IKEv2 Payload Types Transform Type Values IKEv2 Transform Attribute Types Transform Type 1 - Encryption Algorithm Transform IDs Transform Type 2 - Pseudorandom Function Transform IDs Transform Type 3 - Integrity Algorithm Transform IDs Transform Type 4 - Key Exchange Method Transform IDs Transform Type 5 - Extended Sequence Numbers Transform IDs In the IKEv1 Phase 1 settings, you can select one of these modes: Main Mode. No action taken. Router 1 then inserts this SA into its SAD. In my case even after adding the ACL entry there was another step which was needed to fix this tunnel. These messages negotiate cryptographic algorithms, exchange nonces, and do a Diffie-Hellman exchange. #crypto ikev2 policy cisco. Related Community Discussions View Bug Details in Bug Search Tool Why Is Login Required? KEi (Key-optional): The CREATE_CHILD_SA request might optionally contain a KE payload for an additional DH exchange to enable stronger guarantees of forward secrecy for the CHILD_SA. The link you shared is for a vEdge setup, the one I've found is for cEdge 16.12.x. Same here. Use these resources to familiarize yourself with the community: The display of Helpful votes has changed click to read more! This packet contains: ISAKMP Header(SPI/ version/flags), SAr1(cryptographic algorithm that IKE responder chooses), KEr(DH public Key value of the responder), and Responder Nonce. Looks like its working after I added the ACL to the outside interface. The DH Group configured under the crypto map would be used only during rekey. Uses certificates for the authentication mechanism. We may get it in march release if everything will be on track. Learn more about how Cisco is using Inclusive Language. Responder sends the response for IKE_AUTH. My template for 'VPN Interface IPsec' looks like this: Then, this template is added under the Service VPN : I thought it was all working fine, however I now have a new problem.IKEv2 is working for Phase 1, but IPSEC is failing.For some reason the ISR4K is creating 16 SA's whilst Zscaler only support a maximum of 8 SA's, therefore the tunnel is currently unusable. Template applied to Service VPN 1, Source interface from VPN 0 (Internet Interface with public IP to reach external Firewall via Internet). I had the same Firebox and RADIUS server working for IPSec MUVPN, but not for IKEv2. I notice the guide was written for the vEdge. Has anyone ever created an exception list to bypass zscaler in certain situations and go out the DIA door instead? I believe it is specific to ISR4K's and being fixed in the November code release. Cisco recommends that you have knowledge of the packet exchange for IKEv2. The CLI based workaround for it (on cEdge). For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Client Related Configuration Use the VPN Interface IPsec feature template to configure IPsec tunnels on Cisco IOS XE service VPNs that are being used for Internet Key Exchange (IKE) sessions. Edit your Feature Template for the VPN Interface Ethernet that is applied to your physical interface in VPN0.Under ACL/QOS add a IPv4 Ingress Access List using the name of the ACL you created in the first step. First pair of messages is the IKE_SA_INIT exchange. : crypto ikev2 profile default . Configure Phase 1 Settings For IKEv1. Click the Add button to insert a new VPN rule. Working output: #show crypto ikev2 profile IKEv2 profile: default Ref Count: 4 Match criteria: Fvrf: global Local address/interface: none Identities: none Certificate maps: mymap Local identity: none <----- Remote identity: none Conditions: FlexVPN No local identity configured, relaying on global default. INFO_R Event: EV_CHK_INFO_TYPE IKEv2-PROTO-5: (99): SM Trace-> SA: I . It seems like it's not passing domain information. Find answers to your questions by entering keywords or phrases in the Search bar above. The first CHILD_SA is created for the proxy_ID pair that matches the trigger packet. Refer toCisco Technical Tips Conventionsfor more information on document conventions. I'd like to configure a IPSEC tunnel to Zscaler, the interface should be sourced from VPN0 so that i can use the public IP address attached to my DIA circuit. This module describes the Internet Key Exchange Version 2 (IKEv2) protocol. A Notify Payload may appear in a response message (usually specifying why a request was rejected), in an INFORMATIONAL Exchange (to report an error not in an IKE request), or in any other message to indicate sender capabilities or to modify the meaning of the request.If this CREATE_CHILD_SA exchange is rekeying an existing SA other than the IKE_SA, the leading N payload of type REKEY_SA MUST identify the SA being rekeyed. A vulnerability in the Internet Key Exchange Version 2 (IKEv2) implementation in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to prevent IKEv2 from establishing new security associations. Cisco recommends that you have knowledge of the packet exchange for IKEv2. You cannot use PSK for authentication of a Remote Access FlexVPN, see this screenshot below from Cisco live presentation BRKSEX-2881. what i am missing here. crypto ikev2 authorization policy FlexVPN, encryption 3des aes-cbc-128 aes-cbc-192 aes-cbc-256, crypto ipsec transform-set ESP-GCM esp-gcm, crypto ipsec transform-set AES-CBC esp-aes 256 esp-sha256-hmac, crypto ipsec transform-set AES-CBC1 esp-aes esp-sha-hmac, crypto ipsec transform-set AES-CBC2 esp-3des esp-sha-hmac, set transform-set AES-CBC AES-CBC1 AES-CBC2 ESP-GCM, ip local pool FlexVPN 10.7.1.231 10.7.1.239. This does present a bit of a problem for inteligent traffic steering. Router1 verifies and processes the response: (1) The initiator DH secret key is computed, and (2) the initiator skeyid is also generated. Note: In this output, unlike in IKEv1, the PFS DH group value appears as "PFS (Y/N): N, DH group: none" during the first tunnel negotiation, but, after a rekey occurs, the right values appear. This mode is more secure, and uses three . This is the CREATE_CHILD_SA request. High Performance gateway uses IKEv2 and have applied the following IKE policy on Azure Gateway. Find answers to your questions by entering keywords or phrases in the Search bar above. Cisco Community Technology and Support Security VPN Remote Access IKEv2 Auth exchange failed 33016 5 2 Remote Access IKEv2 Auth exchange failed Go to solution mustafa.chapal Beginner 08-08-2018 01:52 PM - edited 03-12-2019 05:29 AM Hi, The packet exchange in IKEv2 is radically different from packet exchange in IKEv1. N (Notify payload-optional): The Notify Payload is used to transmit informational data, such as error conditions and state transitions, to an IKE peer. This section lists the configurations used in this document. New here? IKEv2 Settings Policy - HQ-VPN Auth Type - Preshared Manual Key Key is set in both fields IPsec Tab: Crypto Map Type - Static IKEv2 Mode - Tunnel Transform Sets IKEv2 Proposals - SHA-256 Enable Reverse Route Injection- Checked Enable PFS - Checked Modulus Group - 19 Lifetime Duration - 28800 Lifetime Size - 4608000 Advanced Tab: The connection uses a custom IPsec/IKE policy with the UsePolicyBasedTrafficSelectors option, as described in this article.. Relevant Configuration:crypto ipsec transform-set TS esp-3des esp-sha-hmac crypto ipsec profile phse2-prof set transform-set TS set ikev2-profile IKEV2-SETUP, *Nov 11 19:30:34.831: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: I_BLD_AUTH Event:EV_GEN_AUTH *Nov 11 19:30:34.831: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: I_BLD_AUTH Event: EV_CHK_AUTH_TYPE *Nov 11 19:30:34.831: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: I_BLD_AUTH Event: EV_OK_AUTH_GEN *Nov 11 19:30:34.831: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: I_BLD_AUTH Event: EV_SEND_AUTH *Nov 11 19:30:34.831: IKEv2:Construct Vendor Specific Payload: CISCO-GRANITE *Nov 11 19:30:34.831: IKEv2:Construct Notify Payload: INITIAL_CONTACT *Nov 11 19:30:34.831: IKEv2:Construct Notify Payload: SET_WINDOW_SIZE *Nov 11 19:30:34.831: IKEv2:Construct Notify Payload: ESP_TFC_NO_SUPPORT *Nov 11 19:30:34.831: IKEv2:Construct Notify Payload: NON_FIRST_FRAGS Payload contents: VID Next payload: IDi, reserved: 0x0, length: 20 IDiNext payload: AUTH, reserved: 0x0, length: 12 Id type: IPv4 address, Reserved: 0x0 0x0 AUTHNext payload: CFG, reserved: 0x0, length: 28 Auth method PSK, reserved: 0x0, reserved 0x0 CFGNext payload: SA, reserved: 0x0, length: 309 cfg type: CFG_REQUEST, reserved: 0x0, reserved: 0x0, *Nov 11 19:30:34.831: SA Next payload:TSi, reserved: 0x0, length: 40 last proposal: 0x0, reserved: 0x0, length: 36 Proposal: 1, Protocol id: ESP, SPI size: 4, #trans: 3 last transform: 0x3, reserved: 0x0: length: 8 type: 1, reserved: 0x0, id: 3DES last transform: 0x3, reserved: 0x0: length: 8 type: 3, reserved: 0x0, id: SHA96 last transform: 0x0, reserved: 0x0: length: 8 type: 5, reserved: 0x0, id: Don't use ESN TSiNext payload: TSr, reserved: 0x0, length: 24 Num of TSs: 1, reserved 0x0, reserved 0x0 TS type: TS_IPV4_ADDR_RANGE, proto id: 0, length: 16 start port: 0, end port: 65535 start addr: 0.0.0.0, end addr: 255.255.255.255 TSrNext payload: NOTIFY, reserved: 0x0, length: 24 Num of TSs: 1, reserved 0x0, reserved 0x0 TS type: TS_IPV4_ADDR_RANGE, proto id: 0, length: 16 start port: 0, end port: 65535 start addr: 0.0.0.0, end addr: 255.255.255.255, NOTIFY(INITIAL_CONTACT) Next payload: NOTIFY, reserved: 0x0, length: 8 Security protocol id: IKE, spi size: 0, type: INITIAL_CONTACT NOTIFY(SET_WINDOW_SIZE) Next payload: NOTIFY, reserved: 0x0, length: 12 Security protocol id: IKE, spi size: 0, type: SET_WINDOW_SIZE NOTIFY(ESP_TFC_NO_SUPPORT) Next payload: NOTIFY, reserved: 0x0, length: 8 Security protocol id: IKE, spi size: 0, type: ESP_TFC_NO_SUPPORT NOTIFY(NON_FIRST_FRAGS) Next payload: NONE, reserved: 0x0, length: 8 Security protocol id: IKE, spi size: 0, type: NON_FIRST_FRAGS *Nov 11 19:30:34.832: IKEv2:(SA ID = 1):Next payload: ENCR, version: 2.0 Exchange type:IKE_AUTH, flags:INITIATORMessage id: 1, length: 556 Payload contents: ENCR Next payload: VID, reserved: 0x0, length: 528 *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001CurState: I_WAIT_AUTHEvent: EV_NO_EVENT, *Nov 11 19:30:34.832: IKEv2:Got a packet from dispatcher *Nov 11 19:30:34.832: IKEv2:Processing an item off the pak queue *Nov 11 19:30:34.832: IKEv2:(SA ID = 1):Request has mess_id 1; expected 1 through 1 *Nov 11 19:30:34.832:IKEv2:(SA ID = 1):Next payload: ENCR, version: 2.0 Exchange type:IKE_AUTH, flags:INITIATORMessage id: 1, length: 556 Payload contents: *Nov 11 19:30:34.832: IKEv2:Parse Vendor Specific Payload: (CUSTOM) VID Next payload: IDi, reserved: 0x0, length: 20 IDiNext payload: AUTH, reserved: 0x0, length: 12 Id type: IPv4 address, Reserved: 0x0 0x0 AUTH Next payload: CFG, reserved: 0x0, length: 28 Auth method PSK, reserved: 0x0, reserved 0x0 CFG Next payload: SA, reserved: 0x0, length: 309 cfg type: CFG_REQUEST, reserved: 0x0, reserved: 0x0 *Nov 11 19:30:34.832: attrib type: internal IP4 DNS, length: 0 *Nov 11 19:30:34.832: attrib type: internal IP4 DNS, length: 0 *Nov 11 19:30:34.832: attrib type: internal IP4 NBNS, length: 0 *Nov 11 19:30:34.832: attrib type: internal IP4 NBNS, length: 0 *Nov 11 19:30:34.832: attrib type: internal IP4 subnet, length: 0 *Nov 11 19:30:34.832: attrib type: application version, length: 257 attrib type: Unknown - 28675, length: 0 *Nov 11 19:30:34.832: attrib type: Unknown - 28672, length: 0 *Nov 11 19:30:34.832: attrib type: Unknown - 28692, length: 0 *Nov 11 19:30:34.832: attrib type: Unknown - 28681, length: 0 *Nov 11 19:30:34.832: attrib type: Unknown - 28674, length: 0 *Nov 11 19:30:34.832:SANext payload: TSi, reserved: 0x0, length: 40 last proposal: 0x0, reserved: 0x0, length: 36 Proposal: 1, Protocol id: ESP, SPI size: 4, #trans: 3 last transform: 0x3, reserved: 0x0: length: 8 type: 1, reserved: 0x0, id: 3DES last transform: 0x3, reserved: 0x0: length: 8 type: 3, reserved: 0x0, id: SHA96 last transform: 0x0, reserved: 0x0: length: 8 type: 5, reserved: 0x0, id: Don't use ESN TSiNext payload: TSr, reserved: 0x0, length: 24 Num of TSs: 1, reserved 0x0, reserved 0x0 TS type: TS_IPV4_ADDR_RANGE, proto id: 0, length: 16 start port: 0, end port: 65535 start addr: 0.0.0.0, end addr: 255.255.255.255 TSr Next payload: NOTIFY, reserved: 0x0, length: 24 Num of TSs: 1, reserved 0x0, reserved 0x0 TS type: TS_IPV4_ADDR_RANGE, proto id: 0, length: 16 start port: 0, end port: 65535 start addr: 0.0.0.0, end addr: 255.255.255.255. IKEv2 is the supporting protocol for IP Security Protocol (IPsec) and is used for performing mutual authentication and establishing and maintaining security associations (SAs). Could you please clarify, as I'm waiting for this feature being available for some months now. this is due to 4.9 a lot of hash/cryptography where removed! If the SA offers include different DH groups, KEi must be an element of the group the initiator expects the responder to accept. If the SA offers include different DH groups, KEi must be an element of the group the initiator expects the responder to accept. All rights reserved. description Cisco AnyConnect IKEv2 ip unnumbered GigabitEthernet0/0 tunnel mode ipsec ipv4 tunnel protection ipsec profile staff Take a break, you have now completed the main config on the router, and its time to move onto configuration relating to the client. I followed the guide and created the IPSEC interface on the service side instead of VPN0, unfortunately I'm getting a IKEv2 failure: IKEv2:% Getting preshared key from profile keyring if-ipsec1-ikev2-keyringIKEv2:% Matched peer block 'if-ipsec1-ikev2-keyring-peer'IKEv2:(SESSION ID = 0,SA ID = 0):Searching Policy with fvrf 0, local address X.X.X.XIKEv2:(SESSION ID = 0,SA ID = 0):Found Policy 'policy1-global'IKEv2-ERROR:Address type 1622425149 not supported. All of the devices used in this document started with a cleared (default) configuration. 03-12-2019 I am trying to remote access to my Cisco 897VA Router using pre shared key only through Windows 10, Mac OS X and iPhone builtin IKEv2 VPN. Description (partial) Symptom: Garbage value (non-comprehensible) seen in the ikev2 error line "Address type 4132115430 not supported" Conditions: When ikev2 error debugging is turned on. This exchange consists of a single request/response pair and was referred to as a phase 2 exchange in IKEv1. Doesn't work for me. IKEv2 Packet Exchange and Protocol Level Debugging, Technical Support & Documentation - Cisco Systems, Router 1 receives a packet that matches the crypto acl for peer ASA 10.0.0.2. Nonce Ni(optional): If the CHILD_SA is created as part of the initial exchange, a second KE payload and nonce must not be sent. 4 Sep 18 2018 17:40:58 750003 Local:80.x.y.z:500 Remote:51.a.b.c:500 Username:51.a.b.c IKEv2 Negotiation aborted due to ERROR: Detected unsupported . Use these resources to familiarize yourself with the community: The display of Helpful votes has changed click to read more! It might be initiated by either end of the IKE_SA after the initial exchanges are completed. If this CREATE_CHILD_SA exchange is rekeying an existing SA other than the IKE_SA, the leading N payload of type REKEY_SA must identify the SA being rekeyed. I also had to mention the same ACL in the local policy for this to work. Responder initiates SA creation for that peer. The Responder tunnel usually comes up before the Initiator. #peer R3. Do you had to apply some NAT config? It contains: ISAKMP Header (SPI/version/flags), SAi1 (cryptographic algorithm that IKE initiator supports), KEi (DH public Key value of the initiator), and N (Initiator Nonce). Local Address = 0.0.0.0. Bug Details Include The address range specifies that all traffic to and from that range are tunnelled. This is the CREATE_CHILD_SA response. I'm unsure if Viptela using IOS XE has this same capability. You can use IKEv2 as a virtual private network (VPN) tunneling protocol that supports automatic VPN reconnection. A Notify Payload might appear in a response message (usually specifying why a request was rejected), in an informational exchange (to report an error not in an IKE request), or in any other message to indicate sender capabilities or to modify the meaning of the request. Zscaler support IP-SLA HTTP probes to check the cloud proxy health, on traditional routers you are able to use 'track' features to, for example, change the admin distance of a static route based on the results of the IP-SLA test. The sample configuration connects a Cisco ASA device to an Azure route-based VPN gateway. N(Notify payload-optional). Update: This was a version error, using wrong version of anyconnect, this has now been resolved. Relevant Configuration:crypto ipsec ikev2 ipsec-proposal AES256 protocol esp encryption aes-256 protocol esp integrity sha-1 md5, *Nov 11 19:30:34.832: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_WAIT_AUTH Event: EV_RECV_AUTH *Nov 11 19:30:34.832: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_WAIT_AUTH Event: EV_CHK_NAT_T *Nov 11 19:30:34.832: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_WAIT_AUTH Event: EV_PROC_ID *Nov 11 19:30:34.832: IKEv2:(SA ID = 1):Received valid parameteres in process id *Nov 11 19:30:34.832: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_WAIT_AUTH Event: EV_CHK_IF_PEER_CERT_NEEDS_TO_BE_FETCHED_FOR_PROF_SEL *Nov 11 19:30:34.832: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_WAIT_AUTH Event: EV_GET_POLICY_BY_PEERID *Nov 11 19:30:34.833: IKEv2:(1): Choosing IKE profile IKEV2-SETUP *Nov 11 19:30:34.833: IKEv2:% Getting preshared key by address 10.0.0.1 *Nov 11 19:30:34.833: IKEv2:% Getting preshared key by address 10.0.0.1 *Nov 11 19:30:34.833: IKEv2:Adding Proposal default to toolkit policy *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):Using IKEv2 profile 'IKEV2-SETUP' *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_WAIT_AUTH Event: EV_SET_POLICY *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):Setting configured policies *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_WAIT_AUTH Event: EV_VERIFY_POLICY_BY_PEERID *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_WAIT_AUTH Event: EV_CHK_AUTH4EAP *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_WAIT_AUTH Event: EV_CHK_POLREQEAP *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_VERIFY_AUTH Event: EV_CHK_AUTH_TYPE *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_VERIFY_AUTH Event: EV_GET_PRESHR_KEY *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_VERIFY_AUTH Event: EV_VERIFY_AUTH *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_VERIFY_AUTH Event: EV_CHK4_IC *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_VERIFY_AUTH Event: EV_CHK_REDIRECT *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):Redirect check is not needed, skipping it *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_VERIFY_AUTH Event: EV_NOTIFY_AUTH_DONE *Nov 11 19:30:34.833: IKEv2:AAA group authorization is not configured *Nov 11 19:30:34.833: IKEv2:AAA user authorization is not configured *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_VERIFY_AUTH Event: EV_CHK_CONFIG_MODE *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_VERIFY_AUTH Event: EV_SET_RECD_CONFIG_MODE *Nov 11 19:30:34.833: IKEv2:Received config data from toolkit: *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_VERIFY_AUTH Event: EV_PROC_SA_TS *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_VERIFY_AUTH Event: EV_GET_CONFIG_MODE *Nov 11 19:30:34.833: IKEv2:Error constructing config reply *Nov 11 19:30:34.833: IKEv2:No config data to send to toolkit: *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_BLD_AUTH Event: EV_MY_AUTH_METHOD *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_BLD_AUTH Event: EV_GET_PRESHR_KEY *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_BLD_AUTH Event: EV_GEN_AUTH *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_BLD_AUTH Event: EV_CHK4_SIGN *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_BLD_AUTH Event: EV_OK_AUTH_GEN *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: R_BLD_AUTH Event: EV_SEND_AUTH *Nov 11 19:30:34.833: IKEv2:Construct Vendor Specific Payload: CISCO-GRANITE *Nov 11 19:30:34.833: IKEv2:Construct Notify Payload: SET_WINDOW_SIZE *Nov 11 19:30:34.833: IKEv2:Construct Notify Payload: ESP_TFC_NO_SUPPORT *Nov 11 19:30:34.833: IKEv2:Construct Notify Payload: NON_FIRST_FRAGS, *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):Next payload: ENCR, version: 2.0 Exchange type:IKE_AUTH, flags:RESPONDER MSG-RESPONSEMessage id: 1, length: 252 Payload contents: ENCR Next payload: VID, reserved: 0x0, length: 224 *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: AUTH_DONE Event: EV_OK *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):Action: Action_Null *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: AUTH_DONE Event: EV_PKI_SESH_CLOSE *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):Closing the PKI session *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: AUTH_DONE Event: EV_UPDATE_CAC_STATS *Nov 11 19:30:34.833: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: AUTH_DONE Event:EV_INSERT_IKE *Nov 11 19:30:34.834: IKEv2:Store mib index ikev2 1, platform 60 *Nov 11 19:30:34.834: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: AUTH_DONE Event: EV_GEN_LOAD_IPSEC *Nov 11 19:30:34.834: IKEv2:(SA ID = 1):Asynchronous request queued *Nov 11 19:30:34.834: IKEv2:(SA ID = 1): *Nov 11 19:30:34.834: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState:AUTH_DONEEvent: EV_NO_EVENT, *Nov 11 19:30:34.834: IKEv2:Got a packet from dispatcher *Nov 11 19:30:34.834: IKEv2:Processing an item off the pak queue, *Nov 11 19:30:34.840: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: AUTH_DONE Event: EV_OK_RECD_LOAD_IPSEC *Nov 11 19:30:34.840: IKEv2:(SA ID = 1):Action: Action_Null *Nov 11 19:30:34.840: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: AUTH_DONE Event: EV_START_ACCT *Nov 11 19:30:34.840: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: AUTH_DONE Event: EV_CHECK_DUPE *Nov 11 19:30:34.840: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000001 CurState: AUTH_DONE Event: EV_CHK4_ROLE, *Nov 11 19:30:34.834: IKEv2:(SA ID = 1):Next payload: ENCR, version: 2.0 Exchange type:IKE_AUTH, flags:RESPONDER MSG-RESPONSEMessage id: 1, length: 252 Payload contents: *Nov 11 19:30:34.834: IKEv2:Parse Vendor Specific Payload: (CUSTOM) VID Next payload: IDr, reserved: 0x0, length: 20 IDrNext payload: AUTH, reserved: 0x0, length: 12 Id type: IPv4 address, Reserved: 0x0 0x0 AUTHNext payload: SA, reserved: 0x0, length: 28 Auth method PSK, reserved: 0x0, reserved 0x0 SANext payload: TSi, reserved: 0x0, length: 40 last proposal: 0x0, reserved: 0x0, length: 36 Proposal: 1, Protocol id: ESP, SPI size: 4, #trans: 3 last transform: 0x3, reserved: 0x0: length: 8 type: 1, reserved: 0x0, id: 3DES last transform: 0x3, reserved: 0x0: length: 8 type: 3, reserved: 0x0, id: SHA96 last transform: 0x0, reserved: 0x0: length: 8 type: 5, reserved: 0x0, id: Don't use ESN TSiNext payload: TSr, reserved: 0x0, length: 24 Num of TSs: 1, reserved 0x0, reserved 0x0 TS type: TS_IPV4_ADDR_RANGE, proto id: 0, length: 16 start port: 0, end port: 65535 start addr: 0.0.0.0, end addr: 255.255.255.255 TSr Next payload: NOTIFY, reserved: 0x0, length: 24 Num of TSs: 1, reserved 0x0, reserved 0x0 TS type: TS_IPV4_ADDR_RANGE, proto id: 0, length: 16 start port: 0, end port: 65535 start addr: 0.0.0.0, end addr: 255.255.255.255 *Nov 11 19:30:34.834: IKEv2:Parse Notify Payload: SET_WINDOW_SIZE NOTIFY(SET_WINDOW_SIZE) Next payload: NOTIFY, reserved: 0x0, length: 12 Security protocol id: IKE, spi size: 0, type: SET_WINDOW_SIZE *Nov 11 19:30:34.834: IKEv2:Parse Notify Payload: ESP_TFC_NO_SUPPORT NOTIFY(ESP_TFC_NO_SUPPORT) Next payload: NOTIFY, reserved: 0x0, length: 8 Security protocol id: IKE, spi size: 0, type: ESP_TFC_NO_SUPPORT *Nov 11 19:30:34.834: IKEv2:Parse Notify Payload: NON_FIRST_FRAGS NOTIFY(NON_FIRST_FRAGS) Next payload: NONE, reserved: 0x0, length: 8 Security protocol id: IKE, spi size: 0, type: NON_FIRST_FRAGS *Nov 11 19:30:34.834: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: I_WAIT_AUTH Event:EV_RECV_AUTH *Nov 11 19:30:34.834: IKEv2:(SA ID = 1):Action: Action_Null *Nov 11 19:30:34.834: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: I_PROC_AUTH Event: EV_CHK4_NOTIFY *Nov 11 19:30:34.834: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: I_PROC_AUTH Event:EV_PROC_MSG *Nov 11 19:30:34.834: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: I_PROC_AUTH Event: EV_CHK_IF_PEER_CERT_NEEDS_TO_BE_FETCHED_FOR_PROF_SEL *Nov 11 19:30:34.834: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: I_PROC_AUTH Event: EV_GET_POLICY_BY_PEERID *Nov 11 19:30:34.834: IKEv2:Adding Proposal PHASE1-prop to toolkit policy *Nov 11 19:30:34.834: IKEv2:(SA ID = 1):Using IKEv2 profile 'IKEV2-SETUP' *Nov 11 19:30:34.834: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: I_PROC_AUTH Event: EV_VERIFY_POLICY_BY_PEERID *Nov 11 19:30:34.834: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: I_PROC_AUTH Event: EV_CHK_AUTH_TYPE *Nov 11 19:30:34.834: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: I_PROC_AUTH Event: EV_GET_PRESHR_KEY *Nov 11 19:30:34.835: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: I_PROC_AUTH Event:EV_VERIFY_AUTH *Nov 11 19:30:34.835: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: I_PROC_AUTH Event: EV_CHK_EAP *Nov 11 19:30:34.835: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: I_PROC_AUTH Event:EV_NOTIFY_AUTH_DONE *Nov 11 19:30:34.835: IKEv2:AAA group authorization is not configured *Nov 11 19:30:34.835: IKEv2:AAA user authorization is not configured *Nov 11 19:30:34.835: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: I_PROC_AUTH Event: EV_CHK_CONFIG_MODE *Nov 11 19:30:34.835: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: I_PROC_AUTH Event: EV_CHK4_IC *Nov 11 19:30:34.835: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: I_PROC_AUTH Event: EV_CHK_IKE_ONLY *Nov 11 19:30:34.835: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: I_PROC_AUTH Event: EV_PROC_SA_TS *Nov 11 19:30:34.835: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: AUTH_DONE Event: EV_OK *Nov 11 19:30:34.835: IKEv2:(SA ID = 1):Action: Action_Null *Nov 11 19:30:34.835: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: AUTH_DONE Event: EV_PKI_SESH_CLOSE *Nov 11 19:30:34.835: IKEv2:(SA ID = 1):Closing the PKI session *Nov 11 19:30:34.835: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: AUTH_DONE Event: EV_UPDATE_CAC_STATS *Nov 11 19:30:34.835: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: AUTH_DONE Event: EV_INSERT_IKE *Nov 11 19:30:34.835: IKEv2:Store mib index ikev2 1, platform 60 *Nov 11 19:30:34.835: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: AUTH_DONE Event: EV_GEN_LOAD_IPSEC *Nov 11 19:30:34.835: IKEv2:(SA ID = 1):Asynchronous request queued *Nov 11 19:30:34.835: IKEv2:(SA ID = 1): *Nov 11 19:30:34.835: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000001 CurState: AUTH_DONE Event: EV_NO_EVENT *Nov 11 19:30:34.835: IKEv2:KMI message 8 consumed.