MSR3064

rcowen — Tue, 07 Mar 2017 22:31:57 GMT

I have an advpn configuration that's working great however when I apply

interface Tunnel 0 mode advpn udp

tunnel protection ipsec profile ipsecprofile1

I repeatedly get the debugging message

The SA doesn't exist in kernel.

If I apply an ike profile the ipsec tunnel works beautiful and I can even switch the config and the error message goes away until I reboot, apply the ike profile and then switch to the ikev2...

dis ikev2 sa; no matter which profile I apply is always empty. "dis ike sa" does return proper results.

any hints?

Here's my ipsec/ikev2 config example....

ipsec profile ipsecprofile1 isakmp
transform-set ipsectran1
ike-profile ikeprofile1

ipsec transform-set ipsectran1
esp encryption-algorithm aes-cbc-256
esp authentication-algorithm sha512

ikev2 profile ikeprofile1
authentication-method local pre-share
keychain keychain1

ikev2 keychain keychain1
peer ikePEER
address 0.0.0.0 0.0.0.0
pre-shared-key <redacted>

ikev2 proposal ikev2proposal
encryption aes-cbc-256
integrity sha512
dh group20

topic MSR3064 in Security e-Series

MSR3064