Site to Site VPN Fortigate - Cisco ASA, Cisco sees Anti-Replay Attack.

[l33byt]

Our fortigate 1000c - v5.0,build0228 (GA Patch 4) Was upgraded from version 4.0 last week. We have a VPN to a Cisco ASA which is not managed by us. The party from the remote peer reported that they needed to turn off anti-replay checks on the ASA because it was seen that the fortigate was attacking it. I have attached the Cisco information. %ASA-4-402119: IPSEC: Received an ESP packet (SPI= 0xEDA2CA6E, sequence number= 0x8CC) from A.A.A.A (user= A.A.A.A) to B.B.B.B that failed anti-replay checking. %ASA-4-402119: IPSEC: Received an ESP packet (SPI= 0xEDA2CA6E, sequence number= 0x8CD) from A.A.A.A (user= A.A.A.A) to B.B.B.B that failed anti-replay checking. %ASA-4-402119: IPSEC: Received an ESP packet (SPI= 0x0E972C69, sequence number= 0x12EC) from A.A.A.A (user= A.A.A.A) to B.B.B.B that failed anti-replay checking. %ASA-4-402119: IPSEC: Received an ESP packet (SPI= 0x0E972C69, sequence number= 0x12ED) from A.A.A.A (user= A.A.A.A) to B.B.B.B that failed anti-replay checking. %ASA-4-402119: IPSEC: Received an ESP packet (SPI= 0x0E972C69, sequence number= 0x12EE) from A.A.A.A (user= A.A.A.A) to B.B.B.B that failed anti-replay checking. %ASA-4-402119: IPSEC: Received an ESP packet (SPI= 0x0E972C69, sequence number= 0x12EF) from A.A.A.A (user= A.A.A.A) to B.B.B.B that failed anti-replay checking. %ASA-4-402119: IPSEC: Received an ESP packet (SPI= 0x0E972C69, sequence number= 0x12F0) from A.A.A.A (user= A.A.A.A) to B.B.B.B that failed anti-replay checking. why is the fortigate doing this?

[Silver]

Dear L33byt, Can you tell what type of vpn you have been using to setup it with cisco ASA. Is it policy base or route base ipsec vpn. I am asking you because i need to setup my fortigate with another to remote sites which they are using cisco ASA. awaiting your reply.

[Silver]

Any input plz for my question

[emnoc]

I have some input. 1st off the problem is cisco and not the firewall and 2nd I hate ASA , they cause me to much grief :) your fix; DAL01SETX(config)# crypto ipsec security-association replay ? configure mode commands/options: disable Disable replay checking window-size Set replay window size Or let me correct that, their fix is to increase the window replay size.

[Ramesh_M]

Hi, In order to resolve this error, use the crypto ipsec security-association replay window-size command in order to vary the window size. hostname(config)#crypto ipsec security-association replay window-size 1024 Note: Cisco recommends that you use the full 1024 window size to eliminate any anti-replay problems. Usage Guidelines Cisco IPsec authentication provides anti-replay protection against an attacker duplicating encrypted packets by assigning a unique sequence number to each encrypted packet. (Security association anti-replay is a security service in which the receiver can reject old or duplicate packets to protect itself against replay attacks.) The decryptor checks off the sequence numbers that it has seen before. The encryptor assigns sequence numbers in an increasing order. The decryptor remembers the value X of the highest sequence number that it has already seen. N is the window size, and the decryptor also remembers whether it has seen packets having sequence numbers from X-N+1 through X. Any packet with the sequence number X-N is discarded. Currently, N is set at 64, so only 64 packets can be tracked by the decryptor. At times, however, the 64-packet window size is not sufficient. For example, QoS gives priority to high-priority packets, which could cause some low-priority packets to be discarded even though they could be one of the last 64 packets received by the decryptor; this event can generate warning syslog messages that are false alarms. The crypto ipsec security-association replay command lets you expand the window size, allowing the decryptor to keep track of more than 64 packets. Increasing the anti-replay window size has no impact on throughput and security. The impact on memory is insignificant because only an extra 128 bytes per incoming IPsec SA is needed to store the sequence number on the decryptor. It is recommended that you use the full 1024 window size to eliminate any future anti-replay problems.