Cisco ASA with strongswan

Hmmm - working a bit.

Not sure but have a look at the following.

crypto ipsec transform-set e01 esp-3des esp-sha-hmac crypto ipsec transform-set e02 esp-3des esp-sha-hmac

crypto map outside_map 40 match address e01 crypto map outside_map 40 set peer 192.168.1.1 crypto map outside_map 40 set transform-set erwin01_w_wawie crypto map outside_map 40 set security-association lifetime seconds

Well you are not referencing the defined transform sets from the crypto map?

As far as I know it is not necesary to defing multiple transform sets, so -

crypto ipsec transform-set my-ts esp-3des esp-sha-hmac

crypto map outside_map 40 match address e01 crypto map outside_map 40 set peer 192.168.1.1 crypto map outside_map 40 set transform-set my-ts crypto map outside_map 40 set security-association lifetime seconds

For further simplification you mmight consider:-

access-list e01 extended permit ip 50.50.50.0 255.255.255.0

crypto ipsec transform-set my-ts esp-3des esp-sha-hmac

crypto map outside_map 40 match address e01 crypto map outside_map 40 set peer 192.168.1.1 crypto map outside_map 40 set transform-set my-ts crypto map outside_map 40 set security-association lifetime seconds

This may be telling you what is wrong.

Wanted and Found should probably be the same.

000 "e01-cisco_vpn_asa": ESP algorithms wanted: 3_000-2,

bod43 pisze:

thx for help, i made as You suggest, but i have still problem. My links aren't stable, They works about 1-3 minutes and go down. Sometimes they work together, sometimes only one of them. After restart both links works for a 2-3 minutes

I try to test varius config, eg aes-256, change crypto etc:

crypto map outside_map 40 match address erwin01_w_wawie crypto map outside_map 40 set peer 192.168.1.1 crypto map outside_map 40 set transform-set my_ts crypto map outside_map 40 set security-association lifetime seconds 86400

crypto ipsec transform-set my_ts esp-aes esp-sha-hmac

crypto isakmp policy 10 authentication pre-share encryption 3des hash sha group 2 lifetime 28800 crypto isakmp policy 20 authentication pre-share encryption aes-256 hash sha group 2 lifetime 86400

clear crypto ipsec peer 192.168.1.1 clear crypto isakmp sa 192.168.1.1

but i still have:

IKE Peer: 192.168.1.1 Type : L2L Role : initiator Rekey : no State : MM_ACTIVE Encrypt : 3des Hash : SHA Auth : preshared Lifetime: 28800 Lifetime Remaining: 28678

In my logs i still have:

Error processing payload: Payload ID: 1 Removing peer from peer table failed, no match! Error: Unable to remove PeerTblEntry

Error processing payload: Payload ID: 1 Removing peer from peer table failed, no match! Error: Unable to remove PeerTblEntry

and debug show:

,processing SA payload ,IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + NOTIFY (11)

• NONE (0) total length : 96

, All SA proposals found unacceptable , Error processing payload: Payload ID: 1 , IKE MM Responder FSM error history (struct &0xd8b7ac38) , : MM_DONE, EV_ERROR-->MM_START, EV_RCV_MSG-->MM_START, EV_START_MM-->MM_START, EV_START_MM-->MM_START, EV_START_MM-->MM_START, EV_START_MM-->MM_START, EV_START_MM-->MM_START, EV_START_MM

, IKE SA MM:94edd0b6 terminating: flags 0x01000002, refcnt 0, tuncnt 0 , sending delete/delete with reason message

On my other site, strognswan:

ipsec.conf:

config setup interfaces=%defaultroute plutodebug=control crlcheckinterval=180 strictcrlpolicy=no nat_traversal=yes uniqueids=yes

conn %default type=tunnel authby=secret ikelifetime=28800 keylife=86400 keyingtries=5 auto=start keyexchange=ike pfs=no auth=esp esp=aes128-sha1 #esp=3des-sha1 ike=aes256-sha-modp1536 #dpdaction=hold #dpddelay=60 #dpdtimeout=500

ipsec statusall

ike_life: 28800s; ipsec_life: 86400s; rekey_margin: 540s; rekey_fuzz: