Does not... dynamic ip VPN traffic

I'm having a problem with is taffic between two routers to work. Here are my devices:

Main location:

Cisco 861w (static IP)

10.0.0.0 / 255.255.255.0

Remote Desktop:

Cisco Small Business WRVS4400N (dynamic IP)

192.168.2.0 / 255.255.255.0

At the main site, I used the Cisco Professional configuration utility to create the site to site vpn using the wizard and select dynamic ip address. In remote desktop, I've entered all the information and got VPN 'Up '.

Now the problem is that I can't communicate with networks, except when the primary location starts a connection to the remote desktop.

For example:

192.168.2.100 to 10.0.0.251 ping is 100% packet loss

10.0.0.251 to 192.168.2.100 ping is 100% packet loss

BUT

If I leave a constant ping from 10.0.0.251 to 192.168.2.100, then the machine 192.168.2.100 is able to ping 10.0.0.251 and get answers. As soon as I stop the constant ping running on the 10.0.0.251 of the machine then answers on 192.168.2.100 stop...

Is happening here? I am at a loss...

Dear Jacob...

hope it will work for check you

crypto ISAKMP policy 10
BA 3des

md5 hash
preshared authentication
Group 2
XXX address 10.10.10.10 isakmp encryption key

Set your key instead of XXX and correspond with your remote site. After that write the address of your counterpart
invalid-spi-recovery crypto ISAKMP
!
!
Crypto ipsec transform-set esp-3des esp-md5-hmac XXX
!
Crypto map YYY-address <> >
YYY 10 ipsec-isakmp crypto map
defined peer 10.10.10.10
game of transformation-ZZZ
match address 101

interface <> >
card crypto AAAA

access-list 101 permit ip 192.168.1.0 0.0.0.255 11.11.11.11 (remote user) 255.255.255.255
access-list 101 permit ip 192.168.1.0 0.0.0.255 22.22.22.22 user (Remote) 255.255.255.255

After that, configure NAT with forced - access list

For troubleshooting

HS cry peer ipsec his 10.10.10.10

HS cry session

hope that your site to IPSec VPN tunnel works very well

Tags: Cisco Security

Similar Questions

Does site to Site VPN traffic.

Hello

I had a problem with my connection to my supplier, and we can't figure it out for the life of us. We have the tunnel upward, we simply cannot ping either side of it. (as you can tell from the moment where the position, I am at a loss).

The goal is for our site to pass all traffic via the seller, so they can go out route to the internet for the rest of their network.

As I said, the tunnel is just, does not seem to be passsing no matter what traffic, or at least real traffic, I think the keep alives pass.

Hello

Some comments on configurations

Your configurations of sites on a quick glance seems fine. You have configured NAT0 for all traffic and you have set up all the traffic on the local network to connect VPN L2L.

The seller site configurations seems a little weird. Lets start with the routing. It has a route for network 10.0.0.0/8 and 10.4.0.0/16 pointing to the IP address 10.4.250.49 behind the interface 'inner' that CANNOT be the right gateway IP address as the IP 'internal' interfaces is 10.4.253.66/30, so the roads to my knowledge are useless. (IP address of the next hop must be from a directly connected network)

These are the roads

Route inside 10.0.0.0 255.0.0.0 10.4.250.49 1

Route inside 10.4.0.0 255.255.0.0 10.4.250.49 1

It's the 'inside' interface

interface GigabitEthernet0/1

No tap

Speed 1000

full duplex

nameif inside

security-level 100

IP 10.4.253.66 255.255.255.252

So with the configuration above it needs impossible even for traffic to the front between the local networks of the two sites.

If your goal is also to have passed your site outside of the site and outside traffic to the Internet through the ASA of the seller then its lack of certain configurations.

You should be at least

Global 1 interface (outside)

Since there are only "nat" statement currently sets the addresses of source for translations, but there is no "global" setting the actual address of the NAT/PAT.

The ASA of the Site of the seller is also the command lack

permit same-security-traffic intra-interface

That would allow the traffic coming through the "outside" interface (from your site through the VPN) and go through the 'outside' (your topic traffic to Internet)

-Jouni

INTERNET does not immediately work VPN

Hello

I've been working to resolve the problem on the network of vpn cisco eazy extented for a week. While the VPN is connected internet does not work, I thought it was the remote side, now I think it might be because secondary server configuration question I try serveral on-site the same configuration for the remote side internet is getting lost for the user. still can ping 4.2.2.2 for the router itself. Please help me solve this problem.,.

Router config HO

!
!
AAA authentication login userauthen local
AAA authorization groupauthor LAN
!
!
AAA - the id of the joint session
iomem 15 memory size
IP cef
!
!
!
!

!
!
crypto ISAKMP policy 3
BA 3des
preshared authentication
Group 2
!
Configuration group social isakmp crypto-seat customer
pass123 keys
pool ippool
ACL 101
Save-password
!
!
Crypto ipsec transform-set esp-3des esp-md5-hmac RIGHT
!
Crypto-map dynamic dynmap 10
Set transform-set RIGHT
market arriere-route
!
!
!
map clientmap client to authenticate crypto list userauthen
card crypto clientmap isakmp authorization list groupauthor
client configuration address map clientmap crypto answer
10 ipsec-isakmp crypto map clientmap Dynamics dynmap
!
!
!
!
!
!
!
interface FastEthernet0/0
IP address xx.xx.xx.xy 255.255.255.248
penetration of the IP stream
stream IP output
NAT outside IP
IP virtual-reassembly
route IP cache flow
automatic duplex
automatic speed
clientmap card crypto
!
interface FastEthernet0/1
192.168.0.166-IP address 255.255.255.0
IP nat inside
IP virtual-reassembly
automatic duplex
automatic speed
!
local pool IP 10.10.10.10 ippool 10.10.10.200
IP forward-Protocol ND
IP route 0.0.0.0 0.0.0.0 xx.xx.xx.yx
!

IP http server
IP http secure server
The dns server IP
overload of IP nat inside source list 111 interface FastEthernet0/0
!
access-list 101 permit ip 192.168.0.0 0.0.0.255 10.10.10.0 0.0.0.255
access-list 101 permit ip 192.168.0.0 0.0.0.255 10.200.192.0 0.0.0.255
access-list 101 permit ip 192.168.0.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 101 permit ip 192.168.0.0 0.0.0.255 10.172.16.0 0.0.0.255
access-list 101 permit ip 192.168.0.0 0.0.0.255 172.16.1.0 0.0.0.255
access-list 104. allow ip 192.168.0.0 0.0.0.255 any
access-list 104. allow ip 192.168.0.0 0.0.0.255 any what newspaper
access-list 111 deny ip host 192.168.0.16 everything
access-list 111 deny ip host 192.168.0.16 no matter what paper
access-list 111 deny ip 192.168.0.0 0.0.0.255 10.10.10.0 0.0.0.255
access-list 111 deny ip 192.168.0.0 0.0.0.255 10.10.10.0 0.0.0.255 connect
access-list 111 deny ip 192.168.0.0 0.0.0.255 172.16.1.0 0.0.0.255
access-list 111 deny ip 192.168.0.0 0.0.0.255 10.200.192.0 0.0.0.255
access-list 111 deny ip 192.168.0.0 0.0.0.255 10.1.1.0 0.0.0.255
access-list 111 deny ip 192.168.0.0 0.0.0.255 10.172.16.0 0.0.0.255
access-list 111 deny ip 192.168.0.0 0.0.0.255 192.168.1.0 0.0.0.255
access ip-list 111 allow a whole
access-list 133 deny ip host 192.168.0.16 10.10.10.0 0.0.0.255
!

Remote Desktop

Router #show run
Building configuration...

Current configuration: 2243 bytes
!
! Last modification of the configuration at 08:34:12 UTC kills Sep 18 2012
! NVRAM config updated at 08:34:14 UTC killed Sep 18 2012
! NVRAM config updated at 08:34:14 UTC killed Sep 18 2012
version 15.1
no service button
horodateurs service debug datetime msec
Log service timestamps datetime msec
no password encryption service
!
router host name
!
boot-start-marker
boot-end-marker
!
!
Select the secret 4 6Uhgk1ATmwo4j3eoSZScCqsB/Q1llvengtFuqfN8mh6
!
AAA new-model
!
!
AAA authentication login default local
AAA authorization network default local
!
!
!
!
!
AAA - the id of the joint session
!
iomem 10 memory size
Crypto pki token removal timeout default 0
!
!
IP source-route
!
!
!
!
!
IP cef
M name server IP
M name server IP
No ipv6 cef
!
!
!
0 user username password Cisco
!
!
!
!
VDSL controller 0
!
!
!
!
!
!
!
Crypto ipsec VPN-REMOTE-OFFICE ezvpn client
connect auto
Group seat key pass123 social
network extension mode
XX.XX.XX.xy peer
user username password Cisco
xauth userid local mode
!
!
!
!
!
!
interface Ethernet0
no ip address
Shutdown
no fair queue
!
ATM0 interface
no ip address
No atm ilmi-keepalive
!
point-to-point interface ATM0.1
PVC 8/35
aal5mux encapsulation ppp Dialer
Dialer pool-member 1
!
!
interface FastEthernet0
no ip address
!
interface FastEthernet1
no ip address
!
interface FastEthernet2
no ip address
!
interface FastEthernet3
no ip address
!
interface Vlan1
IP 10.200.192.1 255.255.255.0
IP nat inside
IP virtual-reassembly in
ezvpn client crypto ipsec VPN-DESKTOP-remote CONTROL inside
!
interface Dialer0
the negotiated IP address
NAT outside IP
IP virtual-reassembly in
encapsulation ppp
Dialer pool 1
Dialer-Group 1
PPP chap hostname xxxxxxx
PPP chap password 0 yyyyy
Crypto ipsec VPN-REMOTE-OFFICE ezvpn client
!
IP forward-Protocol ND
no ip address of the http server
no ip http secure server
!
!
The dns server IP
overload of IP nat inside source list 120 interface Dialer0
IP route 0.0.0.0 0.0.0.0 Dialer0
!
access-list 120 deny ip 10.200.192.0 0.0.0.255 192.168.0.0 0.0.0.255
access-list 120 allow ip 10.200.192.0 0.0.0.255 any

Note: no problem when you use a VPN clinet software

Looks like you're hit this bug: CSCtj63428:

http://Tools.Cisco.com/support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCtj63428

You can change the configuration of the Easy VPN NEM mode just the VPN LAN-to-LAN tunnel, or demote according to listed in the bug workaround solution to solve the problem.

Headless app does not dynamically

I have a problem with our application without a head.

We have three actions of hub like this:
```
int retVal = _udsUtil->addAccountAction(_accountId, QString("bb.action.COMPOSE"), QString(tr("Compose")),
        _cardTarget, QString("application"), _itemComposeIconFilename, _itemMimeType, UDS_PLACEMENT_SIGNATURE);
if (retVal != 0) {
    qDebug() << "HubAccount::initialize: addAccountActionData: bb.action.COMPOSE : " << " retval: " << retVal;
}
```
As part of the application without a head, we a TranslationService which is initialized like this:
```
TranslationService::TranslationService() :
    QObject(),
    m_translator(new QTranslator(this)),
    m_bpsHandler(new BpsHandler())
{
    connect(m_bpsHandler, SIGNAL(localeUpdated(QString)), this, SLOT(onSystemLanguageChanged(QString)));
    onSystemLanguageChanged(QLocale().name());
}
```
It connects the signal with this machine localeUpdated slot:
```
void TranslationService::onSystemLanguageChanged(QString newLocale)
{
    qDebug() << "TranslationService::onSystemLanguageChanged()" << newLocale;
    QCoreApplication::instance()->removeTranslator(m_translator);

    // Append the locale code (ie: en_US, fr_FR, etc)
    QString file_name = QString("appheadless_%1").arg(newLocale);
    qDebug() << "File name:" << file_name;

    if (m_translator->load(file_name, "app/native/qm")) {
        qDebug() << "File loaded successfully";
        QCoreApplication::instance()->installTranslator(m_translator);
    }
}
```
There is an appheadless.qm and appheadless_de.qm file in the appropriate directory (app/native/qm) which I checked with the target file system browser.

When I install the application with the locale OF the action is properly translated in German, but when I switch to English, it remains that way - and vice versa (English installation, string rest in English)

The output log file States:

08.06.2016, 15:20:41.330 TranslationService Debug:nSystemLanguageChanged() 'en_US '.
08.06.2016, 15:20:41.353 Debug file name: "appheadless_en_GB."
08.06.2016, 15:20:41.427 debug successfully loaded file
08.06.2016, 15:20:47.556 TranslationService Debug:nSystemLanguageChanged() 'de_DE '.
08.06.2016, 15:20:47.565 Debug file name: "appheadless_de_DE."
08.06.2016, 15:20:47.590 debug successfully loaded file

in the meantime, I look into the hub and action again message does not change its channel

The problem isn't your TranslationService.

When you addAccountAction(), your string is translated for the locale at the moment. There is no such thing as Retranslate.onLocaleOrLanguageChanged in C++, but @greenmr did a great how-to article on how to do it! Check it out here: https://supportforums.blackberry.com/t5/Native-Development/HOWTO-Live-translation-in-C-similar-to-Re...

I have never worked with UDS myself, maybe his solution will not work with stock account Hub, you can try it for yourself.

Another simple solution would be to call _udsUtil-> updateAccountAction() whenever onSystemLanguageChanged() is called, that would translate the text updated using local news.

OpenManage Network Manager 5.3 does not display the data traffic Analyzer

Hi I have OMNM installed on a virtual machine and a PC Dell-6248 okay discovered and that responded to the questionnaire. However the flow of traffic or Traffic Analyzer features do not work. I recorded the switch (click right switch\Traffic Analyzer\Register) and activated sflow on swtich (port 6343) and implementation of the polling and sampling on a few ports in order to generate traffic data. The data appear to be sent from the switch ok because I tried to install the application SFlow trend on the same machine as OMNM and that contains traffic data, no problem.

Java 7, ActivePerl, Adobe Flash and reader are all installed and firewall disabled. The only other thing a bit strange is that the network display feature works on Google Chrome, it doesn't work on FireFox or IE and Performance indicator Gagues (CPU usage, memory usage, temperature) do not work either. I'm not sure if they are related to the Traffic Analyzer problem...

Windows Server 2008 R2 64 on a VMWare virtual machine. PC-6248 switch sfotware version is 3.2.0.7

Any help would be appreciated.

Thank you

Andrew

Eventually found the problem here. The absence of traffic Analyzer data was caused by the presence of an interface VLAN IP address on our switch. I had recorded the physical switch ok in OMNM, but the sflow data do not seem to come from the IP Address of the switch when I ran a trace of Wireshark on sflow traffic. Instead sflow traffic came from a different IP address that turned out be a VLAN IP interface. As the what IP interface was not mandatory on the VLAN special (he was there for outside access mamgement band only), I managed to remove (only the period of INQUIRY, not the VIRTUAL local area network) and now sflow traffic appears to come from physics going on own IP address. I then started to get traffic Analyzer data in OMNM.

Thanks for your suggestion on the use of Wireshark to plot the data on this guy as he lead me to the solution.

Andrew

Capture packets for VPN traffic

Hi team,

Please help me to set the ACL and capture for remote access VPN traffic.

To see the amount of traffic flows from this IP Source address.

Source: Remote VPN IP (syringe) 10.10.10.10 access

Destination: any

That's what I've done does not

extended VPN permit tcp host 10.10.10.10 access list all

interface captures CAP_VPN VPN access to OUTSIDE gross-list data type

Hello

If you have configured capture with this access list, you filter all TCP traffic, so you will not be able to see the UDP or ICMP traffic too, I would recommend using the ACL, although only with intellectual property:

list of allowed extended VPN ip host 10.10.10.10 access everything

Capture interface outside access, VPN CAP_VPN-list

Then with:

See the capture of CAP_VPN

You will be able to see the packet capture on the SAA, you can export the capture of a sniffer of packages as follows:

https:// /capture//pcap capname--> CAP

For more details of capture you can find it on this link

Let me know if you could get the information that you were trying to achieve.

Please Don t forget to rate and score as correct the helpful post!

David Castro,

Kind regards

ASA 8.3 VPN site-to-site does not UDP traffic to other peer

Hello!!!

Someone turned off the lights :-) I say this because that's 6.2 6.3 I can't get the basic things...

On a SAA, I created a "site-site" VPN profile to connect to a remote site, on the other side (ASA 8.2) sees no problem, I can pass all IP traffic via VPN without NAT; but on a new ASA5505 with 8.3 (1) version fw and ASDM 6.3 (1) can't do that in any way :-(

What I get is trivial...

... It works perfectly with TCP and ICMP traffic, but does not have UDP traffic: in practice, if I followed the traffic to a remote private IP, TCP and ICMP traffic I see only packets in vlan "inside" with the private IP, but with the UDP traffic on top of that, I see traffic on vlan 'out' with the IP public ASA and source port changed :

Inside: UDP to 172.16.2.128:6000 to 172.16.0.200:6000
Outside: UDP to 5.5.5.5:23400 to 172.16.0.200:6000

Why?

Of course, the traffic is not encrypted and does not reach the other side of the tunnel!

Here are the important parts of the configuration:

interface Vlan1
nameif inside
security-level 100
172.16.2.1 IP address 255.255.255.0

network obj_any object
subnet 0.0.0.0 0.0.0.0

remote network object
172.16.0.0 subnet 255.255.254.0

outside_cryptomap to access extended list ip 172.16.2.0 allow 255.255.255.0 network remote control object

NAT (inside, outside) static source any any destination static remote-remote network

network obj_any object

NAT dynamic interface (indoor, outdoor)

card crypto outside_map0 1 match address outside_cryptomap

outside_map0 card crypto 1jeu pfs

card crypto outside_map0 1 set ip.ip.ip.ip counterpart

outside_map0 card crypto 1jeu nat-t-disable

outside_map0 interface card crypto outside

Given that the new business object, I have not yet quite clear (ok, I don't find time to do a deep reading of the documentation), someone is able to direct me to fix this trivial?

Note: If I remove my drive manual nat and I flag "network translating" on the remote network object thus indicate that they want NAT with ip network remote control then don't work any IP vs. remote site traffic. Why, why have not more than the simple rules of 'nat exception' the old version and why the crypto-plan applies only to TCP traffic? Possible that there is an object any which takes all IP traffic?

A big thank you to all.

73,

Arturo

Hi Arturo,.

I know that there is a certain NAT related bugs in 8.3 (1) and although I don't remember a specific which corresponds to your symptoms, I would say you try 8.3 (2) instead, or maybe even the last available version of a temp (currently to 8.3 (2.4):)

http://tools.cisco.com/support/downloads/go/ImageList.x?relVer=8.3.2+Interim&mdfid=279916854&sftType=Adaptive+Security+Appliance+%28ASA%29+Software&optPlat=&nodecount=9&edesignator=null&modelName=Cisco+ASA+5510+Adaptive+Security+Appliance&treeMdfId=268438162&modifmdfid=&imname=&treeName=Security&hybrid=Y&imst=N

If you still see the problem, then, check

entry Packet-trace within the udp 172.16.2.2 1025 172.16.0.1 detail 123

entry Packet-trace inside tcp 172.16.2.2 1025 172.16.0.1 detail 123

and check what's different.

HTH

Herbert

PIX and ASA static, dynamic and RA VPN does not

Hello

I am facing a very interesting problem between a PIX 515 and an ASA 5510.

The PIX is in HQ and has several dynamic VPN connections (around 130) and IPsec vpn remote works very well. I had to add a PIX to ASA L2L VPN static and it does not work as it is supposed to be. The ASA 5510, at the remote end, connects and rest for a small period of time, however, all other VPN connections stop working.

The most interesting thing is that ASA is associated with the dynamic map and not the static map that I created (check by sh crypto ipsec his counterpart x.x.x.x). However, if I make any changes in the ACL 'ACL-Remote' it affects the tunnel between the PIX and ASA.

Someone saw something like that?

Here is more detailed information:

HQ - IOS 8.0 (3) - PIX 515

ASA 5510 - IOS 7.2 (3) - remote provider

Several Huawei and Cisco routers dynamically connected via ADSL

Several users remote access IPsec

A VPN site-to site static between PIX and ASA - does not.

Here is the config on the PIX:

Crypto ipsec transform-set ESP-3DES-ESP-SHA-HMAC-IPSec esp-3des esp-sha-hmac

Dyn - VPN game 100 Dynamics-card crypto transform-set ESP-3DES-ESP-SHA-HMAC-IPSec

Crypto dynamic-map Dyn - VPN 100 the value reverse-road

VPN - card 30 crypto card matches the ACL address / remote

card crypto VPN-card 30 peers set 20 x. XX. XX. XX

card crypto VPN-card 30 the transform-set ESP-3DES-ESP-SHA-HMAC-IPSec value

VPN crypto card - 100 - isakmp dynamic Dyn - VPN ipsec

interface card crypto VPN-card outside

crypto ISAKMP allow outside

crypto ISAKMP policy 10

preshared authentication

3des encryption

md5 hash

Group 2

life 86400

crypto ISAKMP policy 65535

preshared authentication

3des encryption

sha hash

Group 2

life 86400

access list ACL-remote ext ip 10.0.0.0 allow 255.255.255.0 192.168.1.0 255.255.255.0

Thank you.

Marcelo Pinheiro

The problem is that the ASA has a crypto acl defined between host and network, while the remote end has to the network.

Make sure that the acl is reversed.

External ACL does not increment for traffic allowed through the site to site VPN

Hi all, we have many site - to IPSEC VPNS that are sending traffic to us successfully - the largest part of this traffic is FTP or SFTP.

There is not configuration of the firewall of the SAA sysopt. Access lists have been configured on the external interface of the ASA to allow these VPN for FTP SFTP connections & - however, all counters are 0 when I do a 'show access-list internet-in' for FTP or SFTP.

There are general IP entries in list of FTP & SFTP natted access connected to the Internet addresses of these FTP servers and these are increment but then there are certain customers who use the internet to transfer files.

I guess what I was asking is ASA outside increment for traffic access lists allowed by VPN? The access list entries are for THEIRINTERNALIP to OURINTERNALIP (according to crypto card)

Just to add that these ACL is configured through groups of objects in the case that matters - also once again that they are correctly transfer files to us - only I don't get where they are allowed.

Thanks in advance

Mark

VPN traffic is flowing properly and there is no ACL allowing UDP 500 or ESP?

Can you post the output of "sh run all the sysopt"

Federico.

ASA 5505. VPN Site-to-Site does not connect!

Hello!
Already more than a week there, as we had a new channel of communication of MGTSa (Ontario terminal Sercomm RV6688BCM, who barely made in the 'bridge' - had to do the provider in order to receive our white Cisco Ip address), and now I train as well more that one week to raise between our IKEv1 IPsec Site-to-Site VPN tunnel closes offices.
Configurable and use the wizard in ASDM and handles in the CLI, the result of a year, the connection does not rise.
Cisco version 9.2 (2), the image of the Cisco asa922 - k8.bin, Security Plus license version, version 7.2 AMPS (2).
What I'll never know...
Debugging and complete configuration enclose below.
Help, which can follow any responses, please! I was completely exhausted!

Config:

Output of the command: "sh run".

: Saved
:
: Serial: XXXXXXXXXXXX
: Material: ASA5505, 512 MB RAM, 500 MHz Geode Processor
:
ASA Version 9.2 (2)
!
hostname door-71
activate the encrypted password of F6OJ0GOws7WHxeql
names of
IP local pool vpnpool 10.1.72.100 - 10.1.72.120 mask 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
nameif inside
security-level 100
IP 10.1.72.254 255.255.255.0
!
interface Vlan2
nameif outside_mgts
security-level 0
62.112.100.R1 255.255.255.252 IP address
!
passive FTP mode
clock timezone 3 MSK/MSD
clock to DST MSK/MDD recurring last Sun Mar 02:00 last Sun Oct 03:00
DNS lookup field inside
DNS server-group MGTS
Server name 195.34.31.50
permit same-security-traffic inter-interface
permit same-security-traffic intra-interface
network obj_any object
subnet 0.0.0.0 0.0.0.0
network of the NET72 object
10.1.72.0 subnet 255.255.255.0
network object obj - 0.0.0.0
host 0.0.0.0
network of the Nafanya object
Home 10.1.72.5
network object obj - 10.1.72.0
10.1.72.0 subnet 255.255.255.0
network of the NET61 object
10.1.61.0 subnet 255.255.255.0
network of the NETWORK_OBJ_10.1.72.96_27 object
subnet 10.1.72.96 255.255.255.224
network of the NETT72 object
10.1.72.0 subnet 255.255.255.0
network of the NET30 object
10.1.30.0 subnet 255.255.255.0
network of the NETWORK_OBJ_10.1.72.0_24 object
10.1.72.0 subnet 255.255.255.0
object-group service OG INET
the purpose of the echo icmp message service
response to echo icmp service object
service-object icmp traceroute
service-object unreachable icmp
service-purpose tcp - udp destination eq echo
the DM_INLINE_NETWORK_1 object-group network
network-object NET30
network-object, object NET72
DM_INLINE_TCP_1 tcp service object-group
port-object eq www
EQ object of the https port
inside_access_in extended access list permit ip object NET72 object-group DM_INLINE_NETWORK_1
access extensive list ip 10.1.72.0 inside_access_in allow 255.255.255.0 any
inside_access_in extended access list permit ip object Nafanya any idle state
inside_access_in list extended access allowed object-group OG INET an entire
inside_access_in of access allowed any ip an extended list
inside_access_in list extended access deny ip any alerts on any newspaper
outside_mgts_access_in list extended access allowed object-group OG INET an entire
outside_mgts_access_in list extended access permit tcp any any DM_INLINE_TCP_1 object-group
outside_mgts_access_in list extended access deny ip any alerts on any newspaper
access extensive list ip 10.1.72.0 outside_mgts_cryptomap allow 255.255.255.0 object NET61
VPN-ST_splitTunnelAcl permit 10.1.72.0 access list standard 255.255.255.0
pager lines 24
Enable logging
asdm of logging of information
Within 1500 MTU
outside_mgts MTU 1500
IP check path reverse interface outside_mgts
no failover
ICMP unreachable rate-limit 1 burst-size 1
don't allow no asdm history
ARP timeout 14400
no permit-nonconnected arp
NAT (inside outside_mgts) static source NET72 NET72 NETWORK_OBJ_10.1.72.96_27 NETWORK_OBJ_10.1.72.96_27 non-proxy-arp-search of route static destination
NAT (inside outside_mgts) static source NETWORK_OBJ_10.1.72.0_24 NETWORK_OBJ_10.1.72.0_24 NET61 NET61 non-proxy-arp-search of route static destination
!
network obj_any object
NAT (inside outside_mgts) dynamic obj - 0.0.0.0
network of the NET72 object
NAT (inside outside_mgts) interface dynamic dns
inside_access_in access to the interface inside group
Access-group outside_mgts_access_in in the outside_mgts interface
Route 0.0.0.0 outside_mgts 0.0.0.0 62.112.100.R 1
Timeout xlate 03:00
Pat-xlate timeout 0:00:30
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
Floating conn timeout 0:00:00
dynamic-access-policy-registration DfltAccessPolicy
without activating the user identity
identity of the user by default-domain LOCAL
AAA authentication http LOCAL console
the ssh LOCAL console AAA authentication
Enable http server
http 10.1.72.0 255.255.255.0 inside
No snmp server location
No snmp Server contact
Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit
Crypto ipsec ikev2 AES256 ipsec-proposal
Protocol esp encryption aes-256
Esp integrity sha - 1, md5 Protocol
Crypto ipsec ikev2 ipsec-proposal AES192
Protocol esp encryption aes-192
Esp integrity sha - 1, md5 Protocol
Crypto ipsec ikev2 ipsec-proposal AES
Esp aes encryption protocol
Esp integrity sha - 1, md5 Protocol
Crypto ipsec ikev2 proposal ipsec 3DES
Esp 3des encryption protocol
Esp integrity sha - 1, md5 Protocol
Crypto ipsec ikev2 ipsec-proposal OF
encryption protocol esp
Esp integrity sha - 1, md5 Protocol
Crypto ipsec pmtu aging infinite - the security association
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define ikev2 AES256 AES192 AES 3DES ipsec-proposal OF
card crypto outside_mgts_map 1 match address outside_mgts_cryptomap
card crypto outside_mgts_map 1 set pfs Group1
peer set card crypto outside_mgts_map 1 91.188.180.42
card crypto outside_mgts_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
outside_mgts_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
card crypto outside_mgts_map interface outside_mgts
inside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
inside crypto map inside_map interface
Crypto ca trustpoint ASDM_TrustPoint0
registration auto
E-mail [email protected] / * /
name of the object CN = door-71
Serial number
IP address 62.112.100.42
Proxy-loc-transmitter
Configure CRL
Crypto ca trustpoint ASDM_TrustPoint1
registration auto
ASDM_TrustPoint1 key pair
Configure CRL
trustpool crypto ca policy
string encryption ca ASDM_TrustPoint0 certificates
certificate eff26954
30820395 3082027d a0030201 020204ef f2695430 0d06092a 864886f7 0d 010105
019
6460ae26 ec5f301d 0603551d 0e041604 14c9a3f2 d70e6789 38fa4b01 465d 1964
60ae26ec 5f300d06 092 has 8648 01050500 03820101 00448753 7baa5c77 86f70d01
62857b 65 d05dc91e 3edfabc6 7b3771af bbedee14 673ec67d 3d0c2de4 b7a7ac05
5f203a8c 98ab52cf 076401e5 1a2c6cb9 3f7afcba 52c617a5 644ece10 d6e1fd7d
28b57d8c aaf49023 2037527e 9fcfa218 9883191f 60b221bf a561f2be d6882091
0222b7a3 3880d6ac 49328d1f 2e085b15 6d1c1141 5f850e5c b6cb3e67 0e373591
94a 82781 44493217 and 38097952 d 003 5552 5c445f1f 92f04039 a23fba20 b9d51b13
f511f311 d1feb2bb 6d056a15 7e63cc1b 1f134677 8124c 024 3af56b97 51af8253
486844bc b1954abe 8acd7108 5e4212df db835d76 98ffdb2b 8c8ab915 193b 8167
0db3dd54 c8346b96 c4f4eff7 1e7cd576 a8b1f86e 3b868a6e 89
quit smoking
string encryption ca ASDM_TrustPoint1 certificates
certificate a39a2b54
3082025f 30820377 a0030201 020204 has 3 9a2b5430 0d06092a 864886f7 0d 010105
0500304 06035504 03130767 36313137 30120603 55040513 6174652d 3110300e b

c084dcd9 d250e194 abcb3eb8 1da93bd0 fb0dba1a b1c35b43 d547a841 5d4ee1a4
14bdb207 7dd790a4 0cd 70471 5f3a896a 07bd56dc ea01b3dd 254cde88 e1490e97
f3e54c05 551adde0 66aa3782 c85880c2 b162ec29 4e49346a df71062d 6d6d8f49
62b9de93 ba07b4f7 a50e77e1 8f54b32b 6627cb27 e982b36f a 362973, 0 88de3272
9bd6d4d2 8ca1e11f 214f20a9 78bdea95 78fdc45c d6d45674 6acb9bcb d0bd930e
638eedfe cd559ab1 e1205c48 3ee9616f e631db55 e82b623c 434ffdc1 11020301
0001 has 363 3061300f 0603551d 130101ff 0101ff30 04053003 0e060355 1d0f0101
ff040403 1f060355 02018630 230418 30168014 0cea70bf 0d0e0c4b eb34a0b1 1 d
8242 has 549 0603 551d0e04 1604140c ea70bf0d 0e0c4beb 34a0b182 301D 5183ccf9
42a 54951 010105 05000382 0101004e 7bfe054a 0d 864886f7 0d06092a 83ccf930
d434a27c 1d3dce15 529bdc5f 70a2dff1 98975de9 2a97333b 96077966 05a8e9ef
bf320cbd ecec3819 ade20a86 9aeb5bde bd129c7b 29341e4b edf91473 f2bf235d
9aaeae21 a629ccc6 3c79200b b9a89b08 bf38afb6 ea56b957 4430f692 a 4745, 411
34d71fad 588e4e18 2b2d97af b2aae6b9 b6a22350 d031615b 49ea9b9f 2fdd82e6
ebd4dccd df93c17e deceb796 f268abf1 881409b 5 89183841 f484f0e7 bd5f7b69
ebf7481c faf69d3e 9d24df6e 9c2b0791 785019f7 a0d20e95 2ef35799 66ffc819
4a77cdf2 c6fb4380 fe94c13c d4261655 7bf3d6ba 6289dc8b f9aad4e1 bd918fb7
32916fe1 477666ab c2a3d591 a84dd435 51711f6e 93e2bd84 89884c
quit smoking
crypto isakmp identity address
IKEv2 crypto policy 1
aes-256 encryption
integrity sha
Group 2 of 5
FRP sha
second life 86400
IKEv2 crypto policy 10
aes-192 encryption
integrity sha
Group 2 of 5
FRP sha
second life 86400
IKEv2 crypto policy 20
aes encryption
integrity sha
Group 2 of 5
FRP sha
second life 86400
IKEv2 crypto policy 30
3des encryption
integrity sha
Group 2 of 5
FRP sha
second life 86400
IKEv2 crypto policy 40
the Encryption
integrity sha
Group 2 of 5
FRP sha
second life 86400
Crypto ikev2 activate outside_mgts port 443 customer service
Crypto ikev2 access remote trustpoint ASDM_TrustPoint0
Crypto ikev1 allow inside
Crypto ikev1 enable outside_mgts
IKEv1 crypto policy 10
authentication crack
aes-256 encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 20
authentication rsa - sig
aes-256 encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 30
preshared authentication
aes-256 encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 40
authentication crack
aes-192 encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 50
authentication rsa - sig
aes-192 encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 60
preshared authentication
aes-192 encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 70
authentication crack
aes encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 80
authentication rsa - sig
aes encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 90
preshared authentication
aes encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 100
authentication crack
3des encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 110
authentication rsa - sig
3des encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 120
preshared authentication
3des encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 130
authentication crack
the Encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 140
authentication rsa - sig
the Encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 150
preshared authentication
the Encryption
sha hash
Group 2
life 86400
Telnet timeout 5
without ssh stricthostkeycheck
SSH 10.1.72.0 255.255.255.0 inside
SSH timeout 60
SSH group dh-Group1-sha1 key exchange
Console timeout 0
vpnclient Server 91.188.180.X
vpnclient mode network-extension-mode
vpnclient nem-st-autoconnect
VPN - L2L vpnclient vpngroup password *.
vpnclient username aradetskayaL password *.
dhcpd auto_config outside_mgts
!
dhcpd update dns replace all two interface inside
!
a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
SSL-trust ASDM_TrustPoint0 inside point
SSL-trust ASDM_TrustPoint0 outside_mgts point
WebVPN
Select outside_mgts
internal GroupPolicy_91.188.180.X group strategy
attributes of Group Policy GroupPolicy_91.188.180.X
Ikev1 VPN-tunnel-Protocol
internal group VPN - ST strategy
attributes of group VPN - ST policy
value of 195.34.31.50 DNS Server 8.8.8.8
Ikev1 VPN-tunnel-Protocol
Split-tunnel-policy tunnelspecified
Split-tunnel-network-list value VPN-ST_splitTunnelAcl
by default no
aradetskayaL encrypted HR3qeva85hzXT6KK privilege 15 password username
tunnel-group 91.188.180.X type ipsec-l2l
attributes global-tunnel-group 91.188.180.X
Group - default policy - GroupPolicy_91.188.180.42
IPSec-attributes tunnel-group 91.188.180.X
IKEv1 pre-shared-key *.
remote control-IKEv2 pre-shared-key authentication *.
remotely IKEv2 authentication certificate
pre-shared-key authentication local IKEv2 *.
remote access to tunnel-group VPN - ST type
VPN-general ST-attributes tunnel-group
address vpnpool pool
Group Policy - by default-VPN-ST
tunnel-group ipsec VPN ST-attributes
IKEv1 pre-shared-key *.
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
maximum message length automatic of customer
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the rsh
inspect the rtsp
inspect sqlnet
inspect the skinny
inspect sunrpc
inspect xdmcp
inspect the sip
inspect the netbios
inspect the tftp
Review the ip options
inspect the icmp
inspect the icmp error
!
global service-policy global_policy
context of prompt hostname
no remote anonymous reporting call
Cryptochecksum:212e4f5035793d1c219fed57751983d8
: end

door-71 # sh crypto ikev1 his

There are no SAs IKEv1

door-71 # sh crypto ikev2 his

There are no SAs IKEv2

door-71 # sh crypto ipsec his

There is no ipsec security associations

door-71 # sh crypto isakmp

There are no SAs IKEv1

There are no SAs IKEv2

Global statistics IKEv1
The active Tunnels: 0
Previous Tunnels: 0
In bytes: 0
In the packages: 0
In packs of fall: 0
In Notifys: 0
In the constituencies of P2: 0
In P2 invalid Exchange: 0
In P2 Exchange rejects: 0
Requests for removal in his P2: 0
Bytes: 0
Package: 0
Fall packages: 0
NOTIFYs out: 0

Exchanges of P2: 0
The Invalides Exchange P2: 0
Exchange of P2 rejects: 0
Requests to remove on P2 Sa: 0
Tunnels of the initiator: 0
Initiator fails: 0
Answering machine fails: 0
Ability system breaks down: 0
AUTH failed: 0
Decrypt failed: 0
Valid hash fails: 0
No failure his: 0

IKEV1 statistics for Admission appeals
In negotiating SAs Max: 25
In negotiating SAs: 0
In negotiating SAs Highwater: 0
In negotiating SAs rejected: 0

Global statistics IKEv2
The active Tunnels: 0
Previous Tunnels: 0
In bytes: 0
In the packages: 0
In packs of fall: 0
In Fragments of fall: 0
In Notifys: 0
In Exchange for the P2: 0
In P2 invalid Exchange: 0
In P2 Exchange rejects: 0
In IPSEC delete: 0
In delete IKE: 0
Bytes: 0
Package: 0
Fall packages: 0
Fragments of fall: 0
NOTIFYs out: 0
Exchange of P2: 0
The Invalides Exchange P2: 0
Exchange of P2 rejects: 0
On IPSEC delete: 0
The IKE Delete: 0
Locally launched sAs: 0
Locally launched sAs failed: 0
SAs remotely initiated: 0
SAs remotely initiated failed: 0
System capacity: 0
Authentication failures: 0
Decrypt failures: 0
Hash failures: 0
Invalid SPI: 0
In the Configs: 0
Configs: 0
In the Configs rejects: 0
Configs rejects: 0
Previous Tunnels: 0
Previous Tunnels wraps: 0
In the DPD Messages: 0
The DPD Messages: 0
The NAT KeepAlive: 0
IKE recomposition launched locally: 0
IKE returned to the remote initiated key: 0
Generate a new key CHILD initiated locally: 0
CHILD given to the remote initiated key: 0

IKEV2 statistics for Admission appeals
Max active SAs: no limit
Max in negotiating SAs: 50
Challenge cookie line: never
Active sAs: 0
In negotiating SAs: 0
Incoming requests: 0
Accepted incoming requests: 0
A rejected incoming requests: 0
Out of requests: 0
Out of the applications accepted: 0
The outgoing rejected requests: 0
A rejected queries: 0
Rejected at the SA: 0 Max limit
Rejected low resources: 0
Rejected the current reboot: 0
Challenges of cookie: 0
Cookies transmitted challenges: 0
Challenges of cookie failed: 0

IKEv1 global IPSec over TCP statistics
--------------------------------
Embryonic connections: 0
Active connections: 0
Previous connections: 0
Incoming packets: 0
Inbound packets ignored: 0
Outgoing packets: 0
Outbound packets ignored: 0
The RST packets: 0
Heartbeat Recevied ACK packets: 0
Bad headers: 0
Bad trailers: 0
Chess timer: 0
Checksum errors: 0
Internal error: 0

door-71 # sh statistical protocol all cryptographic
[Statistics IKEv1]
Encrypt packets of requests: 0
Encapsulate packets of requests: 0
Decrypt packets of requests: 0
Decapsulating requests for package: 0
HMAC calculation queries: 0
ITS creation queries: 0
SA asked to generate a new key: 0
Deletion requests: 0
Next phase of allocation key applications: 0
Number of random generation queries: 0
Failed requests: 0
[Statistics IKEv2]
Encrypt packets of requests: 0
Encapsulate packets of requests: 0
Decrypt packets of requests: 0
Decapsulating requests for package: 0
HMAC calculation queries: 0
ITS creation queries: 0
SA asked to generate a new key: 0
Deletion requests: 0
Next phase of allocation key applications: 0
Number of random generation queries: 0
Failed requests: 0
[IPsec statistics]
Encrypt packets of requests: 0
Encapsulate packets of requests: 0
Decrypt packets of requests: 0
Decapsulating requests for package: 0
HMAC calculation queries: 0

ITS creation queries: 0
SA asked to generate a new key: 0
Deletion requests: 0
Next phase of allocation key applications: 0
Number of random generation queries: 0
Failed requests: 0
[SSL statistics]
Encrypt packets of queries: 19331
Encapsulate packets of queries: 19331
Decrypt packets of queries: 437
Package requests decapsulating: 437
HMAC calculation queries: 19768
ITS creation queries: 178
SA asked to generate a new key: 0
Requests to remove SA: 176
Next phase of allocation key applications: 0
Number of random generation queries: 0
Failed requests: 0
[Statistical SSH are not taken in charge]
[Statistics SRTP]
Encrypt packets of requests: 0
Encapsulate packets of requests: 0
Decrypt packets of requests: 0
Decapsulating requests for package: 0
HMAC calculation queries: 0
ITS creation queries: 0
SA asked to generate a new key: 0
Deletion requests: 0
Next phase of allocation key applications: 0
Number of random generation queries: 0
Failed requests: 0
[Statistics]
Encrypt packets of requests: 0
Encapsulate packets of requests: 0
Decrypt packets of requests: 0
Decapsulating requests for package: 0
HMAC calculation queries: 6238
ITS creation queries: 0
SA asked to generate a new key: 0
Deletion requests: 0
Next phase of allocation key applications: 0
Number of queries random generation: 76
Failure of queries: 9
door-71 # sh crypto ca trustpoints

Trustpoint ASDM_TrustPoint0:
Configured for the production of a self-signed certificate.

Trustpoint ASDM_TrustPoint1:
Configured for the production of a self-signed certificate.

If you need something more, then spread!
Please explain why it is that I don't want to work?

Hello

When the IPSEC tunnel does not come to the top, the first thing comes to my mind is to run a tracer of package from the CLI and the phases in it. Please run this command from your firewall side and share the output. I've just compiled this command with the random ip address and ports of your given range.

Packet-trace entry inside tcp 10.1.72.2 1233 10.1.61.2 443 detailed

Best regards

Amandine

Return VPN traffic flows do not on the tunnel

Hello.

I tried to find something on the internet for this problem, but am fails miserably. I guess I don't really understand how the cisco decides on the road.

In any case, I have a Cisco 837 which I use for internet access and to which I would like to be able to complete a VPN on. When I vpn (using vpnc in a Solaris box as it happens which is connected to the cisco ethernet interface), I can establish a VPN and when I ping a host on the inside, I see this package ping happen, however, the return package, the cisco 837 is trying to send via the public internet facing interface Dialer1 without encryption. I can't work for the life of me why.

(Also note: I can also establish a tunnel to the public internet, but again, I don't can not all traffic through the tunnel.) I guess I'm having the same problem, IE back of packages are not going where it should be, but I do know that for some, on the host being ping well, I can see the ping arriving packets and the host responds with a response to ICMP echo).

Here is the version of cisco:

version ADSL #show
Cisco IOS software, software C850 (C850-ADVSECURITYK9-M), Version 12.4 (15) T5, VERSION of the SOFTWARE (fc4)
Technical support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by Cisco Systems, Inc.
Updated Friday 1 May 08 02:07 by prod_rel_team

ROM: System Bootstrap, Version 12.3 (8r) YI4, VERSION of the SOFTWARE

ADSL availability is 1 day, 19 hours, 27 minutes
System to regain the power ROM
System restarted at 17:20:56 CEST Sunday, October 10, 2010
System image file is "flash: c850-advsecurityk9 - mz.124 - 15.T5.bin".

Cisco 857 (MPC8272) processor (revision 0 x 300) with 59392K / 6144K bytes of memory.
Card processor ID FCZ122391F5
MPC8272 CPU Rev: Part Number 0xC, mask number 0 x 10
4 interfaces FastEthernet
1 ATM interface
128 KB of non-volatile configuration memory.
20480 bytes K of on board flash system (Intel Strataflash) processor

Configuration register is 0 x 2102

And here is the cisco configuration (IP address, etc. changed of course):

Current configuration: 7782 bytes
!
! Last configuration change at 11:57:21 CEST Monday, October 11, 2010 by bautsche
! NVRAM config updated at 11:57:22 CEST Monday, October 11, 2010 by bautsche
!
version 12.4
no service button
tcp KeepAlive-component snap-in service
a tcp-KeepAlive-quick service
horodateurs service debug datetime localtime show-timezone msec
Log service timestamps datetime localtime show-timezone msec
encryption password service
sequence numbers service
!
hostname adsl
!
boot-start-marker
boot-end-marker
!
logging buffered 4096
enable secret 5
!
AAA new-model
!
!
AAA authentication login local_authen local
AAA authentication login sdm_vpn_xauth_ml_1 local
AAA authorization exec local local_author
AAA authorization sdm_vpn_group_ml_1 LAN
!
!
AAA - the id of the joint session
clock timezone gmt 0
clock daylight saving time UTC recurring last Sun Mar 01:00 last Sun Oct 01:00
!
!
dot11 syslog
no ip source route
dhcp IP database dhcpinternal
No dhcp use connected vrf ip
DHCP excluded-address IP 10.10.7.1 10.10.7.99
DHCP excluded-address IP 10.10.7.151 10.10.7.255
!
IP dhcp pool dhcpinternal
import all
Network 10.10.7.0 255.255.255.0
router by default - 10.10.7.1
Server DNS 212.159.6.9 212.159.6.10 212.159.13.49 212.159.13.50
!
!
IP cef
property intellectual auth-proxy max-nodata-& 3
property intellectual admission max-nodata-& 3
no ip bootp Server
nfs1 host IP 10.10.140.207
name of the IP-server 212.159.11.150
name of the IP-server 212.159.13.150
!
!
!
username password cable 7
username password bautsche 7
vpnuser password username 7
!
!
crypto ISAKMP policy 1
BA 3des
md5 hash
preshared authentication
Group 2
!
crypto ISAKMP policy 2
BA aes 256
preshared authentication
Group 2
!
crypto ISAKMP policy 3
BA 3des
Prior authentication group part 2
the local address SDM_POOL_1 pool-crypto isakmp client configuration
!
ISAKMP crypto client configuration group groupname2
key
DNS 10.10.140.201 10.10.140.202
swangage.co.uk field
pool SDM_POOL_1
users of max - 3
netmask 255.255.255.0
!
ISAKMP crypto client configuration group groupname1
key
DNS 10.10.140.201 10.10.140.202
swangage.co.uk field
pool SDM_POOL_1
users of max - 3
netmask 255.255.255.0
ISAKMP crypto sdm-ike-profile-1 profile
groupname2 group identity match
client authentication list sdm_vpn_xauth_ml_1
ISAKMP authorization list sdm_vpn_group_ml_1
client configuration address respond
ISAKMP crypto profile sdm-ike-profile-2
groupname1 group identity match
ISAKMP authorization list sdm_vpn_group_ml_1
client configuration address respond
!
!
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
Crypto ipsec transform-set esp-3des esp-md5-hmac ESP_MD5_3DES
Crypto ipsec transform-set ESP-AES-256-SHA aes - esp esp-sha-hmac
!
crypto dynamic-map SDM_DYNMAP_1 1
Set the security association idle time 3600
game of transformation-ESP-AES-256-SHA
market arriere-route
crypto dynamic-map SDM_DYNMAP_1 2
Set the security association idle time 3600
game of transformation-ESP-AES-256-SHA
market arriere-route
!
!
card crypto SDM_CMAP_1 client authentication list sdm_vpn_xauth_ml_1
map SDM_CMAP_1 isakmp authorization list sdm_vpn_group_ml_1 crypto
map SDM_CMAP_1 65535-isakmp dynamic SDM_DYNMAP_1 ipsec crypto
!
Crypto ctcp port 10000
Archives
The config log
hidekeys
!
!
synwait-time of tcp IP 10
!
!
!
Null0 interface
no ip unreachable
!
ATM0 interface
no ip address
no ip redirection
no ip unreachable
no ip proxy-arp
route IP cache flow
No atm ilmi-keepalive
PVC 0/38
aal5mux encapsulation ppp Dialer
Dialer pool-member 1
!
DSL-automatic operation mode
waiting-224 in
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Vlan1
Description $FW_INSIDE$
10.10.7.1 IP address 255.255.255.0
IP access-group 121 to
no ip redirection
no ip unreachable
no ip proxy-arp
IP nat inside
IP virtual-reassembly
route IP cache flow
map SDM_CMAP_1 crypto
Hold-queue 100 on
!
interface Dialer1
Description $FW_OUTSIDE$
the negotiated IP address
IP access-group 121 to
no ip redirection
no ip unreachable
no ip proxy-arp
NAT outside IP
IP virtual-reassembly
encapsulation ppp
route IP cache flow
No cutting of the ip horizon
Dialer pool 1
Dialer idle-timeout 0
persistent Dialer
Dialer-Group 1
No cdp enable
Authentication callin PPP chap Protocol
PPP chap hostname
PPP chap password 7
map SDM_CMAP_1 crypto
!
local IP SDM_POOL_1 10.10.148.11 pool 10.10.148.20
IP local pool public_184 123.12.12.184
IP local pool public_186 123.12.12.186
IP local pool public_187 123.12.12.187
IP local pool internal_9 10.10.7.9
IP local pool internal_8 10.10.7.8
IP local pool internal_223 10.10.7.223
IP local pool internal_47 10.10.7.47
IP forward-Protocol ND
IP route 0.0.0.0 0.0.0.0 Dialer1
IP route 10.10.140.0 255.255.255.0 10.10.7.2
!
no ip address of the http server
no ip http secure server
IP nat inside source overload map route SDM_RMAP_1 interface Dialer1
IP nat inside source static 10.10.7.9 123.12.12.184
IP nat inside source static tcp 10.10.7.8 22 123.12.12.185 22 Expandable
IP nat inside source static tcp 10.10.7.8 25 123.12.12.185 25 expandable
IP nat inside source static tcp 10.10.7.8 80 123.12.12.185 80 extensible
IP nat inside source static tcp 10.10.7.8 443 123.12.12.185 443 extensible
IP nat inside source static tcp 10.10.7.8 993 123.12.12.185 993 extensible
IP nat inside source static tcp 10.10.7.8 123.12.12.185 1587 1587 extensible
IP nat inside source static tcp 10.10.7.8 8443 123.12.12.185 8443 extensible
IP nat inside source static 10.10.7.223 123.12.12.186
IP nat inside source static 10.10.7.47 123.12.12.187
!
record 10.10.140.213
access-list 18 allow one
access-list 23 permit 10.10.140.0 0.0.0.255
access-list 23 permit 10.10.7.0 0.0.0.255
Access-list 100 category SDM_ACL = 2 Note
access-list 100 deny ip any 10.10.148.0 0.0.0.255
access ip-list 100 permit a whole
Note access-list 121 SDM_ACL category = 17
access-list 121 deny udp any eq netbios-dgm all
access-list 121 deny udp any eq netbios-ns everything
access-list 121 deny udp any eq netbios-ss all
access-list 121 tcp refuse any eq 137 everything
access-list 121 tcp refuse any eq 138 everything
access-list 121 tcp refuse any eq 139 all
access ip-list 121 allow a whole
access-list 125 permit tcp any any eq www
access-list 125 permit udp any eq isakmp everything
access-list 125 permit udp any any eq isakmp
access-list 194 deny udp any eq isakmp everything
access-list 194 deny udp any any eq isakmp
access-list 194 allow the host ip 123.12.12.184 all
IP access-list 194 allow any host 123.12.12.184
access-list 194 allow the host ip 10.10.7.9 all
IP access-list 194 allow any host 10.10.7.9
access-list 195 deny udp any eq isakmp everything
access-list 195 deny udp any any eq isakmp
access-list 195 allow the host ip 123.12.12.185 all
IP access-list 195 allow any host 123.12.12.185
access-list 195 allow the host ip 10.10.7.8 all
IP access-list 195 allow any host 10.10.7.8
not run cdp
public_185 allowed 10 route map
corresponds to the IP 195
!
public_184 allowed 10 route map
corresponds to the IP 194
!
allowed SDM_RMAP_1 1 route map
corresponds to the IP 100
!
!
control plan
!
!
Line con 0
connection of authentication local_authen
no activation of the modem
preferred no transport
telnet output transport
StopBits 1
line to 0
connection of authentication local_authen
telnet output transport
StopBits 1
line vty 0 4
access-class 23 in
privilege level 15
authorization exec local_author
connection of authentication local_authen
length 0
preferred no transport
transport input telnet ssh
!
max-task-time 5000 Planner
Scheduler allocate 4000 1000
Scheduler interval 500
130.88.202.49 SNTP server
130.88.200.98 SNTP server
130.88.200.6 SNTP server
130.88.203.64 SNTP server
end

Any help would be appreciated.

Thank you very much.

Ciao,.

Eric

Hi Eric,.

(Sorry for the late reply - needed some holidays)

So I see that you have a few steps away now. I think that there are 2 things we can try:

1)

I guess you have provided that:

IP nat inside source overload map route SDM_RMAP_1 interface Dialer1

Since the routemap refers to ACL 100 to define the traffic to be translated, we can exclude traffic that initiates the router:

Access-list 100 category SDM_ACL = 2 Note

access-list 100 deny ip 123.12.12.185 host everything
access-list 100 deny ip any 10.10.148.0 0.0.0.255
access ip-list 100 permit a whole

Which should prevent the source udp 4500 to 1029 changing port

OR

2)

If you prefer to use a different ip address for VPN,

Then, you can use a loop like this:

loopback interface 0

123.12.12.187 the IP 255.255.255.255

No tap

map SDM_CMAP_1 crypto local-address loopback 0

I don't think you should apply card encryption to the loopback interface, but it's been a while since I have configured something like that, so if you have problems first try and if still does not get the crypto debugs new (isakmp + ipsec on the vpn, nat router on the router of the client package).

HTH

Herbert

Site-to-Site VPN Ping does not

I configured a vpn site-to site between two firewalls ASA 5505. Establishes the tunnel, but the icmp traffic does not pass. In fact, ping worked twice, but only at random. I need to work on a regular basis. I have attached the configurations as well as an output of the packet - trace both of the ASA and the IPSec and its ISAKMP. Thanks for any help you can provide.

ASA Configuration 1:

ASA Version 8.0 (3)

!

hostname asa1

activate the encrypted password of A.zMQonBIU0NmOC0

names of

!

interface Vlan1

nameif inside

security-level 100

IP 10.1.50.253 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

IP 1.1.1.1 255.255.255.240

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

OMV1AjIsWknnKr9H encrypted passwd

boot system Disk0: / asa803 - k8.bin

passive FTP mode

acl_out list extended access permit tcp any host 63.76.12.195 eq smtp

acl_out list extended access permit tcp any host 63.76.12.195 eq www

acl_out list extended access permit tcp any host 63.76.12.195 eq 3389

acl_out list extended access permit tcp any host 63.76.12.195 eq ftp

acl_out list extended access permit tcp any host 63.76.12.195 eq ftp - data

acl_out list extended access permit tcp any host 63.76.12.195 eq telnet

acl_out list extended access permit tcp any host 63.76.12.195 eq 5800

acl_out list extended access permit tcp any host 63.76.12.195 eq 5900

acl_out list extended access permit tcp any host 63.76.12.195 eq https

acl_out list extended access permit tcp any host 63.76.12.196 eq www

acl_out list extended access permit tcp any host 63.76.12.196 eq https

acl_out list extended access permit tcp any host 63.76.12.196 eq smtp

acl_out list extended access permit tcp any host 63.76.12.196 eq 3389

acl_out list extended access permit icmp any one

access-list 101 extended allow ip 10.1.50.0 255.255.255.0 10.1.40.0 255.255.255.0

access-list 101 extended allow ip 10.1.50.0 255.255.255.0 10.1.51.0 255.255.255.0

vpn-fargo extended ip 10.1.50.0 access list allow 255.255.255.0 10.1.51.0 255.255.255.0

pager lines 24

Enable logging

debug logging in buffered memory

asdm of logging of information

Within 1500 MTU

Outside 1500 MTU

IP local pool ippool 10.1.40.1 - 10.1.40.254

ICMP unreachable rate-limit 1 burst-size 1

ICMP allow any inside

ICMP allow all outside

ASDM image disk0: / asdm - 523.bin

don't allow no asdm history

ARP timeout 14400

Global 1 interface (outside)

(Inside) NAT 0-list of access 101

NAT (inside) 1 0.0.0.0 0.0.0.0

static (inside, outside) 1.1.1.2 tcp ftp 10.1.50.3 ftp netmask 255.255.255.255

static (inside, outside) 1.1.1.2 tcp ftp - data 10.1.50.3 ftp - data netmask 255.255.255.255

static (inside, outside) 1.1.1.2 tcp telnet 10.1.50.3 telnet netmask 255.255.255.255

static (inside, outside) tcp 1.1.1.2 5800 10.1.50.102 5800 netmask 255.255.255.255

static (inside, outside) 1.1.1.2 tcp 5900 10.1.50.102 5900 netmask 255.255.255.255

static (inside, outside) 1.1.1.2 tcp 3389 10.1.50.5 3389 netmask 255.255.255.255

static (inside, outside) 1.1.1.3 10.1.50.6 netmask 255.255.255.255

Access-group acl_out in interface outside

Route outside 0.0.0.0 0.0.0.0 1.1.1.0 1

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout, uauth 0:05:00 absolute

dynamic-access-policy-registration DfltAccessPolicy

Enable http server

http 192.168.1.0 255.255.255.0 inside

No snmp server location

No snmp Server contact

Server enable SNMP traps snmp authentication linkup, linkdown cold start

Crypto ipsec transform-set esp-3des esp-md5-hmac RIGHT

Crypto-map dynamic dynmap 10 transform-set RIGHT

map mymap 10-isakmp ipsec crypto dynamic dynmap

card crypto mymap 20 match address vpn-fargo

card crypto mymap 20 peers set 2.2.2.2

card crypto mymap 20 transform-set RIGHT

crypto mymap 20 card value reverse-road

mymap outside crypto map interface

crypto isakmp identity address

crypto ISAKMP allow outside

crypto ISAKMP policy 10

preshared authentication

3des encryption

md5 hash

Group 2

life 86400

crypto ISAKMP policy 20

preshared authentication

aes-256 encryption

sha hash

Group 5

life 86400

crypto ISAKMP ipsec-over-tcp port 10000

Telnet timeout 5

SSH 0.0.0.0 0.0.0.0 inside

SSH timeout 5

Console timeout 0

management-access inside

dhcpd outside auto_config

!

a basic threat threat detection

Statistics-list of access threat detection

internal group vpn3000 strategy

attributes of the strategy group vpn3000

value of server WINS 10.1.50.5

value of 10.1.50.5 DNS server 10.1.50.6

Split-tunnel-policy tunnelspecified

Split-tunnel-network-list value 101

asa1.com value by default-field

disable authentication of the user

the address value ippool pools

encrypted vpn Tw.atDK7GScnXkMJ password username

vpn tunnel-group type remote access

VPN tunnel-group general attributes

Group Policy - by default-vpn3000

jtvpn group of tunnel ipsec-attributes

pre-shared-key *.

tunnel-group 2.2.2.2 type ipsec-l2l

2.2.2.2 tunnel-group ipsec-attributes

pre-shared-key *.

!

class-map inspection_default

match default-inspection-traffic

!

!

type of policy-card inspect dns preset_dns_map

parameters

message-length maximum 512

Policy-map global_policy

class inspection_default

inspect the preset_dns_map dns

inspect the ftp

inspect h323 h225

inspect the h323 ras

inspect the rsh

inspect the rtsp

inspect sqlnet

inspect the skinny

inspect sunrpc

inspect xdmcp

inspect the sip

inspect the netbios

inspect the tftp

inspect the icmp

inspect the icmp error

!

global service-policy global_policy

context of prompt hostname

: end

ASA 2 configuration:

ASA Version 8.2 (1)

!

hostname asa2

activate the encrypted password of A.zMQonBIU0NmOC0

1vU9VISnc.IQ6OSN encrypted passwd

names of

!

interface Vlan1

nameif inside

security-level 100

IP 10.1.51.253 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

IP address 2.2.2.2 255.255.255.240

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

passive FTP mode

vpn - dsm extended ip 10.1.51.0 access list allow 255.255.255.0 10.1.50.0 255.255.255.0

IP 10.1.51.0 allow Access-list extended sheep 255.255.255.0 10.1.50.0 255.255.255.0

access outside-access list extended icmp permitted an echo

outside-access extended access list permit icmp any any echo response

outside-access extended access list permit all all unreachable icmp

access outside-access allowed list icmp exceed all once

pager lines 24

asdm of logging of information

Within 1500 MTU

Outside 1500 MTU

ICMP unreachable rate-limit 1 burst-size 1

ICMP allow any inside

ICMP allow all outside

don't allow no asdm history

ARP timeout 14400

Global 1 interface (outside)

NAT (inside) 0 access-list sheep

NAT (inside) 1 0.0.0.0 0.0.0.0

access-outside group access component software snap-in interface outside

Route outside 0.0.0.0 0.0.0.0 2.2.2.0 1

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-registration DfltAccessPolicy

the ssh LOCAL console AAA authentication

Enable http server

http 192.168.1.0 255.255.255.0 inside

No snmp server location

No snmp Server contact

Server enable SNMP traps snmp authentication linkup, linkdown cold start

Crypto ipsec transform-set ESP-3DES esp-3des esp-md5-hmac

life crypto ipsec security association seconds 28800

Crypto ipsec kilobytes of life - safety 4608000 association

card crypto mymap 10 correspondence address vpn - dsm

card crypto mymap 10 set peer 1.1.1.1

card crypto mymap 10 game of transformation-ESP-3DES

crypto mymap 10 card value reverse-road

mymap outside crypto map interface

crypto isakmp identity address

crypto ISAKMP allow outside

crypto ISAKMP policy 10

preshared authentication

3des encryption

md5 hash

Group 2

life 86400

crypto ISAKMP policy 20

preshared authentication

aes-256 encryption

sha hash

Group 5

life 86400

Telnet 0.0.0.0 0.0.0.0 inside

Telnet timeout 5

SSH 0.0.0.0 0.0.0.0 inside

SSH timeout 5

Console timeout 0

management-access inside

dhcpd outside auto_config

!

a basic threat threat detection

Statistics-list of access threat detection

no statistical threat detection tcp-interception

WebVPN

tunnel-group 1.1.1.1 type ipsec-l2l

tunnel-group 1.1.1.1 ipsec-attributes

pre-shared-key *.

!

class-map inspection_default

match default-inspection-traffic

!

!

type of policy-card inspect dns preset_dns_map

parameters

message-length maximum 512

Policy-map global_policy

class inspection_default

inspect the preset_dns_map dns

inspect the ftp

inspect h323 h225

inspect the h323 ras

inspect the rsh

inspect the rtsp

inspect esmtp

inspect sqlnet

inspect the skinny

inspect sunrpc

inspect xdmcp

inspect the sip

inspect the netbios

inspect the tftp

inspect the icmp

inspect the icmp error

!

global service-policy global_policy

context of prompt hostname

: end

Packet trace of ASA1:

asa1 (config) # entry packet - trace within the icmp 10.1.50.253 1 1 detailed 10.1.51.253

Phase: 1

Type: FLOW-SEARCH

Subtype:

Result: ALLOW

Config:

Additional information:

Not found no corresponding stream, creating a new stream

Phase: 2

Type:-ROUTE SEARCH

Subtype: entry

Result: ALLOW

Config:

Additional information:

in 0.0.0.0 0.0.0.0 outdoors

Phase: 3

Type: ACCESS-LIST

Subtype:

Result: DECLINE

Config:

Implicit rule

Additional information:

Direct flow from returns search rule:

ID = 0xd49dcce0, priority = 500, area = allowed, deny = true

Hits = 5, user_data = 0 x 6, cs_id = 0 x 0, reverse, flags = 0 x 0 = 0 protocol

SRC ip = 10.1.50.253, mask is 255.255.255.255, port = 0

DST ip = 0.0.0.0 mask 0.0.0.0, port = 0 =

Result:

input interface: inside

entry status: to the top

entry-line-status: to the top

output interface: outside

the status of the output: to the top

output-line-status: to the top

Action: drop

Drop-reason: flow (acl-drop) is denied by the configured rule

Packet trace of ASA2:

asa2 (config) # entry packet - trace within the icmp 10.1.51.253 1 1 detailed 10.1.50.253

Phase: 1

Type: FLOW-SEARCH

Subtype:

Result: ALLOW

Config:

Additional information:

Not found no corresponding stream, creating a new stream

Phase: 2

Type:-ROUTE SEARCH

Subtype: entry

Result: ALLOW

Config:

Additional information:

in 10.1.50.0 255.255.255.0 outside

Phase: 3

Type: ACCESS-LIST

Subtype:

Result: DECLINE

Config:

Implicit rule

Additional information:

Direct flow from returns search rule:

ID = 0xc9583648, priority = 500, area = allowed, deny = true

hits = 9, user_data = 0 x 6, cs_id = 0 x 0, reverse, flags = 0 x 0 = 0 protocol

SRC ip = 10.1.51.253, mask is 255.255.255.255, port = 0

DST ip = 0.0.0.0 mask = 0.0.0.0, port = 0, dscp = 0 x 0

Result:

input interface: inside

entry status: to the top

entry-line-status: to the top

output interface: outside

the status of the output: to the top

output-line-status: to the top

Action: drop

Drop-reason: flow (acl-drop) is denied by the configured rule

ASA 1 IPSec security association:

peer address: 2.2.2.2

Tag crypto map: dynmap, seq num: 10, local addr: 1.1.1.1

local ident (addr, mask, prot, port): (10.1.50.0/255.255.255.0/0/0)

Remote ident (addr, mask, prot, port): (10.1.51.0/255.255.255.0/0/0)

current_peer: 2.2.2.2

#pkts program: encrypt 0, #pkts: 0, #pkts digest: 0

decaps #pkts: 5, #pkts decrypt: 5, #pkts check: 5

compressed #pkts: 0, unzipped #pkts: 0

#pkts uncompressed: 0, comp #pkts failed: 0, #pkts Dang failed: 0

success #frag before: 0, failures before #frag: 0, #fragments created: 0

Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0

#send errors: 0, #recv errors: 0

endpt local crypto. : 1.1.1.1, remote Start crypto. : 2.2.2.2

Path mtu 1500, fresh ipsec generals 58, media, mtu 1500

current outbound SPI: 1F3E7E3A

SAS of the esp on arrival:

SPI: 0x1DFAE5E0 (502982112)

transform: esp-3des esp-md5-hmac no

running parameters = {L2L, Tunnel}

slot: 0, id_conn: 77824, crypto-card: dynmap

calendar of his: service life remaining (KB/s) key: (3824999/28036)

Size IV: 8 bytes

support for replay detection: Y

outgoing esp sas:

SPI: 0x1F3E7E3A (524189242)

transform: esp-3des esp-md5-hmac no

running parameters = {L2L, Tunnel}

slot: 0, id_conn: 77824, crypto-card: dynmap

calendar of his: service life remaining (KB/s) key: (3825000/28034)

Size IV: 8 bytes

support for replay detection: Y

ASA 1 ISAKMP Security Association:

1 peer IKE: 2.2.2.2

Type: L2L role: answering machine

Generate a new key: no State: MM_ACTIVE

ASA 2 IPSec security association:

peer address: 1.1.1.1

Tag crypto map: mymap, seq num: 10, local addr: 2.2.2.2

list of access vpn - dsm allowed ip 10.1.51.0 255.255.255.0 10.1.50.0 255.255.255.0

local ident (addr, mask, prot, port): (10.1.51.0/255.255.255.0/0/0)

Remote ident (addr, mask, prot, port): (10.1.50.0/255.255.255.0/0/0)

current_peer: 63.76.12.194

#pkts program: 5, #pkts encrypt: 5, #pkts digest: 5

#pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0

compressed #pkts: 0, unzipped #pkts: 0

#pkts uncompressed: 5, comp #pkts failed: 0, #pkts Dang failed: 0

success #frag before: 0, failures before #frag: 0, #fragments created: 0

Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0

#send errors: 0, #recv errors: 0

endpt local crypto. : 2.2.2.2, remote Start crypto. : 1.1.1.1

Path mtu 1500, fresh ipsec generals 58, media, mtu 1500

current outbound SPI: 1DFAE5E0

SAS of the esp on arrival:

SPI: 0x1F3E7E3A (524189242)

transform: esp-3des esp-md5-hmac no compression

running parameters = {L2L, Tunnel}

slot: 0, id_conn: 81920, crypto-map: mymap

calendar of his: service life remaining (KB/s) key: (4374000/27900)

Size IV: 8 bytes

support for replay detection: Y

Anti-replay bitmap:

0x00000000 0x00000001

outgoing esp sas:

SPI: 0x1DFAE5E0 (502982112)

transform: esp-3des esp-md5-hmac no compression

running parameters = {L2L, Tunnel}

slot: 0, id_conn: 81920, crypto-map: mymap

calendar of his: service life remaining (KB/s) key: (4373999/27900)

Size IV: 8 bytes

support for replay detection: Y

Anti-replay bitmap:

0x00000000 0x00000001

ASA 2 ISAKMP Security Association:

1 peer IKE: 1.1.1.1

Type: L2L role: initiator

Generate a new key: no State: MM_ACTIVE

Hi Mike,.

I see the following in your configuration:

map mymap 10-isakmp ipsec crypto dynamic dynmap

Sequence number of Th for the peer 2.2.2.2 is 20 so we first hit the dynamic map that could cause this problem.

To avoid this, I suggest you do the following:

No map mymap 10-isakmp ipsec crypto dynamic dynmap

map mymap 65535-isakmp ipsec crypto dynamic dynmap

To validate this fact, if you look at the SA on ASA1 ipsec, you will find that it was negotiated with dymap (card crypto seq 10) and not 20!

ASA 1 IPSec security association:

peer address: 2.2.2.2

Tag crypto map: dynmap, seq num: 10, local addr: 1.1.1.1

local ident (addr, mask, prot, port): (10.1.50.0/255.255.255.0/0/0)

Remote ident (addr, mask, prot, port): (10.1.51.0/255.255.255.0/0/0)

current_peer: 2.2.2.2

#pkts program: encrypt 0, #pkts: 0, #pkts digest: 0

decaps #pkts: 5, #pkts decrypt: 5, #pkts check: 5

compressed #pkts: 0, unzipped #pkts: 0

#pkts uncompressed: 0, comp #pkts failed: 0, #pkts Dang failed: 0

success #frag before: 0, failures before #frag: 0, #fragments created: 0

Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0

#send errors: 0, #recv errors: 0

Hope this helps!

See you soon,.

Manasi!

VPN from Site to Site of 2600 NSA does not work after upgrade to 6.2.0.1/6.2.2.0 6.2.0.0 SonicOS

Site to Site VPN using policy based or VPN type road works very well in NSA 2600 with SonicOS Enhanced 6.2.0.0 - 20n. However, in order to correct the poodle attacks on SSLv3, we improve our SonicOS to 6.2.0.1 - 24n and this make the VPN does not. We tried SonicOS 6.2.2.0 - 7n with the same result. However, the VPN works remotely locally, but not the reverse, i.e. one meaning outside of the local network. Here are the details of the VPN deployment:

Distance: NetScreen SSG-5 or GSU - 320 M

Local: SonicWall NSA-2600

Policy type: Tunnel Interface

Auth. method: IKE using preshared Secret

IKE Phase 1 proposal: Main Mode, group 2, 3DES, SHA1

Proposal of IPSec Phase 2: ESP 3DES SHA1

Please advice if it is linked to the SSLv3 disabled on Ipsec or any setting that we can make the VPN works on SonicOS after 6.2.0.1, again thank you!

After reading the Release Notes for Early Release SonicOS 6.2.2.0 - 12n NSA-2600, we have solved the problem easily. Here's the important part:

IMPORTANT: SonicOS 6.2.2.0 includes a design change added in recent versions for the treatment of the traffic via the Interfaces of the VPN Tunnel. By default, NAT policies are now applied to this traffic. In SonicOS 6.2.0.0 and SonicOS 6.1.1.9 and 6.1.1.x earlier, traffic on the Interfaces of the VPN Tunnel was exempt from policies NAT. Transition one of these earlier versions to 6.2.2.0 may require configuration changes.

In fact, the truth is since 6.2.0.1, they already have policies NAT for the Interfaces of the VPN Tunnel. So the solution, regardless of usage 6.2.0.1 or 6.2.2.0, is just to write your policy NAT there is source and services NAT to network strategy involved VPN Tunnel Interface, that will be fine. To be simple, just

Original of the CBC Definition of the CBC Original dest Definition of dest SVC Original Definition of SVC

Any Source language Remote VPN network Source language Any Source language

SonicWall VPN PIX - does not, could someone help?

Hi all

I'm trying to set up an a 506th PIX VPN tunnel (firmware 6.3 (2)), a firewall SonicWall Pro. It does not at the moment. Phase 1 is ok but the phase 2 is not, the VPN tunnel has not been established, and the security association is removed after a minute or two. I enclose below the PIX config and an attempt to create VPN tunnel debugging output (slightly modified and cut for reasons of confidentiality). The PIX already has other two VPN configured which work perfectly.

I would be very grateful to anyone who could help me answer the following questions about this VPN configuration:

1. to debug output, which means the next?

ISAKMP (0): retransmission of the phase 2 (0/0)... mess_id 0xafc08a94

crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

ISAKMP: error msg not encrypted

2. in the config, I don't know if the 3 static controls are necessary and how it might interact... What do you think?

3. in what order things happen in the PIX when traffic is from the local network to remote network by VPN? What is NAT then treatment then setting up VPN to access list? or or treatment, then NAT and VPN to access list? or another possibility?

4. How can I get it work?

Thank you very much in advance for any help provided,

A.G.

########### NAMING #################################

vpnpix1 - is the local cisco PIX

remotevpnpeer - is the Sonicwall firewall remote

Intranet - is the local network behind PIX

remotevpnLAN - is the remote network behind the SonicWall

################ CONFIG #############################

6.3 (2) version PIX

interface ethernet0 10full

interface ethernet1 10full

ethernet0 nameif outside security0

nameif ethernet1 inside the security100

.../...

hostname vpnpix1

.../...

names of

name A.B.C.D vpnpix1-e1

name X.Y.Z.T vpnpix1-e0

name E.F.G.H defaultgw

intranet name 10.0.0.0

name 192.168.250.0 nat-intranet

name J.K.L.M internetgw

name 10.M.N.P server1

name Server2 10.M.N.Q

name 10.M.N.R server3

name 192.168.252.0 remotevpnLAN

name 10.1.71.0 nat-remotevpnLAN

.../...

object-group network server-group

description servers used by conencted to users remote LAN through a VPN tunnel

network-host server1 object

host Server2 network-object

network-host server3 object

.../...

access allowed INCOMING tcp nat-remotevpnLAN 255.255.255.0 list object-group server-eq - ica citrix

.../...

OUTBOUND ip intranet 255.0.0.0 allowed access list nat-remotevpnLAN 255.255.255.0

access list permits INTRANET-to-remotevpnLAN-VPN ip intranet 255.0.0.0 255.255.255.0 remotevpnLAN

access-list SHEEP, remotevpnLAN permits intranet ip 255.0.0.0 255.255.255.0 nat-remotevpnLAN

.../...

IP address outside the vpnpix1-e0 255.255.255.240

IP address inside the vpnpix1-e1 255.255.252.0

.../...

Global 192.168.250.1 1 (outside)

NAT (inside) 0 access-list SHEEP-to-remotevpnLAN

NAT (inside) 1 intranet 255.0.0.0 0 0

.../...

static (inside, outside) server1 server1 netmask 255.255.255.255 0 0

public static server2 (indoor, outdoor) server2 netmask 255.255.255.255 0 0

public static server3 (indoor, outdoor) server3 netmask 255.255.255.255 0 0

static (exterior, Interior) nat-remotevpnLAN remotevpnLAN netmask 255.255.255.0 0 0

.../...

Access-group ENTERING into the interface outside

Access-group OUTGOING in the interface inside

Route outside 0.0.0.0 0.0.0.0 internetgw 1

Route inside the intranet 255.0.0.0 defaultgw 1

.../...

Permitted connection ipsec sysopt

.../...

Crypto ipsec transform-set esp-3des esp-md5-hmac VPN - TS1

.../...

map BusinessPartners 30 ipsec-isakmp crypto

card crypto BusinessPartners 30 matches the INTRANET-to-remotevpnLAN-VPN address

card crypto BusinessPartners 30 set peer remotevpnpeer

card crypto BusinessPartners 30 game of transformation-VPN-TS1

BusinessPartners outside crypto map interface

ISAKMP allows outside

.../...

ISAKMP key * address remotevpnpeer netmask 255.255.255.255

ISAKMP identity address

part of pre authentication ISAKMP policy 10

ISAKMP policy 10 3des encryption

ISAKMP policy 10 md5 hash

10 2 ISAKMP policy group

ISAKMP life duration strategy 10 28800

part of pre authentication ISAKMP policy 20

ISAKMP policy 20 3des encryption

ISAKMP policy 20 chopping sha

20 2 ISAKMP policy group

ISAKMP duration strategy of life 20 28800

part of pre authentication ISAKMP policy 30

ISAKMP policy 30 3des encryption

ISAKMP policy 30 md5 hash

30 1 ISAKMP policy group

ISAKMP duration strategy of life 30 28800

.../...

: end

################## DEBUG ############################

vpnpix1 # debug crypto isakmp

vpnpix1 #.

ISAKMP (0): early changes of Main Mode

crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

Exchange OAK_MM

ISAKMP (0): treatment ITS payload. Message ID = 0

ISAKMP (0): audit ISAKMP transform 1 against the policy of priority 10

ISAKMP: 3DES-CBC encryption

ISAKMP: MD5 hash

ISAKMP: default group 2

ISAKMP: preshared auth

ISAKMP: type of life in seconds

ISAKMP: duration of life (basic) of 28800

ISAKMP (0): atts are acceptable. Next payload is 0

ISAKMP (0): ITS been pre-shared key, using id ID_IPV4_ADDR type authentication

to return to the State is IKMP_NO_ERROR

crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

Exchange OAK_MM

ISAKMP (0): processing KE payload. Message ID = 0

ISAKMP (0): processing NONCE payload. Message ID = 0

ISAKMP (0): load useful treatment vendor id

ISAKMP (0): ID payload

next payload: 8

type: 1

Protocol: 17

Port: 500

Length: 8

ISAKMP (0): the total payload length: 12

to return to the State is IKMP_NO_ERROR

crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

Exchange OAK_MM

ISAKMP (0): processing ID payload. Message ID = 0

ISAKMP (0): HASH payload processing. Message ID = 0

ISAKMP (0): SA has been authenticated.

ISAKMP (0): start Quick Mode Exchange, M - ID - 1346336108:afc08a94

to return to the State is IKMP_NO_ERROR

ISAKMP (0): send to notify INITIAL_CONTACT

ISAKMP (0): sending message 24578 NOTIFY 1 protocol

Peer VPN: ISAKMP: approved new addition: ip:remotevpnpeer / 500 Total VPN peer: 3

Peer VPN: ISAKMP: Peer ip:remotevpnpeer / 500 Ref cnt incremented: 1 Total VPN peer: 3

crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

ISAKMP (0): processing NOTIFY payload Protocol 14 1

SPI 0, message ID = 476084314

to return to the State is IKMP_NO_ERR_NO_TRANS

ISAKMP (0): retransmission of the phase 2 (0/0)... mess_id 0xafc08a94

crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

ISAKMP: error msg not encrypted

ISAKMP (0): start Quick Mode Exchange, M - ID 1919346690:7266e802

crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

ISAKMP: error msg not encrypted

ISAKMP (0): retransmission of the phase 2 (1: 1)... mess_id 0xafc08a94

crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

ISAKMP: error msg not encrypted

ISAKMP (0): retransmission of the phase 2 (0/2)... mess_id 0x7266e802

crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

ISAKMP: error msg not encrypted

ISAKMP (0): retransmission of the phase 2 (2/3)... mess_id 0xafc08a94

crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

ISAKMP: error msg not encrypted

ISAKMP (0): retransmission of the phase 2 (1/4)... mess_id 0x7266e802

crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

ISAKMP: error msg not encrypted

ISAKMP (0): start Quick Mode Exchange, M - ID - 1475513565:a80d7323

ISAKMP (0): delete SA: CBC vpnpix1-e0, dst remotevpnpeer

crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

ISAKMP: drop msg deleted his

ISADB: Reaper checking HIS 0x10ff1ac, id_conn = 0 DELETE IT!

Peer VPN: ISAKMP: Peer ip:remotevpnpeer / 500 Ref cnt decremented for: 0 Total of VPN peer: 3

Peer VPN: ISAKMP: deleted peer: ip:remotevpnpeer / 500 Total VPN peers: 2

ISADB: Reaper checking HIS 0 x 1100984, id_conn = 0

ISADB: Reaper checking HIS 0x10fcddc, id_conn = 0

crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

ISAKMP: its not located for ike msg

#####################################################

Get rid of:

static (exterior, Interior) nat-remotevpnLAN remotevpnLAN netmask 255.255.255.0 0 0

You don't need it. Change:

OUTBOUND ip intranet 255.0.0.0 allowed access list nat-remotevpnLAN 255.255.255.0

access-list SHEEP, remotevpnLAN permits intranet ip 255.0.0.0 255.255.255.0 nat-remotevpnLAN

TO:

access list permits OUTGOING ip intranet 255.0.0.0 255.255.255.0 remotevpnLAN

access-list SHEEP, remotevpnLAN permits intranet ip 255.0.0.0 255.255.255.0 remotevpnLAN

This indicates the PIX not NAT IPSec traffic. NAT happens BEFORE IPSec in the PIX, so if you the traffic IPSec nat it will never match your crypto access list and will not be encrypted.

This, however, should not stop the tunnel of Phase 2 of the course of construction, they would stop flowing above the tunnel, traffic, so you still have a problem somewhere. What I'm guessing, is that the Sonicwall (SW) has a different encryption-defined list access, it must be the EXACT OPPOSITE of what is configured on the PIX. In other words, the SW should be encrypting the traffic of "remotevpnLAN-24" "intranet/8", make sure that the subnet mask ar ETHE same too. "

To answer your questions:

1. it simply means that the PIX has not received a response and is to retransmit the last ISAKMP packet. The process_block simply means that the PIX has dropped a package that was to be encrypted because the IPSec tunnel has not been built. If you get the tunnel built, these messages will disappear.

2. the 3 first static does not appear to be linked to the tunnel IPSec, if they are simply to access a server inside, then they will not affect this VPN tunnel. The last of them should be deleted, as I already said.

3. for traffic initiated from inside the PIX, the order is incoming ACL, then NAT, IPSec processing. That's why your OUTGOING ACL must allow traffic first, then your NAT 0 statement refuses to be NAT had, then the encryption function is the traffic and the number.

4 do what I said above :-)

If you still have no luck, re - run debugs, but initiate traffic behind the Sonicwall, in this way the Sonicwall will try and debug of build that the tunnel and you will get more information on the PIX. Mainly, we'll see what traffic model the SonicWall is configured to encrypt (you don't see if the PIX initiates the tunnel).

Check sensor SFR with FireSight via VPN - does not work

Hello security experts.

I have an ASA5515-X with SFR installed 5.4.0 and manage with 5.4 FireSight installed on the virtual machine on LAN and I record the sensor without any problem but when I try to register the sensor to FireSight via VPN I can't do. The interface on the ASA management has no intellectual property nor nameif configured and the interface is connected to the switch, SFR has the IP even configured as LAN addressing. I can see traffic being exchanged between the sensor and the FireSight but I can't save the sensor.

Has anyone managed to register the sensor via VPN? Is there something else to be configured in order to save the sensor with the MC via the VPN?

The delay between the Firesight and the sensor (on WAN and VPN) I get between 80 and 100 ms, what could be the problem?

Thank you very much!

Remi

Hello

If you are unable to telnet from DC to the sensor on the port 8305 delivers connectivity then.

Can try you to ping from sensor to DC:
```
ping -M do -c 20 -s 1572 
```
By default, the MTU is 1500 on eth0, if the ping does not work I will suggest to lower the MTU on the interface and see if it works. See also: / var/log/messages | grep sftunnel and see the error messages on DC and sensor and send it to me everywhere. Best regards, Aastha Bhardwaj rate if this is useful!

Original of the CBC	Definition of the CBC	Original dest	Definition of dest	SVC Original	Definition of SVC
Any	Source language	Remote VPN network	Source language	Any	Source language

Does not... dynamic ip VPN traffic

Similar Questions

Maybe you are looking for