SOS - isakmp debug output

Discussion in 'Cisco' started by RobO, Dec 16, 2004.

  1. RobO

    RobO Guest

    Hello all!

    Please can you help!
    I am currently setting up a site-to-site VPN between a 837 and a
    draytek router.

    I appear to be having problems with establishing a SA.I do not have
    access to the draytek but have to rely on other people to configure it
    for me.
    We have agreed on keys,encryption etc but following is the debug isamkp
    output I keep getting and no connection is established.
    I believe I have tried all combinations but nothing.
    My match ACL is as follows:
    access-list 111 permit ip LOCAL_NET 0.0.0.255 REMOTE_NET 0.0.0.255
    I have a route-map applied denying the same as the above ACL.
    Are there specific setups for draytek that need to be applied to the
    Cisco box.
    Also the Draytek is on leased line so its apparently set to
    dial-in/out.

    Many thanks in advance.

    Rob
    ----------------------start_debug------------------------
    Dec 16 13:45:18.759: ISAKMP: received ke message (1/2)
    Dec 16 13:45:18.759: ISAKMP (0:0): no idb in request
    Dec 16 13:45:18.759: ISAKMP: local port 500, remote port 500
    Dec 16 13:45:18.759: ISAKMP: set new node 0 to QM_IDLE
    Dec 16 13:45:18.763: ISAKMP (0:1): constructed NAT-T vendor ID
    Dec 16 13:45:18.763: ISAKMP (0:1): Input = IKE_MESG_FROM_IPSEC,
    IKE_SA_REQ_MM
    Dec 16 13:45:18.763: ISAKMP (0:1): Old State = IKE_READY New State =
    IKE_I_MM1

    Dec 16 13:45:18.763: ISAKMP (0:1): beginning Main Mode exchange
    Dec 16 13:45:18.763: ISAKMP (0:1): sending packet to REMOTE_IP my_port
    500 peer_port 500 (I) MM_NO_STATE
    Dec 16 13:45:18.807: ISAKMP (0:1): received packet from REMOTE_IP dport
    500 sport 500 (I) MM_NO_STATE
    Dec 16 13:45:18.807: ISAKMP (0:1): Input = IKE_MESG_FROM_PEER,
    IKE_MM_EXCH
    Dec 16 13:45:18.811: ISAKMP (0:1): Old State = IKE_I_MM1 New State =
    IKE_I_MM2

    Dec 16 13:45:18.811: ISAKMP (0:1): processing SA payload. message ID =
    0
    Dec 16 13:45:18.811: ISAKMP (0:1): found peer pre-shared key matching
    REMOTE_IP
    Dec 16 13:45:18.811: ISAKMP (0:1) local preshared key found
    Dec 16 13:45:18.811: ISAKMP (0:1): Checking ISAKMP transform 1 against
    priority 1 policy
    Dec 16 13:45:18.811: ISAKMP: encryption DES-CBC
    Dec 16 13:45:18.811: ISAKMP: hash SHA
    Dec 16 13:45:18.811: ISAKMP: default group 2
    Dec 16 13:45:18.815: ISAKMP: auth pre-share
    Dec 16 13:45:18.815: ISAKMP: life type in seconds
    Dec 16 13:45:18.815: ISAKMP: life duration (basic) of 3600
    Dec 16 13:45:18.815: ISAKMP (0:1): atts are acceptable. Next payload is
    0
    Dec 16 13:45:19.035: ISAKMP (0:1): Input = IKE_MESG_INTERNAL,
    IKE_PROCESS_MAIN_MODE
    Dec 16 13:45:19.035: ISAKMP (0:1): Old State = IKE_I_MM2 New State =
    IKE_I_MM2

    Dec 16 13:45:19.039: ISAKMP (0:1): sending packet to REMOTE_IP my_port
    500 peer_port 500 (I) MM_SA_SETUP
    Dec 16 13:45:19.039: ISAKMP (0:1): Input = IKE_MESG_INTERNAL,
    IKE_PROCESS_COMPLETE
    Dec 16 13:45:19.039: ISAKMP (0:1): Old State = IKE_I_MM2 New State =
    IKE_I_MM3

    Dec 16 13:45:20.367: ISAKMP (0:1): received packet from REMOTE_IP dport
    500 sport 500 (I) MM_SA_SETUP
    Dec 16 13:45:20.367: ISAKMP (0:1): Input = IKE_MESG_FROM_PEER,
    IKE_MM_EXCH
    Dec 16 13:45:20.367: ISAKMP (0:1): Old State = IKE_I_MM3 New State =
    IKE_I_MM4

    Dec 16 13:45:20.371: ISAKMP (0:1): processing KE payload. message ID =
    0
    Dec 16 13:45:20.647: ISAKMP (0:1): processing NONCE payload. message ID
    = 0
    Dec 16 13:45:20.647: ISAKMP (0:1): found peer pre-shared key matching
    REMOTE_IP
    Dec 16 13:45:20.651: ISAKMP (0:1): SKEYID state generated
    Dec 16 13:45:20.651: ISAKMP (0:1): Input = IKE_MESG_INTERNAL,
    IKE_PROCESS_MAIN_MODE
    Dec 16 13:45:20.651: ISAKMP (0:1): Old State = IKE_I_MM4 New State =
    IKE_I_MM4

    Dec 16 13:45:20.667: ISAKMP (0:1): Send initial contact
    Dec 16 13:45:20.667: ISAKMP (0:1): SA is doing pre-shared key
    authentication using id type ID_IPV4_ADDR
    Dec 16 13:45:20.667: ISAKMP (1): ID payload
    next-payload : 8
    type : 1
    addr : LOCAL_IP
    protocol : 17
    port : 0
    length : 8
    Dec 16 13:45:20.667: ISAKMP (1): Total payload length: 12
    Dec 16 13:45:20.671: ISAKMP (0:1): sending packet to REMOTE_IP my_port
    500 peer_port 500 (I) MM_KEY_EXCH
    Dec 16 13:45:20.671: ISAKMP (0:1): Input = IKE_MESG_INTERNAL,
    IKE_PROCESS_COMPLETE
    Dec 16 13:45:20.671: ISAKMP (0:1): Old State = IKE_I_MM4 New State =
    IKE_I_MM5

    Dec 16 13:45:23.703: ISAKMP (0:1): received packet from REMOTE_IP dport
    500 sport 500 (I) MM_KEY_EXCH
    Dec 16 13:45:23.703: ISAKMP (0:1): phase 1 packet is a duplicate of a
    previous packet.
    Dec 16 13:45:23.703: ISAKMP (0:1): retransmitting due to retransmit
    phase 1
    Dec 16 13:45:23.703: ISAKMP (0:1): retransmitting phase 1
    MM_KEY_EXCH...
    Dec 16 13:45:24.203: ISAKMP (0:1): retransmitting phase 1
    MM_KEY_EXCH...
    Dec 16 13:45:24.203: ISAKMP (0:1): incrementing error counter on sa:
    retransmit phase 1
    Dec 16 13:45:24.203: ISAKMP (0:1): retransmitting phase 1 MM_KEY_EXCH
    Dec 16 13:45:24.203: ISAKMP (0:1): sending packet to REMOTE_IP my_port
    500 peer_port 500 (I) MM_KEY_EXCH
    Dec 16 13:45:29.635: ISAKMP (0:1): received packet from REMOTE_IP dport
    500 sport 500 (I) MM_KEY_EXCH
    Dec 16 13:45:29.635: ISAKMP (0:1): phase 1 packet is a duplicate of a
    previous packet.
    Dec 16 13:45:29.635: ISAKMP (0:1): retransmitting due to retransmit
    phase 1
    Dec 16 13:45:29.635: ISAKMP (0:1): retransmitting phase 1
    MM_KEY_EXCH...
    Dec 16 13:45:30.135: ISAKMP (0:1): retransmitting phase 1
    MM_KEY_EXCH...
    Dec 16 13:45:30.135: ISAKMP (0:1): incrementing error counter on sa:
    retransmit phase 1
    Dec 16 13:45:30.135: ISAKMP (0:1): retransmitting phase 1 MM_KEY_EXCH
    Dec 16 13:45:30.135: ISAKMP (0:1): sending packet to REMOTE_IP my_port
    500 peer_port 500 (I) MM_KEY_EXCH
    Dec 16 13:45:40.135: ISAKMP (0:1): retransmitting phase 1
    MM_KEY_EXCH...
    Dec 16 13:45:40.135: ISAKMP (0:1): incrementing error counter on sa:
    retransmit phase 1
    Dec 16 13:45:40.135: ISAKMP (0:1): retransmitting phase 1 MM_KEY_EXCH
    Dec 16 13:45:40.135: ISAKMP (0:1): sending packet to REMOTE_IP my_port
    500 peer_port 500 (I) MM_KEY_EXCH
    Dec 16 13:45:48.755: ISAKMP: received ke message (1/2)
    Dec 16 13:45:48.755: ISAKMP: set new node 0 to QM_IDLE
    Dec 16 13:45:48.755: ISAKMP (0:1): SA is still budding. Attached new
    ipsec request to it.
    Dec 16 13:45:50.135: ISAKMP (0:1): retransmitting phase 1
    MM_KEY_EXCH...
    Dec 16 13:45:50.135: ISAKMP (0:1): incrementing error counter on sa:
    retransmit phase 1
    Dec 16 13:45:50.135: ISAKMP (0:1): retransmitting phase 1 MM_KEY_EXCH
    Dec 16 13:45:50.135: ISAKMP (0:1): sending packet to REMOTE_IP my_port
    500 peer_port 500 (I) MM_KEY_EXCH
    Dec 16 13:46:00.135: ISAKMP (0:1): retransmitting phase 1
    MM_KEY_EXCH...
    Dec 16 13:46:00.135: ISAKMP (0:1): incrementing error counter on sa:
    retransmit phase 1
    Dec 16 13:46:00.135: ISAKMP (0:1): retransmitting phase 1 MM_KEY_EXCH
    Dec 16 13:46:00.135: ISAKMP (0:1): sending packet to REMOTE_IP my_port
    500 peer_port 500 (I) MM_KEY_EXCH
    Dec 16 13:46:10.135: ISAKMP (0:1): retransmitting phase 1
    MM_KEY_EXCH...
    Dec 16 13:46:10.135: ISAKMP (0:1): peer does not do paranoid
    keepalives.

    Dec 16 13:46:10.135: ISAKMP (0:1): deleting SA reason "death by
    retransmission P1" state (I) MM_KEY_EXCH (peer REMOTE_IP) input queue 0
    Dec 16 13:46:10.135: ISAKMP (0:1): deleting SA reason "death by
    retransmission P1" state (I) MM_KEY_EXCH (peer REMOTE_IP) input queue 0
    Dec 16 13:46:10.135: ISAKMP (0:1): deleting node 148264246 error TRUE
    reason "death by retransmission P1"
    Dec 16 13:46:10.135: ISAKMP (0:1): deleting node 250228106 error TRUE
    reason "death by retransmission P1"
    Dec 16 13:46:10.139: ISAKMP (0:1): Input = IKE_MESG_INTERNAL,
    IKE_PHASE1_DEL
    Dec 16 13:46:10.139: ISAKMP (0:1): Old State = IKE_I_MM5 New State =
    IKE_DEST_SA

    Dec 16 13:46:18.755: ISAKMP: received ke message (3/1)
    Dec 16 13:46:18.755: ISAKMP: ignoring request to send delete notify (no
    ISAKMP sa) src LOCAL_IP dst REMOTE_IP for SPI 0x0
    ------------------------end_debug--------------------------------------
     
    RobO, Dec 16, 2004
    #1
    1. Advertisements

  2. RobO

    RobO Guest

    Just in case anybody comes across this and maybe I simply missed out
    something really stupid.
    I upgraded the IOS to 12.3 and voila all sorted.

    Later

    Rob
     
    RobO, Dec 16, 2004
    #2
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.