topic Re: Limit in received IKEv2 Phase-1 SA Proposal count in Firewall and Security Management

Limit in received IKEv2 Phase-1 SA Proposal count

TomasFy — Fri, 25 Mar 2022 17:22:38 GMT

Hi,

I am working on a VPN with 3rd party vendor and we cannot make it working.

During troubleshooting I found out that the problem is down to fact that gateway can ‘see’ only 16 IKE Phase-1 Proposals sent from the other party.

As result the tunnel negotiation is refused with message “No proposal chosen”.

In packet capture I can see that 20 proposals are sent, but in ikev2.xmll debug file I can only see 16. On the basis of Peer engineer’s analysis I know that the 16 Proposals in our GW’s debug match 1st 16 sets in their configuration.The rest seems to be just cut off.

The one which should match has index 17 …

Is this a known problem and is there any solution to it?

My GW version R80.40 with JHF T139. The Peer's GW is Cisco ASA-X

Re: Limit in received IKEv2 Phase-1 SA Proposal count

the_rock — Fri, 25 Mar 2022 17:27:08 GMT

Is tunnel management set as per subnet or per gateway?

Andy

Re: Limit in received IKEv2 Phase-1 SA Proposal count

Chris_Atkinson — Sun, 27 Mar 2022 07:54:54 GMT

Per sk112139 only up to 16 proposals are supported in R80.40 currently.

Re: Limit in received IKEv2 Phase-1 SA Proposal count

TomasFy — Tue, 29 Mar 2022 12:09:26 GMT

Hi Chris,

Thank you for the answer. I was looking for any solution but didn't find this one 😞

Do you know whether the same regards IKEv1?

Is the limit there the same or lower? Or maybe higher than this?

Re: Limit in received IKEv2 Phase-1 SA Proposal count

Timothy_Hall — Tue, 29 Mar 2022 16:27:40 GMT

For IKEv1 I don't believe this limit applies, as I'm pretty sure only one SA can be proposed at a time. IKEv2 allows multiple proposals within the same negotiation, and the creation of Child SAs as well.