I have a CCR 1016 12G acting as mobile l2tp client to a CHR in our datacenter.
Yesterday I upgraded the CCR to 6.40.4, and everything was great.
Then proceeded to upgrade the CHR to 6.40.4, l2tp tunnel gave “Phase 1 negotiation failed due to time up”
I tried every minor and major firmware from 6.37, and deduced that the problem lies between 6.39.2 and 6.39.3 but can’t for the life of me figure out why this is happening.
I also tried to setup the secrets and proposals again, with varying key types but to no avail.
When turning on IPsec Debug, i get the following relevant results, secure strings and IP addresses have been truncated.:
Respond new phase 1 (identity protection): [500]<=>[500]
08:43:40 ipsec,debug begin.
08:43:40 ipsec,debug seen nptype=1(sa) len=332
08:43:40 ipsec,debug seen nptype=13(vid) len=20
08:43:40 ipsec,debug seen nptype=13(vid) len=20
08:43:40 ipsec,debug seen nptype=13(vid) len=20
08:43:40 ipsec,debug seen nptype=13(vid) len=20
08:43:40 ipsec,debug seen nptype=13(vid) len=20
08:43:40 ipsec,debug seen nptype=13(vid) len=20
08:43:40 ipsec,debug seen nptype=13(vid) len=20
08:43:40 ipsec,debug seen nptype=13(vid) len=20
08:43:40 ipsec,debug seen nptype=13(vid) len=20
08:43:40 ipsec,debug seen nptype=13(vid) len=20
08:43:40 ipsec,debug seen nptype=13(vid) len=20
08:43:40 ipsec,debug seen nptype=13(vid) len=20
08:43:40 ipsec,debug seen nptype=13(vid) len=20
08:43:40 ipsec,debug succeed.
08:43:40 ipsec received Vendor ID: RFC 3947
08:43:40 ipsec received Vendor ID: draft-ietf-ipsec-nat-t-ike-08
08:43:40 ipsec received Vendor ID: draft-ietf-ipsec-nat-t-ike-07
08:43:40 ipsec received Vendor ID: draft-ietf-ipsec-nat-t-ike-06
08:43:40 ipsec received Vendor ID: draft-ietf-ipsec-nat-t-ike-05
08:43:40 ipsec received Vendor ID: draft-ietf-ipsec-nat-t-ike-04
08:43:40 ipsec received Vendor ID: draft-ietf-ipsec-nat-t-ike-03
08:43:40 ipsec received Vendor ID: draft-ietf-ipsec-nat-t-ike-02
08:43:40 ipsec received Vendor ID: draft-ietf-ipsec-nat-t-ike-02
08:43:40 ipsec
08:43:40 ipsec received Vendor ID: draft-ietf-ipsec-nat-t-ike-01
08:43:40 ipsec received Vendor ID: draft-ietf-ipsec-nat-t-ike-00
08:43:40 ipsec received Vendor ID: CISCO-UNITY
08:43:40 ipsec received Vendor ID: DPD
08:43:40 ipsec,debug remote supports DPD
08:43:40 ipsec Selected NAT-T version: RFC 3947
08:43:40 ipsec,debug total SA len=328
08:43:40 ipsec,debug 00000001 00000001
08:43:40 ipsec,debug begin.
08:43:40 ipsec,debug seen nptype=2(prop) len=320
08:43:40 ipsec,debug succeed.
08:43:40 ipsec,debug proposal #1 len=320
08:43:40 ipsec,debug begin.
08:43:40 ipsec,debug seen nptype=3(trns) len=40
08:43:40 ipsec,debug seen nptype=3(trns) len=40
08:43:40 ipsec,debug seen nptype=3(trns) len=40
08:43:40 ipsec,debug seen nptype=3(trns) len=40
08:43:40 ipsec,debug seen nptype=3(trns) len=40
08:43:40 ipsec,debug seen nptype=3(trns) len=40
08:43:40 ipsec,debug seen nptype=3(trns) len=36
08:43:40 ipsec,debug seen nptype=3(trns) len=36
08:43:40 ipsec,debug succeed.
08:43:40 ipsec,debug transform #1 len=40
08:43:40 ipsec,debug type=Life Type, flag=0x8000, lorv=seconds
08:43:40 ipsec,debug type=Life Duration, flag=0x0000, lorv=4
08:43:40 ipsec,debug type=Encryption Algorithm, flag=0x8000, lorv=AES-CBC
08:43:40 ipsec,debug encryption(aes)
08:43:40 ipsec,debug type=Key Length, flag=0x8000, lorv=256
08:43:40 ipsec,debug type=Authentication Method, flag=0x8000, lorv=pre-shared key
08:43:40 ipsec,debug type=Hash Algorithm, flag=0x8000, lorv=SHA
08:43:40 ipsec,debug hash(sha1)
08:43:40 ipsec,debug type=Group Description, flag=0x8000, lorv=2048-bit MODP group
08:43:40 ipsec,debug dh(modp2048)
08:43:40 ipsec,debug transform #2 len=40
08:43:40 ipsec,debug type=Life Type, flag=0x8000, lorv=seconds
08:43:40 ipsec,debug type=Life Duration, flag=0x0000, lorv=4
08:43:40 ipsec,debug type=Encryption Algorithm, flag=0x8000, lorv=AES-CBC
08:43:40 ipsec,debug encryption(aes)
08:43:40 ipsec,debug type=Key Length, flag=0x8000, lorv=256
08:43:40 ipsec,debug type=Authentication Method, flag=0x8000, lorv=pre-shared key
08:43:40 ipsec,debug type=Hash Algorithm, flag=0x8000, lorv=SHA
08:43:40 ipsec,debug hash(sha1)
08:43:40 ipsec,debug type=Group Description, flag=0x8000, lorv=1024-bit MODP group
08:43:40 ipsec,debug dh(modp1024)
08:43:40 ipsec,debug transform #3 len=40
08:43:40 ipsec,debug type=Life Type, flag=0x8000, lorv=seconds
08:43:40 ipsec,debug type=Life Duration, flag=0x0000, lorv=4
08:43:40 ipsec,debug type=Encryption Algorithm, flag=0x8000, lorv=AES-CBC
08:43:40 ipsec,debug encryption(aes)
08:43:40 ipsec,debug type=Key Length, flag=0x8000, lorv=192
08:43:40 ipsec,debug type=Authentication Method, flag=0x8000, lorv=pre-shared key
08:43:40 ipsec,debug type=Hash Algorithm, flag=0x8000, lorv=SHA
08:43:40 ipsec,debug hash(sha1)
08:43:40 ipsec,debug type=Group Description, flag=0x8000, lorv=2048-bit MODP group
08:43:40 ipsec,debug dh(modp2048)
08:43:40 ipsec,debug transform #4 len=40
08:43:40 ipsec,debug type=Life Type, flag=0x8000, lorv=seconds
08:43:40 ipsec,debug type=Life Duration, flag=0x0000, lorv=4
08:43:40 ipsec,debug type=Encryption Algorithm, flag=0x8000, lorv=AES-CBC
08:43:40 ipsec,debug encryption(aes)
08:43:40 ipsec,debug type=Key Length, flag=0x8000, lorv=192
08:43:40 ipsec,debug type=Authentication Method, flag=0x8000, lorv=pre-shared key
08:43:40 ipsec,debug type=Hash Algorithm, flag=0x8000, lorv=SHA
08:43:40 ipsec,debug hash(sha1)
08:43:40 ipsec,debug type=Group Description, flag=0x8000, lorv=1024-bit MODP group
08:43:40 ipsec,debug dh(modp1024)
08:43:40 ipsec,debug transform #5 len=40
08:43:40 ipsec,debug type=Life Type, flag=0x8000, lorv=seconds
08:43:40 ipsec,debug type=Life Duration, flag=0x0000, lorv=4
08:43:40 ipsec,debug type=Encryption Algorithm, flag=0x8000, lorv=AES-CBC
08:43:40 ipsec,debug encryption(aes)
08:43:40 ipsec,debug type=Key Length, flag=0x8000, lorv=128
08:43:40 ipsec,debug type=Authentication Method, flag=0x8000, lorv=pre-shared key
08:43:40 ipsec,debug type=Hash Algorithm, flag=0x8000, lorv=SHA
08:43:40 ipsec,debug hash(sha1)
08:43:40 ipsec,debug type=Group Description, flag=0x8000, lorv=2048-bit MODP group
08:43:40 ipsec,debug dh(modp2048)
08:43:40 ipsec,debug transform #6 len=40
08:43:40 ipsec,debug type=Life Type, flag=0x8000, lorv=seconds
08:43:40 ipsec,debug type=Life Duration, flag=0x0000, lorv=4
08:43:40 ipsec,debug type=Encryption Algorithm, flag=0x8000, lorv=AES-CBC
08:43:40 ipsec,debug encryption(aes)
08:43:40 ipsec,debug type=Key Length, flag=0x8000, lorv=128
08:43:40 ipsec,debug type=Authentication Method, flag=0x8000, lorv=pre-shared key
08:43:40 ipsec,debug type=Hash Algorithm, flag=0x8000, lorv=SHA
08:43:40 ipsec,debug hash(sha1)
08:43:40 ipsec,debug type=Group Description, flag=0x8000, lorv=1024-bit MODP group
08:43:40 ipsec,debug dh(modp1024)
08:43:40 ipsec,debug transform #7 len=36
08:43:40 ipsec,debug type=Life Type, flag=0x8000, lorv=seconds
08:43:40 ipsec,debug type=Life Duration, flag=0x0000, lorv=4
08:43:40 ipsec,debug type=Encryption Algorithm, flag=0x8000, lorv=3DES-CBC
08:43:40 ipsec,debug encryption(3des)
08:43:40 ipsec,debug type=Authentication Method, flag=0x8000, lorv=pre-shared key
08:43:40 ipsec,debug type=Hash Algorithm, flag=0x8000, lorv=SHA
08:43:40 ipsec,debug hash(sha1)
08:43:40 ipsec,debug type=Group Description, flag=0x8000, lorv=2048-bit MODP group
08:43:40 ipsec,debug dh(modp2048)
08:43:40 ipsec,debug transform #8 len=36
08:43:40 ipsec,debug type=Life Type, flag=0x8000, lorv=seconds
08:43:40 ipsec,debug type=Life Duration, flag=0x0000, lorv=4
08:43:40 ipsec,debug type=Encryption Algorithm, flag=0x8000, lorv=3DES-CBC
08:43:40 ipsec,debug encryption(3des)
08:43:40 ipsec,debug type=Authentication Method, flag=0x8000, lorv=pre-shared key
08:43:40 ipsec,debug type=Hash Algorithm, flag=0x8000, lorv=SHA
08:43:40 ipsec,debug hash(sha1)
08:43:40 ipsec,debug type=Group Description, flag=0x8000, lorv=1024-bit MODP group
08:43:40 ipsec,debug dh(modp1024)
08:43:40 ipsec,debug pair 1:
08:43:40 ipsec,debug proposal #1: 8 transform
08:43:40 ipsec,debug prop#=1, prot-id=ISAKMP, spi-size=0, #trns=8
08:43:40 ipsec,debug trns#=1, trns-id=IKE
08:43:40 ipsec,debug type=Life Type, flag=0x8000, lorv=seconds
08:43:40 ipsec,debug type=Life Duration, flag=0x0000, lorv=4
08:43:40 ipsec,debug type=Encryption Algorithm, flag=0x8000, lorv=AES-CBC
08:43:40 ipsec,debug type=Key Length, flag=0x8000, lorv=256
08:43:40 ipsec,debug type=Authentication Method, flag=0x8000, lorv=pre-shared key
08:43:40 ipsec,debug type=Hash Algorithm, flag=0x8000, lorv=SHA
08:43:40 ipsec,debug type=Group Description, flag=0x8000, lorv=2048-bit MODP group
08:43:40 ipsec,debug Compared: Local:Peer
08:43:40 ipsec,debug (lifetime = 86400:86400)
08:43:40 ipsec,debug (lifebyte = 0:0)
08:43:40 ipsec,debug enctype = AES-CBC:AES-CBC
08:43:40 ipsec,debug (encklen = 256:256)
08:43:40 ipsec,debug hashtype = SHA:SHA
08:43:40 ipsec,debug authmethod = pre-shared key:pre-shared key
08:43:40 ipsec,debug dh_group = 1024-bit MODP group:2048-bit MODP group
08:43:40 ipsec,debug Compared: Local:Peer
08:43:40 ipsec,debug (lifetime = 86400:86400)
08:43:40 ipsec,debug (lifebyte = 0:0)
08:43:40 ipsec,debug enctype = 3DES-CBC:AES-CBC
08:43:40 ipsec,debug (encklen = 0:256)
08:43:40 ipsec,debug hashtype = SHA:SHA
08:43:40 ipsec,debug authmethod = pre-shared key:pre-shared key
08:43:40 ipsec,debug dh_group = 1024-bit MODP group:2048-bit MODP group
08:43:40 ipsec,debug prop#=1, prot-id=ISAKMP, spi-size=0, #trns=8
08:43:40 ipsec,debug trns#=2, trns-id=IKE
08:43:40 ipsec,debug type=Life Type, flag=0x8000, lorv=seconds
08:43:40 ipsec,debug type=Life Duration, flag=0x0000, lorv=4
08:43:40 ipsec,debug type=Encryption Algorithm, flag=0x8000, lorv=AES-CBC
08:43:40 ipsec,debug type=Key Length, flag=0x8000, lorv=256
08:43:40 ipsec,debug type=Authentication Method, flag=0x8000, lorv=pre-shared key
08:43:40 ipsec,debug type=Hash Algorithm, flag=0x8000, lorv=SHA
08:43:40 ipsec,debug type=Group Description, flag=0x8000, lorv=1024-bit MODP group
08:43:40 ipsec,debug Compared: Local:Peer
08:43:40 ipsec,debug (lifetime = 86400:86400)
08:43:40 ipsec,debug (lifebyte = 0:0)
08:43:40 ipsec,debug enctype = AES-CBC:AES-CBC
08:43:40 ipsec,debug (encklen = 256:256)
08:43:40 ipsec,debug hashtype = SHA:SHA
08:43:40 ipsec,debug authmethod = pre-shared key:pre-shared key
08:43:40 ipsec,debug dh_group = 1024-bit MODP group:1024-bit MODP group
08:43:40 ipsec,debug an acceptable proposal found.
08:43:40 ipsec,debug dh(modp1024)
08:43:40 ipsec,debug agreed on pre-shared key auth.
08:43:40 ipsec,debug ===
08:43:40 ipsec,debug new cookie:
08:43:40 ipsec,debug 8ea5f4cb328c083a
08:43:40 ipsec,debug add payload of len 56, next type 13
08:43:40 ipsec,debug add payload of len 16, next type 13
08:43:40 ipsec,debug add payload of len 16, next type 13
08:43:40 ipsec,debug add payload of len 16, next type 0
08:43:40 ipsec,debug 148 bytes from [500] to [500]
08:43:40 ipsec,debug 1 times of 148 bytes message will be sent to [500
]
08:43:40 ipsec,debug,packet
08:43:40 ipsec sent phase1 packet [500]<=>[500]
08:43:46 ipsec,debug 148 bytes from [500] to [500]
08:43:46 ipsec,debug 1 times of 148 bytes message will be sent to [500
]
08:43:46 ipsec resent phase1 packet [500]<=>[500]
then a few retransmits and ultimately the time up failure.
Does anyone know?