Troubleshooting Cisco IPSec Site to Site VPN - "QM Rejected"

There was a VPN issue to troubleshoot recently. It was between Juniper SRX and Cisco Router. It seems straightforward but it took quite a long time to troubleshoot because of communication. All steps listed here for my future reference.

Some other related posts:

• Troubleshooting Cisco IPSec Site to Site VPN - "reason: Unknown delete reason!" after Phase 1 Completed
• Troubleshooting Cisco IPSec Site to Site VPN - "IPSec policy invalidated proposal with error 32"
• Troubleshooting Cisco IPSec Site to Site VPN - "QM Rejected"

Diagram

1. Enabled Debugging on Cisco IOS Router

vpn-R1#debug crypto ipsec
Crypto IPSEC debugging is on

vpn-R1#debug crypto isakmp
Crypto ISAKMP debugging is on

vpn-R1#debug crypto engine
Crypto Engine debugging is on

vpn-R1#terminal monitor

2. Debugging results
It shows invalidated proposal and ISAKMP deleted node with reason "QM rejected"

003345: Sep  5 10:49:31.279 EDT: ISAKMP (1060): received packet from 20.20.34.50 dport 500 sport 500 Global (R) QM_IDLE      
003346: Sep  5 10:49:31.279 EDT: ISAKMP: set new node 1450843075 to QM_IDLE      
003347: Sep  5 10:49:31.279 EDT: ISAKMP:(1060): processing HASH payload. message ID = 1450843075
003348: Sep  5 10:49:31.279 EDT: ISAKMP:(1060): processing SA payload. message ID = 1450843075
003349: Sep  5 10:49:31.279 EDT: ISAKMP:(1060):Checking IPSec proposal 1
003350: Sep  5 10:49:31.279 EDT: ISAKMP: transform 0, ESP_3DES
003351: Sep  5 10:49:31.279 EDT: ISAKMP:   attributes in transform:
003352: Sep  5 10:49:31.279 EDT: ISAKMP:      authenticator is HMAC-SHA
003353: Sep  5 10:49:31.279 EDT: ISAKMP:      group is 2
003354: Sep  5 10:49:31.279 EDT: ISAKMP:      SA life type in seconds
003355: Sep  5 10:49:31.279 EDT: ISAKMP:      SA life duration (VPI) of  0x0 0x0 0xE 0x10 
003356: Sep  5 10:49:31.279 EDT: ISAKMP:      encaps is 1 (Tunnel)
003357: Sep  5 10:49:31.279 EDT: ISAKMP:(1060):atts are acceptable.
003358: Sep  5 10:49:31.279 EDT: IPSEC(validate_proposal_request): proposal part #1
003359: Sep  5 10:49:31.279 EDT: IPSEC(validate_proposal_request): proposal part #1,
  (key eng. msg.) INBOUND local= 200.153.121.58:0, remote= 20.20.34.50:0,
    local_proxy= 10.9.106.18/255.255.255.255/256/0,
    remote_proxy= 10.21.51.128/255.255.255.255/256/0,
    protocol= ESP, transform= esp-3des esp-sha-hmac  (Tunnel), 
    lifedur= 0s and 0kb, 
    spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x0


003361: Sep  5 10:49:31.279 EDT: Crypto mapdb : proxy_match
 src addr     : 10.9.106.18
 dst addr     : 10.21.51.128
 protocol     : 0
 src port     : 0
 dst port     : 0
.......
003369: Sep  5 10:49:31.283 EDT: map_db_find_best did not find matching map
003370: Sep  5 10:49:31.283 EDT: IPSEC(ipsec_process_proposal): proxy identities not supported
003371: Sep  5 10:49:31.283 EDT: ISAKMP:(1060): IPSec policy invalidated proposal with error 32
003372: Sep  5 10:49:31.283 EDT: ISAKMP:(1060): phase 2 SA policy not acceptable! (local 20.15.121.58 remote 20.20.34.50)
003373: Sep  5 10:49:31.283 EDT: ISAKMP: set new node -2087949406 to QM_IDLE      
003374: Sep  5 10:49:31.283 EDT: ISAKMP:(1060):Sending NOTIFY PROPOSAL_NOT_CHOSEN protocol 3
 spi 739556696, message ID = 2207017890
003375: Sep  5 10:49:31.283 EDT: ISAKMP:(1060): sending packet to 20.20.34.50 my_port 500 peer_port 500 (R) QM_IDLE      
003376: Sep  5 10:49:31.283 EDT: ISAKMP:(1060):Sending an IKE IPv4 Packet.
003377: Sep  5 10:49:31.283 EDT: ISAKMP:(1060):purging node -2087949406
003378: Sep  5 10:49:31.283 EDT: ISAKMP:(1060):deleting node 1450843075 error TRUE reason "QM rejected"
003379: Sep  5 10:49:31.283 EDT: ISAKMP:(1060):Node 1450843075, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
vpn-router#
003380: Sep  5 10:49:31.283 EDT: ISAKMP:(1060):Old State = IKE_QM_READY  New State = IKE_QM_READY

003382: Sep  5 10:50:21.284 EDT: ISAKMP:(1060):purging node 1450843075

3. Checking configuration

Cisco Router's crypto map

vpn-router#show crypto map 
 Interfaces using crypto map NiStTeSt1:

Crypto Map IPv4 "vpn" 20 ipsec-isakmp
 Description: VPN to C
 Peer = 20.20.34.50
 Extended IP access list C-VPN-List
     access-list C-VPN-List permit ip host 10.9.106.18 host 10.1.254.19
 Current peer: 20.20.34.50
 Security association lifetime: 4608000 kilobytes/3600 seconds
 Responder-Only (Y/N): N
 PFS (Y/N): Y
 DH group:  group2
 Mixed-mode : Disabled
 Transform sets={ 
  Conductor:  { esp-3des esp-sha-hmac  } , 
 }

Peer Juniper SRX 550 configuraiton:

set interfaces st0 unit 22 description Cisco-R
set security ike policy ike-policy-Cisco-R mode main
set security ike policy ike-policy-Cisco-R proposals ike-proposal-Padrao
set security ike policy ike-policy-Cisco-R pre-shared-key ascii-text "$APfTz0O"
set security ike gateway ike-gate-Cisco-R ike-policy ike-policy-Cisco-R
set security ike gateway ike-gate-Cisco-R address 20.15.121.58
set security ike gateway ike-gate-Cisco-R remote-identity inet 20.15.121.58
set security ike gateway ike-gate-Cisco-R external-interface reth0.0
set security ipsec vpn ipsec-vpn-Cisco-R bind-interface st0.22
set security ipsec vpn ipsec-vpn-Cisco-R ike gateway ike-gate-Cisco-R
set security ipsec vpn ipsec-vpn-Cisco-R ike proxy-identity local 10.21.51.128/32
set security ipsec vpn ipsec-vpn-Cisco-R ike proxy-identity remote 10.9.106.18/32
set security ipsec vpn ipsec-vpn-Cisco-R ike proxy-identity service any
set security ipsec vpn ipsec-vpn-Cisco-R ike ipsec-policy ipsec-policy-P
set security ipsec vpn ipsec-vpn-Cisco-R establish-tunnels immediately




set security ike proposal ike-proposal-P authentication-method pre-shared-keys
set security ike proposal ike-proposal-P dh-group group2
set security ike proposal ike-proposal-P authentication-algorithm sha1
set security ike proposal ike-proposal-P encryption-algorithm 3des-cbc
set security ike proposal ike-proposal-P lifetime-seconds 28800


set security ipsec policy ipsec-policy-P perfect-forward-secrecy keys group2
set security ipsec policy ipsec-policy-P proposals ipsec-proposal-Padrao
set security ipsec proposal ipsec-proposal-P protocol esp
set security ipsec proposal ipsec-proposal-P authentication-algorithm hmac-sha1-96
set security ipsec proposal ipsec-proposal-P encryption-algorithm 3des-cbc
set security ipsec proposal ipsec-proposal-P lifetime-seconds 3600

Cisco IOS Router 1900 Configuration:

crypto isakmp policy 2
encr 3des
authentication pre-share
group 2
lifetime 28800
!


crypto isakmp key 76tyYuty!2@ address 20.13.194.17
!crypto isakmp aggressive-mode disable

crypto ipsec transform-set C esp-3des esp-sha-hmac
mode tunnel


crypto map vpn 20 ipsec-isakmp
description VPN to C
set peer 20.20.34.50
set transform-set Conductor
set pfs group2
match address C-VPN-List


ip access-list extended C-VPN-List
permit ip host 10.9.106.18 host 10.1.254.19

interface GigabitEthernet0/0
ip address 20.15.121.58 255.255.255.248
duplex auto
speed auto
crypto map vpn

Solution:
It clearly shows access-list not matching on both end. Juniper SRX has a NAT from 10.1.254.19 to 10.21.51.128. Cisco router only knows their Internal IP 10.1.254.19. Once Cisco router changed access-list to match Juniper. Tunnel is up right away.