We are having an issue where we had to replace an ASA5505 and before there was a site to site vpn and now with the current MX64 the connection is not working. Here was the config from the ASA for the VPN:
name 1.2.3.4 Diag description Diag VPN
access-list outside_1_cryptomap extended permit ip host 10.0.20.45 Diag 255.255.255.248
access-list inside_nat_static extended permit ip host LocalServer Diag 255.255.255.248
static (inside,outside) 10.0.20.45 access-list inside_nat_static
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set peer 4.5.6.7
crypto map outside_map 1 set transform-set ESP-3DES-SHA
crypto map outside_map 1 set security-association lifetime seconds 14400
crypto map outside_map 1 set security-association lifetime kilobytes 10000
crypto map outside_map interface outside
crypto isakmp enable inside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
tunnel-group 4.5.6.7 type ipsec-l2l
tunnel-group 4.5.6.7 ipsec-attributes
pre-shared-key xxxxx
peer-id-validate nocheck
isakmp keepalive disable
Current Meraki Connection is set to
Public IP 4.5.6.7
Private Subnet 10.0.20.45/29
IP SEC Policy
PH1 - 3DES / SHA1 / DH2 / Timeout 14400
PH2 - 3DES / SHA1 / PFS off / Timeout 14400
Event log shows
Non-Meraki / Client VPN negotiation msg: failed to pre-process ph2 packet (side: 1, status: 1).
Non-Meraki / Client VPN negotiation msg: failed to get sainfo.
Non-Meraki / Client VPN negotiation msg: initiate new phase 2 negotiation: Local_PublicIP[500]<=>4.5.6.7[500]
Non-Meraki / Client VPN negotiation msg: IPsec-SA expired: ESP/Tunnel 4.5.6.7[500]->Local_PublicIP[500] spi=178891342(0xaa9acb0)
Non-Meraki / Client VPN negotiation msg: failed to pre-process ph2 packet (side: 1, status: 1).
Non-Meraki / Client VPN negotiation msg: failed to get sainfo.
Non-Meraki / Client VPN negotiation msg: ISAKMP-SA established Local_PublicIP[500]-4.5.6.7[500] spi:5407379688442cfd:315d9f4a0c478522
Non-Meraki / Client VPN negotiation msg: initiate new phase 2 negotiation: Local_PublicIP[500]<=>4.5.6.7[500]
VPN registry connectivity change vpn_type: site-to-site, connectivity: true
Non-Meraki / Client VPN negotiation msg: failed to pre-process ph2 packet (side: 1, status: 1).
Non-Meraki / Client VPN negotiation msg: failed to get sainfo.
Non-Meraki / Client VPN negotiation msg: IPsec-SA expired: ESP/Tunnel 4.5.6.7[500]->Local_PublicIP[500] spi=108337968(0x6751b30)
Non-Meraki / Client VPN negotiation msg: pfkey DELETE failed: No such process
Non-Meraki / Client VPN negotiation msg: ISAKMP-SA deleted Local_PublicIP[500]-4.5.6.7[500] spi:74f722074d7dc223:2e10212799bd830f
Non-Meraki / Client VPN negotiation msg: purged ISAKMP-SA spi=74f722074d7dc223:2e10212799bd830f.
Non-Meraki / Client VPN negotiation msg: purged IPsec-SA spi=0.
Non-Meraki / Client VPN negotiation msg: Unknown IPsec-SA spi=0, hmmmm?
Non-Meraki / Client VPN negotiation msg: purging ISAKMP-SA spi=74f722074d7dc223:2e10212799bd830f.
Any thoughts? Thank you
