CLIENT-TO-SITE VPN

Similar Questions

• Using Cisco Client to site VPN on a behind a NAT ASA 5520

  I apologize if this has been asked and we answered in the forums.  I looked, and while I found a large number of entries that were dancing all around this question, I never found nothing which addressed this specific issue.   We currently use an ASA 5520 as the head end of a relatively large customer to site IPSEC VPN (approximately 240 users, not consecutively).   This ASA is currently sitting behind a Checkpoint firewall with a real publicly addressable IP address on its public interface.  All of our customers use the legacy Cisco VPN (not the one anyconnect) client.  We plan to a few controllers F5 link set up between ISPS and firewalls.   For VPN connectivity F5 recommends that we NAT IP address (called a broad IP) to point back to a private IP address on the ASA and F5.  My question is, will this work?   I've always heard say that the head of line needed to have a public IP address on this subject because this is what will be placed in packages for the client to respond to.

  For further information, here's what we have now and what we are invited to attend.

  Current

  ISP - router - firewall-fire - ASA (public IP address as endpoint)

  Proposed

  ISP - router - F5 (public IP address as endpoint using a NAT to ASA) - Firewall - ASA (10.X.X.X as its external interface)

  Proposed alternative

  ISP - router - F5 (public IP address as endpoint using a NAT to ASA) - ASA (10.X.X.X as its external interface)

  All thoughts at this moment would be greatly appreciated.   Thank you!

  Hello

  If there is a static NAT one by one on F5 to the external interface of the ASA, then I don't think they would be any problems.
  Because when the client will attempt to connect to IKE to the translated public IP, F5 will redirect the request to ASA outside interface that is configured for the VPN.

  In addition, to ensure the udp500, 4500 and esp is allowed and then you should be good to go.

  HTH

  Concerning
  Mohit

• Unable to connect to the client to site VPN

  Hello

  Suddenly this morning I couldn't connect to the VPN from my work. I did not update the operating system or any other application in my Mac. I checked with my VPN provider and all is well. I tried to connect to the VPN from another PC and the connection was successful.

  It of weird, can you help me on this?

  Thank you

  My Info:

  OS X El Capitan

  Version 10.11.6 (15-1004)

  Error log:

  7 September 11:17:57 racoon Gerards-MacBook-Pro [680]: agreed to the takeover of vpn connection.

  7 September 11:17:57 racoon Gerards-MacBook-Pro [680]: IPSec to connect to the server 50.57.56.150

  7 September 11:17:57 racoon Gerards-MacBook-Pro [680]: connection.

  7 September 11:17:57 racoon Gerards-MacBook-Pro [680]: IPSec Phase 1 started (initiated by me).

  7 September 11:17:57 racoon Gerards-MacBook-Pro [680]: IKE Packet: forward the success. (Initiator, Aggressive Mode 1 message).

  7 September 11:17:57 racoon Gerards-MacBook-Pro [680]: > > > > > status of phase change = Phase 1 began by us

  7 September 11:17:57 racoon Gerards-MacBook-Pro [680]: no message must be encrypted, 0x14a1, side 0 status

  7 September 11:17:57 racoon Gerards-MacBook-Pro [680]: IPSec to connect to the server 50.57.56.150

  7 September 11:17:57 racoon Gerards-MacBook-Pro [680]: connection.

  7 September 11:17:57 racoon Gerards-MacBook-Pro [680]: IPSec Phase 1 started (initiated by me).

  7 September 11:17:57 racoon Gerards-MacBook-Pro [680]: IKE Packet: forward the success. (Initiator, Aggressive Mode 1 message).

  7 September 11:17:57 racoon Gerards-MacBook-Pro [680]: > > > > > status of phase change = Phase 1 began by us

  7 September 11:17:57 racoon Gerards-MacBook-Pro [680]: port 62465 anticipated, but 0

  7 September 11:17:57 racoon Gerards-MacBook-Pro [680]: IKEv1 Phase 1 AUTH: success. (Initiator, aggressive-Mode Message 2).

  7 September 11:17:57 racoon Gerards-MacBook-Pro [680]: > > > > > status of phase change = Phase 1 began with a peer

  7 September 11:17:57 racoon Gerards-MacBook-Pro [680]: IKE Packet: receive a success. (Initiator, Aggressive Mode 2 message).

  7 September 11:17:57 racoon Gerards-MacBook-Pro [680]: initiating IKEv1 Phase 1: success. (Initiator, aggressive Mode).

  7 September 11:17:57 racoon Gerards-MacBook-Pro [680]: IKE Packet: forward the success. (Initiator, Aggressive Mode 3 message).

  7 September 11:17:57 racoon Gerards-MacBook-Pro [680]: IPSec Phase 1 established (initiated by me).

  7 September 11:18:05 racoon Gerards-MacBook-Pro [680]!: jumped to retransmit the frags: frag_flags 1, r-> sendbuf-> l 136, max 1280

  7 September 11:18:05 racoon Gerards-MacBook-Pro [680]: retransmitted packet received from the 50.57.56.150 [500].

  7 September 11:18:05 racoon Gerards-MacBook-Pro [680]: the packet is retransmitted by 50.57.56.150 [500].

  7 September 11:18:13 racoon Gerards-MacBook-Pro [680]!: jumped to retransmit the frags: frag_flags 1, r-> sendbuf-> l 136, max 1280

  7 September 11:18:13 racoon Gerards-MacBook-Pro [680]: retransmitted packet received from the 50.57.56.150 [500].

  7 September 11:18:13 racoon Gerards-MacBook-Pro [680]: the packet is retransmitted by 50.57.56.150 [500].

  7 September 11:18:21 racoon Gerards-MacBook-Pro [680]!: jumped to retransmit the frags: frag_flags 1, r-> sendbuf-> l 136, max 1280

  7 September 11:18:21 racoon Gerards-MacBook-Pro [680]: retransmitted packet received from the 50.57.56.150 [500].

  7 September 11:18:21 racoon Gerards-MacBook-Pro [680]: the packet is retransmitted by 50.57.56.150 [500].

  7 September 11:18:27 racoon Gerards-MacBook-Pro [680]: IPSec disconnection from the server 50.57.56.150

  7 September 11:18:27 racoon Gerards-MacBook-Pro [680]: IKE Packet: forward the success. (Information message).

  7 September 11:18:27 racoon Gerards-MacBook-Pro [680]: IKEv1-Information Notice: pass success. (Delete the ISAKMP Security Association).

  7 September 11:18:27 racoon Gerards-MacBook-Pro [680]: glob found no match for the path "/ var/run/racoon/*.conf".

  7 September 11:18:27 racoon Gerards-MacBook-Pro [680]: IPSec disconnection from the server 50.57.56.150

  September 7 11:18:27 Gerards-MacBook-Pro UserNotificationCenter [682]: * ATTENTION: the method in the class userSpaceScaleFactor NSWindow is discouraged on 10.7 and later versions. It should not be used in new applications. Use convertRectToBacking: instead.

  7 September 11:18:29 racoon Gerards-MacBook-Pro [680]: connection.

  7 September 11:18:29 racoon Gerards-MacBook-Pro [680]: unknown information exchange has received.

  Establish a virtual private network connection-

• How to control the activity of the client-to-site (IPSEC ASA)

  I have a client to site VPN configuration on my 5505 according to directives of the Chapter35 of the ASA8.x configuration guide.

  One thing I am not sure about is how can I control what VPN users can connect to? I see nothing in the config that binds inside the interface so that prevents them to connect to the DMZ as well? How to limit connectivity so they can only connect to a host on the inside? or a host on the inside and the other on the DMZ?

  Thank you

  According to me, is what you're looking for.

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a0080641a52.shtml

  It will be useful.

• Client VPN router IOS, and site to site vpn

  Hello

  Im trying to configure a vpn client access to an ios router that already has a vpn site-to site running. I don't see how the two can run on the same router.

  So I guess my question is is it possible? and if anyone has therefore had a config that they can share or a useful link.

  IM using a router 800 series with 12.4 ios

  Thank you very much

  Colin

  ReadersUK wrote:
  Hi
  Im trying to configure access for a vpn client to a ios router that already has a site to site vpn running. I cant see how both can be running on the same router.
  So i guess my question is can this be done? and if so has anyone got a config they can share or a useful link.
  im using a 800 series router with 12.4 ios
  Many thanks
  Colin
  

  Colin

  It can be done. Look at this config example that shows a router configured with a site to site VPN and client vpn - connection

  https://www.Cisco.com/en/us/Tech/tk583/TK372/technologies_configuration_example09186a0080094685.shtml

  Jon

• IPSec site to site VPN cisco VPN client routing problem and

  Hello

  I'm really stuck with the configuration of ipsec site to site vpn (hub to spoke, multiple rays) with cisco vpn remote client access to this vpn.

  The problem is with remote access - cisco vpn client access - I can communicate with hub lan - but I need also communication of all lans speaks of the cisco vpn client.

  There are on the shelves, there is no material used cisco - routers DLINK.

  Someone told me that it is possible to use NAT to translate remote access IP-lan-HUB customers and thus allow communication - but I'm unable to set up and operate.

  Can someone help me please?

  Thank you

  Peter

  RAYS - not cisco devices / another provider

  Cisco 1841 HSEC HUB:

  crypto ISAKMP policy 1

  BA 3des

  preshared authentication

  Group 2

  ISAKMP crypto key x xx address no.-xauth

  !

  the group x crypto isakmp client configuration

  x key

  pool vpnclientpool

  ACL 190

  include-local-lan

  !

  86400 seconds, duration of life crypto ipsec security association

  Crypto ipsec transform-set esp-3des esp-sha-hmac 1cisco

  !

  Crypto-map dynamic dynmap 10

  Set transform-set 1cisco

  !

  card crypto ETH0 client authentication list userauthen

  card crypto isakmp authorization list groupauthor ETH0

  client configuration address card crypto ETH0 answer

  ETH0 1 ipsec-isakmp crypto map

  set peer x

  Set transform-set 1cisco

  PFS group2 Set

  match address 180

  card ETH0 10-isakmp ipsec crypto dynamic dynmap

  !

  !

  interface FastEthernet0/1

  Description $ES_WAN$

  card crypto ETH0

  !

  IP local pool vpnclientpool 192.168.200.100 192.168.200.150

  !

  !

  overload of IP nat inside source list LOCAL interface FastEthernet0/1

  !

  IP access-list extended LOCAL

  deny ip 192.168.7.0 0.0.0.255 192.168.1.0 0.0.0.255

  deny ip 192.168.7.0 0.0.0.255 192.168.200.0 0.0.0.255

  IP 192.168.7.0 allow 0.0.0.255 any

  !

  access-list 180 allow ip 192.168.7.0 0.0.0.255 192.168.1.0 0.0.0.255

  access-list 190 allow ip 192.168.7.0 0.0.0.255 192.168.200.0 0.0.0.255

  !

  How the DLINK has been configured for traffic between the site to site VPN subnets? You are able to add multiple remote subnets on DLINK? If you can, then you must add the pool of Client VPN subnet.

  Alternatively, if you cannot add multiple subnet on DLINK router, you can change the pool of Client VPN 192.168.6.0/24, and on the crypto ACL between the site to site VPN, you must edit the 180 existing ACL

  DE:

  access-list 180 allow ip 192.168.7.0 0.0.0.255 192.168.1.0 0.0.0.255

  access-list 180 allow ip 192.168.200.0 0.0.0.255 192.168.1.0 0.0.0.255

  TO:

  access-list 180 allow ip 192.168.6.0 0.0.1.255 192.168.1.0 0.0.0.255

  Also change the ACL 190 split tunnel:

  DE:

  access-list 190 allow ip 192.168.7.0 0.0.0.255 192.168.200.0 0.0.0.255

  access-list 190 allow ip 192.168.1.0 0.0.0.255 192.168.200.0 0.0.0.255

  TO:

  access-list 190 allow ip 192.168.7.0 0.0.0.255 192.168.6.0 0.0.0.255

  access-list 190 allow ip 192.168.1.0 0.0.0.255 192.168.6.0 0.0.0.255

  Finally, replace the remote subnet 192.168.7.0/255.255.255.0 192.168.6.0/255.255.254.0 DLINK.

  Hope that helps.

• Can not pass traffic from the VPN client to remote VPN site to site

  Hello

  I can't get the traffic flowing between my VPN clients and my remote site-to-site VPN, I did step by step in this link:

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a008046f307.shtml

  my firewall says that the package is abandoned by statefull inspection.

  But this should be the command "same-security-traffic..." "this problem must be resolved

  % ASA-6-302020: built ICMP incoming connections for faddr gaddr laddr (nworks) 10.48.100.2/0 10.48.100.2/0 10.45.231.163/1

  % ASA-6-302020: built outgoing ICMP connection for faddr gaddr laddr 10.45.231.163/1 10.45.231.163/1 10.48.100.2/0

  % ASA-6-302021: disassembly ICMP connection for faddr gaddr laddr (nworks) 10.48.100.2/0 10.48.100.2/0 10.45.231.163/1

  % ASA-6-302021: disassembly ICMP connection for faddr gaddr laddr 10.45.231.163/1 10.45.231.163/1 10.48.100.2/0

  Is it all what you might think that I'm missing?

  Best regards

  Erik

  Erik,

  Please check it out because no decaps means the ASA does not what it is the other side of the tunnel.

  If you send traffic and you will see the crypt increment... but nothing in return... 99% sure that the problem is at the other end.

  Federico.

• VPN clients connecting to the site to site VPN

  Hi all

  I'm currently configured my firewall outside interface VPN closing the point for two clients VPN and Cisco VPN site-to-site. What I found is that when I Client VPN, I can't access the devices on the site-to-site VPN. I think that the PIX does not allow this kind of connections, because it requires routing on the same interface. Can someone point me to some docs on ORC who can help me in this situation. Thanks in advance for your help.

  the restriction has been resolved with pix v7, and the related command is "permit same-security-traffic intra-interface".

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a008046f307.shtml

• VPN - PC (vpn client) problem-> router-> (site to site vpn)-> local network

  Hello

  is it possible to install?

  I have a pc and I want to connect to the Remote LAN.

  PC (using vpn client) - vpn (internet)---> ROUTER1 - a vpn (MPLS network)---> ROUTER2---> SERVER site

  How can I connect to a remote server? Is there an easy way?

  I did the configuration of the vpn client (I can connect ROUTER1 and access a LAN via vpn with 192.168.1.x), but I can't connect to the server, even if I set the subnet (192.168.1.x) under the access list of site to site vpn (access list for traffic that must pass between ROUTER1 and ROUTER2).

  Please advise! Thanks in advance.

  Looks like I've not well explained.

  On ROUTER1

  ===================

  1 ACL VNC_acl is used to split tunnel, so you should include IP server_NET it NOT vpn IP pool.

  2 ACL najavorbel is used to set the lan lan traffic between ROUTER1 and ROUTER2, 2 you should inlcude

  IP 192.168.133.0 allow 0.0.0.255 0.0.0.255

  You must change the crypto ROUTER2 ACL of the minor or the najavorbel of the ACL

  The other way to is to the client VPN NAT IP to a local area network lan IP ROUTER1, in this way, you don't need any changes on ROUTER2. But I have to take a look at your configuration to make the suggestion.

• SBS 2008 office1 Serv2008 Office 2 need to share assets between them via a site to site VPN tunnel

  Hi all.

  I really need help on this one.

  The office 1 installer running SBS2008 Office 2 running Server 2008.

  Each firm has its own FQDN Office 1 CompanyABC 2 A_B_C of the company office.

  Each firm has its own internal IP address pool Office 1 192.168.69.xxx and office 192.168.20.xxx 2.

  Site to site VPN tunnel between 2 office routers Netgear SRX5308 1 and 2 Netgear FVS318G Office established and working.

  Each firm has its own DNS server and acts as a domain controller

  How to configure the 2 networks to see each other and be able to use assets on every network (files, printers)?

  Is it so simple that the addition of another pool internal IP for each DNS server?

  Thanks in advance for your help.

  Hello

  Your Question is beyond the scope of this community.

  I suggest that repost you your question in the Forums of SBS.

  https://social.technet.Microsoft.com/forums/en-us/home?Forum=smallbusinessserver

  "Windows Small Business Server 2011 Essentials online help"

  https://msdn.Microsoft.com/en-us/library/home-client.aspx

  TechNet Server forums.

  http://social.technet.Microsoft.com/forums/WindowsServer/en-us/home?category=WindowsServer

  See you soon.

• IPSec Site to Site VPN Solution needed?

  Hi all

  I need a solution to provide full connectivity to one of my clients. I created two IPSEC Site to Site VPN, one between the INFO and RITA and second between NIDA and RITA. I can access RITA machine that is 172.16.36.101 at the INFO and 10.0.0.5 to NIDA.

  Now, I need to give access to my customer INFORMATION to direct NIDA 10.0.0.5 without established VPN machine to NIDA 10.0.0.5 of 172.16.36.101 access.

  Could you please give me the solution how is that possible?

  Concerning

  Uzair Hussain

  Hi uzair.infotech,

  Looks like you need to set up a grouping between the 3 sites, at the end of that your topology will look like this:

  INFO - RITA - NIDA

  You can check this guide that explains step by step how to configure grouping:

  https://supportforums.Cisco.com/document/12752536/how-configure-site-sit...

  Hope this info helps!

  Note If you help!

  -JP-

• Troubleshooting IPSec Site to Site VPN between ASA and 1841

  Hi all

  in the past I've implemented several VPN connections between the devices of the SAA. So I thought a site link between an ASA site and 1841 would be easier... But it seems I was mistaken.

  I configured a VPN Site to Site, as it has been described in the Document ID: SDM 110198: IPsec Site to Site VPN between ASA/PIX and an example of IOS Router Configuration (I have not used SDM but CCP).

  I have run the wizards on the ASA with ASDM and the current IOS version 15.1 1841, with CCP.

  It seems to Phase 1 and 2 are coming although my ASA in ADSM reports (monitoring > VPN > VPN statistics > Sessions) a tunnel established with some of the Tx traffic but 0 Rx traffic),

  On the ASA:

  Output of the command: "sh crypto ipsec its peer 217.xx.yy.zz.

  address of the peers: 217.86.154.120
  Crypto map tag: VPN-OUTSIDE, seq num: 2, local addr: 62.aa.bb.cc

  access extensive list ip 192.168.37.0 outside_2_cryptomap_1 allow 255.255.255.0 172.20.2.0 255.255.255.0
  local ident (addr, mask, prot, port): (LAN-A/255.255.255.0/0/0)
  Remote ident (addr, mask, prot, port): (LAN-G/255.255.255.0/0/0)
  current_peer: 217.xx.yy.zz

  #pkts program: 400, #pkts encrypt: 400, #pkts digest: 400
  #pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0
  compressed #pkts: 0, unzipped #pkts: 0
  #pkts uncompressed: 400, comp #pkts failed: 0, #pkts Dang failed: 0
  success #frag before: 0, failures before #frag: 0, #fragments created: 0
  Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
  #send errors: 0, #recv errors: 0

  local crypto endpt. : 62.aa.bb.cc, remote Start crypto. : 217.xx.yy.zz

  Path mtu 1500, fresh ipsec generals 58, media, mtu 1500
  current outbound SPI: 39135054
  current inbound SPI: B2E9E500

  SAS of the esp on arrival:
  SPI: 0xB2E9E500 (3001672960)
  transform: esp-3des esp-sha-hmac no compression
  running parameters = {L2L, Tunnel, PFS 2 group}
  slot: 0, id_conn: 100327424, crypto-map: VPN-OUTSIDE
  calendar of his: service life remaining (KB/s) key: (4374000/1598)
  Size IV: 8 bytes
  support for replay detection: Y
  Anti-replay bitmap:
  0x00000000 0x00000001
  outgoing esp sas:
  SPI: 0 x 39135054 (957567060)
  transform: esp-3des esp-sha-hmac no compression
  running parameters = {L2L, Tunnel, PFS 2 group}
  slot: 0, id_conn: 100327424, crypto-map: VPN-OUTSIDE
  calendar of his: service life remaining (KB/s) key: (4373976/1598)
  Size IV: 8 bytes
  support for replay detection: Y
  Anti-replay bitmap:
  0x00000000 0x00000001

  Output of the command: "sh crypto isakmp his."

  HIS active: 4
  Generate a new key SA: 0 (a tunnel report Active 1 and 1 to generate a new key during the generate a new key)
  Total SA IKE: 4

  IKE Peer: 217.xx.yy.zz
  Type: L2L role: initiator
  Generate a new key: no State: MM_ACTIVE

  On the 1841

  1841 crypto isakmp #sh its
  IPv4 Crypto ISAKMP Security Association
  DST CBC conn-State id
  217.86.154.120 62.153.156.163 QM_IDLE 1002 ACTIVE

  1841 crypto ipsec #sh its

  Interface: Dialer1
  Tag crypto map: SDM_CMAP_1, local addr 217.86.154.120

  protégé of the vrf: (none)
  local ident (addr, mask, prot, port): (172.20.2.0/255.255.255.0/0/0)
  Remote ident (addr, mask, prot, port): (192.168.37.0/255.255.255.0/0/0)
  current_peer 62.153.156.163 port 500
  LICENCE, flags is {origin_is_acl},
  #pkts program: encrypt 0, #pkts: 0, #pkts digest: 0
  #pkts decaps: 585, #pkts decrypt: 585, #pkts check: 585
  compressed #pkts: 0, unzipped #pkts: 0
  #pkts uncompressed: 0, #pkts compr. has failed: 0
  #pkts not unpacked: 0, #pkts decompress failed: 0
  Errors #send 0, #recv 0 errors

  local crypto endpt. : 217.86.154.120, remote Start crypto. : 62.153.156.163
  Path mtu 1452, ip mtu 1452, ip mtu BID Dialer1
  current outbound SPI: 0xB2E9E500 (3001672960)
  PFS (Y/N): Y, Diffie-Hellman group: group2

  SAS of the esp on arrival:
  SPI: 0 x 39135054 (957567060)
  transform: esp-3des esp-sha-hmac.
  running parameters = {Tunnel}
  Conn ID: 2003, flow_id: FPGA:3, sibling_flags 80000046, card crypto: SDM_CMAP_1
  calendar of his: service life remaining (k/s) key: (4505068/1306)
  Size IV: 8 bytes
  support for replay detection: Y
  Status: ACTIVE

  the arrival ah sas:

  SAS of the CFP on arrival:

  outgoing esp sas:
  SPI: 0xB2E9E500 (3001672960)
  transform: esp-3des esp-sha-hmac.
  running parameters = {Tunnel}
  Conn ID: 2004, flow_id: FPGA:4, sibling_flags 80000046, card crypto: SDM_CMAP_1
  calendar of his: service life remaining (k/s) key: (4505118/1306)
  Size IV: 8 bytes
  support for replay detection: Y
  Status: ACTIVE

  outgoing ah sas:

  outgoing CFP sas:

  Interface: virtual Network1
  Tag crypto map: SDM_CMAP_1, local addr 217.86.154.120

  protégé of the vrf: (none)
  local ident (addr, mask, prot, port): (172.20.2.0/255.255.255.0/0/0)
  Remote ident (addr, mask, prot, port): (192.168.37.0/255.255.255.0/0/0)
  current_peer 62.153.156.163 port 500
  LICENCE, flags is {origin_is_acl},
  #pkts program: encrypt 0, #pkts: 0, #pkts digest: 0
  #pkts decaps: 585, #pkts decrypt: 585, #pkts check: 585
  compressed #pkts: 0, unzipped #pkts: 0
  #pkts uncompressed: 0, #pkts compr. has failed: 0
  #pkts not unpacked: 0, #pkts decompress failed: 0
  Errors #send 0, #recv 0 errors

  local crypto endpt. : 217.86.154.120, remote Start crypto. : 62.153.156.163
  Path mtu 1452, ip mtu 1452, ip mtu BID Dialer1
  current outbound SPI: 0xB2E9E500 (3001672960)
  PFS (Y/N): Y, Diffie-Hellman group: group2

  SAS of the esp on arrival:
  SPI: 0 x 39135054 (957567060)
  transform: esp-3des esp-sha-hmac.
  running parameters = {Tunnel}
  Conn ID: 2003, flow_id: FPGA:3, sibling_flags 80000046, card crypto: SDM_CMAP_1
  calendar of his: service life remaining (k/s) key: (4505068/1306)
  Size IV: 8 bytes
  support for replay detection: Y
  Status: ACTIVE

  the arrival ah sas:

  SAS of the CFP on arrival:

  outgoing esp sas:
  SPI: 0xB2E9E500 (3001672960)
  transform: esp-3des esp-sha-hmac.
  running parameters = {Tunnel}
  Conn ID: 2004, flow_id: FPGA:4, sibling_flags 80000046, card crypto: SDM_CMAP_1
  calendar of his: service life remaining (k/s) key: (4505118/1306)
  Size IV: 8 bytes
  support for replay detection: Y
  Status: ACTIVE

  outgoing ah sas:

  outgoing CFP sas:

  It seems that the routing on the 1841 is working properly as I can tear down the tunnel and relaunch in scathing a host on the network of 1841, but not vice versa.

  Trounleshoot VPN of the 1841 report shows a message like "the following sources are forwarded through the interface card crypto.      (172.20.2.0 1) go to "Configure-> routing" and correct the routing table.

  I have not found an error on the 1841 config so if one of the guys reading this thread has an idea I appreciate highly suspicion!

  It's the running of the 1841 configuration

  !
  version 15.1
  horodateurs service debug datetime msec
  Log service timestamps datetime msec
  encryption password service
  !
  host name 1841
  !
  boot-start-marker
  start the system flash c1841-adventerprisek9 - mz.151 - 1.T.bin
  boot-end-marker
  !
  logging buffered 51200 notifications
  !
  AAA new-model
  !
  !
  AAA authentication login default local
  !
  AAA - the id of the joint session
  !
  iomem 20 memory size
  clock timezone PCTime 1
  PCTime of summer time clock day March 30, 2003 02:00 October 26, 2003 03:00
  dot11 syslog
  IP source-route
  !
  No dhcp use connected vrf ip
  !
  IP cef
  no ip bootp Server
  IP domain name test
  name of the IP-server 194.25.2.129
  name of the IP-server 194.25.2.130
  name of the IP-server 194.25.2.131
  name of the IP-server 194.25.2.132
  name of the IP-server 194.25.2.133
  No ipv6 cef
  !
  Authenticated MultiLink bundle-name Panel
  !
  !
  object-group network phone
  VoIP phone description
  Home 172.20.2.50
  Home 172.20.2.51
  !
  redundancy
  !
  !
  controller LAN 0/0/0
  atm mode
  Annex symmetrical shdsl DSL-mode B
  !
  !
  crypto ISAKMP policy 1
  BA 3des
  preshared authentication
  Group 2
  isakmp encryption key * address 62.aa.bb.cc
  !
  !
  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
  !
  map SDM_CMAP_1 1 ipsec-isakmp crypto
  Description Tunnel to62.aa.bb.cc
  the value of 62.aa.bb.cc peer
  game of transformation-ESP-3DES-SHA
  PFS group2 Set
  match address 100
  !
  !
  !
  interface FastEthernet0/0
  DMZ description $ FW_OUTSIDE$
  10.10.10.254 IP address 255.255.255.0
  IP nat inside
  IP virtual-reassembly
  automatic duplex
  automatic speed
  !
  interface FastEthernet0/1
  Description $ETH - LAN$ $FW_INSIDE$
  IP 172.20.2.254 255.255.255.0
  IP access-group 100 to
  IP nat inside
  IP virtual-reassembly
  IP tcp adjust-mss 1412
  automatic duplex
  automatic speed
  !
  ATM0/0/0 interface
  no ip address
  No atm ilmi-keepalive
  !
  point-to-point interface ATM0/0/0.1
  PVC 1/32
  PPPoE-client dial-pool-number 1
  !
  !
  interface Dialer1
  Description $FW_OUTSIDE$
  the negotiated IP address
  IP mtu 1452
  NAT outside IP
  IP virtual-reassembly
  encapsulation ppp
  Dialer pool 1
  Dialer-Group 2
  PPP authentication chap callin pap
  PPP chap hostname xxxxxxx
  PPP chap password 7 xxxxxxx8
  PPP pap sent-name of user password xxxxxxx xxxxxxx 7
  map SDM_CMAP_1 crypto
  !
  IP forward-Protocol ND
  IP http server
  local IP http authentication
  IP http secure server
  !
  !
  The dns server IP
  IP nat inside source static tcp 10.10.10.1 808 interface Dialer1 80
  IP nat inside source static tcp 10.10.10.1 25 25 Dialer1 interface
  IP nat inside source overload map route SDM_RMAP_1 interface Dialer1
  IP nat inside source overload map route SDM_RMAP_2 interface Dialer1
  IP route 0.0.0.0 0.0.0.0 Dialer1 permanent
  !
  logging trap notifications
  Note category of access list 1 = 2 CCP_ACL
  access-list 1 permit 172.20.2.0 0.0.0.255
  Note access-list category 2 CCP_ACL = 2
  access-list 2 allow 10.10.10.0 0.0.0.255
  Note access-list 100 category CCP_ACL = 4
  Note access-list 100 IPSec rule
  access-list 100 permit ip 172.20.2.0 0.0.0.255 192.168.37.0 0.0.0.255
  Note CCP_ACL the access list 101 = 2 category
  Note access-list 101 IPSec rule
  access-list 101 deny ip 172.20.2.0 0.0.0.255 192.168.37.0 0.0.0.255
  access-list 101 permit ip 172.20.2.0 0.0.0.255 any
  Note access-list 102 CCP_ACL category = 2
  Note access-list 102 IPSec rule
  access-list 102 deny ip 172.20.2.0 0.0.0.255 192.168.37.0 0.0.0.255
  access-list 102 permit ip 10.10.10.0 0.0.0.255 any
  !

  !
  allowed SDM_RMAP_1 1 route map
  corresponds to the IP 101
  !
  allowed SDM_RMAP_2 1 route map
  corresponds to the IP 102
  !
  !
  control plan
  !
  !
  Line con 0
  line to 0
  line vty 0 4
  length 0
  transport input telnet ssh
  !
  Scheduler allocate 20000 1000
  NTP-Calendar Update
  NTP 172.20.2.250 Server prefer
  end

  As I mentioned previously: suspicion is much appreciated!

  Best regards

  Joerg

  Joerg,

  ASA receives not all VPN packages because IOS does not send anything.

  Try to send packets to the 1841 LAN to LAN of the ASA and see is the "sh cry ips its" on the 1841 increments the encrypted packets (there not)

  The problem seems so on the side of the router.

  I think that is a routing problem, but you only have one default gateway (no other channels on the router).

  The ACL 100 is set to encrypt the traffic between the two subnets.

  It seems that the ACL 101 is also bypassing NAT for VPN traffic.

  Follow these steps:

  Try running traffic of LAN router inside IP (source of ping 192.168.37.x 172.20.2.254) and see if the packages are not through the translation and obtaining encrypted.

  I would also like to delete 100 ACL from the inside interface on the router because it is used for the VPN. You can create an another ACL to apply to the interface.

  Federico.

• SA520w routing through site-to-site VPN tunnels

  I have several offices that are connected using site-to-site VPN tunnels and all will use the SA520W (firmware 2.1.18). I currently have 3 routers in place, router tunnels created for the router B and c of router. I need assistance with the configuration to allow the guests to router site B get to the router site C. I have attempted to add a static route, but get a destination unreachable host trying to ping. Also, if I connect to the router site has via the Cisco VPN client, I'm not able to get resources on each site, B, or C.

  A - the site 10.10.0.0/24

  Site B - 10.0.0.0/24

  Site of the C - 10.25.0.0/24

  Any help is greatly appreciated.

  So, that's what you have configured correctly?

  RTR_A

  ||

  _____________ || ___________

  ||                                            ||

  RTR_B                                RTR_C

  Since there is no tunnel between B and C there is no way for us past that traffic through RTR_A for two reasons. The most important reason is that subnet 10.25.0.0/24 (rtr_c) is not allowed to pass through the IPSec tunnel (it's okay to IPSec?) of rtr_a ==> rtr_b. You can't just add a statement of road because your addresses are not routable which is the reason why it fails.

  Your only option is to create another tunnel between rtr_b and rtr_c. This may not be the ONLY option, but you should get what you need.

  I hope this helps.

• Site to Site VPN tunnel is not come between 2 routers

  Dear all,

  I have 2 routers for branch which is configured for VPN site-to-site, but the tunnel does not come!

  I ran debug and I enclose herwith output for your kind review and recommendation. I also enclose here the 2 routers configs branch.

  Any idea on why the Site to site VPN is not coming?

  Kind regards

  Haitham

  You guessed it!

  Just because you have re-used the same card encryption for LAN to LAN and vpn-client traffic.

  This from the DOC CD

  No.-xauth

  (Optional) Use this keyword if the router to router IP Security (IPSec) is on the same card encryption as a virtual private network (VPN) - client - to-Cisco-IOS IPSec. This keyword prevents the router causing the peer for the information of extended authentication (Xauth) (username and password).

• 887VDSL2 IPSec site to site vpn does NOT use the easy vpn

  Much of community support.

  as I'm looking through the config Guide about 870 router series, only to find information about the config with eazy vpn.

  is there a classic way, about 870 Series site 2 site without eazy vpn IPSec configuration?

  Have a classic way if a tunnel? Have the 870 is not as a vpn client?

  Thank you

  Of course, here's example of Site to Site VPN configuration for your reference:

  http://www.Cisco.com/en/us/Tech/tk583/TK372/technologies_configuration_example09186a0080194650.shtml

  http://www.Cisco.com/en/us/products/HW/routers/ps221/products_configuration_example09186a008073e078.shtml

  Hope that helps.