topic Re: S2S phase 2 down in Firewall and Security Management

S2S phase 2 down

RemoteUser — Thu, 10 Jul 2025 09:31:36 GMT

We have a vpn s2s that goes down with asa. (phase-2)

crypto map outside_map 300 match address outside_300_cryptomap
crypto map outside_map 300 set peer x.x.x.x (our pubblic IP)
crypto map outside_map 300 set ikev2 ipsec-proposal ESP-AES256-SHA256
crypto map outside_map 300 set security-association lifetime seconds 28800
DH Group 14

Our side checkpoint doesn't change...

Error from checkpoint in the log:
Child SA exchange: Sending notification to peer: No proposal chosen MyMethods Phase2: AES-256 + HMAC-SHA2-256, No IPComp, No ESN, Group 14

The guys that mange ASA told me that they doesn't change anything.

Re: S2S phase 2 down

_Val_ — Mon, 14 Jul 2025 13:01:03 GMT

What does the log say?

Re: S2S phase 2 down

the_rock — Mon, 14 Jul 2025 14:23:44 GMT

Hey bro,

Ask them if they can run this debug on Cisco and send it over.

Andy

debug vpn:

debug crypto condition peer x.x.x.x

debug crypto ikev1 200

debug crypto ipsec 200

to cancel all debugs-> undebug all

Re: S2S phase 2 down

the_rock — Mon, 14 Jul 2025 14:31:21 GMT

Was the tunnel ever up btw?

Andy

Re: S2S phase 2 down

the_rock — Tue, 15 Jul 2025 12:25:12 GMT

Hey bro,

Any luck with this?

Andy

Re: S2S phase 2 down

RemoteUser — Wed, 23 Jul 2025 06:49:42 GMT

Hi brother, sorri for the late response i was ooo.
Anway we solved the issue, there was an incompatibility with PFS

Re: S2S phase 2 down

the_rock — Wed, 23 Jul 2025 11:15:02 GMT

Excellent work bro.