cisco ikev2 error address type not supportedcleveland clinic strongsville lab hours
tanyatamir53355. Find answers to your questions by entering keywords or phrases in the Search bar above. Cisco recommends that you have knowledge of the packet exchange for IKEv2. : crypto ikev2 profile default . Learn more about how Cisco is using Inclusive Language. Bug Search Tool - Cisco New here? #crypto ikev2 policy cisco. IKEv2 Packet Exchange and Protocol Level Debugging, Technical Support & Documentation - Cisco Systems, Router 1 receives a packet that matches the crypto acl for peer ASA 10.0.0.2. All traffic must be accepted and specific routing is needed to direct traffic into specific tunnels. They contain the source and destination address of the initiator and responder respectively for forwarding/receiving encrypted traffic. The Responder tunnel usually comes up before the Initiator. Finding Feature Information Prerequisites for Configuring Internet Key Exchange Version 2 BR12-1X(config)# crypto ikev2 profile apple, BR12-1X(config-ikev2-profile)# config-exchange request, BR12-1X(config-ikev2-profile)# no config-exchange request. The address range specifies that all traffic to and from that range are tunnelled. You can configure IPsec on tunnels for VPN 1 through 65530, except for 512. https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/System-Interface/systems-interfaces-book/configure-interfaces.html. We may get it in march release if everything will be on track. Could you please clarify, as I'm waiting for this feature being available for some months now. Zscaler support IP-SLA HTTP probes to check the cloud proxy health, on traditional routers you are able to use 'track' features to, for example, change the admin distance of a static route based on the results of the IP-SLA test. Cisco IOS and IOS XE Software Internet Key Exchange Version 2 Denial of IOS IKEv2 Debugs for Site-to-Site VPN with PSKs Troubleshooting - Cisco Customers Also Viewed These Support Documents, https://www.cisco.com/c/en/us/support/docs/security/flexvpn/115907-config-flexvpn-wcca-00.html. IPsec with IKEv2 simple lab - Cisco - edited Use these resources to familiarize yourself with the community: The display of Helpful votes has changed click to read more! In addition, this document provides information on how to translate certain debug lines in a configuration. Be aware the static route will only be withdrawn from the routing table if the Tunnel goes down. Responder initiates SA creation for that peer. 05:29 AM. If the SA offers include different DH groups, KEi must be an element of the group the initiator expects the responder to accept. E.g. Phase 1: AES256, SHA384, DH14, SA 28800 Phase 2: AES256, SHA256, PFS2048, SA 3600 I'm getting the error: encryption failure: Ike version: ikev2 not supported for peer I'm new to checkpoint. My assumption is that although the IPSEC is created on the service side, by sourcing the tunnel from the interface with a public IP address in VPN0, the cEdge would VRF jump to VPN0. IKEv2 Problems WatchGuard Community Use these resources to familiarize yourself with the community: The display of Helpful votes has changed click to read more! These parameters are identical to the one that was received from ASA1. 03-12-2019 I shared this with TAC too. The difference between IKEv1 and IKEv2 is that, in the latter, the Child SAs are created as part of AUTH exchange itself. currently using 4.8, seems to have solved all issues. Nonce Ni (optional): If the CHILD_SA is created as part of the initial exchange, a second KE payload and nonce must not be sent), KEi (Key-optional): The CREATE_CHILD_SA request might optionally contain a KE payload for an additional DH exchange to enable stronger guarantees of forward secrecy for the CHILD_SA. I'm unsure if Viptela using IOS XE has this same capability. Are you seeing encrypts and decrypts over your IPSEC tunnel? The DH Group configured under the crypto map would be used only during rekey. Keyring: configure the key will be exchanged to establish phase1 and the type which is in our example (pre-shared) Example: #crypto ikev2 keyring cisco. ASA IKEv2 Debugs for Remote Access VPN Troubleshooting - Cisco New here? If this CREATE_CHILD_SA exchange is not rekeying an existing SA, the N payload must be omitted. Options. Doesn't work for me. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Create VPN Gateway Policy (Phase1) To create a Phase1 VPN policy, go to Configuration -> VPN -> IPSec VPN and click on the " VPN Gateway " tab. Help would really be appreciated. Relevant Configuration:crypto ikev2 proposal PHASE1-prop encryption 3des aes-cbc-128 integrity sha1 group 2 crypto ikev2 keyring KEYRNG peer peer2 address 10.0.0.1 255.255.255.0 hostname host2 pre-shared-key local cisco pre-shared-key remote cisco, *Nov 11 19:30:34.822: IKEv2:(SA ID = 1):Next payload: SA, version: 2.0 Exchange type:IKE_SA_INIT,flags:RESPONDER MSG-RESPONSEMessage id: 0, length: 449 Payload contents: SANext payload: KE, reserved: 0x0, length: 48 last proposal: 0x0, reserved: 0x0, length: 44 Proposal: 1, Protocol id: IKE, SPI size: 0, #trans: 4 last transform: 0x3, reserved: 0x0: length: 12 type: 1, reserved: 0x0, id: AES-CBC last transform: 0x3, reserved: 0x0: length: 8 type: 2, reserved: 0x0, id: SHA1 last transform: 0x3, reserved: 0x0: length: 8 type: 3, reserved: 0x0, id: SHA96 last transform: 0x0, reserved: 0x0: length: 8 type: 4, reserved: 0x0, id: DH_GROUP_1024_MODP/Group 2 KENext payload: N, reserved: 0x0, length: 136 DH group: 2, Reserved: 0x0 NNext payload: VID, reserved: 0x0, length: 24 VID Next payload: VID, reserved: 0x0, length: 23 VID Next payload: NOTIFY, reserved: 0x0, length: 21 NOTIFY(NAT_DETECTION_SOURCE_IP) Next payload: NOTIFY, reserved: 0x0, length: 28 Security protocol id: IKE, spi size: 0, type: NAT_DETECTION_SOURCE_IP NOTIFY(NAT_DETECTION_DESTINATION_IP) Next payload: CERTREQ, reserved: 0x0, length: 28 Security protocol id: IKE, spi size: 0, type: NAT_DETECTION_DESTINATION_IP CERTREQ Next payload: NOTIFY, reserved: 0x0, length: 105 Cert encoding Hash and URL of PKIX NOTIFY(HTTP_CERT_LOOKUP_SUPPORTED) Next payload: NONE, reserved: 0x0, length: 8 Security protocol id: IKE, spi size: 0, type: HTTP_CERT_LOOKUP_SUPPORTED, *Nov 11 19:30:34.822: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000000 CurState: INIT_DONE Event: EV_DONE *Nov 11 19:30:34.822: IKEv2:(SA ID = 1):Cisco DeleteReason Notify is enabled *Nov 11 19:30:34.822: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000000 CurState: INIT_DONE Event: EV_CHK4_ROLE *Nov 11 19:30:34.822: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000000 CurState: INIT_DONE Event:EV_START_TMR *Nov 11 19:30:34.822: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000000 CurState: R_WAIT_AUTH Event: EV_NO_EVENT *Nov 11 19:30:34.822: IKEv2:New ikev2 sa request admitted *Nov 11 19:30:34.822: IKEv2:Incrementing outgoing negotiating sa count by one, *Nov 11 19:30:34.823: IKEv2:Got a packet from dispatcher *Nov 11 19:30:34.823: IKEv2:Got a packet from dispatcher *Nov 11 19:30:34.823: IKEv2:Processing an item off the pak queue, I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (R) MsgID = 00000000 CurState: INIT_DONE Event:EV_START_TMR, *Nov 11 19:30:34.823: IKEv2:(SA ID = 1):Next payload: SA, version: 2.0 Exchange type: IKE_SA_INIT, flags:RESPONDER MSG-RESPONSEMessage id: 0, length: 449 Payload contents: SANext payload: KE, reserved: 0x0, length: 48 last proposal: 0x0, reserved: 0x0, length: 44 Proposal: 1, Protocol id: IKE, SPI size: 0, #trans: 4 last transform: 0x3, reserved: 0x0: length: 12 type: 1, reserved: 0x0, id: AES-CBC last transform: 0x3, reserved: 0x0: length: 8 type: 2, reserved: 0x0, id: SHA1 last transform: 0x3, reserved: 0x0: length: 8 type: 3, reserved: 0x0, id: SHA96 last transform: 0x0, reserved: 0x0: length: 8 type: 4, reserved: 0x0, id: DH_GROUP_1024_MODP/Group 2 KENext payload: N, reserved: 0x0, length: 136 DH group: 2, Reserved: 0x0 NNext payload: VID, reserved: 0x0, length: 24 *Nov 11 19:30:34.823: IKEv2:Parse Vendor Specific Payload: CISCO-DELETE-REASON VID Next payload: VID, reserved: 0x0, length: 23 *Nov 11 19:30:34.823: IKEv2:Parse Vendor Specific Payload: (CUSTOM) VID Next payload: NOTIFY, reserved: 0x0, length: 21 *Nov 11 19:30:34.823: IKEv2:Parse Notify Payload: NAT_DETECTION_SOURCE_IP NOTIFY(NAT_DETECTION_SOURCE_IP) Next payload: NOTIFY, reserved: 0x0, length: 28 Security protocol id: IKE, spi size: 0, type: NAT_DETECTION_SOURCE_IP *Nov 11 19:30:34.824: IKEv2:Parse Notify Payload: NAT_DETECTION_DESTINATION_IP NOTIFY(NAT_DETECTION_DESTINATION_IP) Next payload: CERTREQ, reserved: 0x0, length: 28 Security protocol id: IKE, spi size: 0, type: NAT_DETECTION_DESTINATION_IP CERTREQ Next payload: NOTIFY, reserved: 0x0, length: 105 Cert encoding Hash and URL of PKIX *Nov 11 19:30:34.824: IKEv2:Parse Notify Payload: HTTP_CERT_LOOKUP_SUPPORTED NOTIFY(HTTP_CERT_LOOKUP_SUPPORTED) Next payload: NONE, reserved: 0x0, length: 8 Security protocol id: IKE, spi size: 0, type: HTTP_CERT_LOOKUP_SUPPORTED, *Nov 11 19:30:34.824: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: I_WAIT_INIT Event: EV_RECV_INIT *Nov 11 19:30:34.824: IKEv2:(SA ID = 1):Processing IKE_SA_INIT message *Nov 11 19:30:34.824: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: I_PROC_INIT Event: EV_CHK4_NOTIFY *Nov 11 19:30:34.824: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: I_PROC_INIT Event: EV_VERIFY_MSG *Nov 11 19:30:34.824: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: I_PROC_INIT Event: EV_PROC_MSG *Nov 11 19:30:34.824: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: I_PROC_INIT Event: EV_DETECT_NAT *Nov 11 19:30:34.824: IKEv2:(SA ID = 1):Process NAT discovery notify *Nov 11 19:30:34.824: IKEv2:(SA ID = 1):Processing nat detect src notify *Nov 11 19:30:34.824: IKEv2:(SA ID = 1):Remote address matched *Nov 11 19:30:34.824: IKEv2:(SA ID = 1):Processing nat detect dst notify *Nov 11 19:30:34.824: IKEv2:(SA ID = 1):Local address matched *Nov 11 19:30:34.824: IKEv2:(SA ID = 1):No NAT found *Nov 11 19:30:34.824: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: I_PROC_INIT Event: EV_CHK_NAT_T *Nov 11 19:30:34.824: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: I_PROC_INIT Event: EV_CHK_CONFIG_MODE *Nov 11 19:30:34.824: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: INIT_DONE Event:EV_GEN_DH_SECRET *Nov 11 19:30:34.831: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: INIT_DONE Event: EV_NO_EVENT *Nov 11 19:30:34.831: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: INIT_DONE Event: EV_OK_RECD_DH_SECRET_RESP *Nov 11 19:30:34.831: IKEv2:(SA ID = 1):Action: Action_Null *Nov 11 19:30:34.831: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: INIT_DONE Event:EV_GEN_SKEYID *Nov 11 19:30:34.831: IKEv2:(SA ID = 1):Generate skeyid *Nov 11 19:30:34.831: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: INIT_DONE Event: EV_DONE *Nov 11 19:30:34.831: IKEv2:(SA ID = 1):Cisco DeleteReason Notify is enabled *Nov 11 19:30:34.831: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: INIT_DONE Event: EV_CHK4_ROLE *Nov 11 19:30:34.831: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: I_BLD_AUTH Event: EV_GET_CONFIG_MODE *Nov 11 19:30:34.831: IKEv2:Sending config data to toolkit *Nov 11 19:30:34.831: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=F94020DD8CB4B9C4 (I) MsgID = 00000000 CurState: I_BLD_AUTH Event: EV_CHK_EAP. For a branch office VPN that uses IKEv1, the Phase 1 exchange can use Main Mode or Aggressive Mode. Initiates SA creation, *Nov 11 19:30:34.811: IKEv2:(SA ID = 1):SM Trace-> SA: I_SPI=F074D8BBD5A59F0B R_SPI=0000000000000000 (I) MsgID = 00000000 CurState: IDLE Event: EV_INIT_SA. These messages negotiate cryptographic algorithms, exchange nonces, and do a Diffie-Hellman exchange. To a remote end configured with encryption domains i wasnt sucessfull. Configure Phase 1 Settings For IKEv1. A Notify Payload might appear in a response message (usually specifying why a request was rejected), in an informational exchange (to report an error not in an IKE request), or in any other message to indicate sender capabilities or to modify the meaning of the request. The packet exchange in IKEv2 is radically different from packet exchange in IKEv1. My template for 'VPN Interface IPsec' looks like this: Then, this template is added under the Service VPN : I thought it was all working fine, however I now have a new problem.IKEv2 is working for Phase 1, but IPSEC is failing.For some reason the ISR4K is creating 16 SA's whilst Zscaler only support a maximum of 8 SA's, therefore the tunnel is currently unusable. Local Address = 0.0.0.0. Related Community Discussions View Bug Details in Bug Search Tool Why Is Login Required? Let me ask you something - what format do you enter user/domain information in the client? Getting "no pre-shared key with peer" in IKEv2 setup on csr1000 - Cisco Description (partial) Symptom: Garbage value (non-comprehensible) seen in the ikev2 error line "Address type 4132115430 not supported" Conditions: When ikev2 error debugging is turned on. The connection uses a custom IPsec/IKE policy with the UsePolicyBasedTrafficSelectors option, as described in this article.. Hi, made some more tests and my problem is the following, IPSec tunnel can be established if remote end is configured without any specific encryption domains for the communication and with a transport network within the tunnel (for routing purpose - like in GRE Tunnel). I notice the guide was written for the vEdge. In IKEv1 there was a clearly demarcated phase1 exchange that consisted of six (6) packets followed by a phase 2 exchange that consisted of three (3) packets; the IKEv2 exchange is variable. This mode is more secure, and uses three . The CHILD_SA packet typically contains: Router 2 now builds the reply for the CHILD_SA exchange. Palo Alto IP: 1.1.1.1 Cisco ASA IP: 2.2.2.2 Cisco ASA iKev2 and IPsec parameters: Working output: #show crypto ikev2 profile IKEv2 profile: default Ref Count: 4 Match criteria: Fvrf: global Local address/interface: none Identities: none Certificate maps: mymap Local identity: none <----- Remote identity: none Conditions: FlexVPN No local identity configured, relaying on global default. Same here. 2023 Cisco and/or its affiliates. All but the headers of all the messages that follow are encrypted and authenticated. Initiator building IKE_INIT_SA packet. Source Interface in my setup is the WAN Interface connected to the Internet. Internet Key Exchange Version 2 (IKEv2) Parameters Refer toCisco Technical Tips Conventionsfor more information on document conventions. I had the same Firebox and RADIUS server working for IPSec MUVPN, but not for IKEv2. If the proposal is acceptable to the responder, it sends identical TS payloads back. crypto ikev2 authorization policy FlexVPN, encryption 3des aes-cbc-128 aes-cbc-192 aes-cbc-256, crypto ipsec transform-set ESP-GCM esp-gcm, crypto ipsec transform-set AES-CBC esp-aes 256 esp-sha256-hmac, crypto ipsec transform-set AES-CBC1 esp-aes esp-sha-hmac, crypto ipsec transform-set AES-CBC2 esp-3des esp-sha-hmac, set transform-set AES-CBC AES-CBC1 AES-CBC2 ESP-GCM, ip local pool FlexVPN 10.7.1.231 10.7.1.239. The Notify Payload, is used to transmit informational data, such as error conditions and state transitions, to an IKE peer. If it guesses wrong, the CREATE_CHILD_SA exchange fails, and it must retry with a different KEi. Bug Details Include Can you also post the config for the VPN template. Same in every possible way. As far as I'm aware that feature is not supported on cEdge platforms, you can only use IPsec tunnels on the Service Side VPN. Select the " Show Advanced Settings " option on the top left and make sure the enable box is checked. encryption failure: Ike version: ikev2 not support - Check Point All rights reserved. Configuring Internet Key Exchange Version 2 - Cisco Router2 sends out the responder message to Router 1. ", https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/Security/Security-Book/security-book_chapter_01.html?bookSearch=true#c_Configuring_IKE_Enabled_IPsec_Tunnels_12216.xml. Tunnel is up on the Initiator and the status shows. Windows or MAC (native or AC) client can only use Certificates or EAP. The information in this document is based on these software and hardware versions: The information in this document was created from the devices in a specific lab environment. First pair of messages is the IKE_SA_INIT exchange. Update: This was a version error, using wrong version of anyconnect, this has now been resolved. Customers Also Viewed These Support Documents, Branch router, ISR4451-X, version 16.12.1b. It might be initiated by either end of the IKE_SA after the initial exchanges are completed. In the IKEv1 Phase 1 settings, you can select one of these modes: Main Mode. Failed to remove peer correlation entry from cikePeerCorrTable. The VPN is not connecting at all. KEi (Key-optional): The CREATE_CHILD_SA request might optionally contain a KE payload for an additional DH exchange to enable stronger guarantees of forward secrecy for the CHILD_SA. 189035: *Aug 8 14:01:22.161 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):IKE Proposal: 1, SPI size: 0 (initial negotiation), AES-CBC SHA256 SHA256 DH_GROUP_2048_MODP/Group 14, 189036: *Aug 8 14:01:22.161 Chicago: IKEv2:(SA ID = 1):[IKEv2 -> PKI] Retrieve configured trustpoint(s), 189037: *Aug 8 14:01:22.161 Chicago: IKEv2:(SA ID = 1):[PKI -> IKEv2] Retrieved trustpoint(s): 'TP-self-signed-653483565', 189038: *Aug 8 14:01:22.161 Chicago: IKEv2:(SA ID = 1):[IKEv2 -> PKI] Get Public Key Hashes of trustpoints, 189039: *Aug 8 14:01:22.161 Chicago: IKEv2:(SA ID = 1):[PKI -> IKEv2] Getting of Public Key Hashes of trustpoints FAILED, 189040: *Aug 8 14:01:22.161 Chicago: IKEv2:Failed to retrieve Certificate Issuer list, 189041: *Aug 8 14:01:22.161 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Sending Packet [To 2.2.2.2:500/From 1.1.1.1:500/VRF i0:f0], Initiator SPI : 8A15E970577C6140 - Responder SPI : 0550071FA9DFE718 Message id: 0, SA KE N VID VID NOTIFY(NAT_DETECTION_SOURCE_IP) NOTIFY(NAT_DETECTION_DESTINATION_IP), 189042: *Aug 8 14:01:22.161 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Completed SA init exchange, 189043: *Aug 8 14:01:22.161 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Starting timer (30 sec) to wait for auth message, 189044: *Aug 8 14:01:22.429 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Received Packet [From 2.2.2.2:4500/To 1.1.1.1:500/VRF i0:f0], Initiator SPI : 8A15E970577C6140 - Responder SPI : 0550071FA9DFE718 Message id: 1, IDi NOTIFY(INITIAL_CONTACT) NOTIFY(Unknown - 16396) IDr AUTH CFG NOTIFY(ESP_TFC_NO_SUPPORT) NOTIFY(NON_FIRST_FRAGS) SA TSi TSr, 189045: *Aug 8 14:01:22.429 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Stopping timer to wait for auth message, 189046: *Aug 8 14:01:22.429 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Checking NAT discovery, 189047: *Aug 8 14:01:22.429 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):NAT OUTSIDE found, 189048: *Aug 8 14:01:22.429 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):NAT detected float to init port 4500, resp port 4500, 189049: *Aug 8 14:01:22.433 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Searching policy based on peer's identity '10.5.1.70' of type 'IPv4 address', 189050: *Aug 8 14:01:22.433 Chicago: IKEv2:found matching IKEv2 profile 'FlexVPN', 189051: *Aug 8 14:01:22.433 Chicago: IKEv2:% Getting preshared key from profile keyring keys, 189052: *Aug 8 14:01:22.433 Chicago: IKEv2:% Matched peer block 'DYNAMIC', 189053: *Aug 8 14:01:22.433 Chicago: IKEv2:Searching Policy with fvrf 0, local address 1.1.1.1, 189054: *Aug 8 14:01:22.433 Chicago: IKEv2:Found Policy 'ikev2policy', 189055: *Aug 8 14:01:22.433 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Verify peer's policy, 189056: *Aug 8 14:01:22.433 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Peer's policy verified, 189057: *Aug 8 14:01:22.433 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Get peer's authentication method, 189058: *Aug 8 14:01:22.433 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Peer's authentication method is 'PSK', 189059: *Aug 8 14:01:22.433 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Get peer's preshared key for 10.5.1.70, 189060: *Aug 8 14:01:22.433 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Verify peer's authentication data, 189061: *Aug 8 14:01:22.433 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Use preshared key for id 10.5.1.70, key len 7, 189062: *Aug 8 14:01:22.433 Chicago: IKEv2:[IKEv2 -> Crypto Engine] Generate IKEv2 authentication data, 189063: *Aug 8 14:01:22.433 Chicago: IKEv2:[Crypto Engine -> IKEv2] IKEv2 authentication data generation PASSED, 189064: *Aug 8 14:01:22.433 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Verification of peer's authenctication data PASSED, 189065: *Aug 8 14:01:22.433 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Processing INITIAL_CONTACT, 189066: *Aug 8 14:01:22.433 Chicago: IKEv2:(SESSION ID = 8673,SA ID = 1):Received valid config mode data.