IPSec VPN RTBE88U

[UXinG]

IPsec VPN not working on ASUS RT-BE88U

I would appreciate your help with the following issue.

I have been using an ASUS RT-BE88U router for approximately one year, but I have been unable to establish an IPsec VPN connection. I never experienced this problem with my previous ASUS routers, but I cannot get it working on the RT-BE88U.

So far, I have tried the following:

• Connecting from within my local network and externally using my phone’s 5G connection.

• Temporarily disabling the router’s firewall.

• Manually opening the required VPN ports.

• Running the VPN server on my NAS and forwarding the relevant ports to the NAS.

None of these options has worked. It appears that the RT-BE88U is not actually opening the IPsec/VPN ports, or that the VPN traffic is being blocked somewhere. Even when I forward the ports to another device or router, I still cannot establish a connection from outside my network.

Has anyone experienced this issue with the RT-BE88U? Are there any specific settings, known firmware issues, or other tips I could try? I feel that I have already gone through almost all of the usual troubleshooting steps.

Thank you in advance for your help.

[jzchen]

Set it up as you've done with prior ASUS routers, submit a Feedback log.  Describe the problem and time/date of failed connection attempt.  In about 1 - 2 weeks try the connection again, even without a firmware being published/released.

[UXinG]

Sep 12 08:10:15 01[NET] received packet: from 147.185.132.46[52407] to 212.92.82.249[4500] (296 bytes)
Sep 12 08:10:15 01[ENC] parsed IKE_SA_INIT request 0 [ SA KE No ]
Sep 12 08:10:15 01[IKE] 147.185.132.46 is initiating an IKE_SA
Sep 12 08:10:15 01[CFG] selected proposal: IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
Sep 12 08:10:15 01[IKE] sending cert request for "C=TW, O=ASUS, CN=ASUS RT-BE88U-1620 Root CA"
Sep 12 08:10:15 01[ENC] generating IKE_SA_INIT response 0 [ SA KE No CERTREQ N(CHDLESS_SUP) N(MULT_AUTH) V ]
Sep 12 08:10:15 01[NET] sending packet: from 212.92.82.249[4500] to 147.185.132.46[52407] (309 bytes)
Sep 12 08:10:45 05[JOB] deleting half open IKE_SA with 147.185.132.46 after timeout
Sep 12 08:11:21 06[NET] received packet: from 147.185.132.46[57950] to 212.92.82.249[4500] (596 bytes)
Sep 12 08:11:21 06[ENC] parsed IKE_SA_INIT request 0 [ SA KE No ]
Sep 12 08:11:21 06[IKE] 147.185.132.46 is initiating an IKE_SA
Sep 12 08:11:21 06[CFG] selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
Sep 12 08:11:21 06[IKE] sending cert request for "C=TW, O=ASUS, CN=ASUS RT-BE88U-1620 Root CA"
Sep 12 08:11:21 06[ENC] generating IKE_SA_INIT response 0 [ SA KE No CERTREQ N(CHDLESS_SUP) N(MULT_AUTH) V ]
Sep 12 08:11:21 06[NET] sending packet: from 212.92.82.249[4500] to 147.185.132.46[57950] (437 bytes)
Sep 12 08:11:51 07[JOB] deleting half open IKE_SA with 147.185.132.46 after timeout
Sep 12 08:16:17 05[NET] received packet: from 192.168.1.6[500] to 212.92.82.249[500] (848 bytes)
Sep 12 08:16:17 05[ENC] parsed ID_PROT request 0 [ SA V V V V V V V V V V V V V V ]
Sep 12 08:16:17 05[IKE] received NAT-T (RFC 3947) vendor ID
Sep 12 08:16:17 05[IKE] received draft-ietf-ipsec-nat-t-ike vendor ID
Sep 12 08:16:17 05[IKE] received draft-ietf-ipsec-nat-t-ike-08 vendor ID
Sep 12 08:16:17 05[IKE] received draft-ietf-ipsec-nat-t-ike-07 vendor ID
Sep 12 08:16:17 05[IKE] received draft-ietf-ipsec-nat-t-ike-06 vendor ID
Sep 12 08:16:17 05[IKE] received draft-ietf-ipsec-nat-t-ike-05 vendor ID
Sep 12 08:16:17 05[IKE] received draft-ietf-ipsec-nat-t-ike-04 vendor ID
Sep 12 08:16:17 05[IKE] received draft-ietf-ipsec-nat-t-ike-03 vendor ID
Sep 12 08:16:17 05[IKE] received draft-ietf-ipsec-nat-t-ike-02 vendor ID
Sep 12 08:16:17 05[IKE] received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
Sep 12 08:16:17 05[IKE] received XAuth vendor ID
Sep 12 08:16:17 05[IKE] received Cisco Unity vendor ID
Sep 12 08:16:17 05[IKE] received FRAGMENTATION vendor ID
Sep 12 08:16:17 05[IKE] received DPD vendor ID
Sep 12 08:16:17 05[IKE] 192.168.1.6 is initiating a Main Mode IKE_SA
Sep 12 08:16:17 05[CFG] selected proposal: IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
Sep 12 08:16:17 05[ENC] generating ID_PROT response 0 [ SA V V V V V ]
Sep 12 08:16:17 05[NET] sending packet: from 212.92.82.249[500] to 192.168.1.6[500] (180 bytes)
Sep 12 08:16:17 01[NET] received packet: from 192.168.1.6[500] to 212.92.82.249[500] (228 bytes)
Sep 12 08:16:17 01[ENC] parsed ID_PROT request 0 [ KE No NAT-D NAT-D ]
Sep 12 08:16:17 01[ENC] generating ID_PROT response 0 [ KE No NAT-D NAT-D ]
Sep 12 08:16:17 01[NET] sending packet: from 212.92.82.249[500] to 192.168.1.6[500] (244 bytes)
Sep 12 08:16:17 06[NET] received packet: from 192.168.1.6[500] to 212.92.82.249[500] (108 bytes)
Sep 12 08:16:17 06[ENC] invalid ID_V1 payload length, decryption failed?
Sep 12 08:16:17 06[ENC] could not decrypt payloads
Sep 12 08:16:17 06[IKE] message parsing failed
Sep 12 08:16:17 06[ENC] generating INFORMATIONAL_V1 request 1859980451 [ HASH N(PLD_MAL) ]
Sep 12 08:16:17 06[NET] sending packet: from 212.92.82.249[500] to 192.168.1.6[500] (76 bytes)
Sep 12 08:16:17 06[IKE] ID_PROT request with message ID 0 processing failed
Sep 12 08:16:28 07[NET] received packet: from 178.230.110.60[28037] to 212.92.82.249[500] (848 bytes)
Sep 12 08:16:28 07[ENC] parsed ID_PROT request 0 [ SA V V V V V V V V V V V V V V ]
Sep 12 08:16:28 07[IKE] received NAT-T (RFC 3947) vendor ID
Sep 12 08:16:28 07[IKE] received draft-ietf-ipsec-nat-t-ike vendor ID
Sep 12 08:16:28 07[IKE] received draft-ietf-ipsec-nat-t-ike-08 vendor ID
Sep 12 08:16:28 07[IKE] received draft-ietf-ipsec-nat-t-ike-07 vendor ID
Sep 12 08:16:28 07[IKE] received draft-ietf-ipsec-nat-t-ike-06 vendor ID
Sep 12 08:16:28 07[IKE] received draft-ietf-ipsec-nat-t-ike-05 vendor ID
Sep 12 08:16:28 07[IKE] received draft-ietf-ipsec-nat-t-ike-04 vendor ID
Sep 12 08:16:28 07[IKE] received draft-ietf-ipsec-nat-t-ike-03 vendor ID
Sep 12 08:16:28 07[IKE] received draft-ietf-ipsec-nat-t-ike-02 vendor ID
Sep 12 08:16:28 07[IKE] received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
Sep 12 08:16:28 07[IKE] received XAuth vendor ID
Sep 12 08:16:28 07[IKE] received Cisco Unity vendor ID
Sep 12 08:16:28 07[IKE] received FRAGMENTATION vendor ID
Sep 12 08:16:28 07[IKE] received DPD vendor ID
Sep 12 08:16:28 07[IKE] 178.230.110.60 is initiating a Main Mode IKE_SA
Sep 12 08:16:28 07[CFG] selected proposal: IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
Sep 12 08:16:28 07[ENC] generating ID_PROT response 0 [ SA V V V V V ]
Sep 12 08:16:28 07[NET] sending packet: from 212.92.82.249[500] to 178.230.110.60[28037] (180 bytes)
Sep 12 08:16:28 05[NET] received packet: from 178.230.110.60[28037] to 212.92.82.249[500] (228 bytes)
Sep 12 08:16:28 05[ENC] parsed ID_PROT request 0 [ KE No NAT-D NAT-D ]
Sep 12 08:16:28 05[IKE] remote host is behind NAT
Sep 12 08:16:28 05[ENC] generating ID_PROT response 0 [ KE No NAT-D NAT-D ]
Sep 12 08:16:28 05[NET] sending packet: from 212.92.82.249[500] to 178.230.110.60[28037] (244 bytes)
Sep 12 08:16:28 01[NET] received packet: from 178.230.110.60[28102] to 212.92.82.249[4500] (108 bytes)
Sep 12 08:16:28 01[ENC] invalid ID_V1 payload length, decryption failed?
Sep 12 08:16:28 01[ENC] could not decrypt payloads
Sep 12 08:16:28 01[IKE] message parsing failed
Sep 12 08:16:28 01[ENC] generating INFORMATIONAL_V1 request 3753807788 [ HASH N(PLD_MAL) ]
Sep 12 08:16:28 01[NET] sending packet: from 212.92.82.249[500] to 178.230.110.60[28037] (76 bytes)
Sep 12 08:16:28 01[IKE] ID_PROT request with message ID 0 processing failed
Sep 12 08:16:47 05[JOB] deleting half open IKE_SA with 192.168.1.6 after timeout
Sep 12 08:16:58 07[JOB] deleting half open IKE_SA with 178.230.110.60 after timeout

[UXinG]

ik looks like the asus doesn't accept the UDP packets