Tunnel internal IPSec for an ASA5525?

Similar Questions

• PPTP VPN or IPSEC for Android and iPAD

  Being new on the RV180 (and routers VPN besides) I had trouble getting a VPN's, supporting my iPad and Android devices. However, I understand that an IPSEC connection would be a safer sollution. Unfortunately I can't find a clear statement anywhere to do it.

  I found descriptions/parameters in the different RV180 of the setting of the (few) in mobile platforms. So far not managed to get the installation program.

  Little help to start would be great!

  Thank you very much.

  Ronald

  Hello Robert.

  My name is Chris and I work at the Cisco Small Business Support Center.

  The PPTP option will be much easier to install, and most devices have a built-in capability of PPTP.

  The RV180 supports the IPSEC tunnels, but only for links from site to site or a remote user with the client software.  Some of the other features of our support SSL VPN connections, which would allow you to use the Cisco Anyconnect client available for android, but SSL VPN is not a characteristic of the RV180.

  On my Android (Droid X running Android 2.3.4) phone he built in VPN, IPSEC and PPTP client.  Yours is probably as well, but if not there should be a few apps available.

  If you decide to go with PPTP you can configure it like this on the RV180:

  1. go to the router admin page and click on VPN > IPsec > VPN users.

  2. check the box to enable the PPTP server.

  3. complete the range of internal addresses for your customers to use PPTP (192.168.1.200 - 192.168.1.210 for example)

  4. click on save.

  5. Once you click on save, you should be able to edit the table of parameters of VPN client.

  6. click on add, check enabled, enter a user name and password for the PPTP user to use and for the protocol type, select PPTP.

  7. click Save to add the user.

  Once this is done, you should be able to go into the settings on your Android device and add a VPN for PPTP connection.   Fill in the same information you setup of the RV180 and you should be able to connect.

  The server address will be the WAN IP of your RV180.

  As far as IPSEC goes, the process is similar but a little more complicated.

  1. on the router admin page go to VPN > IPsec > Basic VPN configuration.

  2. choose the VPN client for peer type.

  3. name connection (it is used on the router)

  4. choose a pre-shared key to be used with this connection.

  5. for remote WAN IP address, you can leave the default remote.com

  6. for the Local gateway Type, you'll want to choose IP

  7. to Local WAN IP select IP and enter the IP address of the RV180 (WAN IP)

  8. for LAN Local, enter the local network for the RV180 ID (default is 192.168.1.0)

  9. to the Local LAN subnet mask enter 255.255.255.0

  10. click on save.

  The steps above create a VPN IPSec tunnel using the default values of the router, which you can view by clicking on default settings under VPN > IPSEC.

  Now you just set your phone.  On my phone, I have an option for Advanced IPSEC VPN, but yours may be different, or you may need to use an application like a customer, if your phone does not have built-in IPSEC VPN.

  On my Droid X, I want to go wireless and networks, VPN settings, Advanced IPSEC VPN, add a new virtual private network.

  My phone uses models of connection, so be sure to choose one that fits your tunnel on the RV180 parameters.

  Enter the RV180 WAN IP address as the VPN server, as well as the pre-shared key, install you on the RV180.

  Make sure that all connection settings that you have configured on the RV180.

  You will also be asked for an internal subnet IP address, and for this, you must enter the Local LAN and subnet mask, that you configured on the RV180 in steps 8 and 9 above.

  I wish I could be more specific, but it seems that there are several different menus and options depending on what Android phone using your.

  I hope that this helps, but if not feel free to respond and I'll try to explain.

• Chrombook L2TP/IPSec for ASA 5510

  Hello

  I have trouble getting a chromebook to establish a remote access connection VPN using L2TP/IPsec for a Cisco ASA 5510 12 7.2 (5) running.

  Run a debug crypto isakmp 5 I see the following logs (ip changed...)

  Jan 06 09:58:06 [IKEv1 DEBUG]: IP = 1.1.1.1, Oakley proposal is acceptable

  Jan 06 09:58:06 [IKEv1 DEBUG]: IP = 1.1.1.1, IKE SA proposal # 1, turn # 1 entry overall IKE acceptable matches # 4

  Jan 06 09:58:06 [IKEv1]: IP = 1.1.1.1, connection landed on tunnel_group DefaultRAGroup

  Jan 06 09:58:06 [IKEv1]: Group = DefaultRAGroup, IP = 1.1.1.1, status of automatic NAT detection: remote endpoint IS behind a NAT device this end is NOT behind a NAT device

  Jan 06 09:58:06 [IKEv1]: IP = 1.1.1.1, connection landed on tunnel_group DefaultRAGroup

  Jan 06 09:58:06 [IKEv1]: Group = DefaultRAGroup, IP = 1.1.1.1, previously allocated memory of liberation for permission-dn-attributes

  06 jan 09:58:06 [IKEv1]: Group = DefaultRAGroup, IP = 1.1.1.1, PHASE 1 COMPLETED

  Jan 06 09:58:06 [IKEv1]: IP = 1.1.1.1, Keep-alive type for this connection: DPD

  Jan 06 09:58:06 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 1.1.1.1, timer to generate a new key to start P1: 8100 seconds.

  06 jan 09:58:06 [IKEv1]: Group = DefaultRAGroup, IP = 1.1.1.1, PHASE 1 COMPLETED

  Jan 06 09:58:06 [IKEv1]: IP = 1.1.1.1, Keep-alive type for this connection: DPD

  Jan 06 09:58:06 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 1.1.1.1, timer to generate a new key to start P1: 8100 seconds.

  Jan 06 09:58:06 [IKEv1]: Group = DefaultRAGroup, IP = 1.1.1.1, data received in payload ID remote Proxy Host: address 3.3.3.3, 17 of the Protocol, Port 1701

  Jan 06 09:58:06 [IKEv1]: Group = DefaultRAGroup, IP = 1.1.1.1, data received in payload ID local Proxy Host: address 2.2.2.2, 17 of the Protocol, Port 1701

  Jan 06 09:58:06 [IKEv1]: Group = DefaultRAGroup, IP = 1.1.1.1, detected L2TP/IPSec session.

  Jan 06 09:58:06 [IKEv1]: Group = DefaultRAGroup, IP = 1.1.1.1, QM IsRekeyed its not found old addr

  Jan 06 09:58:06 [IKEv1]: Group = DefaultRAGroup, IP = 1.1.1.1, static checking Card Crypto, check card = outside_map, seq = 1...

  Jan 06 09:58:06 [IKEv1]: Group = DefaultRAGroup, IP = 1.1.1.1, static checking Card Crypto Card = outside_map, seq = 1, ACL does not proxy IDs src:1.1.1.1 dst: 2.2.2.2

  Jan 06 09:58:06 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 1.1.1.1, only Tunnel UDP-encapsulated and UDP-encapsulated-Transport mode NAT-Traversal-defined selection

  Jan 06 09:58:06 [IKEv1]: Group = DefaultRAGroup, IP = 1.1.1.1, remote peer IKE configured crypto card: outside_dyn_map0

  Jan 06 09:58:06 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 1.1.1.1, ITS processing IPSec payload

  Jan 06 09:58:06 [IKEv1]: Group = DefaultRAGroup, IP = 1.1.1.1, proposals of any IPSec security association has deemed unacceptable.

  Jan 06 09:58:06 [IKEv1]: Group = DefaultRAGroup, IP = 1.1.1.1, error QM WSF (P2 struct & 0x3d48800, mess id 0xce12c3dc).

  Jan 06 09:58:06 [IKEv1 DEBUG]: Group = DefaultRAGroup, IP = 1.1.1.1, history of mistake IKE responder QM WSF (struct & 0x3d48800) , : QM_DONE EV_ERROR--> QM_BLD_MSG2 EV_NEGO_SA--> QM_BLD_MSG2, EV_IS_REKEY--> QM_BLD_MSG2, EV_CONFIRM_SA--> QM_BLD_MSG2, EV_PROC_MSG--> QM_BLD_MSG2, EV_HASH_OK--> QM_BLD_MSG2, NullEvent--> QM_BLD_MSG2, EV_COMP_HASH

  Jan 06 09:58:06 [IKEv1]: Group = DefaultRAGroup, IP = 1.1.1.1, removing counterpart table correlator failed, no match!

  1.1.1.1 = address remote chromebook NAT

  2.2.2.2 = ASA 5510 acting as distance termintaion access point

  3.3.3.3 = Chromebook private address

  I noticed that the Chromebook is appearing as the ID of the remote proxy but later, he seeks the applied to the Chromebook NAT address.  Not sure if this is the cause or how to solve this problem, if it is.

  Can someone advise please

  Thank you

  Ryan

  7.2 is old code.  You can re - test with 9.0.x or 9.1.x.

  https://support.Google.com/Chromebook/answer/1282338?hl=en

• Best disk internal SSD for end 2009 27 "?

  Hello!

  I am trying to decide the best new (1 TB or 2 TB) internal SSD for my October 2009 27 "iMac (3.06 GHz Core 2 Duo).

  I see OWC has a drive and a kit that are certainly compatible, but the Samsung EVO and PRO seem to get better feedback. Any thoughts or ideas are appreciated!

  Get the OWC

• Question about the extended international warranty for Qosmio F10

  Friends
  I bought a Qosmio F10 of UAE UNITED and it came with an international warranty of 3 years and its expiration time, December 12, 2007.
  I would like to know if someone has purchased an extended international warranty for Toshiba Qosmio F10 model.
  Please give me the details where can I buy the extended warranty.

  Concerning
  PVSRAO

  Hello

  Did you know that the Web of Toshiba Europe site?
  If not, then please visit this site:
  http://EU.computers.Toshiba-Europe.com

  You will find many interesting areas and in respect of the Services, you will find all the information on the guarantee of the uprisings, service and extensions.
  Generally each service partner Toshiba should be able to also give the warranty information and there, you could also buy extensions.

• Re: HARD drive need internal and business BT internal module for Satellite P300-156

  where can I buy HDD case internal and internal module for Satellite P300-156 BT?

  Try an authorized Service Center. There is a list on the Toshiba under Support site

• another disk internal ssd for my computer

  Hello, I have a feel LIKE Phoenix 810qe 230qe Desktop PC, I would get another drive internal ssd for my computer and the clone with usb plug so I can't open up my case, I'll use a Vantec CB-ISATAU2 SATA/IDE to USB 2.0 supports 3.5-inch, 2.5-inch adapter, I like to know what kind of disk internal ssd I should use I see a lot of hybirds, but what is the difference? I want to get something close to what I have now which is 128 GB SSD drive.where or what would be the best...

  You say that you do not want to open the case.  Is it fair to clone the disk or you are not going to install it in the computer?

  I have a HP 810-135qe Phoenix.  I installed a Samsung 840 EVO 500 GB SSD2.5 ".  It works absolutely great.  I cloned my HHD using the software of the Data Migration tool provided by Samsung.  In addition, the Software Wizard to adjust the performance of the SSD.  There is a section to download at the bottom of the page in the link I have provided.  It is one of the SSDS a few who has a good reputation for installation without changing the BIOS.

  Please, click on "Thumbs Up +" if I helped you and click "Accept as Solution" If your problem is resolved.

• Inspiron 1525 not able to select the internal microphone for the webcam, or it appears on the Control Panel, sound, Audio devices

  Initial problem was Dell Webcam video recording record any sound.

  In the Panel configuration, Device Manager, sound video and game controllers, there are two high definition Audio devices listed: location 1 (internal Bus High Definition Audio) - I take it that it is the internal mic. and location 2 (Audio High Definition Bus Interior) - I take it that it is the external microphone jack. Both have the same version of the driver.

  Control Panel, sound, the recordings tab showed 2 devices that looked like identical except the bars that show green with volume were only on the first, which is also the default and would detect sound if you're real close to the webcam microphone when you talk. The two devices displayed as 'work '.

  Accessories, Sound Recorder records are silent any distance you get to internal webcam mic.

  Dell WebCam Audio Source tab has two selections, the two reading Microphone (3 - high definition Audio Device). Both selections recorded the sound with the EXTERNAL microphone jack. There is no way to select the internal microphone webcam, it is not an option.

  According to the instructions found on the web, I uninstalled the first device only in the Device Manager and rebooted. The same version of the same driver has been installed. But now the parameters have changed. Device Mgr shows Loc 1 and 2 pass. However, under the Øresund, tab records there are always 2 features, but the first said "currently unavailable", is always the default and the sound bars that go for green for the audio tests are ANOTHER unit now instead of the first. If you check the properties of each device, they BOTH show the same location 2 (inside Bus High Definition Audio), i.e. the external microphone jack.  Loc 1 device (built in mic) does not appear!

  Accessories Sound Recorder works with the EXTERNAL microphone. (How does he know that one to use, it is not giving me a choice?)

  If the tracking device 1 (internal microphone) does not appear anywhere besides than Device Manager. I want to use the internal microphone for Skype and webcam. Somehow, I need to get the Loc 1 unit appears on the sound - recording tab and in the Source Audio Webcam list? What should I do?

  Thanks in advance for your help.

  Jimco

  Go to the Inspiron 1525 support page

  http://www.Dell.com/support/home/us/en/04/product-support/product/Inspiron-1525/drivers

• Disable ipsec for l2tp vpn connection?

  Hello

  How can I disable ipsec for l2tp vpn connection? I use a linux vpn that offers only l2tp. I remember doing this with winxp in regedit.

  [HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/RasMan/settings] "ProhibitIpSec" = DWORD: 00000001

  How is it possible in win7?

  Thank you.

  Thank you for visiting the Microsoft answers community site. The question you have posted is related to Linux and would be better suited to the community network. Please visit the link below to find a community that will provide the support you want.

  http://social.technet.Microsoft.com/forums/en-us/w7itpronetworking/threads

• How can I reinstall my internal microphone for my toshiba satellite L655.

  How can I reinstall my internal microphone for my toshiba satellite L655. I tried sounds in the control panel that came with a small box that says reading, recording, sound, communication. I clicked on record, then I have a right click on it and it says recorder not connected not, but being the only option to thumbnail it does not help me I want to use my internal microphone located next to the built-in web cam.

  Hello

  (1) you are able to hear the sound of the computer?

  (2) have you made changes before the start of this issue?

  Method 1: Open the troubleshooting of Audio recording

  http://Windows.Microsoft.com/en-us/Windows7/open-the-recording-audio-Troubleshooter

  Method 2: Audio recording in sound recorder: frequently asked questions

  http://Windows.Microsoft.com/en-us/Windows7/recording-audio-in-sound-recorder-frequently-asked-questions

  Method 3: When the sound card is installed, the microphone is also installed and uses the sound card drivers.

  Please try to uncheck the option put the microphone muted in the sound menu. If the problem persists then uninstall and reinstall the sound drivers.

  I hope this helps.

• No internal event for e-mail, click on? Huh? Can create you your own customer internal events?

  In the case that I inherited 1.5 years ago, there seems to be no internal event for Click-through Email?

  Is there a reason why it would not exist? You would just use the activity of the person hitting the tracks page instead? What happens if you link off the coast to a page that is not the subject of a follow-up?

  Can I create my own internal event?

  Anyone?

  I ask because we are moving to a new model where our SFDC and Oracle DB are 1:1 and we heavily use events to create tasks for our team out to act on telequal.

  Yes, by default, there should be the usual set of internal events of activity - Email Bounce, Open Email, send Email, click email through, Email subscribe, E-mail Unsubscribe, form submit, Hypersite visit, visit the Web site, etc.

• Blocks VIRTUAL local network access to a tunnel VPN IPSec on WRV200?

  I have two identical WRV200 wireless routers which are connected by a VPN IPSec tunnel.  This goes to my LAN LAN of my parents.  Everything works well.

  But I also have my WRV200 configured for two VLANS.  Vlan1 for my network and secure wireless access.  VLAN2 for a WiFi not secure for customers.

  My problem is that my guest on VLAN2 slips through the VPN devices and access on LAN of my parents.  I'm looking for a way to block to do this.

  I use the version of the software on the two routers (v1.0.39).

  For what it's worth, I know that my receive an IP address in the range 192.168.x.101 DHCP - 199.  I could assign a different range if that helps.  I thought that I could block this beach on the remote router firewall, but I see there is blocking a single IP address at the time, maximum of 8.  Am I missing something?

  Or could I put something weird in the routing tables somewhere to get the IPs guest out of lala land?

  Any suggestions are appreciated.  I can't be the only one in this boat.

  Steve

  Try to check local and remote, vpn under safe group settings if you change the ip address range subnet. Don't include the range of ip addresses of the computers wireless comments so that it will not pass through the vpn tunnel. If there is no ip range option, you must to the subnet of the network in order to control the ip address you want to allow on the vpn tunnel.

• Tunnel VPN IPSEC (LAN to LAN) not succeeded traffic

  I had a temporary scenario I need to establish an IPSEC VPN between branch (cisco router) and HQ (VPN concentrator).

  The tunnel is established end but traffic stop happening after some 5-10 minutes. I have to manually clear the session encryption and then connectivity is fine. To test the above, I'll send branch ICMP packets to HQ. I can see ' cryto isakmp his ' and ' crytpo ipsec his ' active and fine.

  Share your opinion on this guy!

  Hello

  Make sure that this life corresponds to the router and the hub.

  This is a doc for IPSEC troubleshooting: -.

  http://www.Cisco.com/en/us/customer/products/ps6120/products_tech_note09186a00807e0aca.shtml

  Parminder Sian

• Failling L2PT/IPSEC for Android (transform invalid proposal flags - 0 x 800)

  Hello

  I have implemented a L2PT/IPSEC tunnel using a router Cisco 1905, located behind a Cisco ASA FW. This tunnel must be established between the router and mobile devices, mainly of iPhones and androids. In the sake of troubleshooting, I made sure the FW is not the way (open all required ports, configured NAT and routes, etc.). It turns out that iPhones correctly establish the tunnel but androids fail.

  Apparently, the problem is the phase 2 of the IPSec protocol, like where it says in debugging
  18 Dec 12:42:34.226: IPSEC (ipsec_process_proposal): invalid transform proposal flags - 0 x 800
  18 Dec 12:42:34.226: ISAKMP: (1028): IPSec policy invalidated proposal with error 1024

  I tried AES and 3DES in games of conversion, but it seems he just doesn´t work.

  Can someone help me?

  Router: Cisco 1905 image: c1900-universalk9-mz. Spa. 150 - 1.M8.bin
  iPhone: 6 (iOS 8.1) and 5 (9.1)
  Android: Motorola MotoG (Android 4.4.2)

  Installation program for mobile devices:

  Type: L2TP/IPSec PSL
  Server address:
  Password preshared IPSec: cisco
  username: cisco
  password: cisco

  Cisco 1905 relevant config:

  AAA of authentication ppp default local
  !
  VPDN enable
  !
  VPDN-group L2TP
  accept-dialin
  L2tp Protocol
  virtual-model 1
  no authentication of l2tp tunnel
  !
  username cisco password cisco
  crypto ISAKMP policy 10
  BA 3des
  preshared authentication
  Group 2
  life 3600
  address of cisco key crypto isakmp 0.0.0.0 0.0.0.0 no.-xauth
  ISAKMP crypto keepalive 3600
  !
  !
  Crypto ipsec transform-set esp-3des esp-sha-hmac ipnetconfig
  transport mode
  !
  encryption dynamic-map ipnetconfig-card 10
  Set nat demux
  Set transform-set ipnetconfig
  !
  !
  cisco 10 ipnetconfig-map ipsec isakmp crypto dynamic map
  !
  !
  interface GigabitEthernet0/0
  the IP 192.168.0.1 255.255.255.192
  no ip proxy-arp
  automatic duplex
  automatic speed
  Cisco card crypto
  !
  !
  interface virtual-Template1
  IP unnumbered GigabitEthernet0/0
  peer default ip address pool poolipnetconfig
  PPP encryption mppe 40
  PPP authentication ms-chap-v2 pap, chap, ms-chap
  !
  local pool IP 192.168.1.1 poolipnetconfig 192.168.1.255

  Debug:

  12:42:30.763 18 Dec: ISAKMP (0): received 200.247.229.53 packet dport 500 sport 50003 Global (N) SA NEWS
  12:42:30.763 18 Dec: ISAKMP: created a struct peer 200.247.229.53, peer port 50003
  12:42:30.763 18 Dec: ISAKMP: new created position = 0x285F5FBC peer_handle = 0 x 80000018
  12:42:30.763 18 Dec: ISAKMP: lock struct 0x285F5FBC, refcount 1 to peer crypto_isakmp_process_block
  12:42:30.763 18 Dec: ISAKMP: 500 local port, remote port 50003
  12:42:30.763 18 Dec: ISAKMP: (0): insert his with his 28840894 = success
  12:42:30.763 18 Dec: ISAKMP: (0): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
  12:42:30.763 18 Dec: ISAKMP: (0): former State = new State IKE_READY = IKE_R_MM1

  18 Dec 12:42:30.763: ISAKMP: (0): treatment ITS payload. Message ID = 0
  18 Dec 12:42:30.763: ISAKMP: (0): load useful vendor id of treatment
  18 Dec 12:42:30.763: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 69
  12:42:30.763 18 Dec: ISAKMP (0): provider ID is NAT - T RFC 3947
  18 Dec 12:42:30.763: ISAKMP: (0): load useful vendor id of treatment
  18 Dec 12:42:30.763: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 164
  18 Dec 12:42:30.763: ISAKMP: (0): load useful vendor id of treatment
  18 Dec 12:42:30.763: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 123
  18 Dec 12:42:30.763: ISAKMP: (0): provider ID is NAT - T v2
  18 Dec 12:42:30.763: ISAKMP: (0): load useful vendor id of treatment
  18 Dec 12:42:30.763: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 221
  18 Dec 12:42:30.763: ISAKMP: (0): load useful vendor id of treatment
  18 Dec 12:42:30.763: ISAKMP: (0): IKE frag vendor processing id payload
  12:42:30.763 18 Dec: ISAKMP: (0): IKE Fragmentation support not enabled
  18 Dec 12:42:30.763: ISAKMP: (0): load useful vendor id of treatment
  18 Dec 12:42:30.763: ISAKMP: (0): provider ID is DPD
  12:42:30.763 18 Dec: ISAKMP: (0): pair found pre-shared key matching 200.247.229.53
  18 Dec 12:42:30.763: ISAKMP: (0): pre-shared key local found
  12:42:30.763 18 Dec: ISAKMP: analysis of the profiles for xauth...
  12:42:30.767 18 Dec: ISAKMP: (0): audit ISAKMP transform 1 against the policy of priority 10
  12:42:30.767 18 Dec: ISAKMP: type of life in seconds
  12:42:30.767 18 Dec: ISAKMP: life (basic) of 28800
  12:42:30.767 18 Dec: ISAKMP: AES - CBC encryption
  12:42:30.767 18 Dec: ISAKMP: keylength 256
  12:42:30.767 18 Dec: ISAKMP: pre-shared key auth
  12:42:30.767 18 Dec: ISAKMP: SHA hash
  12:42:30.767 18 Dec: ISAKMP: group by default 2
  12:42:30.767 18 Dec: ISAKMP: (0): free encryption algorithm does not match policy.
  12:42:30.767 18 Dec: ISAKMP: (0): atts are not acceptable. Next payload is 3
  12:42:30.767 18 Dec: ISAKMP: (0): audit ISAKMP transform 2 against the policy of priority 10
  12:42:30.767 18 Dec: ISAKMP: type of life in seconds
  12:42:30.767 18 Dec: ISAKMP: life (basic) of 28800
  12:42:30.767 18 Dec: ISAKMP: AES - CBC encryption
  12:42:30.767 18 Dec: ISAKMP: keylength 256
  12:42:30.767 18 Dec: ISAKMP: pre-shared key auth
  12:42:30.767 18 Dec: ISAKMP: MD5 hash
  12:42:30.767 18 Dec: ISAKMP: group by default 2
  12:42:30.767 18 Dec: ISAKMP: (0): free encryption algorithm does not match policy.
  12:42:30.767 18 Dec: ISAKMP: (0): atts are not acceptable. Next payload is 3
  12:42:30.767 18 Dec: ISAKMP: (0): audit ISAKMP transform 3 against the policy of priority 10
  12:42:30.767 18 Dec: ISAKMP: type of life in seconds
  12:42:30.767 18 Dec: ISAKMP: life (basic) of 28800
  12:42:30.767 18 Dec: ISAKMP: AES - CBC encryption
  12:42:30.767 18 Dec: ISAKMP: keylength 128
  12:42:30.767 18 Dec: ISAKMP: pre-shared key auth
  12:42:30.767 18 Dec: ISAKMP: SHA hash
  12:42:30.767 18 Dec: ISAKMP: group by default 2
  12:42:30.767 18 Dec: ISAKMP: (0): free encryption algorithm does not match policy.
  12:42:30.767 18 Dec: ISAKMP: (0): atts are not acceptable. Next payload is 3
  12:42:30.767 18 Dec: ISAKMP: (0): audit ISAKMP transform 4 against the policy of priority 10
  12:42:30.767 18 Dec: ISAKMP: type of life in seconds
  12:42:30.767 18 Dec: ISAKMP: life (basic) of 28800
  12:42:30.767 18 Dec: ISAKMP: AES - CBC encryption
  12:42:30.767 18 Dec: ISAKMP: keylength 128
  12:42:30.767 18 Dec: ISAKMP: pre-shared key auth
  12:42:30.767 18 Dec: ISAKMP: MD5 hash
  12:42:30.767 18 Dec: ISAKMP: group by default 2
  12:42:30.767 18 Dec: ISAKMP: (0): free encryption algorithm does not match policy.
  12:42:30.767 18 Dec: ISAKMP: (0): atts are not acceptable. Next payload is 3
  12:42:30.767 18 Dec: ISAKMP: (0): audit ISAKMP transform against the policy of priority 10 5
  12:42:30.767 18 Dec: ISAKMP: type of life in seconds
  12:42:30.767 18 Dec: ISAKMP: life (basic) of 28800
  12:42:30.767 18 Dec: ISAKMP: 3DES-CBC encryption
  12:42:30.767 18 Dec: ISAKMP: pre-shared key auth
  12:42:30.767 18 Dec: ISAKMP: SHA hash
  12:42:30.767 18 Dec: ISAKMP: group by default 2
  12:42:30.767 18 Dec: ISAKMP: (0): atts are acceptable. Next payload is 3
  12:42:30.767 18 Dec: ISAKMP: (0): Acceptable atts: real life: 3600
  12:42:30.767 18 Dec: ISAKMP: (0): Acceptable atts:life: 0
  12:42:30.767 18 Dec: ISAKMP: (0): base life_in_seconds:28800
  12:42:30.767 18 Dec: ISAKMP: (0): return real life: 3600
  12:42:30.767 18 Dec: ISAKMP: (0): timer life Started: 3600.

  18 Dec 12:42:30.767: ISAKMP: (0): load useful vendor id of treatment
  18 Dec 12:42:30.767: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 69
  12:42:30.767 18 Dec: ISAKMP (0): provider ID is NAT - T RFC 3947
  18 Dec 12:42:30.767: ISAKMP: (0): load useful vendor id of treatment
  18 Dec 12:42:30.767: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 164
  18 Dec 12:42:30.767: ISAKMP: (0): load useful vendor id of treatment
  18 Dec 12:42:30.767: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 123
  18 Dec 12:42:30.767: ISAKMP: (0): provider ID is NAT - T v2
  18 Dec 12:42:30.767: ISAKMP: (0): load useful vendor id of treatment
  18 Dec 12:42:30.767: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 221
  18 Dec 12:42:30.767: ISAKMP: (0): load useful vendor id of treatment
  18 Dec 12:42:30.767: ISAKMP: (0): IKE frag vendor processing id payload
  12:42:30.767 18 Dec: ISAKMP: (0): IKE Fragmentation support not enabled
  18 Dec 12:42:30.767: ISAKMP: (0): load useful vendor id of treatment
  18 Dec 12:42:30.767: ISAKMP: (0): provider ID is DPD
  12:42:30.767 18 Dec: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
  12:42:30.767 18 Dec: ISAKMP: (0): former State = new State IKE_R_MM1 = IKE_R_MM1

  18 Dec 12:42:30.767: ISAKMP: (0): built of NAT - T of the seller-rfc3947 ID
  18 Dec 12:42:30.767: ISAKMP: (0): lot of 200.247.229.53 sending my_port 500 peer_port 50003 (R) MM_SA_SETUP
  12:42:30.767 18 Dec: ISAKMP: (0): sending a packet IPv4 IKE.
  12:42:30.767 18 Dec: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
  12:42:30.767 18 Dec: ISAKMP: (0): former State = new State IKE_R_MM1 = IKE_R_MM2

  12:42:31.730 18 Dec: ISAKMP (0): received 200.247.229.53 packet dport 500 sport 50003 Global (R) MM_SA_SETUP
  12:42:31.730 18 Dec: ISAKMP: (0): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
  12:42:31.730 18 Dec: ISAKMP: (0): former State = new State IKE_R_MM2 = IKE_R_MM3

  18 Dec 12:42:31.730: ISAKMP: (0): processing KE payload. Message ID = 0
  18 Dec 12:42:31.758: ISAKMP: (0): processing NONCE payload. Message ID = 0
  12:42:31.758 18 Dec: ISAKMP: (0): pair found pre-shared key matching 200.247.229.53
  12:42:31.758 18 Dec: ISAKMP: receives the payload type 20
  12:42:31.758 18 Dec: ISAKMP (1028): NAT found, both nodes inside the NAT
  12:42:31.758 18 Dec: ISAKMP: receives the payload type 20
  12:42:31.758 18 Dec: ISAKMP (1028): NAT found, both nodes inside the NAT
  12:42:31.758 18 Dec: ISAKMP: (1028): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
  12:42:31.758 18 Dec: ISAKMP: (1028): former State = new State IKE_R_MM3 = IKE_R_MM3

  18 Dec 12:42:31.758: ISAKMP: (1028): lot of 200.247.229.53 sending my_port 500 peer_port 50003 (R) MM_KEY_EXCH
  12:42:31.758 18 Dec: ISAKMP: (1028): sending a packet IPv4 IKE.
  12:42:31.758 18 Dec: ISAKMP: (1028): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
  12:42:31.758 18 Dec: ISAKMP: (1028): former State = new State IKE_R_MM3 = IKE_R_MM4

  12:42:32.278 18 Dec: ISAKMP (1028): received 200.247.229.53 packet dport 4500 sport 50001 Global (R) MM_KEY_EXCH
  12:42:32.278 18 Dec: ISAKMP: (1028): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
  12:42:32.278 18 Dec: ISAKMP: (1028): former State = new State IKE_R_MM4 = IKE_R_MM5

  18 Dec 12:42:32.278: ISAKMP: (1028): payload ID for treatment. Message ID = 0
  12:42:32.278 18 Dec: ISAKMP (1028): payload ID
  next payload: 8
  type: 1
  address: 10.92.110.15
  Protocol: 17
  Port: 500
  Length: 12
  12:42:32.278 18 Dec: ISAKMP: (0): peer games * no * profiles
  18 Dec 12:42:32.278: ISAKMP: (1028): HASH payload processing. Message ID = 0
  12:42:32.278 18 Dec: ISAKMP: (1028): SA authentication status:
  authenticated
  12:42:32.278 18 Dec: ISAKMP: (1028): SA has been authenticated with 200.247.229.53
  12:42:32.278 18 Dec: ISAKMP: (1028): port detected floating port = 50001
  12:42:32.278 18 Dec: ISAKMP: attempts to insert a peer and inserted 192.168.0.1/200.247.229.53/50001/ 285F5FBC successfully.
  12:42:32.278 18 Dec: ISAKMP: (1028): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
  12:42:32.278 18 Dec: ISAKMP: (1028): former State = new State IKE_R_MM5 = IKE_R_MM5

  12:42:32.278 18 Dec: ISAKMP: (1028): ITS been pre-shared key, using id ID_IPV4_ADDR type authentication
  12:42:32.278 18 Dec: ISAKMP (1028): payload ID
  next payload: 8
  type: 1
  address: 192.168.0.1
  Protocol: 17
  Port: 0
  Length: 12
  12:42:32.278 18 Dec: ISAKMP: (1028): the total payload length: 12
  18 Dec 12:42:32.278: ISAKMP: (1028): lot of 200.247.229.53 sending peer_port my_port 4500 50001 (R) MM_KEY_EXCH
  12:42:32.278 18 Dec: ISAKMP: (1028): sending a packet IPv4 IKE.
  12:42:32.278 18 Dec: ISAKMP: (1028): real life of return: 3600
  12:42:32.278 18 Dec: ISAKMP: node set 662318345 to QM_IDLE
  12:42:32.278 18 Dec: ISAKMP: (1028): Protocol to send NOTIFIER RESPONDER_LIFETIME 1
  SPI 672252680, message ID = 662318345
  18 Dec 12:42:32.278: ISAKMP: (1028): lot of 200.247.229.53 sending peer_port my_port 4500 50001 (R) MM_KEY_EXCH
  12:42:32.278 18 Dec: ISAKMP: (1028): sending a packet IPv4 IKE.
  12:42:32.278 18 Dec: ISAKMP: (1028): purge the node 662318345
  12:42:32.278 18 Dec: ISAKMP: phase sending 1 machine life 3600

  12:42:32.278 18 Dec: ISAKMP: (1028): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
  12:42:32.278 18 Dec: ISAKMP: (1028): former State = new State IKE_R_MM5 = IKE_P1_COMPLETE

  12:42:32.278 18 Dec: ISAKMP: (1028): IKE_DPD is enabled, the initialization of timers
  12:42:32.282 18 Dec: ISAKMP: (1028): entry = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
  12:42:32.282 18 Dec: ISAKMP: (1028): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE

  12:42:32.834 18 Dec: ISAKMP (1028): received 200.247.229.53 packet dport 4500 sport 50001 Global (R) QM_IDLE
  12:42:32.834 18 Dec: ISAKMP: node set-647285005 to QM_IDLE
  18 Dec 12:42:32.834: ISAKMP: (1028): HASH payload processing. Message ID =-647285005
  18 Dec 12:42:32.834: ISAKMP: (1028): treatment protocol NOTIFIER INITIAL_CONTACT 1
  SPI 0, message ID =-647285005, his 28840894 =
  12:42:32.834 18 Dec: ISAKMP: (1028): SA authentication status:
  authenticated
  18 Dec 12:42:32.834: ISAKMP: (1028): process of first contact.
  dropping existing phase 1 and 2 with local 192.168.0.1 distance distance 200.247.229.53 port 50001
  12:42:32.834 18 Dec: ISAKMP: (1028): node-647285005 error suppression FALSE reason 'informational (en) State 1.
  12:42:32.834 18 Dec: ISAKMP: (1028): entry = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY
  12:42:32.834 18 Dec: ISAKMP: (1028): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE

  18 Dec 12:42:32.834: IPSEC (key_engine): had an event of the queue with 1 KMI message (s)
  12:42:34.222 18 Dec: ISAKMP (1028): received 200.247.229.53 packet dport 4500 sport 50004 Global (R) QM_IDLE
  12:42:34.222 18 Dec: ISAKMP: node set-725923158 to QM_IDLE
  18 Dec 12:42:34.222: ISAKMP: (1028): HASH payload processing. Message ID =-725923158
  18 Dec 12:42:34.222: ISAKMP: (1028): treatment ITS payload. Message ID =-725923158
  12:42:34.222 18 Dec: ISAKMP: (1028): proposal of IPSec checking 1
  12:42:34.222 18 Dec: ISAKMP: turn 1, ESP_AES
  12:42:34.222 18 Dec: ISAKMP: attributes of transformation:
  12:42:34.222 18 Dec: ISAKMP: type of life in seconds
  12:42:34.222 18 Dec: ISAKMP: life of HIS (basic) of 28800
  12:42:34.222 18 Dec: ISAKMP: program is 4 (Transport-UDP)
  12:42:34.222 18 Dec: ISAKMP: key length is 256
  12:42:34.222 18 Dec: ISAKMP: authenticator is HMAC-SHA
  12:42:34.222 18 Dec: ISAKMP: (1028): atts are acceptable.
  12:42:34.222 18 Dec: ISAKMP: (1028): proposal of IPSec checking 1
  12:42:34.222 18 Dec: ISAKMP: turning 2, ESP_AES
  12:42:34.222 18 Dec: ISAKMP: attributes of transformation:
  12:42:34.222 18 Dec: ISAKMP: type of life in seconds
  12:42:34.222 18 Dec: ISAKMP: life of HIS (basic) of 28800
  12:42:34.222 18 Dec: ISAKMP: program is 4 (Transport-UDP)
  12:42:34.222 18 Dec: ISAKMP: key length is 256
  12:42:34.222 18 Dec: ISAKMP: authenticator is HMAC-MD5
  12:42:34.222 18 Dec: ISAKMP: (1028): atts are acceptable.
  12:42:34.222 18 Dec: ISAKMP: (1028): proposal of IPSec checking 1
  12:42:34.222 18 Dec: ISAKMP: turn 3, ESP_AES
  12:42:34.222 18 Dec: ISAKMP: attributes of transformation:
  12:42:34.222 18 Dec: ISAKMP: type of life in seconds
  12:42:34.222 18 Dec: ISAKMP: life of HIS (basic) of 28800
  12:42:34.222 18 Dec: ISAKMP: program is 4 (Transport-UDP)
  12:42:34.222 18 Dec: ISAKMP: key length is 128
  12:42:34.222 18 Dec: ISAKMP: authenticator is HMAC-SHA
  12:42:34.222 18 Dec: ISAKMP: (1028): atts are acceptable.
  12:42:34.222 18 Dec: ISAKMP: (1028): proposal of IPSec checking 1
  12:42:34.222 18 Dec: ISAKMP: turn 4, ESP_AES
  12:42:34.222 18 Dec: ISAKMP: attributes of transformation:
  12:42:34.222 18 Dec: ISAKMP: type of life in seconds
  12:42:34.222 18 Dec: ISAKMP: life of HIS (basic) of 28800
  12:42:34.222 18 Dec: ISAKMP: program is 4 (Transport-UDP)
  12:42:34.222 18 Dec: ISAKMP: key length is 128
  12:42:34.222 18 Dec: ISAKMP: authenticator is HMAC-MD5
  12:42:34.222 18 Dec: ISAKMP: (1028): atts are acceptable.
  12:42:34.222 18 Dec: ISAKMP: (1028): proposal of IPSec checking 1
  12:42:34.222 18 Dec: ISAKMP: turn 5, ESP_3DES
  12:42:34.222 18 Dec: ISAKMP: attributes of transformation:
  12:42:34.222 18 Dec: ISAKMP: type of life in seconds
  12:42:34.226 18 Dec: ISAKMP: life of HIS (basic) of 28800
  12:42:34.226 18 Dec: ISAKMP: program is 4 (Transport-UDP)
  12:42:34.226 18 Dec: ISAKMP: authenticator is HMAC-SHA
  12:42:34.226 18 Dec: ISAKMP: (1028): atts are acceptable.
  12:42:34.226 18 Dec: ISAKMP: (1028): proposal of IPSec checking 1
  12:42:34.226 18 Dec: ISAKMP: turn 6, ESP_3DES
  12:42:34.226 18 Dec: ISAKMP: attributes of transformation:
  12:42:34.226 18 Dec: ISAKMP: type of life in seconds
  12:42:34.226 18 Dec: ISAKMP: life of HIS (basic) of 28800
  12:42:34.226 18 Dec: ISAKMP: program is 4 (Transport-UDP)
  12:42:34.226 18 Dec: ISAKMP: authenticator is HMAC-MD5
  12:42:34.226 18 Dec: ISAKMP: (1028): atts are acceptable.
  12:42:34.226 18 Dec: ISAKMP: (1028): proposal of IPSec checking 1
  12:42:34.226 18 Dec: ISAKMP: turn 7, ESP_DES
  12:42:34.226 18 Dec: ISAKMP: attributes of transformation:
  12:42:34.226 18 Dec: ISAKMP: type of life in seconds
  12:42:34.226 18 Dec: ISAKMP: life of HIS (basic) of 28800
  12:42:34.226 18 Dec: ISAKMP: program is 4 (Transport-UDP)
  12:42:34.226 18 Dec: ISAKMP: authenticator is HMAC-SHA
  12:42:34.226 18 Dec: ISAKMP: (1028): atts are acceptable.
  12:42:34.226 18 Dec: ISAKMP: (1028): proposal of IPSec checking 1
  12:42:34.226 18 Dec: ISAKMP: turn 8, ESP_DES
  12:42:34.226 18 Dec: ISAKMP: attributes of transformation:
  12:42:34.226 18 Dec: ISAKMP: type of life in seconds
  12:42:34.226 18 Dec: ISAKMP: life of HIS (basic) of 28800
  12:42:34.226 18 Dec: ISAKMP: program is 4 (Transport-UDP)
  12:42:34.226 18 Dec: ISAKMP: authenticator is HMAC-MD5
  12:42:34.226 18 Dec: ISAKMP: (1028): atts are acceptable.
  18 Dec 12:42:34.226: IPSEC (validate_proposal_request): part #1 the proposal
  18 Dec 12:42:34.226: IPSEC (validate_proposal_request): part #1 of the proposal
  (Eng. msg key.) Local INCOMING = 192.168.0.1, distance = 200.247.229.53,.
  local_proxy = 201.229.58.242/255.255.255.255/17/1701 (type = 1),
  remote_proxy = 200.247.229.53/255.255.255.255/17/0 (type = 1),
  Protocol = ESP, transform = NONE (UDP Transport),
  lifedur = 0 and 0kb in
  SPI = 0 x 0 (0), id_conn = 0, keysize = 256, flags = 0 x 0
  18 Dec 12:42:34.226: IPSEC (ipsec_process_proposal): application for conversion not supported for identity:
  {esp - aes 256 esp-sha-hmac}
  18 Dec 12:42:34.226: ISAKMP: (1028): IPSec policy invalidated proposal with error 256
  18 Dec 12:42:34.226: IPSEC (validate_proposal_request): part #1 the proposal
  18 Dec 12:42:34.226: IPSEC (validate_proposal_request): part #1 of the proposal
  (Eng. msg key.) Local INCOMING = 192.168.0.1, distance = 200.247.229.53,.
  local_proxy = 201.229.58.242/255.255.255.255/17/1701 (type = 1),
  remote_proxy = 200.247.229.53/255.255.255.255/17/0 (type = 1),
  Protocol = ESP, transform = NONE (UDP Transport),
  lifedur = 0 and 0kb in
  SPI = 0 x 0 (0), id_conn = 0, keysize = 256, flags = 0 x 0
  18 Dec 12:42:34.226: IPSEC (ipsec_process_proposal): application for conversion not supported for identity:
  {esp - aes 256 esp-md5-hmac}
  18 Dec 12:42:34.226: ISAKMP: (1028): IPSec policy invalidated proposal with error 256
  18 Dec 12:42:34.226: IPSEC (validate_proposal_request): part #1 the proposal
  18 Dec 12:42:34.226: IPSEC (validate_proposal_request): part #1 of the proposal
  (Eng. msg key.) Local INCOMING = 192.168.0.1, distance = 200.247.229.53,.
  local_proxy = 201.229.58.242/255.255.255.255/17/1701 (type = 1),
  remote_proxy = 200.247.229.53/255.255.255.255/17/0 (type = 1),
  Protocol = ESP, transform = NONE (UDP Transport),
  lifedur = 0 and 0kb in
  SPI = 0 x 0 (0), id_conn = 0, keysize = 128, flags = 0 x 0
  18 Dec 12:42:34.226: IPSEC (ipsec_process_proposal): application for conversion not supported for identity:
  {esp - aes esp-sha-hmac}
  18 Dec 12:42:34.226: ISAKMP: (1028): IPSec policy invalidated proposal with error 256
  18 Dec 12:42:34.226: IPSEC (validate_proposal_request): part #1 the proposal
  18 Dec 12:42:34.226: IPSEC (validate_proposal_request): part #1 of the proposal
  (Eng. msg key.) Local INCOMING = 192.168.0.1, distance = 200.247.229.53,.
  local_proxy = 201.229.58.242/255.255.255.255/17/1701 (type = 1),
  remote_proxy = 200.247.229.53/255.255.255.255/17/0 (type = 1),
  Protocol = ESP, transform = NONE (UDP Transport),
  lifedur = 0 and 0kb in
  SPI = 0 x 0 (0), id_conn = 0, keysize = 128, flags = 0 x 0
  18 Dec 12:42:34.226: IPSEC (ipsec_process_proposal): application for conversion not supported for identity:
  {esp - aes esp-md5-hmac}
  18 Dec 12:42:34.226: ISAKMP: (1028): IPSec policy invalidated proposal with error 256
  18 Dec 12:42:34.226: IPSEC (validate_proposal_request): part #1 the proposal
  18 Dec 12:42:34.226: IPSEC (validate_proposal_request): part #1 of the proposal
  (Eng. msg key.) Local INCOMING = 192.168.0.1, distance = 200.247.229.53,.
  local_proxy = 201.229.58.242/255.255.255.255/17/1701 (type = 1),
  remote_proxy = 200.247.229.53/255.255.255.255/17/0 (type = 1),
  Protocol = ESP, transform = NONE (UDP Transport),
  lifedur = 0 and 0kb in
  SPI = 0 x 0 (0), id_conn = 0, keysize = 0, flags = 0 x 0
  18 Dec 12:42:34.226: IPSEC (ipsec_process_proposal): invalid transform proposal flags - 0 x 800
  18 Dec 12:42:34.226: ISAKMP: (1028): IPSec policy invalidated proposal with error 1024
  18 Dec 12:42:34.226: IPSEC (validate_proposal_request): part #1 the proposal
  18 Dec 12:42:34.226: IPSEC (validate_proposal_request): part #1 of the proposal
  (Eng. msg key.) Local INCOMING = 192.168.0.1, distance = 200.247.229.53,.
  local_proxy = 201.229.58.242/255.255.255.255/17/1701 (type = 1),
  remote_proxy = 200.247.229.53/255.255.255.255/17/0 (type = 1),
  Protocol = ESP, transform = NONE (UDP Transport),
  lifedur = 0 and 0kb in
  SPI = 0 x 0 (0), id_conn = 0, keysize = 0, flags = 0 x 0
  18 Dec 12:42:34.226: IPSEC (ipsec_process_proposal): application for conversion not supported for identity:
  {esp-3des esp-md5-hmac}
  18 Dec 12:42:34.226: ISAKMP: (1028): IPSec policy invalidated proposal with error 256
  18 Dec 12:42:34.226: IPSEC (validate_proposal_request): part #1 the proposal
  18 Dec 12:42:34.226: IPSEC (validate_proposal_request): part #1 of the proposal
  (Eng. msg key.) Local INCOMING = 192.168.0.1, distance = 200.247.229.53,.
  local_proxy = 201.229.58.242/255.255.255.255/17/1701 (type = 1),
  remote_proxy = 200.247.229.53/255.255.255.255/17/0 (type = 1),
  Protocol = ESP, transform = NONE (UDP Transport),
  lifedur = 0 and 0kb in
  SPI = 0 x 0 (0), id_conn = 0, keysize = 0, flags = 0 x 0
  18 Dec 12:42:34.226: IPSEC (ipsec_process_proposal): application for conversion not supported for identity:
  {des-esp esp-sha-hmac}
  18 Dec 12:42:34.226: ISAKMP: (1028): IPSec policy invalidated proposal with error 256
  18 Dec 12:42:34.226: IPSEC (validate_proposal_request): part #1 the proposal
  18 Dec 12:42:34.226: IPSEC (validate_proposal_request): part #1 of the proposal
  (Eng. msg key.) Local INCOMING = 192.168.0.1, distance = 200.247.229.53,.
  local_proxy = 201.229.58.242/255.255.255.255/17/1701 (type = 1),
  remote_proxy = 200.247.229.53/255.255.255.255/17/0 (type = 1),
  Protocol = ESP, transform = NONE (UDP Transport),
  lifedur = 0 and 0kb in
  SPI = 0 x 0 (0), id_conn = 0, keysize = 0, flags = 0 x 0
  18 Dec 12:42:34.226: IPSEC (ipsec_process_proposal): application for conversion not supported for identity:
  {des-esp esp-md5-hmac}
  18 Dec 12:42:34.226: ISAKMP: (1028): IPSec policy invalidated proposal with error 256
  18 Dec 12:42:34.226: ISAKMP: (1028): politics of ITS phase 2 is not acceptable! (local 192.168.0.1 200.247.229.53 remote)
  12:42:34.226 18 Dec: ISAKMP: node set 924420306 to QM_IDLE
  12:42:34.226 18 Dec: ISAKMP: (1028): Protocol to send NOTIFIER PROPOSAL_NOT_CHOSEN 3
  SPI 672251800, message ID = 924420306
  18 Dec 12:42:34.226: ISAKMP: (1028): lot of 200.247.229.53 sending peer_port my_port 4500 50001 (R) QM_IDLE
  12:42:34.226 18 Dec: ISAKMP: (1028): sending a packet IPv4 IKE.
  12:42:34.226 18 Dec: ISAKMP: (1028): purge the node 924420306
  12:42:34.226 18 Dec: ISAKMP: (1028): node-725923158 error suppression REAL reason "QM rejected."
  12:42:34.226 18 Dec: ISAKMP: (1028): entrance, node-725923158 = IKE_MESG_FROM_PEER, IKE_QM_EXCH
  12:42:34.226 18 Dec: ISAKMP: (1028): former State = new State IKE_QM_READY = IKE_QM_READY
  12:42:36.558 18 Dec: ISAKMP (1028): received 200.247.229.53 packet dport 4500 sport 50004 Global (R) QM_IDLE
  18 Dec 12:42:36.558: ISAKMP: (1028): package of phase 2 is a duplicate of a previous package.
  18 Dec 12:42:36.558: ISAKMP: (1028): retransmission due to the phase 2 retransmission
  18 Dec 12:42:36.558: ISAKMP: (1028): ignorance, retransmission, because phase2 node marked 725923158 dead
  12:42:40.670 18 Dec: ISAKMP (1028): received 200.247.229.53 packet dport 4500 sport 50004 Global (R) QM_IDLE
  18 Dec 12:42:40.670: ISAKMP: (1028): package of phase 2 is a duplicate of a previous package.
  18 Dec 12:42:40.670: ISAKMP: (1028): retransmission due to the phase 2 retransmission
  18 Dec 12:42:40.670: ISAKMP: (1028): ignorance, retransmission, because phase2 node marked 725923158 dead
  12:42:42.566 18 Dec: ISAKMP (1028): received 200.247.229.53 packet dport 4500 sport 50004 Global (R) QM_IDLE
  18 Dec 12:42:42.566: ISAKMP: (1028): package of phase 2 is a duplicate of a previous package.
  18 Dec 12:42:42.566: ISAKMP: (1028): retransmission due to the phase 2 retransmission
  18 Dec 12:42:42.566: ISAKMP: (1028): ignorance, retransmission, because phase2 node marked 725923158 dead
  12:42:47.262 18 Dec: ISAKMP (1028): received 200.247.229.53 packet dport 4500 sport 50004 Global (R) QM_IDLE
  18 Dec 12:42:47.262: ISAKMP: (1028): package of phase 2 is a duplicate of a previous package.
  18 Dec 12:42:47.262: ISAKMP: (1028): retransmission due to the phase 2 retransmission
  18 Dec 12:42:47.262: ISAKMP: (1028): ignorance, retransmission, because phase2 node marked 725923158 dead
  12:42:49.414 18 Dec: ISAKMP (1028): received 200.247.229.53 packet dport 4500 sport 50004 Global (R) QM_IDLE
  18 Dec 12:42:49.414: ISAKMP: (1028): package of phase 2 is a duplicate of a previous package.
  18 Dec 12:42:49.414: ISAKMP: (1028): retransmission due to the phase 2 retransmission
  18 Dec 12:42:49.414: ISAKMP: (1028): ignorance, retransmission, because phase2 node marked 725923158 dead
  12:42:52.466 18 Dec: ISAKMP (1028): received 200.247.229.53 packet dport 4500 sport 50004 Global (R) QM_IDLE
  18 Dec 12:42:52.466: ISAKMP: (1028): package of phase 2 is a duplicate of a previous package.
  18 Dec 12:42:52.466: ISAKMP: (1028): retransmission due to the phase 2 retransmission
  18 Dec 12:42:52.466: ISAKMP: (1028): ignorance, retransmission, because phase2 node marked 725923158 dead
  12:42:54.574 18 Dec: ISAKMP (1028): received 200.247.229.53 packet dport 4500 sport 50004 Global (R) QM_IDLE
  18 Dec 12:42:54.574: ISAKMP: (1028): package of phase 2 is a duplicate of a previous package.
  18 Dec 12:42:54.574: ISAKMP: (1028): retransmission due to the phase 2 retransmission
  18 Dec 12:42:54.574: ISAKMP: (1028): ignorance, retransmission, because phase2 node marked 725923158 dead
  12:42:58.738 18 Dec: ISAKMP (1028): received 200.247.229.53 packet dport 4500 sport 50004 Global (R) QM_IDLE
  18 Dec 12:42:58.738: ISAKMP: (1028): package of phase 2 is a duplicate of a previous package.
  18 Dec 12:42:58.738: ISAKMP: (1028): retransmission due to the phase 2 retransmission
  18 Dec 12:42:58.738: ISAKMP: (1028): ignorance, retransmission, because phase2 node marked 725923158 dead
  12:43:00.626 18 Dec: ISAKMP (1028): received 200.247.229.53 packet dport 4500 sport 50004 Global (R) QM_IDLE
  18 Dec 12:43:00.626: ISAKMP: (1028): package of phase 2 is a duplicate of a previous package.
  18 Dec 12:43:00.626: ISAKMP: (1028): retransmission due to the phase 2 retransmission
  18 Dec 12:43:00.626: ISAKMP: (1028): ignorance, retransmission, because phase2 node marked 725923158 dead
  12:43:04.274 Dec 18: L2X:pak 0 nec vrf tableid
  12:43:04.274 18 Dec: L2X: Punting to the queue of L2TP control messages
  12:43:04.274 Dec 18: L2X:pak 0 nec vrf tableid
  12:43:04.274 18 Dec: L2X: Punting to the queue of L2TP control messages
  12:43:04.278 18 Dec: L2TP _: _: ERROR: NULL found l2x cc with handle [32787]

  In fact, the main problem is NAT - T, so avoid the connection through a NAT - T should work.

  The solution of closure seems to be a possible workaround.

  Enjoy the holidays!

  -Randy-

• Tunnel of IPSec site to Site - port-based ACL

  I saw crypto that ACLs will be created but still allowing all (IP).

  What happens if I want to allow hosts on siteA to only access servers in siteB web. In this scenario, I only want to allow port 80 to reach hosts on the siteA. Is this possible? is based on the port ACL allow site to site tunnels?

  Hello.

  Seems to work for me very well:

  Opened up just port 80 - expecting encapsulation.
  R0#telnet 192.2.0.2 80
  
      Trying 192.2.0.2, 80 ... Open
  
      GET /
  
      HTTP/1.1 400 Bad Request
  
      Date: Fri, 01 Mar 2002 00:05:31 GMT
  
      Server: cisco-IOS
  
      Connection: close
  
      Accept-Ranges: none
  400 Bad Request
  [Connection to 192.2.0.2 closed by foreign host]
  
      R0#sh cry
  
      R0#sh crypto ipsec sa | i caps|ident
  
         local  ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/6/0)
  
         remote ident (addr/mask/prot/port): (192.2.0.2/255.255.255.255/6/80)
  
          #pkts encaps: 11, #pkts encrypt: 11, #pkts digest: 11
  
          #pkts decaps: 7, #pkts decrypt: 7, #pkts verify: 7
  
      R0#
  Ping should not go over tunnel.
  R0#ping 192.2.0.2
  Type escape sequence to abort.
  
      Sending 5, 100-byte ICMP Echos to 192.2.0.2, timeout is 2 seconds:
  
      !!!!!
  
      Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
  
      R0#sh crypto ipsec sa | i caps|ident
  
         local  ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/6/0)
  
         remote ident (addr/mask/prot/port): (192.2.0.2/255.255.255.255/6/80)
  
          #pkts encaps: 11, #pkts encrypt: 11, #pkts digest: 11
  
          #pkts decaps: 7, #pkts decrypt: 7, #pkts verify: 7
  

  Config:

  R0#sh run | s crypto
  
      crypto isakmp policy 10
  
      authentication pre-share
  
      crypto isakmp key cisco address 0.0.0.0 0.0.0.0
  
      crypto ipsec transform-set TRA esp-aes esp-sha-hmac
  
      crypto map MAP 10 ipsec-isakmp
  
      set peer 1.1.1.3
  
      set transform-set TRA
  
      match address PACL
  
      crypto map MAP
  
      R0#sh ip access-l PACL
  
      Extended IP access list PACL
  
          10 permit tcp any host 192.2.0.2 eq www (19 matches)
  

  Distance:

  R1#sh run | s crypto 
  
      crypto isakmp policy 10
  
      authentication pre-share
  
      crypto isakmp key cisco address 0.0.0.0 0.0.0.0
  
      crypto ipsec transform-set TRA esp-aes esp-sha-hmac
  
      crypto map MAP 10 ipsec-isakmp
  
      set peer 1.1.1.2
  
      set transform-set TRA
  
      match address PACL
  
      crypto map MAP
  
      R1#sh ip access-l PACL
  
      Extended IP access list PACL
  
          10 permit tcp host 192.2.0.2 eq www any (18 matches)
  

  This has been tested on the main road to 12.4.25.

  Note the ID of remote proxy:

     remote ident (addr/mask/prot/port): (192.2.0.2/255.255.255.255/6/80)

  192.2.0.2 is the IP address

  255.255.255.255 is the subnet mask

  6 is the number of IP - TCP protocol (ref: http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xml )

  80 is the destination port number.

  Marcin