SRX

Expand all | Collapse all

IPsec Tunnel between cisco ASA and SRX.. Getting error : IKE negotiation failed with error: No proposal chosen

Jump to Best Answer
  • 1.  IPsec Tunnel between cisco ASA and SRX.. Getting error : IKE negotiation failed with error: No proposal chosen

    Posted 11-18-2018 21:32

    Hi Team,

     

    I am building the tunnels between Cisco ASA and SRX fw on LAB.. I see phase 1 is up on both end FW's but phase 2 is not getting up and i see errors log as below

     

    show log KMD-logs on SRX end.---

     

    Nov 19 10:42:24 NDC9C-SRX kmd[1088]: Config download: Processed 5 - 6 messages
    Nov 19 10:42:24 NDC9C-SRX kmd[1088]: Config download time: 0 seconds
    Nov 19 10:42:51 NDC9C-SRX kmd[1088]: IKE negotiation failed with error: No proposal chosen. IKE Version: 1, VPN: VPN-9C Gateway: IKE-GATEWAY-9C, Local: 1.1.1.1/500, Remote: 1.1.1.3/500, Local IKE-ID: 1.1.1.1, Remote IKE-ID: 1.1.1.3, VR-ID: 0
    Nov 19 10:43:24 NDC9C-SRX kmd[1088]: IKE negotiation failed with error: No proposal chosen. IKE Version: 1, VPN: VPN-9C Gateway: IKE-GATEWAY-9C, Local: 1.1.1.1/500, Remote: 1.1.1.3/500, Local IKE-ID: 1.1.1.1, Remote IKE-ID: 1.1.1.3, VR-ID: 0
    Nov 19 10:43:56 NDC9C-SRX kmd[1088]: IKE negotiation failed with error: No proposal chosen. IKE Version: 1, VPN: VPN-9C Gateway: IKE-GATEWAY-9C, Local: 1.1.1.1/500, Remote: 1.1.1.3/500, Local IKE-ID: 1.1.1.1, Remote IKE-ID: 1.1.1.3, VR-ID: 0
    Nov 19 10:43:57 NDC9C-SRX kmd[1088]: Config download: Processed 6 - 7 messages
    Nov 19 10:43:57 NDC9C-SRX kmd[1088]: Config download time: 0 seconds
    Nov 19 10:44:29 NDC9C-SRX kmd[1088]: IKE negotiation failed with error: No proposal chosen. IKE Version: 1, VPN: VPN-9C Gateway: IKE-GATEWAY-9C, Local: 1.1.1.1/500, Remote: 1.1.1.3/500, Local IKE-ID: 1.1.1.1, Remote IKE-ID: 1.1.1.3, VR-ID: 0
    Nov 19 10:45:02 NDC9C-SRX kmd[1088]: IKE negotiation failed with error: No proposal chosen. IKE Version: 1, VPN: VPN-9C Gateway: IKE-GATEWAY-9C, Local: 1.1.1.1/500, Remote: 1.1.1.3/500, Local IKE-ID: 1.1.1.1, Remote IKE-ID: 1.1.1.3, VR-ID: 0
    Nov 19 10:45:34 NDC9C-SRX kmd[1088]: IKE negotiation failed with error: No proposal chosen. IKE Version: 1, VPN: VPN-9C Gateway: IKE-GATEWAY-9C, Local: 1.1.1.1/500, Remote: 1.1.1.3/500, Local IKE-ID: 1.1.1.1, Remote IKE-ID: 1.1.1.3, VR-ID: 0
    Nov 19 10:47:45 NDC9C-SRX last message repeated 4 times
    Nov 19 10:48:50 NDC9C-SRX last message repeated 2 times'

     

    errors from ASA end:

    Nov 19 05:24:10 [IKEv1]Group = 1.1.1.1, IP = 1.1.1.1, QM FSM error (P2 struct &0x00007f2675bdc9d0, mess id 0x34d9dd85)!
    Nov 19 05:24:10 [IKEv1]Group = 1.1.1.1, IP = 1.1.1.1, Removing peer from correlator table failed, no match!
    Nov 19 05:24:10 [IKEv1]Group = 1.1.1.1, IP = 1.1.1.1, Session is being torn down. Reason: Lost Service

     

    ------------------------------------------------------SRX config---------------------------

    FW's config as below

    SRX:

     

    set system license autoupdate url https://ae1.juniper.net/junos/key_retrieval
    set interfaces ge-0/0/0 unit 0 family inet address 200.200.200.40/24
    set interfaces ge-0/0/1 unit 0 family inet address 10.1.0.2/24
    set interfaces ge-0/0/2 unit 0 family inet
    set interfaces ge-0/0/3 unit 0 family inet address 1.1.1.1/24
    set routing-options static route 10.2.0.0/24 next-hop 1.1.1.3
    set routing-options static route 10.2.0.0/24 resolve
    set security ike traceoptions file ike-trace
    set security ike traceoptions flag all
    set security ike proposal IKE-SHA-AES256-DH1 authentication-method pre-shared-keys
    set security ike proposal IKE-SHA-AES256-DH1 dh-group group2
    set security ike proposal IKE-SHA-AES256-DH1 authentication-algorithm sha1
    set security ike proposal IKE-SHA-AES256-DH1 encryption-algorithm aes-256-cbc
    set security ike proposal IKE-SHA-AES256-DH1 lifetime-seconds 86400
    set security ike policy IKE-POLICY-9C mode main
    set security ike policy IKE-POLICY-9C proposals IKE-SHA-AES256-DH1
    set security ike policy IKE-POLICY-9C pre-shared-key ascii-text "$9$aZUkPQFnCtOQFCu0BcSx7-VwgikP"
    set security ike gateway IKE-GATEWAY-9C ike-policy IKE-POLICY-9C
    set security ike gateway IKE-GATEWAY-9C address 1.1.1.3
    set security ike gateway IKE-GATEWAY-9C external-interface ge-0/0/3.0
    set security ipsec proposal IPSEC-SHA-AES128-ESP protocol esp
    set security ipsec proposal IPSEC-SHA-AES128-ESP authentication-algorithm hmac-sha1-96
    set security ipsec proposal IPSEC-SHA-AES128-ESP encryption-algorithm aes-128-cbc
    set security ipsec proposal IPSEC-SHA-AES128-ESP lifetime-seconds 3600
    set security ipsec proposal IPSEC-SHA-AES128-Eset
    set security ipsec policy VPN-POLICY-SDC-9C proposals IPSEC-SHA-AES128-ESP
    set security ipsec vpn VPN-9C ike gateway IKE-GATEWAY-9C
    set security ipsec vpn VPN-9C ike idle-time 300
    set security ipsec vpn VPN-9C ike ipsec-policy VPN-POLICY-SDC-9C
    set security screen ids-option untrust-screen icmp ping-death
    set security screen ids-option untrust-screen ip source-route-option
    set security screen ids-option untrust-screen ip tear-drop
    set security screen ids-option untrust-screen tcp syn-flood alarm-threshold 1024
    set security screen ids-option untrust-screen tcp syn-flood attack-threshold 200
    set security screen ids-option untrust-screen tcp syn-flood source-threshold 1024
    set security screen ids-option untrust-screen tcp syn-flood destination-threshold 2048
    set security screen ids-option untrust-screen tcp syn-flood queue-size 2000
    set security screen ids-option untrust-screen tcp syn-flood timeout 20
    set security screen ids-option untrust-screen tcp land
    set security policies from-zone trust to-zone untrust policy VPN-POLICY-9C-IN match source-address any
    set security policies from-zone trust to-zone untrust policy VPN-POLICY-9C-IN match destination-address any
    set security policies from-zone trust to-zone untrust policy VPN-POLICY-9C-IN match application any
    set security policies from-zone trust to-zone untrust policy VPN-POLICY-9C-IN then permit tunnel ipsec-vpn VPN-9C
    set security policies from-zone trust to-zone untrust policy VPN-POLICY-9C-IN then log session-init
    set security policies from-zone trust to-zone untrust policy VPN-POLICY-9C-IN then log session-close
    set security policies from-zone trust to-zone untrust policy VPN-POLICY-9C-IN then count
    set security policies from-zone untrust to-zone trust policy VPN-POLICY-9C-OUT match source-address any
    set security policies from-zone untrust to-zone trust policy VPN-POLICY-9C-OUT match destination-address any
    set security policies from-zone untrust to-zone trust policy VPN-POLICY-9C-OUT match application any
    set security policies from-zone untrust to-zone trust policy VPN-POLICY-9C-OUT then permit tunnel ipsec-vpn VPN-9C
    set security policies from-zone untrust to-zone trust policy VPN-POLICY-9C-OUT then log session-init
    set security policies from-zone untrust to-zone trust policy VPN-POLICY-9C-OUT then log session-close
    set security policies from-zone untrust to-zone trust policy VPN-POLICY-9C-OUT then count
    set security zones security-zone trust tcp-rst
    set security zones security-zone trust address-book address 9C-NET-LOCAL 10.1.0.0/24
    set security zones security-zone trust interfaces ge-0/0/1.0 host-inbound-traffic system-services all
    set security zones security-zone untrust address-book address SDC-NET-REMOTE-VPN 10.2.0.0/24
    set security zones security-zone untrust screen untrust-screen
    set security zones security-zone untrust interfaces ge-0/0/0.0 host-inbound-traffic system-services http
    set security zones security-zone untrust interfaces ge-0/0/0.0 host-inbound-traffic system-services https
    set security zones security-zone untrust interfaces ge-0/0/0.0 host-inbound-traffic system-services ssh
    set security zones security-zone untrust interfaces ge-0/0/0.0 host-inbound-traffic system-services telnet
    set security zones security-zone untrust interfaces ge-0/0/0.0 host-inbound-traffic system-services dhcp
    set security zones security-zone untrust interfaces ge-0/0/0.0 host-inbound-traffic system-services ping
    set security zones security-zone untrust interfaces ge-0/0/0.0 host-inbound-traffic system-services all
    set security zones security-zone untrust interfaces ge-0/0/2.0
    set security zones security-zone untrust interfaces ge-0/0/3.0 host-inbound-traffic system-services ping
    set security zones security-zone untrust interfaces ge-0/0/3.0 host-inbound-traffic system-services all

     

    ------------------------------------------------------ASA config---------------------------

     

    on ASA end fw

    ciscoasa# show running-config crypto
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES128-SHA esp-aes esp-sha-hmac
    crypto ipsec security-association pmtu-aging infinite
    crypto map outside_map 1 match address SDCNDC9CALC
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer 1.1.1.1
    crypto map outside_map 1 set ikev1 transform-set ESP-AES128-SHA
    crypto map outside_map 1 set security-association lifetime seconds 3600
    crypto map outside_map interface OTSIDE
    crypto ca trustpoint _SmartCallHome_ServerCA
    no validation-usage
    crl configure
    crypto ca trustpool policy
    auto-import
    crypto ca certificate chain _SmartCallHome_ServerCA
    certificate ca 18dad19e267de8bb4a2158cdcc6b3b4a
    308204d3 308203bb a0030201 02021018 dad19e26 7de8bb4a 2158cdcc 6b3b4a30
    0d06092a 864886f7 0d010105 05003081 ca310b30 09060355 04061302 55533117
    30150603 55040a13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b
    13165665 72695369 676e2054 72757374 204e6574 776f726b 313a3038 06035504
    0b133128 63292032 30303620 56657269 5369676e 2c20496e 632e202d 20466f72
    20617574 686f7269 7a656420 75736520 6f6e6c79 31453043 06035504 03133c56
    65726953 69676e20 436c6173 73203320 5075626c 69632050 72696d61 72792043
    65727469 66696361 74696f6e 20417574 686f7269 7479202d 20473530 1e170d30
    36313130 38303030 3030305a 170d3336 30373136 32333539 35395a30 81ca310b
    30090603 55040613 02555331 17301506 0355040a 130e5665 72695369 676e2c20
    496e632e 311f301d 06035504 0b131656 65726953 69676e20 54727573 74204e65
    74776f72 6b313a30 38060355 040b1331 28632920 32303036 20566572 69536967
    6e2c2049 6e632e20 2d20466f 72206175 74686f72 697a6564 20757365 206f6e6c
    79314530 43060355 0403133c 56657269 5369676e 20436c61 73732033 20507562
    6c696320 5072696d 61727920 43657274 69666963 6174696f 6e204175 74686f72
    69747920 2d204735 30820122 300d0609 2a864886 f70d0101 01050003 82010f00
    3082010a 02820101 00af2408 08297a35 9e600caa e74b3b4e dc7cbc3c 451cbb2b
    e0fe2902 f95708a3 64851527 f5f1adc8 31895d22 e82aaaa6 42b38ff8 b955b7b1
    b74bb3fe 8f7e0757 ecef43db 66621561 cf600da4 d8def8e0 c362083d 5413eb49
    ca595485 26e52b8f 1b9febf5 a191c233 49d84363 6a524bd2 8fe87051 4dd18969
    7bc770f6 b3dc1274 db7b5d4b 56d396bf 1577a1b0 f4a225f2 af1c9267 18e5f406
    04ef90b9 e400e4dd 3ab519ff 02baf43c eee08beb 378becf4 d7acf2f6 f03dafdd
    75913319 1d1c40cb 74241921 93d914fe ac2a52c7 8fd50449 e48d6347 883c6983
    cbfe47bd 2b7e4fc5 95ae0e9d d4d143c0 6773e314 087ee53f 9f73b833 0acf5d3f
    3487968a ee53e825 15020301 0001a381 b23081af 300f0603 551d1301 01ff0405
    30030101 ff300e06 03551d0f 0101ff04 04030201 06306d06 082b0601 05050701
    0c046130 5fa15da0 5b305930 57305516 09696d61 67652f67 69663021 301f3007
    06052b0e 03021a04 148fe5d3 1a86ac8d 8e6bc3cf 806ad448 182c7b19 2e302516
    23687474 703a2f2f 6c6f676f 2e766572 69736967 6e2e636f 6d2f7673 6c6f676f
    2e676966 301d0603 551d0e04 1604147f d365a7c2 ddecbbf0 3009f343 39fa02af
    33313330 0d06092a 864886f7 0d010105 05000382 01010093 244a305f 62cfd81a
    982f3dea dc992dbd 77f6a579 2238ecc4 a7a07812 ad620e45 7064c5e7 97662d98
    097e5faf d6cc2865 f201aa08 1a47def9 f97c925a 0869200d d93e6d6e 3c0d6ed8
    e6069140 18b9f8c1 eddfdb41 aae09620 c9cd6415 3881c994 eea28429 0b136f8e
    db0cdd25 02dba48b 1944d241 7a05694a 584f60ca 7e826a0b 02aa2517 39b5db7f
    e784652a 958abd86 de5e8116 832d10cc defda882 2a6d281f 0d0bc4e5 e71a2619
    e1f4116f 10b595fc e7420532 dbce9d51 5e28b69e 85d35bef a57d4540 728eb70e
    6b0e06fb 33354871 b89d278b c4655f0d 86769c44 7af6955c f65d3208 33a454b6
    183f685c f2424a85 3854835f d1e82cf2 ac11d6a8 ed636a
    quit
    crypto ikev1 enable OTSIDE
    crypto ikev1 policy 1
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    ciscoasa# sho
    ciscoasa# show t
    ciscoasa# show run
    ciscoasa# show running-config | i tunn
    tunnel-group 1.1.1.1 type ipsec-l2l
    tunnel-group 1.1.1.1 ipsec-attributes
    ciscoasa#

     



  • 2.  RE: IPsec Tunnel between cisco ASA and SRX.. Getting error : IKE negotiation failed with error: No proposal chosen

    Posted 11-18-2018 21:34

    Phase 1 & 2 status

     


    root@NDC9C-SRX> show security ike security-associations
    Index State Initiator cookie Responder cookie Mode Remote Address
    5423928 UP abc5522cfd4ebfee 41750c61cf558ea7 Main 1.1.1.3

    root@NDC9C-SRX> show security ipsec security-associations
    Total active tunnels: 0

    root@NDC9C-SRX>

     

     

     

    ciscoasa# show crypto ikev1 sa

    IKEv1 SAs:

    Active SA: 1
    Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
    Total IKE SA: 1

    1 IKE Peer: 1.1.1.1
    Type : L2L Role : initiator
    Rekey : no State : MM_ACTIVE
    ciscoasa# show crypto ip
    ciscoasa# show crypto ipsec sa
    ciscoasa# show crypto ipsec sa
    ciscoasa#



  • 3.  RE: IPsec Tunnel between cisco ASA and SRX.. Getting error : IKE negotiation failed with error: No proposal chosen
    Best Answer

    Posted 11-18-2018 22:26

    Hi,

    PFS is enabled at Cisco side. Try to disable it and check th status.

     



  • 4.  RE: IPsec Tunnel between cisco ASA and SRX.. Getting error : IKE negotiation failed with error: No proposal chosen

    Posted 11-19-2018 19:30

    yes.. Phase1 & phase2 are come up after removing PFS from cisco asa..