I am attempting to setup a site-to-site tunnel between an ASA 5505 and a MT RB2011 device. I have the two tunnels pointed at each other, but I continuously get the following Log entries:
MT :
phase1 negotiation failed due to time up X.X.X.X[500]<=>Y.Y.Y.Y[500]
ASA :
Debug Log : IP = x.x.x.x, Error processingpayload: Payload ID : 1
Syslog Detail: A packet has been recieved with a payload that cannot be processed.
Since the first post, I have updated to version 6.40.
The ASA is utilizing IKEv2, so I correctly configured that (I think) on the MT.
MT Log is now showing :
Phase 1 negotiation failed due to time up: X.X.X.X[500]<=>Y.Y.Y.Y[500]
initiate new phase (Identify protection): X.X.X.X[500]<=>Y.Y.Y.Y[500]
Making progress. I am now getting an error : payload missing : SA
I think this is because there’s no IKEv2 secret configured on the ASA side…
For some reason my MT seems to stop even trying to connect (the logs show no more errors after ~30 ipsec, error entries)
I have successfully gotten the IPSec tunnel established, but now I am unable to pass traffic across it (no responses to PING requests)
I’ve followed several guides and watched several videos, but have been unable to resolve this issue. I have the following NAT:
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; IPSEC
chain=srcnat action=accept src-address=192.168.3.0/24 dst-address=192.168.100.0/24 log=no log-prefix=""
1 ;;; Default Masq
chain=srcnat action=masquerade out-interface=ether1 log=no log-prefix=""
The following raw rule:
Flags: X - disabled, I - invalid, D - dynamic
0 chain=prerouting action=notrack log=no log-prefix="" src-address=192.168.3.0/24 dst-address=192.168.100.0/24
1 chain=prerouting action=notrack log=no log-prefix="" src-address=192.168.100.0/24 dst-address=192.168.3.0/24
** Note : 192.168.3.0/24 is the MT side and 192.168.100.0/24 is the ASA side.
In theory, this should work now that I have an established connection, but it appears I am missing something. Any thoughts?