I'm wondering if anyone might have an idea of something I have configured wrong or if this might possibly be a bug.<br><br>I have a Cisco ASA 5505 and using Mutual RSA + XAuth, config pull, DHCP, main mode, auto for the rest of the important stuff including topology with auto policy. I don't think NAT-T, DPD, or fragmentation options result in any changes.<br>
<br>After iked finishes installing the NONE policies:<br><br>10/08/06 13:52:57 ii : configured adapter tap0<br>10/08/06 13:52:57 ii : creating NONE INBOUND policy ANY:them:* -> ANY:me:*<br>10/08/06 13:52:57 K> : send pfkey X_SPDADD UNSPEC message<br>
10/08/06 13:52:57 K< : recv pfkey X_SPDADD UNSPEC message<br>10/08/06 13:52:57 ii : - id = 80<br>10/08/06 13:52:57 ii : - type = NONE<br>10/08/06 13:52:57 ii : - dir = INBOUND<br>10/08/06 13:52:57 ii : - src = them:0/32<br>
10/08/06 13:52:57 ii : - dst = me:0/32<br>10/08/06 13:52:57 ii : creating NONE OUTBOUND policy ANY:me:* -> ANY:them:*<br>10/08/06 13:52:57 ii : created NONE policy route for them/32<br>10/08/06 13:52:57 K> : send pfkey X_SPDADD UNSPEC message<br>
10/08/06 13:52:57 K< : recv pfkey X_SPDADD UNSPEC message<br>10/08/06 13:52:57 ii : - id = 89<br>10/08/06 13:52:57 ii : - type = NONE<br>10/08/06 13:52:57 ii : - dir = OUTBOUND<br>10/08/06 13:52:57 ii : - src = me:0/32<br>
10/08/06 13:52:57 ii : - dst = them:0/32<br><br>I then see where it tries to start phase 2 and fails:<br><br>10/08/06 13:52:57 ii : calling init phase2 for initial policy<br>10/08/06 13:52:57 !! : unable to locate inbound policy for init phase2<br>
<br>And then it continues creating the IPSEC policies:<br><br>0/08/06 13:52:57 ii : creating IPSEC INBOUND policy ANY:<a href="http://0.0.0.0/0:*">0.0.0.0/0:*</a> -> ANY:192.168.2.10:*<br>10/08/06 13:52:57 K> : send pfkey X_SPDADD UNSPEC message<br>
10/08/06 13:52:57 K< : recv pfkey X_SPDADD UNSPEC message<br>10/08/06 13:52:57 ii : - id = 96<br>10/08/06 13:52:57 ii : - type = IPSEC<br>10/08/06 13:52:57 ii : - dir = INBOUND<br>10/08/06 13:52:57 ii : - src = <a href="http://0.0.0.0:0">0.0.0.0:0</a><br>
10/08/06 13:52:57 ii : - dst = <a href="http://192.168.2.10:0/32">192.168.2.10:0/32</a><br>10/08/06 13:52:57 ii : - transform #0<br>10/08/06 13:52:57 ii : -- proto = 50<br>10/08/06 13:52:57 ii : -- level = UNIQUE<br>10/08/06 13:52:57 ii : -- mode = TUNNEL<br>
10/08/06 13:52:57 ii : -- reqid = 1<br>10/08/06 13:52:57 ii : -- tsrc = them<br>10/08/06 13:52:57 ii : -- tdst = me<br>10/08/06 13:52:57 ii : creating IPSEC OUTBOUND policy ANY:192.168.2.10:* -> ANY:<a href="http://0.0.0.0/0:*">0.0.0.0/0:*</a><br>
10/08/06 13:52:57 ii : created IPSEC policy route for 0.0.0.0<br>10/08/06 13:52:57 K> : send pfkey X_SPDADD UNSPEC message<br>10/08/06 13:52:57 K< : recv pfkey X_SPDADD UNSPEC message<br>10/08/06 13:52:57 ii : - id = 105<br>
10/08/06 13:52:57 ii : - type = IPSEC<br>10/08/06 13:52:57 ii : - dir = OUTBOUND<br>10/08/06 13:52:57 ii : - src = <a href="http://192.168.2.10:0/32">192.168.2.10:0/32</a><br>10/08/06 13:52:57 ii : - dst = <a href="http://0.0.0.0:0">0.0.0.0:0</a><br>
10/08/06 13:52:57 ii : - transform #0<br>10/08/06 13:52:57 ii : -- proto = 50<br>10/08/06 13:52:57 ii : -- level = UNIQUE<br>10/08/06 13:52:57 ii : -- mode = TUNNEL<br>10/08/06 13:52:57 ii : -- reqid = 2<br>10/08/06 13:52:57 ii : -- tsrc = 192.168.10.160<br>
10/08/06 13:52:57 ii : -- tdst = 192.168.10.107<br><br>And then it sits there without hitting phase 2. The other end keeps resending me the config packets until it times out, if I leave it alone.<br>However, if I create traffic, such as simply pinging the gateway, it continues on:<br>
<br>10/08/06 13:53:03 K< : recv pfkey ACQUIRE ESP message<br>10/08/06 13:53:03 ii : - id = 105<br>10/08/06 13:53:03 ii : - type = IPSEC<br>10/08/06 13:53:03 ii : - dir = OUTBOUND<br>10/08/06 13:53:03 ii : - src = me:0/32<br>
10/08/06 13:53:03 ii : - dst = them:0/32<br>10/08/06 13:53:03 ii : calling init phase2 for squired policy<br><br>I see my pings respond and everything appears normal and fully functional. Phase 2 looks like it happens as it should.<br>
<br>Any thoughts on what might be happening?<br><br>Thanks,<br>Michael<br>