Guys,
I'm trying to setup this site to site vpn using the IPSEC VPN Wizard between an ASA5510 and an ASA5505 but I keep getting the same error.
Output from debug crypto ipsec / isakmp on ASA5510 when a PC on the ASA5505 firewall was trying to ping to a PC on the ASA5510 firewall
Dec 01 13:18:09 [IKEv1]: Group = 2.2.2.2, IP = 2.2.2.2, QM FSM error (P2 struct &0xd6306280, mess id 0xc9de71d2)!
Dec 01 13:18:09 [IKEv1]: Group = 2.2.2.2, IP = 2.2.2.2, Removing peer from correlator table failed, no match!
Dec 01 13:18:15 [IKEv1]: Group = 2.2.2.2, IP = 2.2.2.2, QM FSM error (P2 struct &0xd62fcc38, mess id 0xb8a57ff6)!
Dec 01 13:18:15 [IKEv1]: Group = 2.2.2.2, IP = 2.2.2.2, Removing peer from correlator table failed, no match!
Dec 01 13:18:20 [IKEv1]: Group = 2.2.2.2, IP = 2.2.2.2, QM FSM error (P2 struct &0xd62fcc38, mess id 0x9050819c)!
Dec 01 13:18:20 [IKEv1]: Group = 2.2.2.2, IP = 2.2.2.2, Removing peer from correlator table failed, no match!
Googling "QM FSM error" it tells me that there might be an ACL mismatch
--------------------------
----------
----------
-------
From ASA5510
Comparing the Start and the Run configurations this was what was entered:
access-list outside_1_cryptomap_1 extended permit ip 10.1.0.0 255.255.255.0 10.2.0.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 10.1.0.0 255.255.255.0 10.2.0.0 255.255.255.0
nat (inside) 0 access-list inside_nat0_outbound
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto map outside_map 1 match address outside_1_cryptomap_1
crypto map outside_map 1 set pfs
crypto map outside_map 1 set peer 2.2.2.2
crypto map outside_map 1 set transform-set ESP-3DES-SHA
crypto map outside_map interface outside
crypto isakmp enable outside
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
tunnel-group 2.2.2.2 type ipsec-l2l
tunnel-group 2.2.2.2 ipsec-attributes
pre-shared-key *************
From ASA5505
Comparing the Start and the Run configurations this was what was entered:
access-list outside_1_cryptomap extended permit ip 10.2.0.0 255.255.255.0 10.1.0.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 10.2.0.0 255.255.255.0 10.1.0.0 255.255.255.0
nat (inside) 0 access-list inside_nat0_outbound
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set pfs group1
crypto map outside_map 1 set peer 1.1.1.1
crypto map outside_map 1 set transform-set ESP-3DES-SHA
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
tunnel-group 1.1.1.1 type ipsec-l2l
tunnel-group 1.1.1.1 ipsec-attributes
pre-shared-key *************
--------------------------
----------
----------
---------
IP Address information:
ASA5510:
INSIDE: 10.1.0.0/24
OUTSIDE: 1.1.1.1
ASA5505:
INSIDE: 10.2.0.0/24
OUTSIDE: 2.2.2.2
This is setup is currently in our testing area. I've verified communications (firewalls can ping each other).
When I attempt to ping from inside to the other network through the L2L I get the same error messages from both firewalls.
Start Free Trial
