. It will send back QM2 to notify whether the proposal was accepted or not. If successful: *Feb 1 21:44:24.315: ISAKMP (1002): received packet from 1.1.1.102 dport 500 sport 500 Global (I) QM_IDLE *Feb 1 21:44:24.315: ISAKMP:(1002): processing HASH payload. message ID = 196323019 *Feb 1 21:44:24.315: ISAKMP:(1002): processing SA payload. message ID = 196323019 *Feb 1 21:44:24.315: ISAKMP:(1002):Checking IPSec proposal 1 *Feb 1 21:44:24.315: ISAKMP: transform 1, ESP_3DES *Feb 1 21:44:24.315: ISAKMP: attributes in transform: *Feb 1 21:44:24.315: ISAKMP: encaps is 2 (Transport) *Feb 1 21:44:24.315: ISAKMP: SA life type in seconds *Feb 1 21:44:24.315: ISAKMP: SA life duration (basic) of 3600 *Feb 1 21:44:24.315: ISAKMP: SA life type in kilobytes *Feb 1 21:44:24.315: ISAKMP: SA life duration (VPI) of 0x0 0x46 0x50 0x0 *Feb 1 21:44:24.315: ISAKMP: authenticator is HMAC-MD5 *Feb 1 21:44:24.315: ISAKMP:(1002):atts are acceptable.
If not successful: *Feb 1 21:44:23.315: ISAKMP (1002): received packet from 1.1.1.102 dport 500 sport 500 Global (I) QM_IDLE *Feb 1 21:44:23.315: ISAKMP: set new node 1984354591 to QM_IDLE *Feb 1 21:44:23.315: ISAKMP:(1002): processing HASH payload. message ID = 1984354591 *Feb 1 21:44:23.315: ISAKMP:(1002): processing NOTIFY PROPOSAL_NOT_CHOSEN protocol 3 spi 2340447730, message ID = 1984354591, sa = 4990F28 *Feb 1 21:44:23.315: ISAKMP:(1002): deleting spi 2340447730 message ID = 24306363 *Feb 1 21:44:23.315: ISAKMP:(1002):deleting node 24306363 error TRUE reason "Delete Larval" *Feb 1 21:44:23.315: ISAKMP:(1002):deleting node 1984354591 error FALSE reason "Informational (in) state 1" *Feb 1 21:44:23.315: ISAKMP:(1002):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY *Feb 1 21:44:23.315: ISAKMP:(1002):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE PROTOCOL FLOW QM2 The initiator will the acknowledge the acceptance with QM3 and complete the phase 2 installation. *Feb 1 21:44:23.315: ISAKMP:(1002): sending packet to 1.1.1.102 my_port 500 peer_port 500 (I) QM_IDLE *Feb 1 21:44:23.315: ISAKMP:(1002):Sending an IKE IPv4 Packet. *Feb 1 21:44:23.315: ISAKMP:(1002):deleting node 196323019 error FALSE reason "No Error" *Feb 1 21:44:23.315: ISAKMP:(1002):Node 196323019, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH *Feb 1 21:44:23.315: ISAKMP:(1002):Old State = IKE_QM_I_QM1 New State = IKE_QM_PHASE2_COMPLETE QM3 Phase 2 COMPLETE
