CloudLabBox
Try the free demo

Firewalls and VPNs lab 13 of 16

Troubleshooting phase 1 across four vendors

An IOS hub has three IKEv2 spokes, an ASA, a FortiGate and a vSRX, and none of them comes up. Find the proposal, pre-shared key, IKE version and identity faults from each vendor's own IKE output and logs, fix each on the right device and bring all three tunnels up.

Run this lab

It needs Standard: its 7 nodes are set to 8 vCPU and 10,240 MB in total.

In your workspace: Shared, then Firewalls and VPNs multi-vendor guided labs, then 13 - Troubleshooting phase 1 across four vendors

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 8 vCPU and 10,240 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 100 minutes
Nodes need
8 vCPU, 10,240 MB
Smallest plan
Standard

The scenario

Corran Engineering has just cut over three sites to a new IOS hub. Each site is a different firewall (the result of three acquisitions), and the hub team wrote a standard for each tunnel. Nothing has come up. Four faults stand between you and three working tunnels, all of them in phase 1 (the IKE SA). Fix each one on the device that breaks the standard.

TunnelStandardPre-shared keyIdentities
HQ to A-FWIKEv2, AES-256-GCM, PRF SHA-384, DH 20; crypto map 10.0.0.0/24 to 10.1.0.0/24Corran-A-27IP addresses
HQ to B-FWIKEv2, DES with SHA-256, DH 14 (FortiGate evaluation limit); route-basedCorran-B-27IP addresses
HQ to C-SRXIKEv2, AES-256-CBC, SHA-256, DH 20; route-basedCorran-C-27IP addresses
DeviceAddressLAN
HQ203.0.113.2/30 (Tunnel2 169.254.13.1, Tunnel3 169.254.13.5)10.0.0.0/24 (Lo0)
A-FW198.51.100.2/3010.1.0.0/24 (A-PC 10.1.0.10)
B-FW192.0.2.2/30 (to-HQ 169.254.13.2)10.2.0.0/24 (lo1 10.2.0.1)
C-SRX203.0.113.6/30 (st0.0 169.254.13.6)10.3.0.0/24 (C-PC 10.3.0.10)

What you’ll practise

  • Read IKE SA state on IOS, ASA, FortiGate and Junos
  • Recognise NO_PROPOSAL_CHOSEN, AUTHENTICATION_FAILED, an IKE version mismatch and an identity mismatch from the evidence
  • Use each vendor's IKE debug or log safely and turn it off again
  • Decide which side to fix by comparing each device with the written standard
  • Verify all tunnels from the hub

The tasks

  1. Survey the IKE state everywhere
  2. Site A
  3. Site B
  4. Site C (two faults)
  5. Prove all three

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Troubleshooting phase 1 across four vendors7 nodes, 6 links. Every link is listed as text below the diagram.ISPHQA-FWA-PCB-FWC-SRXC-PCGi0/0Gi0/0Gi0/0Gi0/0ge-0/0/1Gi0/0Gi0/1Gi0/1Gi0/2port1Gi0/3ge-0/0/0
7 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • ISP Gi0/0 to HQ Gi0/0
  • ISP Gi0/1 to A-FW Gi0/1
  • ISP Gi0/2 to B-FW port1
  • ISP Gi0/3 to C-SRX ge-0/0/0
  • A-FW Gi0/0 to A-PC Gi0/0
  • C-SRX ge-0/0/1 to C-PC Gi0/0
Nodes in Troubleshooting phase 1 across four vendors, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
ISPCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
HQCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
A-FWCisco ASAvasav-9.22.1.1-PLR-Licensed1 vCPU, 2,048 MB
A-PCCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
B-FWFortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
C-SRXJuniper vSRX NextGen templatevsrxng-23.4R2-S3.92 vCPU, 4,096 MB
C-PCCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Firewalls and VPNs multi-vendor guided labs.

  3. Open 13 - Troubleshooting phase 1 across four vendors and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Firewalls and VPNs labs

All Firewalls and VPNs labs

Related labs in other courses

CloudLabBox is independent of Check Point, Cisco, CompTIA, Fortinet, Juniper Networks, MikroTik, Netgate and Palo Alto Networks. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.