Home / server / Questions / 312291
Accepted
longneck
Asked: 2011-09-17 09:52:38 +0800 CST

"All IKE SA proposals found unacceptable!", but what was proposed?

  • 772

I'm trying to get VPN working between various devices and a Cisco ASA 5520 running 7.2(1). When trying to connect with a Mac running OX X 10.5.8, I keep getting this error: On the ASA it says:

Sep 16 13:44:02 [IKEv1 DEBUG]: Group = <redacted>, IP = <redacted>, All SA proposals found unacceptable
Sep 16 13:44:02 [IKEv1]: IP = <redacted>, All IKE SA proposals found unacceptable!

How can I tell what the Mac is asking for that the ASA will not provide?

vpn mac-osx cisco-asa

1 Answers

  1. Best Answer

    I don't think there is a way to see what proposal an incoming device attempted. Even 'debug isakmp 99' on the ASA will not reveal this. However I believe the default phase 1 settings for Apple devices would be 3DES/SHA-1/DH2, so on your ASA you would need to configure something similar to...

    crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400

    and you'll need to enable nat-t if you haven't already:

    crypto isakmp nat-traversal 3600

    This document on the Cisco website covers L2Tp over IPSEC and has a little section on iPhone and MAC OS X compatibility

    • 3