This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Can't get IPSec Phase 1 to a Cisco ASA. Have previously, but no longer working after WAN IP change.

Previously had an IPSec VPN working between these two devices, after changing WAN address of the UTM pair, will not re-establish the link. PSK has not changed and I can see attempts on port 500 reaching us, but they reportedly can't see us trying to reach them at all. Unfortunately we have no visibility on the router at the other end aside from what they give us. 

Have tried all the basics such as turning on/off strict, turning on/off NAT-T, DPD, MTU path discovery, probing PSK. 

Logs (not debug) if it helps any:

 

2017:12:12-15:32:02 utm-1 pluto[14192]: HA System: not master, won't listen for IKE messages
2017:12:12-15:32:02 utm-1 pluto[14192]: added connection description "S_BXX IpSec Connection -New"
2017:12:12-15:32:02 utm-1 pluto[14192]: added connection description "S_BXX IpSec Connection -New"
2017:12:12-15:32:02 utm-1 pluto[14192]: Pluto is now in slave mode
2017:12:12-15:32:02 utm-2 ipsec_starter[22457]: Starting strongSwan 4.4.1git20100610 IPsec [starter]...
2017:12:12-15:32:02 utm-2 pluto[22472]: Starting IKEv1 pluto daemon (strongSwan 4.4.1git20100610) THREADS VENDORID CISCO_QUIRKS
2017:12:12-15:32:02 utm-2 ipsec_starter[22463]: pluto (22472) started after 20 ms
2017:12:12-15:32:03 utm-2 pluto[22472]: loaded plugins: curl ldap aes des blowfish serpent twofish sha1 sha2 md5 random x509 pubkey pkcs1 pgp dnskey pem sqlite hmac gmp xauth attr attr-sql resolve
2017:12:12-15:32:03 utm-2 pluto[22472]: including NAT-Traversal patch (Version 0.6c)
2017:12:12-15:32:03 utm-2 pluto[22472]: Using Linux 2.6 IPsec interface code
2017:12:12-15:32:03 utm-2 pluto[22472]: HA system enabled and listening on interface eth3
2017:12:12-15:32:03 utm-2 pluto[22472]: Initial HA switch to master mode
2017:12:12-15:32:03 utm-2 pluto[22472]: loading ca certificates from '/etc/ipsec.d/cacerts'
2017:12:12-15:32:03 utm-2 pluto[22472]: loaded ca certificate from '/etc/ipsec.d/cacerts/Wildcard_2018 Verification CA 2.pem'
2017:12:12-15:32:03 utm-2 pluto[22472]: loaded ca certificate from '/etc/ipsec.d/cacerts/Exchange Certificate Verification CA 2.pem'
2017:12:12-15:32:03 utm-2 pluto[22472]: loaded ca certificate from '/etc/ipsec.d/cacerts/Wildcard Certificate Verification CA 3.pem'
2017:12:12-15:32:03 utm-2 pluto[22472]: loaded ca certificate from '/etc/ipsec.d/cacerts/Exchange Certificate 15/16 Verification CA 2.pem'
2017:12:12-15:32:03 utm-2 pluto[22472]: loaded ca certificate from '/etc/ipsec.d/cacerts/Wildcard_2018 Verification CA 1.pem'
2017:12:12-15:32:03 utm-2 pluto[22472]: loaded ca certificate from '/etc/ipsec.d/cacerts/VPN Signing CA.pem'
2017:12:12-15:32:03 utm-2 pluto[22472]: loaded ca certificate from '/etc/ipsec.d/cacerts/Wildcard Certificate Verification CA 2.pem'
2017:12:12-15:32:03 utm-2 pluto[22472]: loaded ca certificate from '/etc/ipsec.d/cacerts/Exchange Certificate Verification CA 1.pem'
2017:12:12-15:32:03 utm-2 pluto[22472]: loaded ca certificate from '/etc/ipsec.d/cacerts/Wildcard Certificate Verification CA 1.pem'
2017:12:12-15:32:03 utm-2 pluto[22472]: loading aa certificates from '/etc/ipsec.d/aacerts'
2017:12:12-15:32:03 utm-2 pluto[22472]: loading ocsp certificates from '/etc/ipsec.d/ocspcerts'
2017:12:12-15:32:03 utm-2 pluto[22472]: Changing to directory '/etc/ipsec.d/crls'
2017:12:12-15:32:03 utm-2 pluto[22472]: loading attribute certificates from '/etc/ipsec.d/acerts'
2017:12:12-15:32:03 utm-2 pluto[22472]: adding interface tun0/tun0 10.242.2.1:500
2017:12:12-15:32:03 utm-2 pluto[22472]: adding interface tun0/tun0 10.242.2.1:4500
2017:12:12-15:32:03 utm-2 pluto[22472]: adding interface eth3/eth3 198.XXX.XXX.2:500
2017:12:12-15:32:03 utm-2 pluto[22472]: adding interface eth3/eth3 198.XXX.XXX.2:4500
2017:12:12-15:32:03 utm-2 pluto[22472]: adding interface eth1/eth1 220.XXX.XXX.232:500
2017:12:12-15:32:03 utm-2 pluto[22472]: adding interface eth1/eth1 220.XXX.XXX.232:4500
2017:12:12-15:32:03 utm-2 pluto[22472]: adding interface eth1/eth1 220.XXX.XXX.228:500
2017:12:12-15:32:03 utm-2 pluto[22472]: adding interface eth1/eth1 220.XXX.XXX.228:4500
2017:12:12-15:32:03 utm-2 pluto[22472]: adding interface eth1/eth1 220.XXX.XXX.230:500
2017:12:12-15:32:03 utm-2 pluto[22472]: adding interface eth1/eth1 220.XXX.XXX.230:4500
2017:12:12-15:32:03 utm-2 pluto[22472]: adding interface eth1/eth1 220.XXX.XXX.238:500
2017:12:12-15:32:03 utm-2 pluto[22472]: adding interface eth1/eth1 220.XXX.XXX.238:4500
2017:12:12-15:32:03 utm-2 pluto[22472]: adding interface eth1/eth1 220.XXX.XXX.231:500
2017:12:12-15:32:03 utm-2 pluto[22472]: adding interface eth1/eth1 220.XXX.XXX.231:4500
2017:12:12-15:32:03 utm-2 pluto[22472]: adding interface eth1/eth1 220.XXX.XXX.233:500
2017:12:12-15:32:03 utm-2 pluto[22472]: adding interface eth1/eth1 220.XXX.XXX.233:4500
2017:12:12-15:32:03 utm-2 pluto[22472]: adding interface eth1/eth1 220.XXX.XXX.229:500
2017:12:12-15:32:03 utm-2 pluto[22472]: adding interface eth1/eth1 220.XXX.XXX.229:4500
2017:12:12-15:32:03 utm-2 pluto[22472]: adding interface eth1/eth1 220.XXX.XXX.227:500
2017:12:12-15:32:03 utm-2 pluto[22472]: adding interface eth1/eth1 220.XXX.XXX.227:4500
2017:12:12-15:32:03 utm-2 pluto[22472]: adding interface eth0/eth0 10.10.0.254:500
2017:12:12-15:32:03 utm-2 pluto[22472]: adding interface eth0/eth0 10.10.0.254:4500
2017:12:12-15:32:03 utm-2 pluto[22472]: adding interface lo/lo 127.0.0.1:500
2017:12:12-15:32:03 utm-2 pluto[22472]: adding interface lo/lo 127.0.0.1:4500
2017:12:12-15:32:03 utm-2 pluto[22472]: adding interface lo/lo ::1:500
2017:12:12-15:32:03 utm-2 pluto[22472]: loading secrets from "/etc/ipsec.secrets"
2017:12:12-15:32:03 utm-2 pluto[22472]: loaded PSK secret for 220.XXX.XXX.227 59.XXX.XXX.130
2017:12:12-15:32:03 utm-2 pluto[22472]: listening for IKE messages
2017:12:12-15:32:03 utm-2 pluto[22472]: added connection description "S_BXX IpSec Connection -New"
2017:12:12-15:32:03 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #1: initiating Main Mode
2017:12:12-15:32:03 utm-2 pluto[22472]: added connection description "S_BXX IpSec Connection -New"
2017:12:12-15:32:03 utm-2 pluto[22472]: HA System: pluto already is in master mode
2017:12:12-15:32:03 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #1: ignoring Vendor ID payload [FRAGMENTATION c0000000]
2017:12:12-15:32:03 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #1: ignoring Vendor ID payload [Cisco-Unity]
2017:12:12-15:32:03 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #1: received Vendor ID payload [XAUTH]
2017:12:12-15:32:03 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #1: ignoring Vendor ID payload [73218631c781b18ed91d06532b9ab7df]
2017:12:12-15:32:03 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #1: ignoring Vendor ID payload [Cisco VPN 3000 Series]
2017:12:12-15:32:13 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #1: discarding duplicate packet; already STATE_MAIN_I3
2017:12:12-15:32:21 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #1: discarding duplicate packet; already STATE_MAIN_I3
2017:12:12-15:32:29 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #1: discarding duplicate packet; already STATE_MAIN_I3
2017:12:12-15:32:33 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #1: next payload type of ISAKMP Hash Payload has an unknown value: 86
2017:12:12-15:32:33 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #1: malformed payload in packet
2017:12:12-15:33:13 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #1: max number of retransmissions (2) reached STATE_MAIN_I3. Possible authentication failure: no acceptable response to our first encrypted message
2017:12:12-15:33:13 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #1: starting keying attempt 2 of an unlimited number
2017:12:12-15:33:13 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #2: initiating Main Mode to replace #1
2017:12:12-15:33:13 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #2: ignoring Vendor ID payload [FRAGMENTATION c0000000]
2017:12:12-15:33:13 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #2: ignoring Vendor ID payload [Cisco-Unity]
2017:12:12-15:33:13 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #2: received Vendor ID payload [XAUTH]
2017:12:12-15:33:13 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #2: ignoring Vendor ID payload [3bfb622c36fb34567f644e535f5db312]
2017:12:12-15:33:13 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #2: ignoring Vendor ID payload [Cisco VPN 3000 Series]
2017:12:12-15:33:23 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #2: discarding duplicate packet; already STATE_MAIN_I3
2017:12:12-15:33:31 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #2: discarding duplicate packet; already STATE_MAIN_I3
2017:12:12-15:33:39 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #2: discarding duplicate packet; already STATE_MAIN_I3
2017:12:12-15:33:43 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #2: byte 2 of ISAKMP Hash Payload must be zero, but is not
2017:12:12-15:33:43 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #2: malformed payload in packet
2017:12:12-15:34:23 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #2: max number of retransmissions (2) reached STATE_MAIN_I3. Possible authentication failure: no acceptable response to our first encrypted message
2017:12:12-15:34:23 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #2: starting keying attempt 3 of an unlimited number
2017:12:12-15:34:23 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #3: initiating Main Mode to replace #2
2017:12:12-15:34:23 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #3: ignoring Vendor ID payload [FRAGMENTATION c0000000]
2017:12:12-15:34:23 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #3: ignoring Vendor ID payload [Cisco-Unity]
2017:12:12-15:34:23 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #3: received Vendor ID payload [XAUTH]
2017:12:12-15:34:23 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #3: ignoring Vendor ID payload [bcb847f8bf9aba76116da8f1eb99a29e]
2017:12:12-15:34:23 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #3: ignoring Vendor ID payload [Cisco VPN 3000 Series]
2017:12:12-15:34:33 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #3: discarding duplicate packet; already STATE_MAIN_I3
2017:12:12-15:34:41 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #3: discarding duplicate packet; already STATE_MAIN_I3
2017:12:12-15:34:49 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #3: discarding duplicate packet; already STATE_MAIN_I3
2017:12:12-15:34:53 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #3: next payload type of ISAKMP Hash Payload has an unknown value: 94
2017:12:12-15:34:53 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #3: malformed payload in packet
2017:12:12-15:35:33 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #3: max number of retransmissions (2) reached STATE_MAIN_I3. Possible authentication failure: no acceptable response to our first encrypted message
2017:12:12-15:35:33 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #3: starting keying attempt 4 of an unlimited number
2017:12:12-15:35:33 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #4: initiating Main Mode to replace #3
2017:12:12-15:35:33 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #4: ignoring Vendor ID payload [FRAGMENTATION c0000000]
2017:12:12-15:35:34 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #4: ignoring Vendor ID payload [Cisco-Unity]
2017:12:12-15:35:34 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #4: received Vendor ID payload [XAUTH]
2017:12:12-15:35:34 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #4: ignoring Vendor ID payload [7ada25d7dfd3ab14565bf8b4b384716d]
2017:12:12-15:35:34 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #4: ignoring Vendor ID payload [Cisco VPN 3000 Series]
2017:12:12-15:35:44 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #4: discarding duplicate packet; already STATE_MAIN_I3
2017:12:12-15:35:52 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #4: discarding duplicate packet; already STATE_MAIN_I3
2017:12:12-15:36:00 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #4: discarding duplicate packet; already STATE_MAIN_I3
2017:12:12-15:36:04 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #4: next payload type of ISAKMP Hash Payload has an unknown value: 42
2017:12:12-15:36:04 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #4: malformed payload in packet
2017:12:12-15:36:44 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #4: max number of retransmissions (2) reached STATE_MAIN_I3. Possible authentication failure: no acceptable response to our first encrypted message
2017:12:12-15:36:44 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #4: starting keying attempt 5 of an unlimited number
2017:12:12-15:36:44 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #5: initiating Main Mode to replace #4
2017:12:12-15:36:44 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #5: ignoring Vendor ID payload [FRAGMENTATION c0000000]
2017:12:12-15:36:44 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #5: ignoring Vendor ID payload [Cisco-Unity]
2017:12:12-15:36:44 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #5: received Vendor ID payload [XAUTH]
2017:12:12-15:36:44 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #5: ignoring Vendor ID payload [c9a61dc4a13e457699b1a0020317b7b1]
2017:12:12-15:36:44 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #5: ignoring Vendor ID payload [Cisco VPN 3000 Series]
2017:12:12-15:36:54 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #5: discarding duplicate packet; already STATE_MAIN_I3
2017:12:12-15:37:02 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #5: discarding duplicate packet; already STATE_MAIN_I3
2017:12:12-15:37:10 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #5: discarding duplicate packet; already STATE_MAIN_I3
2017:12:12-15:37:14 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #5: next payload type of ISAKMP Hash Payload has an unknown value: 217
2017:12:12-15:37:14 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #5: malformed payload in packet
2017:12:12-15:37:38 utm-2 pluto[22472]: packet from 59.XXX.XXX.130:500: ignoring Vendor ID payload [FRAGMENTATION c0000000]
2017:12:12-15:37:38 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #6: responding to Main Mode
2017:12:12-15:37:46 utm-2 pluto[22472]: packet from 59.XXX.XXX.130:500: ignoring Vendor ID payload [FRAGMENTATION c0000000]
2017:12:12-15:37:46 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #7: responding to Main Mode
2017:12:12-15:37:54 utm-2 pluto[22472]: packet from 59.XXX.XXX.130:500: ignoring Vendor ID payload [FRAGMENTATION c0000000]
2017:12:12-15:37:54 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #8: responding to Main Mode
2017:12:12-15:37:54 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #5: max number of retransmissions (2) reached STATE_MAIN_I3. Possible authentication failure: no acceptable response to our first encrypted message
2017:12:12-15:37:54 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #5: starting keying attempt 6 of an unlimited number
2017:12:12-15:37:54 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #9: initiating Main Mode to replace #5
2017:12:12-15:37:54 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #9: ignoring Vendor ID payload [FRAGMENTATION c0000000]
2017:12:12-15:37:54 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #9: ignoring Vendor ID payload [Cisco-Unity]
2017:12:12-15:37:54 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #9: received Vendor ID payload [XAUTH]
2017:12:12-15:37:54 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #9: ignoring Vendor ID payload [59be2a5a70610a7c2c31d62bf7e17afd]
2017:12:12-15:37:54 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #9: ignoring Vendor ID payload [Cisco VPN 3000 Series]
2017:12:12-15:38:02 utm-2 pluto[22472]: packet from 59.XXX.XXX.130:500: ignoring Vendor ID payload [FRAGMENTATION c0000000]
2017:12:12-15:38:02 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #10: responding to Main Mode
2017:12:12-15:38:04 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #9: discarding duplicate packet; already STATE_MAIN_I3
2017:12:12-15:38:12 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #9: discarding duplicate packet; already STATE_MAIN_I3
2017:12:12-15:38:20 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #9: discarding duplicate packet; already STATE_MAIN_I3
2017:12:12-15:38:24 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #9: next payload type of ISAKMP Hash Payload has an unknown value: 52
2017:12:12-15:38:24 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #9: malformed payload in packet
2017:12:12-15:38:48 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #6: max number of retransmissions (2) reached STATE_MAIN_R1
2017:12:12-15:38:56 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #7: max number of retransmissions (2) reached STATE_MAIN_R1
2017:12:12-15:39:04 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #9: max number of retransmissions (2) reached STATE_MAIN_I3. Possible authentication failure: no acceptable response to our first encrypted message
2017:12:12-15:39:04 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #9: starting keying attempt 7 of an unlimited number
2017:12:12-15:39:04 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #11: initiating Main Mode to replace #9
2017:12:12-15:39:04 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #8: max number of retransmissions (2) reached STATE_MAIN_R1
2017:12:12-15:39:04 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #11: ignoring Vendor ID payload [FRAGMENTATION c0000000]
2017:12:12-15:39:04 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #11: ignoring Vendor ID payload [Cisco-Unity]
2017:12:12-15:39:04 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #11: received Vendor ID payload [XAUTH]
2017:12:12-15:39:04 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #11: ignoring Vendor ID payload [6ee8972854a68cc08b26921a30c56df7]
2017:12:12-15:39:04 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #11: ignoring Vendor ID payload [Cisco VPN 3000 Series]
2017:12:12-15:39:12 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #10: max number of retransmissions (2) reached STATE_MAIN_R1
2017:12:12-15:39:14 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #11: discarding duplicate packet; already STATE_MAIN_I3

 

 

And their logs (what they'll send me at least):

5              Nov 23 2017        15:06:16               713041                                                                  IP = 220.XXX.XXX.227, IKE Initiator: New Phase 1, Intf inside, IKE Peer 220.XXX.XXX.227  local Proxy Address 172.21.200.200, remote Proxy Address 10.10.0.3,  Crypto map (ClientMAP)

7              Nov 23 2017        15:06:16               715046                                                                  IP = 220.XXX.XXX.227, constructing ISAKMP SA payload

7              Nov 23 2017        15:06:16               715046                                                                  IP = 220.XXX.XXX.227, constructing Fragmentation VID + extended capabilities payload

7              Nov 23 2017        15:06:16               713236                                                                  IP = 220.XXX.XXX.227, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 640

7              Nov 23 2017        15:06:24               713236                                                                  IP = 220.XXX.XXX.227, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 640

7              Nov 23 2017        15:06:32               713236                                                                  IP = 220.XXX.XXX.227, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 640

7              Nov 23 2017        15:06:40               713236                                                                  IP = 220.XXX.XXX.227, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 640

7              Nov 23 2017        15:06:48               715065                                                                  IP = 220.XXX.XXX.227, IKE MM Initiator FSM error history (struct &0x75630fd8)  <state>, <event>:  MM_DONE, EV_ERROR-->MM_WAIT_MSG2, EV_RETRY-->MM_WAIT_MSG2, EV_TIMEOUT-->MM_WAIT_MSG2, NullEvent-->MM_SND_MSG1, EV_SND_MSG-->MM_SND_MSG1, EV_START_TMR-->MM_SND_MSG1, EV_RESEND_MSG-->MM_WAIT_MSG2, EV_RETRY

7              Nov 23 2017        15:06:48               713906                                                                  IP = 220.XXX.XXX.227, IKE SA MM:2712fef6 terminating:  flags 0x01000022, refcnt 0, tuncnt 0

7              Nov 23 2017        15:06:48               713906                                                                  IP = 220.XXX.XXX.227, sending delete/delete with reason message



This thread was automatically locked due to age.
Parents
  • Hi and welcome to the UTM Community!

    Is 220.XXX.XXX.227 your new IP or your old one?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • Hi Bob, thanks for that,

     

    220.XXX.XXX.227 is the new WAN side of the firewall. The old link started with a 58. on the WAN side of firewall. 

     

    Unfortunately the ASA is outside of our control, and it seems to be the ASA that isn't hearing anything from the UTM. Haven't got much more info on the ASA at this stage other than it's a 5520, and it's running OS 9.1 (5) 21. 

     

    A chunk of the logs with debugging on - doesn't seem to tell me much more:

     

    2017:11:21-16:24:48 utm-2 pluto[4840]: "S_BXX IpSec Connection" #11: discarding duplicate packet; already STATE_MAIN_I3

    2017:11:21-16:24:48 utm-2 pluto[4840]: | next event EVENT_RETRANSMIT in 4 seconds for #11

    2017:11:21-16:24:52 utm-2 pluto[4840]: |

    2017:11:21-16:24:52 utm-2 pluto[4840]: | *time to handle event

    2017:11:21-16:24:52 utm-2 pluto[4840]: | event after this is EVENT_SA_SYNC_UPDATE in 4 seconds

    2017:11:21-16:24:52 utm-2 pluto[4840]: | handling event EVENT_RETRANSMIT for 59.XXX.XXX.130 "S_BXX IpSec Connection" #11

    2017:11:21-16:24:52 utm-2 pluto[4840]: | inserting event EVENT_RETRANSMIT, timeout in 40 seconds for #11

    2017:11:21-16:24:52 utm-2 pluto[4840]: | next event EVENT_SA_SYNC_UPDATE in 4 seconds

    2017:11:21-16:24:53 utm-2 pluto[4840]: |

    2017:11:21-16:24:53 utm-2 pluto[4840]: | *received 92 bytes from 59.XXX.XXX.130:500 on eth1

    2017:11:21-16:24:53 utm-2 pluto[4840]: | **parse ISAKMP Message:

    2017:11:21-16:24:53 utm-2 pluto[4840]: | initiator cookie:

    2017:11:21-16:24:53 utm-2 pluto[4840]: | 49 3c 19 9a b7 03 18 78

    2017:11:21-16:24:53 utm-2 pluto[4840]: | responder cookie:

    2017:11:21-16:24:53 utm-2 pluto[4840]: | c8 13 05 4d 6f 20 37 b4

    2017:11:21-16:24:53 utm-2 pluto[4840]: | next payload type: ISAKMP_NEXT_HASH

    2017:11:21-16:24:53 utm-2 pluto[4840]: | ISAKMP version: ISAKMP Version 1.0

    2017:11:21-16:24:53 utm-2 pluto[4840]: | exchange type: ISAKMP_XCHG_INFO

    2017:11:21-16:24:53 utm-2 pluto[4840]: | flags: ISAKMP_FLAG_ENCRYPTION

    2017:11:21-16:24:53 utm-2 pluto[4840]: | message ID: 91 33 30 71

    2017:11:21-16:24:53 utm-2 pluto[4840]: | length: 92

    2017:11:21-16:24:53 utm-2 pluto[4840]: | ICOOKIE: 49 3c 19 9a b7 03 18 78

    2017:11:21-16:24:53 utm-2 pluto[4840]: | RCOOKIE: c8 13 05 4d 6f 20 37 b4

    2017:11:21-16:24:53 utm-2 pluto[4840]: | peer: 3b a7 e0 82

    2017:11:21-16:24:53 utm-2 pluto[4840]: | state hash entry 1

    2017:11:21-16:24:53 utm-2 pluto[4840]: | state object #11 found, in STATE_MAIN_I3

    2017:11:21-16:24:53 utm-2 pluto[4840]: "S_BXX IpSec Connection" #11: next payload type of ISAKMP Hash Payload has an unknown value: 127

    2017:11:21-16:24:53 utm-2 pluto[4840]: "S_BXX IpSec Connection" #11: malformed payload in packet

     

    Any help here would be very greatly appreciated, cheers.

  • I think the following line means that you're getting a response, but that it's not what you expect:

    2017:12:12-15:33:13 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #1: max number of retransmissions (2) reached STATE_MAIN_I3. Possible authentication failure: no acceptable response to our first encrypted message

    What happens if you replace your Remote Gateway with an identical one in "Respond only" mode?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • I think the following line means that you're getting a response, but that it's not what you expect:

    2017:12:12-15:33:13 utm-2 pluto[22472]: "S_BXX IpSec Connection -New" #1: max number of retransmissions (2) reached STATE_MAIN_I3. Possible authentication failure: no acceptable response to our first encrypted message

    What happens if you replace your Remote Gateway with an identical one in "Respond only" mode?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
No Data