Hello there,
I’m doing a site recovery project and I’m successfully configured on-premise Hyper-v to Azure Site recovery.
I’m now trying to build a site-to-site recovery. My network settings are
- IP-range on-premise hyper-v server 172.16.16.0/24
- IP-range network for VPN to Azure 192.168.5.0/28
IP-range on Azure virtual machines are:
I followed this guide to build the site-to-site vpn on the Cisco 800 router serie and used the ISR serie script that I download from the Azure dashboard.
My Crypto map config on the router is:
Crypto Map IPv4 "VPN" 13 ipsec-isakmp
Description: AZURE-VPN
Peer = 104.40.xxx.x
Extended IP access list AZURE
access-list AZURE permit ip 192.168.5.0 0.0.0.15 172.18.0.0 0.0.255.255
Current peer: 104.40.xxx.x
Security association lifetime: 102400000 kilobytes/3600 seconds
Responder-Only (Y/N): N
PFS (Y/N): N
Transform sets={
AZURE: { esp-3des esp-sha-hmac } ,
}
Interfaces using crypto map VPN:
Dialer1
The error I get on the router is:
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x0
032480: Apr 28 08:07:16.719: IPSEC(ipsec_process_proposal): transform proposal not supported for identity:
{esp-3des esp-sha-hmac }
032481: Apr 28 08:07:16.719: ISAKMP:(2014): IPSec policy invalidated proposal with error 256
032482: Apr 28 08:07:16.719: ISAKMP:(2014): phase 2 SA policy not acceptable!(local 213.247.xxx.xxx remote 104.40.xxx.x
032483: Apr 28 08:07:16.719: ISAKMP: set new node -1867611319 to QM_IDLE
032484: Apr 28 08:07:16.719: ISAKMP:(2014):Sending NOTIFY PROPOSAL_NOT_CHOSEN protocol 3
spi 2267024872, message ID = 2427355977
032485: Apr 28 08:07:16.719: ISAKMP:(2014): sending packet to 104.40.xxx.x my_port 500 peer_port 500 (R) QM_IDLE
032486: Apr 28 08:07:16.719: ISAKMP:(2014):Sending an IKE IPv4 Packet.
032487: Apr 28 08:07:16.719: ISAKMP:(2014):purging node -1867611319
032488: Apr 28 08:07:16.719: ISAKMP:(2014):deleting node -1790187706 error TRUE reason "QM rejected"
032489: Apr 28 08:07:16.719: ISAKMP:(2014):Node 2504779590, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
032490: Apr 28 08:07:16.723: ISAKMP:(2014):Old State = IKE_QM_I_QM1 New State = IKE_QM_I_QM1.....
Success rate is 0 percent (0/5)
Please someone help, because I can’t find what the problem is.