Creating a site to site VPN

Similar Questions

• How to create several site VPN on Cisco 2801

  Hello

  We use 2801 to our VPN needs. We have already configured a VPN site-to site inside. My current scenario is to create several VPN IE at different sites and a remote client VPN server for our road warriors (they use a cisco VPN client to connect).

  Let me know how can I achieve that scenario. Currently we have in VPN profiling in place. can I fill the script using VPN profiles, how it can be used. Kindly advice me at the earliest.

  Please find attached the 2801 direct configuration file, which is quite works very well

  Thanks in advance.

  Djamel.

  Djamel

  As much as I know it does no harm to have political isakmp 9 and isakmp 10 with the same parameters in each of them. But it also is not good. Others that extra isakmp policy I don't see anything that seems problematic in the config you have posted.

  HTH

  Rick

• Question creating a site to site vpn

  I am trying to configure a site to site vpn to test and through http://www.ciscosecrets.info/en/US/products/ps6120/products_configuration_example09186a0080950890.shtml still unable to establish a connection.  I have attached the config for both the 5520's that I use.   What Miss me.

  Try this if you are pinging from the ASA

  management-access inside

• Site to Site VPN on AZURE

  I have a VPN site-to-site existing on Azure and Azure a new subnet created on the local network that must be able to reach.

  I added the new subnet within azure for the VPN and add a static route on the RRAS server win 2012 for routing.

  On the initial installation of a RRAS-Site VPN site (I didn't configure it) I think the interesting traffic specified must be sent through the VPN Tunnel, but I knew how to specify the new subnet via RRAS, I don't want to delete and re-create the VPN Site to Site.

  Y at - there anyone who can help please.

  Thank you

  Philippe

  Hello

  Your question is beyond the scope of this community.

  I suggest that repost you on the Azure MSDN Forums:

  https://social.msdn.Microsoft.com/forums/azure/en-us/home?category=windowsazureplatform

  TechNet forums Azure:

  https://social.technet.Microsoft.com/forums/azure/en-us/home?category=windowsazureplatform

  TechNet Server forums.

  http://social.technet.Microsoft.com/forums/WindowsServer/en-us/home?category=WindowsServer

  TechNet forums:

  https://social.technet.Microsoft.com/forums/en-us/home

  MSDN forums:

  https://social.msdn.Microsoft.com/forums/en-us/home

  See you soon.

• IPSec Site to Site VPN Solution needed?

  Hi all

  I need a solution to provide full connectivity to one of my clients. I created two IPSEC Site to Site VPN, one between the INFO and RITA and second between NIDA and RITA. I can access RITA machine that is 172.16.36.101 at the INFO and 10.0.0.5 to NIDA.

  Now, I need to give access to my customer INFORMATION to direct NIDA 10.0.0.5 without established VPN machine to NIDA 10.0.0.5 of 172.16.36.101 access.

  Could you please give me the solution how is that possible?

  Concerning

  Uzair Hussain

  Hi uzair.infotech,

  Looks like you need to set up a grouping between the 3 sites, at the end of that your topology will look like this:

  INFO - RITA - NIDA

  You can check this guide that explains step by step how to configure grouping:

  https://supportforums.Cisco.com/document/12752536/how-configure-site-sit...

  Hope this info helps!

  Note If you help!

  -JP-

• site to site VPN

  SH running-config crypto

  I have the following configuration, in order to create a site to site vpn which should not be changed in the configuration below.

  Do I need to add new card crypto?

  And what is the dynamic-map

  I need to create new ipsec transform-set or can I use the existing?

  Crypto ipsec transform-set esp-3des esp-sha-hmac ikev1 remoteaccess

  Crypto ipsec transform-set esp-3des esp-sha-hmac L2Lvpn ikev1

  Crypto ipsec kilobytes of life - safety 999608000 association

  Crypto ipsec pmtu aging infinite - the security association

  Crypto-map dynamic Test 1 set pfs Group1

  Crypto-map dynamic Test 1 set transform-set remoteaccess L2Lvpn ikev1

  Crypto-map dynamic 1jeu reverse-Road Test

  card crypto Test 1-isakmp ipsec dynamic test

  Test interface card crypto outside

  Crypto ca trustpoint _SmartCallHome_ServerCA

  Configure CRL

  Crypto ca trustpoint ASDM_TrustPoint0

  Terminal registration

  name of the object CN = TestFW

  Configure CRL

  trustpool crypto ca policy

  crypto isakmp identity address

  Crypto ikev1 allow outside

  IKEv1 crypto policy 1

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 10800

  IKEv1 crypto policy 10

  preshared authentication

  3des encryption

  md5 hash

  Group 2

  life 1800

  IKEv1 crypto policy 65535

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 1800

  tunnel-group x.x.x.x type ipsec-l2l

  tunnel-group ipsec-attributes x.x.x.x

  IKEv1 pre-shared-key *.

  Thank you

  bluesea2010,

  Next step will be sending real traffic, or just run a package Tracker to ensure that traffic flows very well:

  entry Packet-trace within the icmp 192.168.15.x 8 0 172.10.10.x detail

  If all goes well, you should be good to go.

  Hope this info helps!

  Note If you help!

  -JP-

• Troubleshooting IPSec Site to Site VPN between ASA and 1841

  Hi all

  in the past I've implemented several VPN connections between the devices of the SAA. So I thought a site link between an ASA site and 1841 would be easier... But it seems I was mistaken.

  I configured a VPN Site to Site, as it has been described in the Document ID: SDM 110198: IPsec Site to Site VPN between ASA/PIX and an example of IOS Router Configuration (I have not used SDM but CCP).

  I have run the wizards on the ASA with ASDM and the current IOS version 15.1 1841, with CCP.

  It seems to Phase 1 and 2 are coming although my ASA in ADSM reports (monitoring > VPN > VPN statistics > Sessions) a tunnel established with some of the Tx traffic but 0 Rx traffic),

  On the ASA:

  Output of the command: "sh crypto ipsec its peer 217.xx.yy.zz.

  address of the peers: 217.86.154.120
  Crypto map tag: VPN-OUTSIDE, seq num: 2, local addr: 62.aa.bb.cc

  access extensive list ip 192.168.37.0 outside_2_cryptomap_1 allow 255.255.255.0 172.20.2.0 255.255.255.0
  local ident (addr, mask, prot, port): (LAN-A/255.255.255.0/0/0)
  Remote ident (addr, mask, prot, port): (LAN-G/255.255.255.0/0/0)
  current_peer: 217.xx.yy.zz

  #pkts program: 400, #pkts encrypt: 400, #pkts digest: 400
  #pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0
  compressed #pkts: 0, unzipped #pkts: 0
  #pkts uncompressed: 400, comp #pkts failed: 0, #pkts Dang failed: 0
  success #frag before: 0, failures before #frag: 0, #fragments created: 0
  Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
  #send errors: 0, #recv errors: 0

  local crypto endpt. : 62.aa.bb.cc, remote Start crypto. : 217.xx.yy.zz

  Path mtu 1500, fresh ipsec generals 58, media, mtu 1500
  current outbound SPI: 39135054
  current inbound SPI: B2E9E500

  SAS of the esp on arrival:
  SPI: 0xB2E9E500 (3001672960)
  transform: esp-3des esp-sha-hmac no compression
  running parameters = {L2L, Tunnel, PFS 2 group}
  slot: 0, id_conn: 100327424, crypto-map: VPN-OUTSIDE
  calendar of his: service life remaining (KB/s) key: (4374000/1598)
  Size IV: 8 bytes
  support for replay detection: Y
  Anti-replay bitmap:
  0x00000000 0x00000001
  outgoing esp sas:
  SPI: 0 x 39135054 (957567060)
  transform: esp-3des esp-sha-hmac no compression
  running parameters = {L2L, Tunnel, PFS 2 group}
  slot: 0, id_conn: 100327424, crypto-map: VPN-OUTSIDE
  calendar of his: service life remaining (KB/s) key: (4373976/1598)
  Size IV: 8 bytes
  support for replay detection: Y
  Anti-replay bitmap:
  0x00000000 0x00000001

  Output of the command: "sh crypto isakmp his."

  HIS active: 4
  Generate a new key SA: 0 (a tunnel report Active 1 and 1 to generate a new key during the generate a new key)
  Total SA IKE: 4

  IKE Peer: 217.xx.yy.zz
  Type: L2L role: initiator
  Generate a new key: no State: MM_ACTIVE

  On the 1841

  1841 crypto isakmp #sh its
  IPv4 Crypto ISAKMP Security Association
  DST CBC conn-State id
  217.86.154.120 62.153.156.163 QM_IDLE 1002 ACTIVE

  1841 crypto ipsec #sh its

  Interface: Dialer1
  Tag crypto map: SDM_CMAP_1, local addr 217.86.154.120

  protégé of the vrf: (none)
  local ident (addr, mask, prot, port): (172.20.2.0/255.255.255.0/0/0)
  Remote ident (addr, mask, prot, port): (192.168.37.0/255.255.255.0/0/0)
  current_peer 62.153.156.163 port 500
  LICENCE, flags is {origin_is_acl},
  #pkts program: encrypt 0, #pkts: 0, #pkts digest: 0
  #pkts decaps: 585, #pkts decrypt: 585, #pkts check: 585
  compressed #pkts: 0, unzipped #pkts: 0
  #pkts uncompressed: 0, #pkts compr. has failed: 0
  #pkts not unpacked: 0, #pkts decompress failed: 0
  Errors #send 0, #recv 0 errors

  local crypto endpt. : 217.86.154.120, remote Start crypto. : 62.153.156.163
  Path mtu 1452, ip mtu 1452, ip mtu BID Dialer1
  current outbound SPI: 0xB2E9E500 (3001672960)
  PFS (Y/N): Y, Diffie-Hellman group: group2

  SAS of the esp on arrival:
  SPI: 0 x 39135054 (957567060)
  transform: esp-3des esp-sha-hmac.
  running parameters = {Tunnel}
  Conn ID: 2003, flow_id: FPGA:3, sibling_flags 80000046, card crypto: SDM_CMAP_1
  calendar of his: service life remaining (k/s) key: (4505068/1306)
  Size IV: 8 bytes
  support for replay detection: Y
  Status: ACTIVE

  the arrival ah sas:

  SAS of the CFP on arrival:

  outgoing esp sas:
  SPI: 0xB2E9E500 (3001672960)
  transform: esp-3des esp-sha-hmac.
  running parameters = {Tunnel}
  Conn ID: 2004, flow_id: FPGA:4, sibling_flags 80000046, card crypto: SDM_CMAP_1
  calendar of his: service life remaining (k/s) key: (4505118/1306)
  Size IV: 8 bytes
  support for replay detection: Y
  Status: ACTIVE

  outgoing ah sas:

  outgoing CFP sas:

  Interface: virtual Network1
  Tag crypto map: SDM_CMAP_1, local addr 217.86.154.120

  protégé of the vrf: (none)
  local ident (addr, mask, prot, port): (172.20.2.0/255.255.255.0/0/0)
  Remote ident (addr, mask, prot, port): (192.168.37.0/255.255.255.0/0/0)
  current_peer 62.153.156.163 port 500
  LICENCE, flags is {origin_is_acl},
  #pkts program: encrypt 0, #pkts: 0, #pkts digest: 0
  #pkts decaps: 585, #pkts decrypt: 585, #pkts check: 585
  compressed #pkts: 0, unzipped #pkts: 0
  #pkts uncompressed: 0, #pkts compr. has failed: 0
  #pkts not unpacked: 0, #pkts decompress failed: 0
  Errors #send 0, #recv 0 errors

  local crypto endpt. : 217.86.154.120, remote Start crypto. : 62.153.156.163
  Path mtu 1452, ip mtu 1452, ip mtu BID Dialer1
  current outbound SPI: 0xB2E9E500 (3001672960)
  PFS (Y/N): Y, Diffie-Hellman group: group2

  SAS of the esp on arrival:
  SPI: 0 x 39135054 (957567060)
  transform: esp-3des esp-sha-hmac.
  running parameters = {Tunnel}
  Conn ID: 2003, flow_id: FPGA:3, sibling_flags 80000046, card crypto: SDM_CMAP_1
  calendar of his: service life remaining (k/s) key: (4505068/1306)
  Size IV: 8 bytes
  support for replay detection: Y
  Status: ACTIVE

  the arrival ah sas:

  SAS of the CFP on arrival:

  outgoing esp sas:
  SPI: 0xB2E9E500 (3001672960)
  transform: esp-3des esp-sha-hmac.
  running parameters = {Tunnel}
  Conn ID: 2004, flow_id: FPGA:4, sibling_flags 80000046, card crypto: SDM_CMAP_1
  calendar of his: service life remaining (k/s) key: (4505118/1306)
  Size IV: 8 bytes
  support for replay detection: Y
  Status: ACTIVE

  outgoing ah sas:

  outgoing CFP sas:

  It seems that the routing on the 1841 is working properly as I can tear down the tunnel and relaunch in scathing a host on the network of 1841, but not vice versa.

  Trounleshoot VPN of the 1841 report shows a message like "the following sources are forwarded through the interface card crypto.      (172.20.2.0 1) go to "Configure-> routing" and correct the routing table.

  I have not found an error on the 1841 config so if one of the guys reading this thread has an idea I appreciate highly suspicion!

  It's the running of the 1841 configuration

  !
  version 15.1
  horodateurs service debug datetime msec
  Log service timestamps datetime msec
  encryption password service
  !
  host name 1841
  !
  boot-start-marker
  start the system flash c1841-adventerprisek9 - mz.151 - 1.T.bin
  boot-end-marker
  !
  logging buffered 51200 notifications
  !
  AAA new-model
  !
  !
  AAA authentication login default local
  !
  AAA - the id of the joint session
  !
  iomem 20 memory size
  clock timezone PCTime 1
  PCTime of summer time clock day March 30, 2003 02:00 October 26, 2003 03:00
  dot11 syslog
  IP source-route
  !
  No dhcp use connected vrf ip
  !
  IP cef
  no ip bootp Server
  IP domain name test
  name of the IP-server 194.25.2.129
  name of the IP-server 194.25.2.130
  name of the IP-server 194.25.2.131
  name of the IP-server 194.25.2.132
  name of the IP-server 194.25.2.133
  No ipv6 cef
  !
  Authenticated MultiLink bundle-name Panel
  !
  !
  object-group network phone
  VoIP phone description
  Home 172.20.2.50
  Home 172.20.2.51
  !
  redundancy
  !
  !
  controller LAN 0/0/0
  atm mode
  Annex symmetrical shdsl DSL-mode B
  !
  !
  crypto ISAKMP policy 1
  BA 3des
  preshared authentication
  Group 2
  isakmp encryption key * address 62.aa.bb.cc
  !
  !
  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
  !
  map SDM_CMAP_1 1 ipsec-isakmp crypto
  Description Tunnel to62.aa.bb.cc
  the value of 62.aa.bb.cc peer
  game of transformation-ESP-3DES-SHA
  PFS group2 Set
  match address 100
  !
  !
  !
  interface FastEthernet0/0
  DMZ description $ FW_OUTSIDE$
  10.10.10.254 IP address 255.255.255.0
  IP nat inside
  IP virtual-reassembly
  automatic duplex
  automatic speed
  !
  interface FastEthernet0/1
  Description $ETH - LAN$ $FW_INSIDE$
  IP 172.20.2.254 255.255.255.0
  IP access-group 100 to
  IP nat inside
  IP virtual-reassembly
  IP tcp adjust-mss 1412
  automatic duplex
  automatic speed
  !
  ATM0/0/0 interface
  no ip address
  No atm ilmi-keepalive
  !
  point-to-point interface ATM0/0/0.1
  PVC 1/32
  PPPoE-client dial-pool-number 1
  !
  !
  interface Dialer1
  Description $FW_OUTSIDE$
  the negotiated IP address
  IP mtu 1452
  NAT outside IP
  IP virtual-reassembly
  encapsulation ppp
  Dialer pool 1
  Dialer-Group 2
  PPP authentication chap callin pap
  PPP chap hostname xxxxxxx
  PPP chap password 7 xxxxxxx8
  PPP pap sent-name of user password xxxxxxx xxxxxxx 7
  map SDM_CMAP_1 crypto
  !
  IP forward-Protocol ND
  IP http server
  local IP http authentication
  IP http secure server
  !
  !
  The dns server IP
  IP nat inside source static tcp 10.10.10.1 808 interface Dialer1 80
  IP nat inside source static tcp 10.10.10.1 25 25 Dialer1 interface
  IP nat inside source overload map route SDM_RMAP_1 interface Dialer1
  IP nat inside source overload map route SDM_RMAP_2 interface Dialer1
  IP route 0.0.0.0 0.0.0.0 Dialer1 permanent
  !
  logging trap notifications
  Note category of access list 1 = 2 CCP_ACL
  access-list 1 permit 172.20.2.0 0.0.0.255
  Note access-list category 2 CCP_ACL = 2
  access-list 2 allow 10.10.10.0 0.0.0.255
  Note access-list 100 category CCP_ACL = 4
  Note access-list 100 IPSec rule
  access-list 100 permit ip 172.20.2.0 0.0.0.255 192.168.37.0 0.0.0.255
  Note CCP_ACL the access list 101 = 2 category
  Note access-list 101 IPSec rule
  access-list 101 deny ip 172.20.2.0 0.0.0.255 192.168.37.0 0.0.0.255
  access-list 101 permit ip 172.20.2.0 0.0.0.255 any
  Note access-list 102 CCP_ACL category = 2
  Note access-list 102 IPSec rule
  access-list 102 deny ip 172.20.2.0 0.0.0.255 192.168.37.0 0.0.0.255
  access-list 102 permit ip 10.10.10.0 0.0.0.255 any
  !

  !
  allowed SDM_RMAP_1 1 route map
  corresponds to the IP 101
  !
  allowed SDM_RMAP_2 1 route map
  corresponds to the IP 102
  !
  !
  control plan
  !
  !
  Line con 0
  line to 0
  line vty 0 4
  length 0
  transport input telnet ssh
  !
  Scheduler allocate 20000 1000
  NTP-Calendar Update
  NTP 172.20.2.250 Server prefer
  end

  As I mentioned previously: suspicion is much appreciated!

  Best regards

  Joerg

  Joerg,

  ASA receives not all VPN packages because IOS does not send anything.

  Try to send packets to the 1841 LAN to LAN of the ASA and see is the "sh cry ips its" on the 1841 increments the encrypted packets (there not)

  The problem seems so on the side of the router.

  I think that is a routing problem, but you only have one default gateway (no other channels on the router).

  The ACL 100 is set to encrypt the traffic between the two subnets.

  It seems that the ACL 101 is also bypassing NAT for VPN traffic.

  Follow these steps:

  Try running traffic of LAN router inside IP (source of ping 192.168.37.x 172.20.2.254) and see if the packages are not through the translation and obtaining encrypted.

  I would also like to delete 100 ACL from the inside interface on the router because it is used for the VPN. You can create an another ACL to apply to the interface.

  Federico.

• Cisco 3640 to the PIX 501 site 2 site VPN performance specifications.

  I intend on creating a site-2-site VPN in Star configuration with a Cisco 3640 as the hub and PIX 501 at the remote sites. My question is around the plug that I read.

  .

  The specifications for a PIX-501-BUN-K9 tell PIX 501 3DES Bundle (chassis, SW, 10 users, 3DES).

  .

  A question is what really "10 users. Which is the limit of the number of concurrent sessions, I have on the VPN at a given time, or that it means something else?

  .

  I also read the specs say that the Maximum number of VPN tunnels that can support a PIX 501 is 5. Because I'm not going to make a tunnel between the PIX 501 at the remote site and the 3640 on the central site, I think I would be OK. Is that correct or is the max value talk the maximum number of concurrent sessions on the tunnel tunnels?

  .

  Thank you.

  UDP traffic always creates a session in the PIX so that the return traffic will be allowed in. The UDP timeout is 2 minutes but IIRC. If you go around NAT with a statement of "nat 0" should not create an xlate I think.

  The real time is hard to say really, probably around 2 minutes for a UDP-only user, you would probably make a few 'local sho' orders on the PIX to really see for sure however.

• SA520w routing through site-to-site VPN tunnels

  I have several offices that are connected using site-to-site VPN tunnels and all will use the SA520W (firmware 2.1.18). I currently have 3 routers in place, router tunnels created for the router B and c of router. I need assistance with the configuration to allow the guests to router site B get to the router site C. I have attempted to add a static route, but get a destination unreachable host trying to ping. Also, if I connect to the router site has via the Cisco VPN client, I'm not able to get resources on each site, B, or C.

  A - the site 10.10.0.0/24

  Site B - 10.0.0.0/24

  Site of the C - 10.25.0.0/24

  Any help is greatly appreciated.

  So, that's what you have configured correctly?

  RTR_A

  ||

  _____________ || ___________

  ||                                            ||

  RTR_B                                RTR_C

  Since there is no tunnel between B and C there is no way for us past that traffic through RTR_A for two reasons. The most important reason is that subnet 10.25.0.0/24 (rtr_c) is not allowed to pass through the IPSec tunnel (it's okay to IPSec?) of rtr_a ==> rtr_b. You can't just add a statement of road because your addresses are not routable which is the reason why it fails.

  Your only option is to create another tunnel between rtr_b and rtr_c. This may not be the ONLY option, but you should get what you need.

  I hope this helps.

• Site to Site VPN filter

  I've set up a site to site VPN and I can't seem to get the VPN filter works. I've followed this document:

  http://www.Cisco.com/image/gif/paws/99103/PIX-ASA-VPN-filter.PDF

  I created an ACL and created an ACE with only traffic I want to allow. Then, I went to the site to site group policy and apply this filter. However, I can still ping remote network from a customer who should not be allowed. Remote network is 192.168.2.0/24.Here is my partial config:

  permit Test access extended list ip 192.168.2.0 255.255.255.0 192.168.1.2 host
  Trying to deny a range ip extended access list

  Group Policy internal Test
  Test group policy attributes
  value of VPN-Filter Test

  tunnel-group Test_tunnel type ipsec-l2l
  attributes global-tunnel-group Test_tunnel
  Group Policy - by default-Test

  Hello

  First of all I would like to clarify that the group name used for one site to the other tunnel tunnel must be the ip address of the host "at least for the tunnels l2l static" it's tunnel-g were you must apply this "Test" group policy, configuring the filter seems perfect, but you must make sure that you apply the strategy of Group accordingly. Now, once you apply group policy to the correct you have to bounce the tunnel tunnel-g otherwise the new filter will not take effect, you can use the command "erase the crypto ipsec his counterpart x.x.x.x" generate some traffic and bring up the tunnel is again he should have the filter.

  If you apply correctly and bounce the tunnel it will work.

  You can check if the filter is applied with the command "show vpn-sessiondb detail l2l" and find the name of the ACL

  Best regards, please rate.

• Number of site to site VPN

  I have vpn site-to-site on firewall Cyberoam (outside), remote VPN access created the (inside) Firewall ASA.

  the question that I cannot access site to Site Vpn remote access VPN subnet

  See attached drawing

  A likely reason is that you are missing just the following command on the ASA:

   same-security-traffic permit intra-interface

  Or you might miss a NAT exemption from outside to outside.

• question links to site 2 site VPN with authentication cert

  Currently we are accumulate tunnel site-2-site VPN with our client. Usually we use pre-shared key as authentication with other customers without any problems, but it must use authentication cert with her this time. But the question is that our CA is different from theirs. I tried a few times, but he failed. Is it someone please let me know that he must have the certificate issued by the same certification authority to create the VPN tunnel?

  Thank you very much!

  Hello

  You can read this document to get a simple example of setting up a VPN S2S using certificates on an ASA:

  http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a0080aa5be1.shtml

  Basically the sides must have the same certification authority and If there is an intermediate certificate that must be installed also. The ASA 2 will generate a CSR (certificate access code request), now then PKI will create a certificate for both parties, commonly called "certificate of identity".

  Please pass a note and mark as he corrected the post helpful!

  David Castro,

  Kind regards

• Site to site VPN works only on Cisco 881

  I have 2 problems with a cisco 881. The first problem is that Vlan2 (192.168.5.xx) cannot access the internet on the outside. But I know that the router has internet, because I can ping the external ip address. The 2nd problem is that I have a set of site to another upward, but when I test the Site to site I get this error:

  destination of traffic of the tunnel must be channelled through the crypto map interface. The destination following (s) doesn't have a routing entry in the routing table
  192.168.2.0

  I copied the config form this router from another cisco 881 work, where everything works. The only difference is that this router needs a site to site vpn connection.

  My question is how I can get internet on vlan2 and who can I solve the connection to site to site.

  Here's the running configuration:

  Building configuration...

  Current configuration: 12698 bytes
  !
  version 15.3
  horodateurs service debug datetime msec
  Log service timestamps datetime msec
  no password encryption service
  !
  hostname Cisco_881
  !
  boot-start-marker
  boot-end-marker
  !
  AQM-registry-fnf
  !
  logging buffered 51200 warnings
  !
  AAA new-model
  !
  !
  AAA authentication login default local
  AAA authorization exec default local
  AAA authorization network default local
  !
  !
  !
  !
  !
  AAA - the id of the joint session
  !
  Crypto pki trustpoint TP-self-signed-1151531093
  enrollment selfsigned
  name of the object cn = IOS - Self - signed - certificate - 1151531093
  revocation checking no
  rsakeypair TP-self-signed-1151531093
  !
  Crypto pki trustpoint TP-self-signed-2011286623
  enrollment selfsigned
  name of the object cn = IOS - Self - signed - certificate - 2011286623
  revocation checking no
  rsakeypair TP-self-signed-2011286623
  !
  !
  TP-self-signed-1151531093 crypto pki certificate chain
  certificate self-signed 01
  3082022B 30820194 02020101 300 D 0609 2A 864886 F70D0101 05050030 A0030201
  2 060355 04031326 494F532D 53656 C 66 2 AND 536967 6E65642D 43657274 31312F30
  69666963 31313531 35333130 6174652D 3933301E 170 3135 30343031 31363230
  34315A 17 0D 323030 31303130 30303030 305A 3031 06035504 03132649 312F302D
  4F532D53 5369676E 656C662D 43 65727469 66696361 74652 31 31353135 65642D
  33313039 3330819F 300 D 0609 2A 864886 01050003, 818, 0030, 81890281 F70D0101
  8100AC6E E7FA8AFD 9D4E206C 2B23DFC1 990AFDB3 98CD84A7 37697253 A7EF2520
  0C45190E 298B6E9F E2711580 80DCFBFB 05A6A0BA 347B960B D9DA17FC B1543B9D
  FBC048F3 063EBBC5 02391432 F0232A73 EAC7278E 8CB83005 D13A1D47 BEF18198
  A 547469, 2 F65ED0E6 249BF517 1E74117D C94BE542 46EE487D A3843F12 364639B 4
  0B 090203 010001 HAS 3 53305130 1 130101 FF040530 030101FF 301F0603 0F060355
  551 2304 18301680 147996F4 3E6D0EE2 2D9065BB D726137C 2DF42ABE 01301D 06
  03551D0E 04160414 7996F43E 6D0EE22D 9065BBD7 26137C2D F42ABE01 300 D 0609
  2A 864886 F70D0101 8181002A 05050003 677B9BE6 CB60D188 73227C4B 2DC33101
  BD448017 EDEF0296 FF7438A3 4C46519B 144C775F 1429CF06 7DB29F2D EB16EE75
  22100B 63 0D75511A 98DC57DC EF87BED2 1C1635C8 B5352706 3963037A 4E9B739A
  3A1EC9BE 8431BD70 116D3B31 E4A2AC4C 0F934B3F 196AF829 AD537005 6935B 451
  EB31DB3F A9BA6D70 65B70D19 D00158
  quit smoking
  TP-self-signed-2011286623 crypto pki certificate chain
  no ip source route
  !
  !
  !
  !

  !
  DHCP excluded-address IP 10.10.10.1
  DHCP excluded-address IP 192.168.5.1 192.168.5.49
  DHCP excluded-address IP 192.168.5.150 192.168.5.254
  !
  DHCP IP CCP-pool
  import all
  Network 10.10.10.0 255.255.255.248
  default router 10.10.10.1
  Rental 2 0
  !
  IP dhcp Internet pool
  network 192.168.5.0 255.255.255.0
  router by default - 192.168.5.254
  DNS-Server 64.59.135.133 64.59.128.120
  lease 6 0
  !
  !
  !
  no ip domain search
  "yourdomain.com" of the IP domain name
  name of the IP-Server 64.59.135.133
  name of the IP-Server 64.59.128.120
  IP cef
  No ipv6 cef
  !
  !
  !
  !
  !
  Authenticated MultiLink bundle-name Panel
  !
  !
  !
  !
  !
  !
  !
  udi pid C881-K9 sn FTX18438503 standard license
  !
  !
  Archives
  The config log
  hidekeys
  username * privilege 15 secret 5 $1$IBY.$X5/iqYy47a5vAWWuG4/Oa/
  username * secret 5 $1$ 17 ST$ QzJMvQnZ9Q.1y7u0rYXFa0
  username * secret 5 $1$ L4W9$ zBKpawZ3i5nXxwyS9H6Lf1
  !
  !
  !
  !
  !
  no passive ftp ip
  !
  !
  crypto ISAKMP policy 1
  BA aes 256
  preshared authentication
  Group 2
  !
  crypto ISAKMP policy 2
  BA 3des
  preshared authentication
  Group 2
  isakmp encryption key * address 208.98.212.xx
  !
  Configuration group crypto isakmp MPE client
  key *.
  pool VPN_IP_POOL
  ACL 100
  include-local-lan
  10 Max-users
  netmask 255.255.255.0
  banner ^ practive entered the field

  This area is reserved for administrators of control systems.

  If you are here by mistake, please disconnect immediately.

  You have full access to 192.168.125.0 / 0.0.0.255

  Support on continue to start your session.              ^ C
  !
  Configuration group customer crypto isakmp PALL
  key *.
  pool VPN_IP_POOL_PALL
  ACL 101
  include-local-lan
  Max - 1 users
  netmask 255.255.255.0
  banner ^ practive entered the field

  This area is limited to the PALL access only.

  If you are here by mistake, please disconnect immediately.

  You have full access to 192.168.125.0 / 0.0.0.255

  Support on continue to start your session.            ^ C
  ISAKMP crypto profile vpn_isakmp_profile
  game of identity EMT group
  client authentication list default
  Default ISAKMP authorization list
  client configuration address respond
  virtual-model 1
  ISAKMP crypto profile vpn_isakmp_profile_2
  match of group identity PALL
  client authentication list default
  Default ISAKMP authorization list
  client configuration address respond
  virtual-model 2
  !
  !
  Crypto ipsec transform-set esp - aes 256 esp-sha-hmac VPN_TRANSFORM
  tunnel mode
  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
  tunnel mode
  !
  Profile of crypto ipsec VPN_PROFILE_MPE
  Set the security association idle time 3600
  game of transformation-VPN_TRANSFORM
  vpn_isakmp_profile Set isakmp-profile
  !
  Profile of crypto ipsec VPN_PROFILE_PALL
  Set the security association idle time 1800
  game of transformation-VPN_TRANSFORM
  vpn_isakmp_profile_2 Set isakmp-profile
  !
  !
  !
  map SDM_CMAP_1 1 ipsec-isakmp crypto
  Description Tunnel to208.98.212.xx
  the value of 208.98.212.xx peer
  game of transformation-ESP-3DES-SHA
  match address 102
  !
  !
  !
  !
  !
  !
  interface Loopback0
  IP 192.168.40.254 255.255.255.0
  !
  interface FastEthernet0
  no ip address
  !
  interface FastEthernet1
  no ip address
  !
  interface FastEthernet2
  switchport access vlan 2
  no ip address
  !
  interface FastEthernet3
  switchport access vlan 2
  no ip address
  !
  interface FastEthernet4
  IP address 208.98.213.xx 255.255.255.224
  IP access-group 111 to
  NAT outside IP
  IP virtual-reassembly in
  automatic duplex
  automatic speed
  map SDM_CMAP_1 crypto
  !
  type of interface virtual-Template1 tunnel
  IP unnumbered Loopback0
  ipv4 ipsec tunnel mode
  Tunnel VPN_PROFILE_MPE ipsec protection profile
  !
  tunnel type of interface virtual-Template2
  IP unnumbered Loopback0
  ipv4 ipsec tunnel mode
  Tunnel VPN_PROFILE_PALL ipsec protection profile
  !
  interface Vlan1
  Description of control network
  IP 192.168.125.254 255.255.255.0
  IP access-group CONTROL_IN in
  IP access-group out CONTROL_OUT
  IP nat inside
  IP virtual-reassembly in
  IP tcp adjust-mss 1452
  !
  interface Vlan2
  Description Internet network
  IP 192.168.5.254 255.255.255.0
  IP access-group INTERNET_IN in
  IP access-group out INTERNET_OUT
  IP nat inside
  IP virtual-reassembly in
  !
  local IP VPN_IP_POOL 192.168.40.100 pool 192.168.40.150
  local IP VPN_IP_POOL_PALL 192.168.40.151 pool 192.168.40.152
  IP forward-Protocol ND
  IP http server
  23 class IP http access
  local IP http authentication
  IP http secure server
  IP http timeout policy slowed down 60 life 86400 request 10000
  !
  !
  IP nat inside source static tcp 192.168.125.2 25000 25000 FastEthernet4 interface
  IP nat inside source overload map route SDM_RMAP_1 interface FastEthernet4
  IP route 0.0.0.0 0.0.0.0 FastEthernet4 permanent 208.98.236.xx
  !
  CONTROL_IN extended IP access list
  Note the access control
  Note the category CCP_ACL = 17
  allow any host 192.168.125.254 eq non500-isakmp udp
  allow any host 192.168.125.254 eq isakmp udp
  allow any host 192.168.125.254 esp
  allow any host 192.168.125.254 ahp
  IP 192.168.125.0 allow 0.0.0.255 192.168.125.0 0.0.0.255
  Note the VPN access
  IP 192.168.125.0 allow 0.0.0.255 192.168.40.0 0.0.0.255
  Note Access VNC
  permit tcp host 192.168.125.2 eq 25000 one
  Comment by e-mail to WIN911
  permit tcp host 192.168.125.2 any eq smtp
  Note DNS traffic
  permit udp host 192.168.125.2 host 64.59.135.133 eq field
  permit udp host 192.168.125.2 host 64.59.128.120 eq field
  Note Everything Else block
  refuse an entire ip
  CONTROL_OUT extended IP access list
  Note the access control
  IP 192.168.125.0 allow 0.0.0.255 192.168.125.0 0.0.0.255
  Note the VPN access
  ip permit 192.168.40.0 0.0.0.255 192.168.125.0 0.0.0.255
  Note Access VNC
  allow any host 192.168.125.2 eq 25000 tcp
  Comment by e-mail to WIN911
  allow any host 192.168.125.2 eq smtp tcp
  Note DNS responses
  allowed from any host domain eq 192.168.125.2 udp
  Note deny all other traffic
  refuse an entire ip
  INTERNET_IN extended IP access list
  Note Access VNC on VLAN
  allow any host 192.168.125.2 eq 25000 tcp
  Note block all other controls and VPN
  deny ip any 192.168.125.0 0.0.0.255
  deny ip any 192.168.40.0 0.0.0.255
  Note leave all other traffic
  allow an ip
  INTERNET_OUT extended IP access list
  Note a complete outbound Internet access
  allow an ip
  WAN_IN extended IP access list
  allow an ip host 207.229.14.xx
  Note PERMIT ESTABLISHED TCP connections
  allow any tcp smtp created everything eq
  Note ALLOW of DOMAIN CONNECTIONS
  permit udp host 64.59.135.133 eq field all
  permit udp host 64.59.128.120 eq field all
  Note ALLOW ICMP WARNING RETURNS
  allow all all unreachable icmp
  permit any any icmp parameter problem
  allow icmp all a package-too-big
  allow a whole icmp administratively prohibited
  permit icmp any any source-quench
  allow icmp all once exceed
  refuse a whole icmp
  allow an ip
  !
  auto discovering IP sla
  not run cdp
  !
  allowed SDM_RMAP_1 1 route map
  corresponds to the IP 103
  !
  access-list 1 remark out to WAN routing
  Note CCP_ACL the access list 1 = 16 category
  access-list 1 permit 192.168.125.2
  access-list 1 permit 192.168.5.0 0.0.0.255
  Note access-list 23 SSH and HTTP access permissions
  access-list 23 permit 192.168.125.0 0.0.0.255
  access-list 23 permit 192.168.40.0 0.0.0.255
  access-list 23 allow one
  Note access-list 100 VPN traffic
  access-list 100 permit ip 192.168.125.0 0.0.0.255 any
  access-list 100 permit ip 192.168.40.0 0.0.0.255 any
  Note access-list 101 for PALL VPN traffic
  access-list 101 permit ip 192.168.125.0 0.0.0.255 any
  Note access-list 102 CCP_ACL category = 4
  Note access-list 102 IPSec rule
  access-list 102 permit ip 192.168.5.0 0.0.0.255 192.168.2.0 0.0.1.255
  Note access-list 103 CCP_ACL category = 2
  Note access-list 103 IPSec rule
  access-list 103 deny ip 192.168.5.0 0.0.0.255 192.168.2.0 0.0.1.255
  access-list 103 allow ip 192.168.5.0 0.0.0.255 any
  access-list 103 allow the host ip 192.168.125.2 all
  Note access-list 111 CCP_ACL category = 17
  access-list 111 permit udp any host 208.98.213.xx eq non500-isakmp
  access-list 111 permit udp any host 208.98.213.xx eq isakmp
  access-list 111 allow esp any host 208.98.213.xx
  access-list 111 allow ahp any host 208.98.213.xx
  Note access-list 111 IPSec rule
  access-list 111 permit ip 192.168.2.0 0.0.1.255 192.168.5.0 0.0.0.255
  Note access-list 111 IPSec rule
  access-list 111 permit ip 192.168.2.0 0.0.1.255 192.168.4.0 0.0.1.255
  access-list 111 permit udp host 208.98.212.xx host 208.98.213.xx eq non500-isakmp
  access-list 111 permit udp host 208.92.12.xx host 208.92.13.xx eq isakmp
  access-list 111 allow esp host 208.92.12.xx host 208.92.13.xx
  access-list 111 allow ahp host 208.92.12.xx host 208.92.13.xx
  access-list 111 permit icmp any host 208.92.13.xx
  access-list 111 permit tcp any host 208.92.13.xx eq 25000
  access-list 111 permit tcp any host 208.92.13.xx eq 22
  access-list 111 permit tcp any host 208.92.13.xx eq telnet
  access-list 111 permit tcp any host 208.92.13.xx eq www
  !
  !
  !
  control plan
  !
  !
  !
  MGCP behavior considered range tgcp only
  MGCP comedia-role behavior no
  disable the behavior MGCP comedia-check-media-src
  disable the behavior of MGCP comedia-sdp-force
  !
  profile MGCP default
  !
  !
  !
  !
  exec banner ^ C
  % Warning of password expiration.
  -----------------------------------------------------------------------

  Unplug IMMEDIATELY if you are not an authorized user
  ^ C
  !
  Line con 0
  no activation of the modem
  line to 0
  line vty 0 4
  access-class 23 in
  password *.
  transport input telnet ssh
  transportation out all
  line vty 5 15
  access-class 160 in
  password *.
  transport of entry all
  transportation out all
  !
  max-task-time 5000 Planner
  Scheduler allocate 20000 1000
  !
  end

  Thank you.

  It seems that DNS has failed, because it is indeed happened to internet, but it does not work when internet DNS resolution.

  Go ahead and try to ping this 157.166.226.25, and it's on the browser http://157.166.226.25/, CNN.com. Let's try those. Also just in case where to configure a DNS SERVER on your router.

  - http://www.cisco.com/c/en/us/support/docs/ip/domain-name-system-dns/2418...

  Disable any ZBF just in case.

  David Castro,

  Kind regards

• Site to site VPN with router IOS

  I want to create a VPN site-to site on the Internet. On the remote site, aside from the VPN to the head office, there should be no traffic not allowed in internal from the Internet to the network and that there should be no traffic from the internal network to the Internet allowed. The internal network will run a private 192.168.x.x address range.

  I'm going to use a Cisco 2811 router integrated of services on the remote site and this will last an IPSec VPN that will end a hub at Headquarters. I understand that this router has an IOS and IPS firewall built in.

  Would I be right in thinking that because I don't want to have access to the Internet (except VPN) or should I configure IOS firewall features on the router? And there is no point in the configuration of the features IPS wouldn't?

  My thought is that only an entry in list of unique access to deny pi a whole applied inbound to the interface that connects to the Internet would be the best strategy. I think that the command "sysopt connection permit-ipsec" should allow the VPN to form even with the ip address to deny any any ACL (or is it just a Pix command? If Yes, then I have to allow ESP and UDP 500 (ISAKMP) from the public address of the hub at Headquarters to allow the VPN to form wouldn't I?).

  Think I'll probably expand slightly the access list to allow the icmp Protocol, ssh and https traffic from the IP address of firewall seat outside so that I can monitor the remote site and access it safely if the fail VPN.

  And I wouldn't need one access list on the interface connected to the internal network I would like because the range of addresses would be not routable, so they would not be able to initiate connections to the Internet (all the trffic to the remote site is specified under a valuable traffic to bring up the VPN)

  Use one of the IOS Firewall inspect commands or the IPS would be useless and have no effect in this case wouldn't it?

  I really just need to know if the ip address to deny any any ACL on the external interface on the remote site is the best solution (and the simplest), and whether it will be safe.

  We used to use fiewalls Pix for remote VPN site to site, Amazon refuse incoming connections on the external interface by default but now I have been informed that these series 2800 routers will be used later, so I would get my thoughts straight and be able to build safe to do the same work all existing PIX are doing (they are all installed for just the VPN at Headquarters as in) the first paragraph).

  I would like any advice or thoughts on the subject. I don't know there must be a ton of people who put routers for the same purpose.

  Thank you in advance.

  Pete.

  Pete

  I did a lot of implementations site VPN to another using IOS routers. They work very well. Based on my experience I offer these comments and I hope that they will help you:

  -you don't want a list of incoming access on the external interface, but you want more in it than simply refuse an ip. There is no permit-ipsec sysopt connection in IOS so you want to certainly allowed ISAKMP and IPSec/ESP. I suggest that you also want to allow SSH. I would like to allow ICMP but only starting from the address space of the network head end. I do not allow HTTPS since I generally do not allow the http server on the router. If you want HTTPS then certainly enable it. To facilitate the ping and traceroute on the remote I frequently allow icmp echo-reply, timeout and unreachable port from any source.

  -I want to put an inside interface access list. There are certain types of traffic that I don't want to send from the Remote LAN. I have usually refuse any trap SNMP or snmp for LAN devices and refuse out of the local network icmp redirects. I also often configure RPF controls inside interface to catch any device which is misconfigured.

  -If you want to allow SSH when the VPN is not active (and I highly recommend that you do) then you will probably need to configure at least 1 (and maybe more) users and password of the router ID. And you want to configure authentication on the vty use local authentication if the head end authentication server is not available.

  -I'm not clear from your description if you plan to run a dynamic routing via the VPN Protocol. I wish I had a dynamic routing protocol because I want to announce a default route to the remote control via the VPN. I do not locally configure a default route on the remote router. This way if the VPN tunnel is up there is a default route pointing to the tunnel and if the VPN tunnel is not up then there is no local route by default and users on the remote database can not access the Internet. It is a simple and very effective method to ensure that all user traffic must pass through the central site.

  -regarding the routes defined on the remote router, my approach is that I define a static route for the endpoint of the tunnel to allow the tunnel to implement and I set up static routes for the subnet to the head of line I can SSH. And I do not configure other static routes the on the remote router.

  -You probably want to disable cdp on the external interface and also to disable the proxy-arp (and I don't make any ip unreachable).

  -There is frequently a problem when using VPN site-to-site with fragmentation. If a device on the local network sends a frame of maximum size, and then the router needs to add additional headers for IPSec, then the frame is too large and requires fragmentation. I like to use tcp adjust-mss ip to control the chunk size for TCP traffic and avoid any problems with fragmentation.

  -I don't think you want to set up the firewall or IPS from the features of IOS on the 2811.

  I hope that your application is fine and that my suggestions could be useful.

  [edit] after posting my response, I read through your post again and realize that you make to a VPN concentrator. The approach I have proposed on the execution of a routing protocol works for me because I usually have a router IOS in mind. It would not work to connect to a hub.

  HTH

  Rick

• Site to Site VPN configuration does not

  Hello

  I just tried to set up a test site to site VPN. Diagram of arrangement is attached. Router R2 is supposed to act as the 'Internet' to allow connectivity between the two networks.

  My VPN on ASA1 and ASA2 configs are below:

  ASA1

  Note to outside_cryptomap_1 to access list VPN traffic to encrypt
  outside_cryptomap_1 to access extended list ip 10.10.10.0 allow 255.255.255.0 172.16.10.0 255.225.255.0

  Crypto ikev1 allow outside
  IKEv1 crypto policy 1
  preshared authentication
  aes-256 encryption
  sha hash
  Group 5
  life 86400

  tunnel-group 11.11.11.2 type ipsec-l2l
  IPSec-attributes tunnel-Group 11.11.11.2
  Cisco pre-shared key IKEv1

  Crypto ipsec transform-set ikev1 AES - SHA esp-aes-256 esp-sha-hmac
  card crypto outside_map 1 match address outside_cryptomap_1
  peer set card crypto outside_map 1 11.11.11.2
  card crypto outside_map 1 set of transformation-AES-SHA
  outside_map interface card crypto outside

  ASA2

  Note to outside_cryptomap_1 to access list VPN traffic to encrypt
  permit access list extended ip 172.16.10.0 outside_cryptomap_1 255.255.255.0 10.10.10.0 255.225.255.0

  Crypto ikev1 allow outside
  IKEv1 crypto policy 1
  preshared authentication
  aes-256 encryption
  sha hash
  Group 5
  life 86400

  tunnel-group 12.12.12.2 type ipsec-l2l
  IPSec-attributes tunnel-group 12.12.12.2
  Cisco pre-shared key IKEv1

  Crypto ipsec transform-set ikev1 AES - SHA esp-aes-256 esp-sha-hmac
  card crypto outside_map 1 match address outside_cryptomap_1
  peer set card crypto outside_map 1 12.12.12.2
  card crypto outside_map 1 set of transformation-AES-SHA
  outside_map interface card crypto outside

  I can ping with the ASA2 ASA1, but when I try to test the VPN trying from one PC to another, I get nothing.

  I tried a few commands show and they came out absolutely empty... as I have not configured:

  SH in detail its crypto isakmp

  There are no SAs IKEv1

  There are no SAs IKEv2

  SH crypto ipsec his

  There is no ipsec security associations

  Anyone have any ideas?

  Hi martin,

  Your configs are quite right. I tried your script, its works really well. Here's the configs & outputs.
  What I mentioned in the previous note follow this.

  --------------------

  ASA1

  ASA1 (config) # sh run
  : Saved
  :
  ASA Version 8.0 (2)
  !
  hostname ASA1
  activate 8Ry2YjIyt7RRXU24 encrypted password
  names of
  !
  interface Ethernet0/0
  nameif outside
  security-level 0
  IP 12.12.12.2 255.255.255.0
  !
  interface Ethernet0/1
  nameif inside
  security-level 100
  10.10.10.2 IP address 255.255.255.0
  !
  interface Ethernet0/2
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface Ethernet0/3
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface Ethernet0/4
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface Ethernet0/4
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface Ethernet0/5
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  2KFQnbNIdI.2KYOU encrypted passwd
  passive FTP mode
  extended vpn 10.10.10.0 ip access list allow 255.255.255.0 172.16.10.0 255.255.255.0
  pager lines 24
  Within 1500 MTU
  Outside 1500 MTU
  no failover
  ICMP unreachable rate-limit 1 burst-size 1
  don't allow no asdm history
  ARP timeout 14400
  Route outside 0.0.0.0 0.0.0.0 12.12.12.1 1
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout, uauth 0:05:00 absolute
  dynamic-access-policy-registration DfltAccessPolicy
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown cold start
  Crypto ipsec transform-set esp-3des esp-sha-hmac tset
  card crypto cmap 1 match for vpn
  card crypto cmap 1 set peer 11.11.11.2
  card crypto cmap 1 transform-set tset
  cmap outside crypto map interface
  crypto ISAKMP allow outside
  crypto ISAKMP policy 1
  preshared authentication
  3des encryption
  md5 hash
  Group 5
  life 86400
  crypto ISAKMP policy 65535
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  Telnet timeout 5
  SSH timeout 5
  Console timeout 0
  a basic threat threat detection
  Statistics-list of access threat detection
  !
  !
  tunnel-group 11.11.11.2 type ipsec-l2l
  IPSec-attributes tunnel-Group 11.11.11.2
  pre-shared-key *.
  context of prompt hostname
  Cryptochecksum:00000000000000000000000000000000
  : end
  ASA1 (config) #.
  ---------------------

  ASA2 (config) # sh run
  : Saved
  :
  ASA Version 8.0 (2)
  !
  hostname ASA2
  activate 8Ry2YjIyt7RRXU24 encrypted password
  names of
  !
  interface Ethernet0/0
  nameif outside
  security-level 0
  IP 11.11.11.2 255.255.255.0
  !
  interface Ethernet0/1
  nameif inside
  security-level 100
  IP 172.16.10.2 255.255.255.0
  !
  interface Ethernet0/2
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface Ethernet0/3
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface Ethernet0/4
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface Ethernet0/5
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  2KFQnbNIdI.2KYOU encrypted passwd
  passive FTP mode
  extended vpn 172.16.10.0 ip access list allow 255.255.255.0 10.10.10.0 255.255.255.0
  pager lines 24
  Outside 1500 MTU
  Within 1500 MTU
  no failover
  ICMP unreachable rate-limit 1 burst-size 1
  don't allow no asdm history
  ARP timeout 14400
  Route outside 0.0.0.0 0.0.0.0 11.11.11.1 1
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout, uauth 0:05:00 absolute
  dynamic-access-policy-registration DfltAccessPolicy
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown cold start
  Crypto ipsec transform-set esp-3des esp-sha-hmac tset
  card crypto cmap 1 match for vpn
  card crypto cmap 1 set peer 12.12.12.2
  card crypto cmap 1 transform-set tset
  cmap outside crypto map interface
  crypto ISAKMP allow outside
  crypto ISAKMP policy 1
  preshared authentication
  3des encryption
  md5 hash
  Group 5
  life 86400
  crypto ISAKMP policy 65535
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  Telnet timeout 5
  SSH timeout 5
  Console timeout 0
  a basic threat threat detection
  Statistics-list of access threat detection
  !
  !
  !
  tunnel-group 12.12.12.2 type ipsec-l2l
  IPSec-attributes tunnel-group 12.12.12.2
  pre-shared-key *.
  context of prompt hostname
  Cryptochecksum:00000000000000000000000000000000
  : end
  ASA2 (config) #.

  -------------------------
  OUTPUTS:

  *********************

  ASA1 (config) # sh crypto isakmp his

  ITS enabled: 1
  Generate a new key SA: 0 (a tunnel report Active 1 and 1 to generate a new key during the generate a new key)
  Total SA IKE: 1

  1 peer IKE: 11.11.11.2
  Type: L2L role: initiator
  Generate a new key: no State: MM_ACTIVE

  ---------------------

  ASA1 (config) # sh crypto ipsec his
  Interface: outside
  Tag crypto map: cmap, seq num: 1, local addr: 12.12.12.2

  access vpn ip 10.10.10.0 list allow 255.255.255.0 172.16.10.0 255.255.255.0
  local ident (addr, mask, prot, port): (10.10.10.0/255.255.255.0/0/0)
  Remote ident (addr, mask, prot, port): (172.16.10.0/255.255.255.0/0/0)
  current_peer: 11.11.11.2

  #pkts program: 50, #pkts encrypt: 50, #pkts digest: 50
  #pkts decaps: 49, #pkts decrypt: 49, #pkts check: 49
  compressed #pkts: 0, unzipped #pkts: 0
  #pkts uncompressed: 50, comp #pkts failed: 0, #pkts Dang failed: 0
  success #frag before: 0, failures before #frag: 0, #fragments created: 0
  Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
  #send errors: 0, #recv errors: 0

  local crypto endpt. : 12.12.12.2, remote Start crypto. : 11.11.11.2

  ------------------------
  ASA2 (config) # sh crypto isakmp his

  ITS enabled: 1
  Generate a new key SA: 0 (a tunnel report Active 1 and 1 to generate a new key during the generate a new key)
  Total SA IKE: 1

  1 peer IKE: 12.12.12.2
  Type: L2L role: answering machine
  Generate a new key: no State: MM_ACTIVE

  ------------------------

  ASA2 (config) # sh crypto ipsec his
  Interface: outside
  Tag crypto map: cmap, seq num: 1, local addr: 11.11.11.2

  access vpn ip 172.16.10.0 list allow 255.255.255.0 10.10.10.0 255.255.255.0
  local ident (addr, mask, prot, port): (172.16.10.0/255.255.255.0/0/0)
  Remote ident (addr, mask, prot, port): (10.10.10.0/255.255.255.0/0/0)
  current_peer: 12.12.12.2

  #pkts program: 49, #pkts encrypt: 49, #pkts digest: 49
  #pkts decaps: 50, #pkts decrypt: 50, #pkts check: 50
  compressed #pkts: 0, unzipped #pkts: 0
  #pkts uncompressed: 49, #pkts comp failed: 0, #pkts Dang failed: 0
  success #frag before: 0, failures before #frag: 0, #fragments created: 0
  Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
  #send errors: 0, #recv errors: 0

  local crypto endpt. : 11.11.11.2, remote Start crypto. : 12.12.12.2
  -------------------------