Meraki

rsage_voda

I am trying to setup a non-meraki IPSEC tunnel between a Cisco ISR4321 running IOS-XE17.12.05b and an old MX84 in my lab running 18.107.10

I have repeatedly checked and re-checked the configuration for phase 1 and phase 2 and the pre-shared key. Below is the debug from the Cisco router. I cannot see what is wrong. Am I just wasting my time with the MX84 and the version of Meraki code?

000164: *Jun 22 10:33:13.609: IPSEC(sa_request): ,
(key eng. msg.) OUTBOUND local= 192.168.0.129:500, remote= xxx.xxx.xxx.xxx:500,
local_proxy= 192.168.150.0/255.255.255.0/256/0,
remote_proxy= 192.168.151.0/255.255.255.0/256/0,
protocol= ESP, transform= esp-aes 256 esp-sha256-hmac (Tunnel), esn= FALSE,
lifedur= 27000s and 4608000kb,
spi= 0x0(0), conn_id= 0, keysize= 256, flags= 0x0
000165: *Jun 22 10:33:13.610: IKEv2:% Getting preshared key from profile keyring IKEv2_KEYRING
000166: *Jun 22 10:33:13.610: IKEv2:% Matched peer block 'PEER1'
000167: *Jun 22 10:33:13.610: IKEv2:(SESSION ID = 0,SA ID = 0):Searching Policy with fvrf 0, local address 192.168.0.129
000168: *Jun 22 10:33:13.610: IKEv2:(SESSION ID = 0,SA ID = 0):Found Policy 'IKEv2_POLICY'
000169: *Jun 22 10:33:13.611: IKEv2:(SESSION ID = 1,SA ID = 1):[IKEv2 -> Crypto Engine] Computing DH public key, DH Group 14
000170: *Jun 22 10:33:13.611: IKEv2:(SESSION ID = 1,SA ID = 1):(SA ID = 1):[Crypto Engine -> IKEv2] DH key Computation PASSED
000171: *Jun 22 10:33:13.611: IKEv2:(SESSION ID = 1,SA ID = 1):Request queued for computation of DH key
000172: *Jun 22 10:33:13.611: IKEv2:(SESSION ID = 1,SA ID = 1):IKEv2 initiator - no config data to send in IKE_SA_INIT exch
000173: *Jun 22 10:33:13.611: IKEv2:(SESSION ID = 1,SA ID = 1):Generating IKE_SA_INIT message
000174: *Jun 22 10:33:13.612: IKEv2:(SESSION ID = 1,SA ID = 1):IKE Proposal: 1, SPI size: 0 (initial negotiation),
Num. transforms: 4
AES-CBC SHA256 SHA256 DH_GROUP_2048_MODP/Group 14
000175: *Jun 22 10:33:13.612: IKEv2:(SESSION ID = 1,SA ID = 1):Corrupt the hash to force NAT in between

000176: *Jun 22 10:33:13.612: IKEv2:(SESSION ID = 1,SA ID = 1):Sending Packet [To xxx.xxx.xxx.xxx:4500/From 192.168.0.129:4500/VRF i0:f0]
Initiator SPI : 2745781F64F2A066 - Responder SPI : 0000000000000000 Message id: 0
IKEv2 IKE_SA_INIT Exchange REQUEST
Payload contents:
SA KE N VID VID VID VID NOTIFY(NAT_DETECTION_SOURCE_IP) NOTIFY(NAT_DETECTION_DESTINATION_IP)

000177: *Jun 22 10:33:13.613: IKEv2:(SESSION ID = 1,SA ID = 1):Insert SA

000178: *Jun 22 10:33:13.679: IKEv2:(SESSION ID = 1,SA ID = 1):Received Packet [From xxx.xxx.xxx.xxx:4500/To 192.168.0.129:4500/VRF i0:f0]
Initiator SPI : 2745781F64F2A066 - Responder SPI : 17178C7F5FE6CE36 Message id: 0
IKEv2 IKE_SA_INIT Exchange RESPONSE
Payload contents:

000179: *Jun 22 10:33:13.679: IKEv2:(SESSION ID = 1,SA ID = 1):parsing SA payload SA
000180: *Jun 22 10:33:13.679: IKEv2:(SESSION ID = 1,SA ID = 1):parsing KE payload KE
000181: *Jun 22 10:33:13.679: IKEv2:(SESSION ID = 1,SA ID = 1):parsing N payload N
000182: *Jun 22 10:33:13.679: IKEv2:(SESSION ID = 1,SA ID = 1):parsing NOTIFY payload NOTIFY(NAT_DETECTION_SOURCE_IP)
000183: *Jun 22 10:33:13.679: IKEv2:(SESSION ID = 1,SA ID = 1):parsing NOTIFY payload NOTIFY(NAT_DETECTION_DESTINATION_IP)
000184: *Jun 22 10:33:13.679: IKEv2:(SESSION ID = 1,SA ID = 1):parsing NOTIFY payload NOTIFY(Unknown - 16418)
000185: *Jun 22 10:33:13.679: IKEv2:(SESSION ID = 1,SA ID = 1):parsing NOTIFY payload NOTIFY(Unknown - 16404)

000186: *Jun 22 10:33:13.679: IKEv2:(SESSION ID = 1,SA ID = 1):Processing IKE_SA_INIT message
000187: *Jun 22 10:33:13.679: IKEv2:(SESSION ID = 1,SA ID = 1):Verify SA init message
000188: *Jun 22 10:33:13.679: IKEv2:(SESSION ID = 1,SA ID = 1):Processing IKE_SA_INIT message
000189: *Jun 22 10:33:13.681: IKEv2:(SESSION ID = 1,SA ID = 1):Checking NAT discovery
000190: *Jun 22 10:33:13.681: IKEv2:(SESSION ID = 1,SA ID = 1):NAT INSIDE found
000191: *Jun 22 10:33:13.681: IKEv2:(SESSION ID = 1,SA ID = 1):NAT encap forced by policy
000192: *Jun 22 10:33:13.681: IKEv2:(SESSION ID = 1,SA ID = 1):no need to float ports, as exchange started with NAT encap
000193: *Jun 22 10:33:13.681: IKEv2:(SESSION ID = 1,SA ID = 1):[IKEv2 -> Crypto Engine] Computing DH secret key, DH Group 14
000194: *Jun 22 10:33:13.706: IKEv2:(SESSION ID = 1,SA ID = 1):(SA ID = 1):[Crypto Engine -> IKEv2] DH key Computation PASSED
000195: *Jun 22 10:33:13.706: IKEv2:(SESSION ID = 1,SA ID = 1):Request queued for computation of DH secret
000196: *Jun 22 10:33:13.706: IKEv2:(SESSION ID = 1,SA ID = 1):(SA ID = 1):[IKEv2 -> Crypto Engine] Calculate SKEYSEED and create rekeyed IKEv2 SA
000197: *Jun 22 10:33:13.706: IKEv2:(SESSION ID = 1,SA ID = 1):(SA ID = 1):[Crypto Engine -> IKEv2] SKEYSEED calculation and creation of rekeyed IKEv2 SA PASSED
000198: *Jun 22 10:33:13.707: IKEv2:(SESSION ID = 1,SA ID = 1):Completed SA init exchange
000199: *Jun 22 10:33:13.707: IKEv2:(SESSION ID = 1,SA ID = 1):Check for EAP exchange
000200: *Jun 22 10:33:13.707: IKEv2:(SESSION ID = 1,SA ID = 1):Generate my authentication data
000201: *Jun 22 10:33:13.707: IKEv2:(SESSION ID = 1,SA ID = 1):Use preshared key for id 192.168.0.129, key len 17
000202: *Jun 22 10:33:13.707: IKEv2:(SESSION ID = 1,SA ID = 1):[IKEv2 -> Crypto Engine] Generate IKEv2 authentication data
000203: *Jun 22 10:33:13.707: IKEv2:(SESSION ID = 1,SA ID = 1):[Crypto Engine -> IKEv2] IKEv2 authentication data generation PASSED
000204: *Jun 22 10:33:13.707: IKEv2:(SESSION ID = 1,SA ID = 1):Get my authentication method
000205: *Jun 22 10:33:13.707: IKEv2:(SESSION ID = 1,SA ID = 1):My authentication method is 'PSK'
000206: *Jun 22 10:33:13.707: IKEv2:(SESSION ID = 1,SA ID = 1):Check for EAP exchange
000207: *Jun 22 10:33:13.707: IKEv2:(SESSION ID = 1,SA ID = 1):Generating IKE_AUTH message
000208: *Jun 22 10:33:13.707: IKEv2:(SESSION ID = 1,SA ID = 1):Constructing IDi payload: '192.168.0.129' of type 'IPv4 address'
000209: *Jun 22 10:33:13.707: IKEv2:(SESSION ID = 1,SA ID = 1):ESP Proposal: 1, SPI size: 4 (IPSec negotiation),
Num. transforms: 3
AES-CBC SHA256 Don't use ESN
000210: *Jun 22 10:33:13.708: IKEv2:(SESSION ID = 1,SA ID = 1):Building packet for encryption.
Payload contents:
VID IDi AUTH SA TSi TSr NOTIFY(INITIAL_CONTACT) NOTIFY(SET_WINDOW_SIZE) NOTIFY(ESP_TFC_NO_SUPPORT) NOTIFY(NON_FIRST_FRAGS)

000211: *Jun 22 10:33:13.708: IKEv2:(SESSION ID = 1,SA ID = 1):Sending Packet [To xxx.xxx.xxx.xxx:4500/From 192.168.0.129:4500/VRF i0:f0]
Initiator SPI : 2745781F64F2A066 - Responder SPI : 17178C7F5FE6CE36 Message id: 1
IKEv2 IKE_AUTH Exchange REQUEST
Payload contents:
ENCR

000212: *Jun 22 10:33:13.751: IKEv2:(SESSION ID = 1,SA ID = 1):Received Packet [From xxx.xxx.xxx.xxx:4500/To 192.168.0.129:4500/VRF i0:f0]
Initiator SPI : 2745781F64F2A066 - Responder SPI : 17178C7F5FE6CE36 Message id: 1
IKEv2 IKE_AUTH Exchange RESPONSE
Payload contents:

000213: *Jun 22 10:33:13.751: IKEv2:(SESSION ID = 1,SA ID = 1):parsing ENCR payload
000214: *Jun 22 10:33:13.751: IKEv2:(SESSION ID = 1,SA ID = 1):parsing NOTIFY payload NOTIFY(AUTHENTICATION_FAILED)

000215: *Jun 22 10:33:13.751: IKEv2:(SESSION ID = 1,SA ID = 1):Process auth response notify
000216: *Jun 22 10:33:13.751: IKEv2-ERROR:(SESSION ID = 1,SA ID = 1):
000217: *Jun 22 10:33:13.751: IKEv2:(SESSION ID = 1,SA ID = 1):Auth exchange failed
000218: *Jun 22 10:33:13.751: IKEv2-ERROR:(SESSION ID = 1,SA ID = 1):: Auth exchange failed
000219: *Jun 22 10:33:13.751: IKEv2:(SESSION ID = 1,SA ID = 1):Abort exchange
000220: *Jun 22 10:33:13.752: IKEv2:(SESSION ID = 1,SA ID = 1):Deleting SA

rsage_voda

Hi thank you all for the assist. I have now got this working. For information I have provided the Meraki configuration.

Topology

Cisco Config

crypto ikev2 proposal IKEv2_PROPOSAL

encryption aes-cbc-256

integrity sha256

group 14

!

crypto ikev2 policy IKEv2_POLICY

match address local 192.168.0.129

proposal IKEv2_PROPOSAL

!

crypto ikev2 keyring IKEv2_KEYRING

peer PEER1

address 195.89.xxx.xxx

pre-shared-key XXXXXXXXXXXXX

!

crypto ikev2 profile IKEv2_PROFILE

match identity remote address 195.89.xxx.xxx 255.255.255.255

identity local address 192.168.0.129

authentication remote pre-share key XXXXXXXXXXXXXXXX

authentication local pre-share

keyring local IKEv2_KEYRING

lifetime 28800

nat force-encap

crypto ipsec transform-set IPSEC_TRANSFORM_SET esp-aes 256 esp-sha256-hmac

mode tunnel

!

crypto map MERAKI 10 ipsec-isakmp

set peer 195.89.xxx.xxx

set transform-set IPSEC_TRANSFORM_SET

set pfs group14

set ikev2-profile IKEv2_PROFILE

match address VPN_ACL

Extended IP access list VPN_ACL

10 permit ip 192.168.150.0 0.0.0.255 192.168.151.0 0.0.0.255 (831 matches)

View solution in original post

alemabrahao

This configuration should work fine. The error suggests a mismatch in the IKE identity or PSK, not a fundamental compatibility issue.

The MX84 supports IKEv2, but has limited identity flexibility. It expects the remote peer to present the public IP as its IKE identity unless you explicitly configure the MX to accept a hostname or FQDN.

If the ISR is behind NAT, make sure the MX has "NAT Traversal" enabled (this is the default in Meraki).

To understand where the error might be, it is best to share the configurations of both the MX and the ISR.

I am not a Cisco Meraki employee. My suggestions are based on documentation of Meraki best practices and day-to-day experience.

Please, if this post was useful, leave your kudos and mark it as solved.

PhilipDAth

I think we also need:
debug crypto isakmp

I cant remember the syntax, but also something like:
debug crypto ikev2

Also make sure the "Local ID" is the public IP address that the MX will appear to come from, and that "Remote ID" is the public IP address that the traffic from ISR4321 will appear to come from.

You can also try checking the Meraki event log.

rsage_voda

Hi thank you for your response. On the Remote ID the i button suggests that this should be configured when the Local ID of the Remote Peer is anything other than its Public IP address. In my case I have set the local ID to a the address provided by DHCP from the NAT router. The previous contributor suggests that from the MX84 perspective that the Remote Peers Local IP address should be its public IP address. However, the Meraki documentation suggests "Uses the IP addresses of the hosts exchanging ISAKMP identity information." which is the address I have provided.

PhilipDAth

Let me put it this way - the configuration you have doesn't work, despite how you have interpreted the documentation. 🙂

JonoM

Just to add, it may be worth taking packet captures on both the MX and the ISR4321 WAN interfaces. You can then review the packet exchange between them and confirm that we are seeing all relevant traffic, including the ISAKMP negotiation.

There are additional logs available to review on the MX-side, but this would require a live session with Meraki Support. If you haven't already @rsage_voda, I would recommend doing so to verify what is visible from that side

If you found this post helpful, please give it kudos. If my answer solved your problem, click "accept as solution" so that others can benefit from it.

GIdenJoe

From the output I can see that the Meraki did not like the authentication from the ISR.
Most likely the IKE ID is not matching what the Meraki is expecting. If the address of the ISR is translated to a another then the message will come from another IP but the IKE ID will remain the IP on the ISR itself. This means you will have to explicitely set the remote IKE ID to the local WAN IP of the ISR so it matches the authentication.

Of course double check your keyring to see if the PSK is matching at both sides.

rsage_voda