Does site to Site VPN traffic.

Hello

I had a problem with my connection to my supplier, and we can't figure it out for the life of us. We have the tunnel upward, we simply cannot ping either side of it. (as you can tell from the moment where the position, I am at a loss).

The goal is for our site to pass all traffic via the seller, so they can go out route to the internet for the rest of their network.

As I said, the tunnel is just, does not seem to be passsing no matter what traffic, or at least real traffic, I think the keep alives pass.

Hello

Some comments on configurations

Your configurations of sites on a quick glance seems fine. You have configured NAT0 for all traffic and you have set up all the traffic on the local network to connect VPN L2L.

The seller site configurations seems a little weird. Lets start with the routing. It has a route for network 10.0.0.0/8 and 10.4.0.0/16 pointing to the IP address 10.4.250.49 behind the interface 'inner' that CANNOT be the right gateway IP address as the IP 'internal' interfaces is 10.4.253.66/30, so the roads to my knowledge are useless. (IP address of the next hop must be from a directly connected network)

These are the roads

Route inside 10.0.0.0 255.0.0.0 10.4.250.49 1

Route inside 10.4.0.0 255.255.0.0 10.4.250.49 1

It's the 'inside' interface

interface GigabitEthernet0/1

No tap

Speed 1000

full duplex

nameif inside

security-level 100

IP 10.4.253.66 255.255.255.252

So with the configuration above it needs impossible even for traffic to the front between the local networks of the two sites.

If your goal is also to have passed your site outside of the site and outside traffic to the Internet through the ASA of the seller then its lack of certain configurations.

You should be at least

Global 1 interface (outside)

Since there are only "nat" statement currently sets the addresses of source for translations, but there is no "global" setting the actual address of the NAT/PAT.

The ASA of the Site of the seller is also the command lack

permit same-security-traffic intra-interface

That would allow the traffic coming through the "outside" interface (from your site through the VPN) and go through the 'outside' (your topic traffic to Internet)

-Jouni

Tags: Cisco Security

Similar Questions

  • Newbie Help Needed: Cisco 1941 router site to site VPN traffic routing issue

    Hello

    Please I need help with a VPN site-to site, I installed a router Cisco 1941 and a VPN concentrator based on Linux (Sophos UTM).

    The VPN is established between them, but I can't say the cisco router to send and receive traffic through the tunnel.

    Please, what missing am me?

    A few exits:

    ISAKMP crypto to show her:

    isakmp crypto #show her

    IPv4 Crypto ISAKMP Security Association

    DST CBC conn-State id

    62.173.32.122 62.173.32.50 QM_IDLE 1045 ACTIVE

    IPv6 Crypto ISAKMP Security Association

    Crypto ipsec to show her:

    Interface: GigabitEthernet0/0

    Tag crypto map: QRIOSMAP, local addr 62.173.32.122

    protégé of the vrf: (none)

    local ident (addr, mask, prot, port): (192.168.20.0/255.255.255.0/0/0)

    Remote ident (addr, mask, prot, port): (192.168.2.0/255.255.255.0/0/0)

    current_peer 62.173.32.50 port 500

    LICENCE, flags is {origin_is_acl},

    #pkts program: encrypt 0, #pkts: 0, #pkts digest: 0

    #pkts decaps: 52, #pkts decrypt: 52, #pkts check: 52

    compressed #pkts: 0, unzipped #pkts: 0

    #pkts uncompressed: 0, #pkts compr. has failed: 0

    #pkts not unpacked: 0, #pkts decompress failed: 0

    Errors #send 0, #recv 0 errors

    local crypto endpt. : 62.173.32.122, remote Start crypto. : 62.173.32.50

    Path mtu 1500, mtu 1500 ip, ip mtu IDB GigabitEthernet0/0

    current outbound SPI: 0x4D7E4817 (1300121623)

    PFS (Y/N): Y, Diffie-Hellman group: group2

    SAS of the esp on arrival:

    SPI: 0xEACF9A (15388570)

    transform: esp-3des esp-md5-hmac.

    running parameters = {Tunnel}

    Conn ID: 2277, flow_id: VPN:277 on board, sibling_flags 80000046, crypto card: QRIOSMAP

    calendar of his: service life remaining (k/s) key: (4491222/1015)

    Size IV: 8 bytes

    support for replay detection: Y

    Status: ACTIVE

    Please see my config:

    crypto ISAKMP policy 1

    BA 3des

    md5 hash

    preshared authentication

    Group 2

    encryption... isakmp key address 62.X.X... 50

    ISAKMP crypto keepalive 10 periodicals

    !

    !

    Crypto ipsec transform-set esp-3des esp-md5-hmac TS-QRIOS

    !

    QRIOSMAP 10 ipsec-isakmp crypto map

    peer 62.X.X set... 50

    transformation-TS-QRIOS game

    PFS group2 Set

    match address 100

    !

    !

    !

    !

    !

    interface GigabitEthernet0/0

    Description WAN CONNECTION

    62.X.X IP... 124 255.255.255.248 secondary

    62.X.X IP... 123 255.255.255.248 secondary

    62.X.X IP... 122 255.255.255.248

    NAT outside IP

    IP virtual-reassembly in

    automatic duplex

    automatic speed

    card crypto QRIOSMAP

    !

    interface GigabitEthernet0/0.2

    !

    interface GigabitEthernet0/1

    LAN CONNECTION description $ES_LAN$

    address 192.168.20.1 255.255.255.0

    IP nat inside

    IP virtual-reassembly in

    automatic duplex

    automatic speed

    !

    IP nat pool mypool 62.X.X... ... Of 122 62.X.X 122 30 prefix length

    IP nat inside source list 1 pool mypool overload

    overload of IP nat inside source list 100 interface GigabitEthernet0/0

    !

    access-list 1 permit 192.168.20.0 0.0.0.255

    access-list 2 allow 10.2.0.0 0.0.0.255

    Note access-list 100 category QRIOSVPNTRAFFIC = 4

    Note access-list 100 IPSec rule

    access-list 100 permit ip 192.168.20.0 0.0.0.255 192.168.2.0 0.0.0.255

    access-list 101 permit esp 62.X.X host... 50 62.X.X host... 122

    access list 101 permit udp host 62.X.X... 50 62.X.X... host isakmp EQ. 122

    access-list 101 permit ahp host 62.X.X... 50 62.X.X host... 122

    access-list 101 deny ip any any newspaper

    access-list 110 deny ip 192.168.20.0 0.0.0.255 192.168.2.0 0.0.0.255

    access-list 110 permit ip 192.168.20.0 0.0.0.255 any

    !

    !

    !

    !

    sheep allowed 10 route map

    corresponds to the IP 110

    The parts of the configuration you posted seem better than earlier versions of the config. The initial problem was that traffic was not in the VPN tunnel. That works now?

    Here are the things I see in your config

    I don't understand the relationship of these 2 static routes by default. It identifies completely the next hop and a mask the bytes of Middleweight of the next hop. Sort of, it seems that they might be the same. But if they were the same, I don't understand why they both make their appearance in the config. Can provide you details?

    IP route 0.0.0.0 0.0.0.0 62.X.X... 121

    IP route 0.0.0.0 0.0.0.0 62.172.32.121

    This static route implies that there is another network (10.2.0/24) connected through the LAN. But there is no other reference to it and especially not for this translation. So I wonder how it works?

    IP route 10.2.0.0 255.255.255.0 192.168.20.2

    In this pair of static routes, the second route is a specific subnet more and would be included in the first and routes for the next of the same break. So I wonder why they are there are. There is not necessarily a problem, but is perhaps something that could be cleaned up.

    IP route 172.17.0.0 255.255.0.0 Tunnel20

    IP route 172.17.2.0 255.255.255.0 Tunnel20

    And these 2 static routes are similar. The second is a more precise indication and would be included in the first. And it is referred to the same next hop. So why have the other?

    IP route 172.18.0.0 255.255.0.0 Tunnel20

    IP route 172.18.0.0 Tunnel20 255.255.255.252

    HTH

    Rick

  • External ACL does not increment for traffic allowed through the site to site VPN

    Hi all, we have many site - to IPSEC VPNS that are sending traffic to us successfully - the largest part of this traffic is FTP or SFTP.

    There is not configuration of the firewall of the SAA sysopt. Access lists have been configured on the external interface of the ASA to allow these VPN for FTP SFTP connections & - however, all counters are 0 when I do a 'show access-list internet-in' for FTP or SFTP.

    There are general IP entries in list of FTP & SFTP natted access connected to the Internet addresses of these FTP servers and these are increment but then there are certain customers who use the internet to transfer files.

    I guess what I was asking is ASA outside increment for traffic access lists allowed by VPN? The access list entries are for THEIRINTERNALIP to OURINTERNALIP (according to crypto card)

    Just to add that these ACL is configured through groups of objects in the case that matters - also once again that they are correctly transfer files to us - only I don't get where they are allowed.

    Thanks in advance

    Mark

    VPN traffic is flowing properly and there is no ACL allowing UDP 500 or ESP?

    Can you post the output of "sh run all the sysopt"

    Federico.

  • Unable to pass traffic between ASA Site to Site VPN Tunnel

    Hello

    I have problems passing traffic between two ASA firewall. The VPN tunnel is up with a dynamic IP and static IP address. I have attached a diagram of the VPN connection. I'm not sure where the problem lies and what to check next. I think I have all the roads and in the access lists are needed.

    I've also attached the ASA5505 config and the ASA5510.

    This is the first time that I've set up a VPN connection any guidance would be greatly appreciated.

    Thank you

    Adam

    Hello

    Regarding your opinion of configuration Remote Site ASA that you have not added the internal networks of the Central Site VPN L2L configurations at all so the traffic does not pass through the VPN.

     access-list outside_1_cryptomap extended permit ip 10.1.1.0 255.255.255.128 10.182.226.0 255.255.*.* access-list exempt extended permit ip 10.1.1.0 255.255.255.128 10.182.226.0 255.255.*.* access-list exempt extended permit ip 10.1.1.0 255.255.255.128 10.182.0.0 255.255.*.* access-list exempt extended permit ip 10.1.1.0 255.255.255.128 192.168.170.0 255.255.*.* access-list exempt extended permit ip 10.1.1.0 255.255.255.128 192.168.172.0 255.255.*.* access-list exempt extended permit ip 10.1.1.0 255.255.255.128 140.15.0.0 255.255.*.*

    Take a look at ACL configurations above. The 'exempt' ACL is used in configurations NAT0 and tells the ASA what traffic of exempting from NAT. "outside_1_cryptomap" ACL is used to tell the traffic between the subnets should be using the L2L VPN connection.

    So in short on the Remote Site ASA these ACLs should be identical. Make additions to the LIST of VPN L2L, then try again.

    I would also like to point out that to ensure that the Central ASAs L2L VPN ACL Site contains the same networks. The ACL on the Central Site will, of course, its internal subnets as the source and the site LAN remote destination.

    THW out of ' crypto ipsec to show his " shows you that only the SA between binding Site Central network and the Remote Site LAN was established. Others have not formed as the configuration is lacking at LEAST on the Remote Site ASA. Can also be the Central Site.

    -Jouni

  • Site to site VPN, I need all internet traffic to exit the site.

    I have 2 sites connected via a pair of SRX5308

    A = 192.168.1.0/24

    IP WAN = 1.1.1.1

    B = 192.168.2.0/24

    IP WAN = 2.2.2.2

    Now what I need to do, is to have all traffic from B to go to the site one even traffic destined to the internet. That is, I need internet traffic out of our network with the IP 1.1.1.1, even if it is from the network B.

    On my I have set up a route 1.1.1.1 of the ISP, then a value by default 0/0 to 192.168.1.1 it ASA knows how to get to the peer VPN is a more specific route, but sends everything above the tunnel, at the remote end which then hairpin of ASA routes internet outside its own WAN port traffic.

    I can understand though not how to so the same thing on the pair of SRX5308 they either don't raise the tunnel or internet route to the local site address B.

    Anyone have any ideas?

    I need to do this because we are logging and monitoring of internet traffic to A site via tapping from upstream to various IDS solutions and will not (cannot) reproduce this to all our remote sites.

    Thank you

    Dave.

    After some more thought and testing I came up with a workable solution to my own problem. I'll share it here in case it can help others.

    (1) use the wizard at both ends to implement a normal VPN that connects the two segments of network 192.168.1.0 and 192.168.2.0

    (2) go to site VPN - VPN policy remote router192.168.2.1 and click Edit

    (a) disable Netbios

    (b) select "None" from the drop-down list the remote IP address.

    (c) to apply the change

    3) go to the VPN-> VPN policy on the head end site (192.168.1.1) and click Edit

    (a) disable Netbios

    (b) select "None" from the drop-down list the local IP address

    (c) to apply the change

    Now all the traffic wil go down the VPN tunnel and exit to the internet on the site of head end. Hope this helps others with the same question.

  • Site to Site VPN configuration does not

    Hello

    I just tried to set up a test site to site VPN. Diagram of arrangement is attached. Router R2 is supposed to act as the 'Internet' to allow connectivity between the two networks.

    My VPN on ASA1 and ASA2 configs are below:

    ASA1

    Note to outside_cryptomap_1 to access list VPN traffic to encrypt
    outside_cryptomap_1 to access extended list ip 10.10.10.0 allow 255.255.255.0 172.16.10.0 255.225.255.0

    Crypto ikev1 allow outside
    IKEv1 crypto policy 1
    preshared authentication
    aes-256 encryption
    sha hash
    Group 5
    life 86400

    tunnel-group 11.11.11.2 type ipsec-l2l
    IPSec-attributes tunnel-Group 11.11.11.2
    Cisco pre-shared key IKEv1

    Crypto ipsec transform-set ikev1 AES - SHA esp-aes-256 esp-sha-hmac
    card crypto outside_map 1 match address outside_cryptomap_1
    peer set card crypto outside_map 1 11.11.11.2
    card crypto outside_map 1 set of transformation-AES-SHA
    outside_map interface card crypto outside

    ASA2

    Note to outside_cryptomap_1 to access list VPN traffic to encrypt
    permit access list extended ip 172.16.10.0 outside_cryptomap_1 255.255.255.0 10.10.10.0 255.225.255.0

    Crypto ikev1 allow outside
    IKEv1 crypto policy 1
    preshared authentication
    aes-256 encryption
    sha hash
    Group 5
    life 86400

    tunnel-group 12.12.12.2 type ipsec-l2l
    IPSec-attributes tunnel-group 12.12.12.2
    Cisco pre-shared key IKEv1

    Crypto ipsec transform-set ikev1 AES - SHA esp-aes-256 esp-sha-hmac
    card crypto outside_map 1 match address outside_cryptomap_1
    peer set card crypto outside_map 1 12.12.12.2
    card crypto outside_map 1 set of transformation-AES-SHA
    outside_map interface card crypto outside

    I can ping with the ASA2 ASA1, but when I try to test the VPN trying from one PC to another, I get nothing.

    I tried a few commands show and they came out absolutely empty... as I have not configured:

    SH in detail its crypto isakmp

    There are no SAs IKEv1

    There are no SAs IKEv2

    SH crypto ipsec his

    There is no ipsec security associations

    Anyone have any ideas?

    Hi martin,

    Your configs are quite right. I tried your script, its works really well. Here's the configs & outputs.
    What I mentioned in the previous note follow this.

    --------------------

    ASA1

    ASA1 (config) # sh run
    : Saved
    :
    ASA Version 8.0 (2)
    !
    hostname ASA1
    activate 8Ry2YjIyt7RRXU24 encrypted password
    names of
    !
    interface Ethernet0/0
    nameif outside
    security-level 0
    IP 12.12.12.2 255.255.255.0
    !
    interface Ethernet0/1
    nameif inside
    security-level 100
    10.10.10.2 IP address 255.255.255.0
    !
    interface Ethernet0/2
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    interface Ethernet0/3
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    interface Ethernet0/4
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    interface Ethernet0/4
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    interface Ethernet0/5
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    2KFQnbNIdI.2KYOU encrypted passwd
    passive FTP mode
    extended vpn 10.10.10.0 ip access list allow 255.255.255.0 172.16.10.0 255.255.255.0
    pager lines 24
    Within 1500 MTU
    Outside 1500 MTU
    no failover
    ICMP unreachable rate-limit 1 burst-size 1
    don't allow no asdm history
    ARP timeout 14400
    Route outside 0.0.0.0 0.0.0.0 12.12.12.1 1
    Timeout xlate 03:00
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout, uauth 0:05:00 absolute
    dynamic-access-policy-registration DfltAccessPolicy
    No snmp server location
    No snmp Server contact
    Server enable SNMP traps snmp authentication linkup, linkdown cold start
    Crypto ipsec transform-set esp-3des esp-sha-hmac tset
    card crypto cmap 1 match for vpn
    card crypto cmap 1 set peer 11.11.11.2
    card crypto cmap 1 transform-set tset
    cmap outside crypto map interface
    crypto ISAKMP allow outside
    crypto ISAKMP policy 1
    preshared authentication
    3des encryption
    md5 hash
    Group 5
    life 86400
    crypto ISAKMP policy 65535
    preshared authentication
    3des encryption
    sha hash
    Group 2
    life 86400
    Telnet timeout 5
    SSH timeout 5
    Console timeout 0
    a basic threat threat detection
    Statistics-list of access threat detection
    !
    !
    tunnel-group 11.11.11.2 type ipsec-l2l
    IPSec-attributes tunnel-Group 11.11.11.2
    pre-shared-key *.
    context of prompt hostname
    Cryptochecksum:00000000000000000000000000000000
    : end
    ASA1 (config) #.
    ---------------------

    ASA2 (config) # sh run
    : Saved
    :
    ASA Version 8.0 (2)
    !
    hostname ASA2
    activate 8Ry2YjIyt7RRXU24 encrypted password
    names of
    !
    interface Ethernet0/0
    nameif outside
    security-level 0
    IP 11.11.11.2 255.255.255.0
    !
    interface Ethernet0/1
    nameif inside
    security-level 100
    IP 172.16.10.2 255.255.255.0
    !
    interface Ethernet0/2
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    interface Ethernet0/3
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    interface Ethernet0/4
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    interface Ethernet0/5
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    2KFQnbNIdI.2KYOU encrypted passwd
    passive FTP mode
    extended vpn 172.16.10.0 ip access list allow 255.255.255.0 10.10.10.0 255.255.255.0
    pager lines 24
    Outside 1500 MTU
    Within 1500 MTU
    no failover
    ICMP unreachable rate-limit 1 burst-size 1
    don't allow no asdm history
    ARP timeout 14400
    Route outside 0.0.0.0 0.0.0.0 11.11.11.1 1
    Timeout xlate 03:00
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout, uauth 0:05:00 absolute
    dynamic-access-policy-registration DfltAccessPolicy
    No snmp server location
    No snmp Server contact
    Server enable SNMP traps snmp authentication linkup, linkdown cold start
    Crypto ipsec transform-set esp-3des esp-sha-hmac tset
    card crypto cmap 1 match for vpn
    card crypto cmap 1 set peer 12.12.12.2
    card crypto cmap 1 transform-set tset
    cmap outside crypto map interface
    crypto ISAKMP allow outside
    crypto ISAKMP policy 1
    preshared authentication
    3des encryption
    md5 hash
    Group 5
    life 86400
    crypto ISAKMP policy 65535
    preshared authentication
    3des encryption
    sha hash
    Group 2
    life 86400
    Telnet timeout 5
    SSH timeout 5
    Console timeout 0
    a basic threat threat detection
    Statistics-list of access threat detection
    !
    !
    !
    tunnel-group 12.12.12.2 type ipsec-l2l
    IPSec-attributes tunnel-group 12.12.12.2
    pre-shared-key *.
    context of prompt hostname
    Cryptochecksum:00000000000000000000000000000000
    : end
    ASA2 (config) #.

    -------------------------
    OUTPUTS:

    *********************

    ASA1 (config) # sh crypto isakmp his

    ITS enabled: 1
    Generate a new key SA: 0 (a tunnel report Active 1 and 1 to generate a new key during the generate a new key)
    Total SA IKE: 1

    1 peer IKE: 11.11.11.2
    Type: L2L role: initiator
    Generate a new key: no State: MM_ACTIVE

    ---------------------

    ASA1 (config) # sh crypto ipsec his
    Interface: outside
    Tag crypto map: cmap, seq num: 1, local addr: 12.12.12.2

    access vpn ip 10.10.10.0 list allow 255.255.255.0 172.16.10.0 255.255.255.0
    local ident (addr, mask, prot, port): (10.10.10.0/255.255.255.0/0/0)
    Remote ident (addr, mask, prot, port): (172.16.10.0/255.255.255.0/0/0)
    current_peer: 11.11.11.2

    #pkts program: 50, #pkts encrypt: 50, #pkts digest: 50
    #pkts decaps: 49, #pkts decrypt: 49, #pkts check: 49
    compressed #pkts: 0, unzipped #pkts: 0
    #pkts uncompressed: 50, comp #pkts failed: 0, #pkts Dang failed: 0
    success #frag before: 0, failures before #frag: 0, #fragments created: 0
    Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
    #send errors: 0, #recv errors: 0

    local crypto endpt. : 12.12.12.2, remote Start crypto. : 11.11.11.2

    ------------------------
    ASA2 (config) # sh crypto isakmp his

    ITS enabled: 1
    Generate a new key SA: 0 (a tunnel report Active 1 and 1 to generate a new key during the generate a new key)
    Total SA IKE: 1

    1 peer IKE: 12.12.12.2
    Type: L2L role: answering machine
    Generate a new key: no State: MM_ACTIVE

    ------------------------

    ASA2 (config) # sh crypto ipsec his
    Interface: outside
    Tag crypto map: cmap, seq num: 1, local addr: 11.11.11.2

    access vpn ip 172.16.10.0 list allow 255.255.255.0 10.10.10.0 255.255.255.0
    local ident (addr, mask, prot, port): (172.16.10.0/255.255.255.0/0/0)
    Remote ident (addr, mask, prot, port): (10.10.10.0/255.255.255.0/0/0)
    current_peer: 12.12.12.2

    #pkts program: 49, #pkts encrypt: 49, #pkts digest: 49
    #pkts decaps: 50, #pkts decrypt: 50, #pkts check: 50
    compressed #pkts: 0, unzipped #pkts: 0
    #pkts uncompressed: 49, #pkts comp failed: 0, #pkts Dang failed: 0
    success #frag before: 0, failures before #frag: 0, #fragments created: 0
    Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
    #send errors: 0, #recv errors: 0

    local crypto endpt. : 11.11.11.2, remote Start crypto. : 12.12.12.2
    -------------------------

  • 887VDSL2 IPSec site to site vpn does NOT use the easy vpn

    Much of community support.

    as I'm looking through the config Guide about 870 router series, only to find information about the config with eazy vpn.

    is there a classic way, about 870 Series site 2 site without eazy vpn IPSec configuration?

    Have a classic way if a tunnel? Have the 870 is not as a vpn client?

    Thank you

    Of course, here's example of Site to Site VPN configuration for your reference:

    http://www.Cisco.com/en/us/Tech/tk583/TK372/technologies_configuration_example09186a0080194650.shtml

    http://www.Cisco.com/en/us/products/HW/routers/ps221/products_configuration_example09186a008073e078.shtml

    Hope that helps.

  • Troubleshooting IPSec Site to Site VPN between ASA and 1841

    Hi all

    in the past I've implemented several VPN connections between the devices of the SAA. So I thought a site link between an ASA site and 1841 would be easier... But it seems I was mistaken.

    I configured a VPN Site to Site, as it has been described in the Document ID: SDM 110198: IPsec Site to Site VPN between ASA/PIX and an example of IOS Router Configuration (I have not used SDM but CCP).

    I have run the wizards on the ASA with ASDM and the current IOS version 15.1 1841, with CCP.

    It seems to Phase 1 and 2 are coming although my ASA in ADSM reports (monitoring > VPN > VPN statistics > Sessions) a tunnel established with some of the Tx traffic but 0 Rx traffic),

    On the ASA:

    Output of the command: "sh crypto ipsec its peer 217.xx.yy.zz.

    address of the peers: 217.86.154.120
    Crypto map tag: VPN-OUTSIDE, seq num: 2, local addr: 62.aa.bb.cc

    access extensive list ip 192.168.37.0 outside_2_cryptomap_1 allow 255.255.255.0 172.20.2.0 255.255.255.0
    local ident (addr, mask, prot, port): (LAN-A/255.255.255.0/0/0)
    Remote ident (addr, mask, prot, port): (LAN-G/255.255.255.0/0/0)
    current_peer: 217.xx.yy.zz

    #pkts program: 400, #pkts encrypt: 400, #pkts digest: 400
    #pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0
    compressed #pkts: 0, unzipped #pkts: 0
    #pkts uncompressed: 400, comp #pkts failed: 0, #pkts Dang failed: 0
    success #frag before: 0, failures before #frag: 0, #fragments created: 0
    Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
    #send errors: 0, #recv errors: 0

    local crypto endpt. : 62.aa.bb.cc, remote Start crypto. : 217.xx.yy.zz

    Path mtu 1500, fresh ipsec generals 58, media, mtu 1500
    current outbound SPI: 39135054
    current inbound SPI: B2E9E500

    SAS of the esp on arrival:
    SPI: 0xB2E9E500 (3001672960)
    transform: esp-3des esp-sha-hmac no compression
    running parameters = {L2L, Tunnel, PFS 2 group}
    slot: 0, id_conn: 100327424, crypto-map: VPN-OUTSIDE
    calendar of his: service life remaining (KB/s) key: (4374000/1598)
    Size IV: 8 bytes
    support for replay detection: Y
    Anti-replay bitmap:
    0x00000000 0x00000001
    outgoing esp sas:
    SPI: 0 x 39135054 (957567060)
    transform: esp-3des esp-sha-hmac no compression
    running parameters = {L2L, Tunnel, PFS 2 group}
    slot: 0, id_conn: 100327424, crypto-map: VPN-OUTSIDE
    calendar of his: service life remaining (KB/s) key: (4373976/1598)
    Size IV: 8 bytes
    support for replay detection: Y
    Anti-replay bitmap:
    0x00000000 0x00000001

    Output of the command: "sh crypto isakmp his."

    HIS active: 4
    Generate a new key SA: 0 (a tunnel report Active 1 and 1 to generate a new key during the generate a new key)
    Total SA IKE: 4

    IKE Peer: 217.xx.yy.zz
    Type: L2L role: initiator
    Generate a new key: no State: MM_ACTIVE

    On the 1841

    1841 crypto isakmp #sh its
    IPv4 Crypto ISAKMP Security Association
    DST CBC conn-State id
    217.86.154.120 62.153.156.163 QM_IDLE 1002 ACTIVE

    1841 crypto ipsec #sh its

    Interface: Dialer1
    Tag crypto map: SDM_CMAP_1, local addr 217.86.154.120

    protégé of the vrf: (none)
    local ident (addr, mask, prot, port): (172.20.2.0/255.255.255.0/0/0)
    Remote ident (addr, mask, prot, port): (192.168.37.0/255.255.255.0/0/0)
    current_peer 62.153.156.163 port 500
    LICENCE, flags is {origin_is_acl},
    #pkts program: encrypt 0, #pkts: 0, #pkts digest: 0
    #pkts decaps: 585, #pkts decrypt: 585, #pkts check: 585
    compressed #pkts: 0, unzipped #pkts: 0
    #pkts uncompressed: 0, #pkts compr. has failed: 0
    #pkts not unpacked: 0, #pkts decompress failed: 0
    Errors #send 0, #recv 0 errors

    local crypto endpt. : 217.86.154.120, remote Start crypto. : 62.153.156.163
    Path mtu 1452, ip mtu 1452, ip mtu BID Dialer1
    current outbound SPI: 0xB2E9E500 (3001672960)
    PFS (Y/N): Y, Diffie-Hellman group: group2

    SAS of the esp on arrival:
    SPI: 0 x 39135054 (957567060)
    transform: esp-3des esp-sha-hmac.
    running parameters = {Tunnel}
    Conn ID: 2003, flow_id: FPGA:3, sibling_flags 80000046, card crypto: SDM_CMAP_1
    calendar of his: service life remaining (k/s) key: (4505068/1306)
    Size IV: 8 bytes
    support for replay detection: Y
    Status: ACTIVE

    the arrival ah sas:

    SAS of the CFP on arrival:

    outgoing esp sas:
    SPI: 0xB2E9E500 (3001672960)
    transform: esp-3des esp-sha-hmac.
    running parameters = {Tunnel}
    Conn ID: 2004, flow_id: FPGA:4, sibling_flags 80000046, card crypto: SDM_CMAP_1
    calendar of his: service life remaining (k/s) key: (4505118/1306)
    Size IV: 8 bytes
    support for replay detection: Y
    Status: ACTIVE

    outgoing ah sas:

    outgoing CFP sas:

    Interface: virtual Network1
    Tag crypto map: SDM_CMAP_1, local addr 217.86.154.120

    protégé of the vrf: (none)
    local ident (addr, mask, prot, port): (172.20.2.0/255.255.255.0/0/0)
    Remote ident (addr, mask, prot, port): (192.168.37.0/255.255.255.0/0/0)
    current_peer 62.153.156.163 port 500
    LICENCE, flags is {origin_is_acl},
    #pkts program: encrypt 0, #pkts: 0, #pkts digest: 0
    #pkts decaps: 585, #pkts decrypt: 585, #pkts check: 585
    compressed #pkts: 0, unzipped #pkts: 0
    #pkts uncompressed: 0, #pkts compr. has failed: 0
    #pkts not unpacked: 0, #pkts decompress failed: 0
    Errors #send 0, #recv 0 errors

    local crypto endpt. : 217.86.154.120, remote Start crypto. : 62.153.156.163
    Path mtu 1452, ip mtu 1452, ip mtu BID Dialer1
    current outbound SPI: 0xB2E9E500 (3001672960)
    PFS (Y/N): Y, Diffie-Hellman group: group2

    SAS of the esp on arrival:
    SPI: 0 x 39135054 (957567060)
    transform: esp-3des esp-sha-hmac.
    running parameters = {Tunnel}
    Conn ID: 2003, flow_id: FPGA:3, sibling_flags 80000046, card crypto: SDM_CMAP_1
    calendar of his: service life remaining (k/s) key: (4505068/1306)
    Size IV: 8 bytes
    support for replay detection: Y
    Status: ACTIVE

    the arrival ah sas:

    SAS of the CFP on arrival:

    outgoing esp sas:
    SPI: 0xB2E9E500 (3001672960)
    transform: esp-3des esp-sha-hmac.
    running parameters = {Tunnel}
    Conn ID: 2004, flow_id: FPGA:4, sibling_flags 80000046, card crypto: SDM_CMAP_1
    calendar of his: service life remaining (k/s) key: (4505118/1306)
    Size IV: 8 bytes
    support for replay detection: Y
    Status: ACTIVE

    outgoing ah sas:

    outgoing CFP sas:

    It seems that the routing on the 1841 is working properly as I can tear down the tunnel and relaunch in scathing a host on the network of 1841, but not vice versa.

    Trounleshoot VPN of the 1841 report shows a message like "the following sources are forwarded through the interface card crypto.      (172.20.2.0 1) go to "Configure-> routing" and correct the routing table.

    I have not found an error on the 1841 config so if one of the guys reading this thread has an idea I appreciate highly suspicion!

    It's the running of the 1841 configuration

    !
    version 15.1
    horodateurs service debug datetime msec
    Log service timestamps datetime msec
    encryption password service
    !
    host name 1841
    !
    boot-start-marker
    start the system flash c1841-adventerprisek9 - mz.151 - 1.T.bin
    boot-end-marker
    !
    logging buffered 51200 notifications
    !
    AAA new-model
    !
    !
    AAA authentication login default local
    !
    AAA - the id of the joint session
    !
    iomem 20 memory size
    clock timezone PCTime 1
    PCTime of summer time clock day March 30, 2003 02:00 October 26, 2003 03:00
    dot11 syslog
    IP source-route
    !
    No dhcp use connected vrf ip
    !
    IP cef
    no ip bootp Server
    IP domain name test
    name of the IP-server 194.25.2.129
    name of the IP-server 194.25.2.130
    name of the IP-server 194.25.2.131
    name of the IP-server 194.25.2.132
    name of the IP-server 194.25.2.133
    No ipv6 cef
    !
    Authenticated MultiLink bundle-name Panel
    !
    !
    object-group network phone
    VoIP phone description
    Home 172.20.2.50
    Home 172.20.2.51
    !
    redundancy
    !
    !
    controller LAN 0/0/0
    atm mode
    Annex symmetrical shdsl DSL-mode B
    !
    !
    crypto ISAKMP policy 1
    BA 3des
    preshared authentication
    Group 2
    isakmp encryption key * address 62.aa.bb.cc
    !
    !
    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
    !
    map SDM_CMAP_1 1 ipsec-isakmp crypto
    Description Tunnel to62.aa.bb.cc
    the value of 62.aa.bb.cc peer
    game of transformation-ESP-3DES-SHA
    PFS group2 Set
    match address 100
    !
    !
    !
    interface FastEthernet0/0
    DMZ description $ FW_OUTSIDE$
    10.10.10.254 IP address 255.255.255.0
    IP nat inside
    IP virtual-reassembly
    automatic duplex
    automatic speed
    !
    interface FastEthernet0/1
    Description $ETH - LAN$ $FW_INSIDE$
    IP 172.20.2.254 255.255.255.0
    IP access-group 100 to
    IP nat inside
    IP virtual-reassembly
    IP tcp adjust-mss 1412
    automatic duplex
    automatic speed
    !
    ATM0/0/0 interface
    no ip address
    No atm ilmi-keepalive
    !
    point-to-point interface ATM0/0/0.1
    PVC 1/32
    PPPoE-client dial-pool-number 1
    !
    !
    interface Dialer1
    Description $FW_OUTSIDE$
    the negotiated IP address
    IP mtu 1452
    NAT outside IP
    IP virtual-reassembly
    encapsulation ppp
    Dialer pool 1
    Dialer-Group 2
    PPP authentication chap callin pap
    PPP chap hostname xxxxxxx
    PPP chap password 7 xxxxxxx8
    PPP pap sent-name of user password xxxxxxx xxxxxxx 7
    map SDM_CMAP_1 crypto
    !
    IP forward-Protocol ND
    IP http server
    local IP http authentication
    IP http secure server
    !
    !
    The dns server IP
    IP nat inside source static tcp 10.10.10.1 808 interface Dialer1 80
    IP nat inside source static tcp 10.10.10.1 25 25 Dialer1 interface
    IP nat inside source overload map route SDM_RMAP_1 interface Dialer1
    IP nat inside source overload map route SDM_RMAP_2 interface Dialer1
    IP route 0.0.0.0 0.0.0.0 Dialer1 permanent
    !
    logging trap notifications
    Note category of access list 1 = 2 CCP_ACL
    access-list 1 permit 172.20.2.0 0.0.0.255
    Note access-list category 2 CCP_ACL = 2
    access-list 2 allow 10.10.10.0 0.0.0.255
    Note access-list 100 category CCP_ACL = 4
    Note access-list 100 IPSec rule
    access-list 100 permit ip 172.20.2.0 0.0.0.255 192.168.37.0 0.0.0.255
    Note CCP_ACL the access list 101 = 2 category
    Note access-list 101 IPSec rule
    access-list 101 deny ip 172.20.2.0 0.0.0.255 192.168.37.0 0.0.0.255
    access-list 101 permit ip 172.20.2.0 0.0.0.255 any
    Note access-list 102 CCP_ACL category = 2
    Note access-list 102 IPSec rule
    access-list 102 deny ip 172.20.2.0 0.0.0.255 192.168.37.0 0.0.0.255
    access-list 102 permit ip 10.10.10.0 0.0.0.255 any
    !

    !
    allowed SDM_RMAP_1 1 route map
    corresponds to the IP 101
    !
    allowed SDM_RMAP_2 1 route map
    corresponds to the IP 102
    !
    !
    control plan
    !
    !
    Line con 0
    line to 0
    line vty 0 4
    length 0
    transport input telnet ssh
    !
    Scheduler allocate 20000 1000
    NTP-Calendar Update
    NTP 172.20.2.250 Server prefer
    end

    As I mentioned previously: suspicion is much appreciated!

    Best regards

    Joerg

    Joerg,

    ASA receives not all VPN packages because IOS does not send anything.

    Try to send packets to the 1841 LAN to LAN of the ASA and see is the "sh cry ips its" on the 1841 increments the encrypted packets (there not)

    The problem seems so on the side of the router.

    I think that is a routing problem, but you only have one default gateway (no other channels on the router).

    The ACL 100 is set to encrypt the traffic between the two subnets.

    It seems that the ACL 101 is also bypassing NAT for VPN traffic.

    Follow these steps:

    Try running traffic of LAN router inside IP (source of ping 192.168.37.x 172.20.2.254) and see if the packages are not through the translation and obtaining encrypted.

    I would also like to delete 100 ACL from the inside interface on the router because it is used for the VPN. You can create an another ACL to apply to the interface.

    Federico.

  • Site to Site VPN tunnel is not come between 2 routers

    Dear all,

    I have 2 routers for branch which is configured for VPN site-to-site, but the tunnel does not come!

    I ran debug and I enclose herwith output for your kind review and recommendation. I also enclose here the 2 routers configs branch.

    Any idea on why the Site to site VPN is not coming?

    Kind regards

    Haitham

    You guessed it!

    Just because you have re-used the same card encryption for LAN to LAN and vpn-client traffic.

    This from the DOC CD

    No.-xauth

    (Optional) Use this keyword if the router to router IP Security (IPSec) is on the same card encryption as a virtual private network (VPN) - client - to-Cisco-IOS IPSec. This keyword prevents the router causing the peer for the information of extended authentication (Xauth) (username and password).

  • Site to site VPN works only on Cisco 881

    I have 2 problems with a cisco 881. The first problem is that Vlan2 (192.168.5.xx) cannot access the internet on the outside. But I know that the router has internet, because I can ping the external ip address. The 2nd problem is that I have a set of site to another upward, but when I test the Site to site I get this error:

    destination of traffic of the tunnel must be channelled through the crypto map interface. The destination following (s) doesn't have a routing entry in the routing table
    192.168.2.0

    I copied the config form this router from another cisco 881 work, where everything works. The only difference is that this router needs a site to site vpn connection.

    My question is how I can get internet on vlan2 and who can I solve the connection to site to site.

    Here's the running configuration:

    Building configuration...

    Current configuration: 12698 bytes
    !
    version 15.3
    horodateurs service debug datetime msec
    Log service timestamps datetime msec
    no password encryption service
    !
    hostname Cisco_881
    !
    boot-start-marker
    boot-end-marker
    !
    AQM-registry-fnf
    !
    logging buffered 51200 warnings
    !
    AAA new-model
    !
    !
    AAA authentication login default local
    AAA authorization exec default local
    AAA authorization network default local
    !
    !
    !
    !
    !
    AAA - the id of the joint session
    !
    Crypto pki trustpoint TP-self-signed-1151531093
    enrollment selfsigned
    name of the object cn = IOS - Self - signed - certificate - 1151531093
    revocation checking no
    rsakeypair TP-self-signed-1151531093
    !
    Crypto pki trustpoint TP-self-signed-2011286623
    enrollment selfsigned
    name of the object cn = IOS - Self - signed - certificate - 2011286623
    revocation checking no
    rsakeypair TP-self-signed-2011286623
    !
    !
    TP-self-signed-1151531093 crypto pki certificate chain
    certificate self-signed 01
    3082022B 30820194 02020101 300 D 0609 2A 864886 F70D0101 05050030 A0030201
    2 060355 04031326 494F532D 53656 C 66 2 AND 536967 6E65642D 43657274 31312F30
    69666963 31313531 35333130 6174652D 3933301E 170 3135 30343031 31363230
    34315A 17 0D 323030 31303130 30303030 305A 3031 06035504 03132649 312F302D
    4F532D53 5369676E 656C662D 43 65727469 66696361 74652 31 31353135 65642D
    33313039 3330819F 300 D 0609 2A 864886 01050003, 818, 0030, 81890281 F70D0101
    8100AC6E E7FA8AFD 9D4E206C 2B23DFC1 990AFDB3 98CD84A7 37697253 A7EF2520
    0C45190E 298B6E9F E2711580 80DCFBFB 05A6A0BA 347B960B D9DA17FC B1543B9D
    FBC048F3 063EBBC5 02391432 F0232A73 EAC7278E 8CB83005 D13A1D47 BEF18198
    A 547469, 2 F65ED0E6 249BF517 1E74117D C94BE542 46EE487D A3843F12 364639B 4
    0B 090203 010001 HAS 3 53305130 1 130101 FF040530 030101FF 301F0603 0F060355
    551 2304 18301680 147996F4 3E6D0EE2 2D9065BB D726137C 2DF42ABE 01301D 06
    03551D0E 04160414 7996F43E 6D0EE22D 9065BBD7 26137C2D F42ABE01 300 D 0609
    2A 864886 F70D0101 8181002A 05050003 677B9BE6 CB60D188 73227C4B 2DC33101
    BD448017 EDEF0296 FF7438A3 4C46519B 144C775F 1429CF06 7DB29F2D EB16EE75
    22100B 63 0D75511A 98DC57DC EF87BED2 1C1635C8 B5352706 3963037A 4E9B739A
    3A1EC9BE 8431BD70 116D3B31 E4A2AC4C 0F934B3F 196AF829 AD537005 6935B 451
    EB31DB3F A9BA6D70 65B70D19 D00158
    quit smoking
    TP-self-signed-2011286623 crypto pki certificate chain
    no ip source route
    !
    !
    !
    !

    !
    DHCP excluded-address IP 10.10.10.1
    DHCP excluded-address IP 192.168.5.1 192.168.5.49
    DHCP excluded-address IP 192.168.5.150 192.168.5.254
    !
    DHCP IP CCP-pool
    import all
    Network 10.10.10.0 255.255.255.248
    default router 10.10.10.1
    Rental 2 0
    !
    IP dhcp Internet pool
    network 192.168.5.0 255.255.255.0
    router by default - 192.168.5.254
    DNS-Server 64.59.135.133 64.59.128.120
    lease 6 0
    !
    !
    !
    no ip domain search
    "yourdomain.com" of the IP domain name
    name of the IP-Server 64.59.135.133
    name of the IP-Server 64.59.128.120
    IP cef
    No ipv6 cef
    !
    !
    !
    !
    !
    Authenticated MultiLink bundle-name Panel
    !
    !
    !
    !
    !
    !
    !
    udi pid C881-K9 sn FTX18438503 standard license
    !
    !
    Archives
    The config log
    hidekeys
    username * privilege 15 secret 5 $1$IBY.$X5/iqYy47a5vAWWuG4/Oa/
    username * secret 5 $1$ 17 ST$ QzJMvQnZ9Q.1y7u0rYXFa0
    username * secret 5 $1$ L4W9$ zBKpawZ3i5nXxwyS9H6Lf1
    !
    !
    !
    !
    !
    no passive ftp ip
    !
    !
    crypto ISAKMP policy 1
    BA aes 256
    preshared authentication
    Group 2
    !
    crypto ISAKMP policy 2
    BA 3des
    preshared authentication
    Group 2
    isakmp encryption key * address 208.98.212.xx
    !
    Configuration group crypto isakmp MPE client
    key *.
    pool VPN_IP_POOL
    ACL 100
    include-local-lan
    10 Max-users
    netmask 255.255.255.0
    banner ^ practive entered the field

    This area is reserved for administrators of control systems.

    If you are here by mistake, please disconnect immediately.

    You have full access to 192.168.125.0 / 0.0.0.255

    Support on continue to start your session.              ^ C
    !
    Configuration group customer crypto isakmp PALL
    key *.
    pool VPN_IP_POOL_PALL
    ACL 101
    include-local-lan
    Max - 1 users
    netmask 255.255.255.0
    banner ^ practive entered the field

    This area is limited to the PALL access only.

    If you are here by mistake, please disconnect immediately.

    You have full access to 192.168.125.0 / 0.0.0.255

    Support on continue to start your session.            ^ C
    ISAKMP crypto profile vpn_isakmp_profile
    game of identity EMT group
    client authentication list default
    Default ISAKMP authorization list
    client configuration address respond
    virtual-model 1
    ISAKMP crypto profile vpn_isakmp_profile_2
    match of group identity PALL
    client authentication list default
    Default ISAKMP authorization list
    client configuration address respond
    virtual-model 2
    !
    !
    Crypto ipsec transform-set esp - aes 256 esp-sha-hmac VPN_TRANSFORM
    tunnel mode
    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
    tunnel mode
    !
    Profile of crypto ipsec VPN_PROFILE_MPE
    Set the security association idle time 3600
    game of transformation-VPN_TRANSFORM
    vpn_isakmp_profile Set isakmp-profile
    !
    Profile of crypto ipsec VPN_PROFILE_PALL
    Set the security association idle time 1800
    game of transformation-VPN_TRANSFORM
    vpn_isakmp_profile_2 Set isakmp-profile
    !
    !
    !
    map SDM_CMAP_1 1 ipsec-isakmp crypto
    Description Tunnel to208.98.212.xx
    the value of 208.98.212.xx peer
    game of transformation-ESP-3DES-SHA
    match address 102
    !
    !
    !
    !
    !
    !
    interface Loopback0
    IP 192.168.40.254 255.255.255.0
    !
    interface FastEthernet0
    no ip address
    !
    interface FastEthernet1
    no ip address
    !
    interface FastEthernet2
    switchport access vlan 2
    no ip address
    !
    interface FastEthernet3
    switchport access vlan 2
    no ip address
    !
    interface FastEthernet4
    IP address 208.98.213.xx 255.255.255.224
    IP access-group 111 to
    NAT outside IP
    IP virtual-reassembly in
    automatic duplex
    automatic speed
    map SDM_CMAP_1 crypto
    !
    type of interface virtual-Template1 tunnel
    IP unnumbered Loopback0
    ipv4 ipsec tunnel mode
    Tunnel VPN_PROFILE_MPE ipsec protection profile
    !
    tunnel type of interface virtual-Template2
    IP unnumbered Loopback0
    ipv4 ipsec tunnel mode
    Tunnel VPN_PROFILE_PALL ipsec protection profile
    !
    interface Vlan1
    Description of control network
    IP 192.168.125.254 255.255.255.0
    IP access-group CONTROL_IN in
    IP access-group out CONTROL_OUT
    IP nat inside
    IP virtual-reassembly in
    IP tcp adjust-mss 1452
    !
    interface Vlan2
    Description Internet network
    IP 192.168.5.254 255.255.255.0
    IP access-group INTERNET_IN in
    IP access-group out INTERNET_OUT
    IP nat inside
    IP virtual-reassembly in
    !
    local IP VPN_IP_POOL 192.168.40.100 pool 192.168.40.150
    local IP VPN_IP_POOL_PALL 192.168.40.151 pool 192.168.40.152
    IP forward-Protocol ND
    IP http server
    23 class IP http access
    local IP http authentication
    IP http secure server
    IP http timeout policy slowed down 60 life 86400 request 10000
    !
    !
    IP nat inside source static tcp 192.168.125.2 25000 25000 FastEthernet4 interface
    IP nat inside source overload map route SDM_RMAP_1 interface FastEthernet4
    IP route 0.0.0.0 0.0.0.0 FastEthernet4 permanent 208.98.236.xx
    !
    CONTROL_IN extended IP access list
    Note the access control
    Note the category CCP_ACL = 17
    allow any host 192.168.125.254 eq non500-isakmp udp
    allow any host 192.168.125.254 eq isakmp udp
    allow any host 192.168.125.254 esp
    allow any host 192.168.125.254 ahp
    IP 192.168.125.0 allow 0.0.0.255 192.168.125.0 0.0.0.255
    Note the VPN access
    IP 192.168.125.0 allow 0.0.0.255 192.168.40.0 0.0.0.255
    Note Access VNC
    permit tcp host 192.168.125.2 eq 25000 one
    Comment by e-mail to WIN911
    permit tcp host 192.168.125.2 any eq smtp
    Note DNS traffic
    permit udp host 192.168.125.2 host 64.59.135.133 eq field
    permit udp host 192.168.125.2 host 64.59.128.120 eq field
    Note Everything Else block
    refuse an entire ip
    CONTROL_OUT extended IP access list
    Note the access control
    IP 192.168.125.0 allow 0.0.0.255 192.168.125.0 0.0.0.255
    Note the VPN access
    ip permit 192.168.40.0 0.0.0.255 192.168.125.0 0.0.0.255
    Note Access VNC
    allow any host 192.168.125.2 eq 25000 tcp
    Comment by e-mail to WIN911
    allow any host 192.168.125.2 eq smtp tcp
    Note DNS responses
    allowed from any host domain eq 192.168.125.2 udp
    Note deny all other traffic
    refuse an entire ip
    INTERNET_IN extended IP access list
    Note Access VNC on VLAN
    allow any host 192.168.125.2 eq 25000 tcp
    Note block all other controls and VPN
    deny ip any 192.168.125.0 0.0.0.255
    deny ip any 192.168.40.0 0.0.0.255
    Note leave all other traffic
    allow an ip
    INTERNET_OUT extended IP access list
    Note a complete outbound Internet access
    allow an ip
    WAN_IN extended IP access list
    allow an ip host 207.229.14.xx
    Note PERMIT ESTABLISHED TCP connections
    allow any tcp smtp created everything eq
    Note ALLOW of DOMAIN CONNECTIONS
    permit udp host 64.59.135.133 eq field all
    permit udp host 64.59.128.120 eq field all
    Note ALLOW ICMP WARNING RETURNS
    allow all all unreachable icmp
    permit any any icmp parameter problem
    allow icmp all a package-too-big
    allow a whole icmp administratively prohibited
    permit icmp any any source-quench
    allow icmp all once exceed
    refuse a whole icmp
    allow an ip
    !
    auto discovering IP sla
    not run cdp
    !
    allowed SDM_RMAP_1 1 route map
    corresponds to the IP 103
    !
    access-list 1 remark out to WAN routing
    Note CCP_ACL the access list 1 = 16 category
    access-list 1 permit 192.168.125.2
    access-list 1 permit 192.168.5.0 0.0.0.255
    Note access-list 23 SSH and HTTP access permissions
    access-list 23 permit 192.168.125.0 0.0.0.255
    access-list 23 permit 192.168.40.0 0.0.0.255
    access-list 23 allow one
    Note access-list 100 VPN traffic
    access-list 100 permit ip 192.168.125.0 0.0.0.255 any
    access-list 100 permit ip 192.168.40.0 0.0.0.255 any
    Note access-list 101 for PALL VPN traffic
    access-list 101 permit ip 192.168.125.0 0.0.0.255 any
    Note access-list 102 CCP_ACL category = 4
    Note access-list 102 IPSec rule
    access-list 102 permit ip 192.168.5.0 0.0.0.255 192.168.2.0 0.0.1.255
    Note access-list 103 CCP_ACL category = 2
    Note access-list 103 IPSec rule
    access-list 103 deny ip 192.168.5.0 0.0.0.255 192.168.2.0 0.0.1.255
    access-list 103 allow ip 192.168.5.0 0.0.0.255 any
    access-list 103 allow the host ip 192.168.125.2 all
    Note access-list 111 CCP_ACL category = 17
    access-list 111 permit udp any host 208.98.213.xx eq non500-isakmp
    access-list 111 permit udp any host 208.98.213.xx eq isakmp
    access-list 111 allow esp any host 208.98.213.xx
    access-list 111 allow ahp any host 208.98.213.xx
    Note access-list 111 IPSec rule
    access-list 111 permit ip 192.168.2.0 0.0.1.255 192.168.5.0 0.0.0.255
    Note access-list 111 IPSec rule
    access-list 111 permit ip 192.168.2.0 0.0.1.255 192.168.4.0 0.0.1.255
    access-list 111 permit udp host 208.98.212.xx host 208.98.213.xx eq non500-isakmp
    access-list 111 permit udp host 208.92.12.xx host 208.92.13.xx eq isakmp
    access-list 111 allow esp host 208.92.12.xx host 208.92.13.xx
    access-list 111 allow ahp host 208.92.12.xx host 208.92.13.xx
    access-list 111 permit icmp any host 208.92.13.xx
    access-list 111 permit tcp any host 208.92.13.xx eq 25000
    access-list 111 permit tcp any host 208.92.13.xx eq 22
    access-list 111 permit tcp any host 208.92.13.xx eq telnet
    access-list 111 permit tcp any host 208.92.13.xx eq www
    !
    !
    !
    control plan
    !
    !
    !
    MGCP behavior considered range tgcp only
    MGCP comedia-role behavior no
    disable the behavior MGCP comedia-check-media-src
    disable the behavior of MGCP comedia-sdp-force
    !
    profile MGCP default
    !
    !
    !
    !
    exec banner ^ C
    % Warning of password expiration.
    -----------------------------------------------------------------------

    Unplug IMMEDIATELY if you are not an authorized user
    ^ C
    !
    Line con 0
    no activation of the modem
    line to 0
    line vty 0 4
    access-class 23 in
    password *.
    transport input telnet ssh
    transportation out all
    line vty 5 15
    access-class 160 in
    password *.
    transport of entry all
    transportation out all
    !
    max-task-time 5000 Planner
    Scheduler allocate 20000 1000
    !
    end

    Thank you.

    It seems that DNS has failed, because it is indeed happened to internet, but it does not work when internet DNS resolution.

    Go ahead and try to ping this 157.166.226.25, and it's on the browser http://157.166.226.25/, CNN.com. Let's try those. Also just in case where to configure a DNS SERVER on your router.

    - http://www.cisco.com/c/en/us/support/docs/ip/domain-name-system-dns/2418...

    Disable any ZBF just in case.

    David Castro,

    Kind regards

  • Site to site VPN with router IOS

    I want to create a VPN site-to site on the Internet. On the remote site, aside from the VPN to the head office, there should be no traffic not allowed in internal from the Internet to the network and that there should be no traffic from the internal network to the Internet allowed. The internal network will run a private 192.168.x.x address range.

    I'm going to use a Cisco 2811 router integrated of services on the remote site and this will last an IPSec VPN that will end a hub at Headquarters. I understand that this router has an IOS and IPS firewall built in.

    Would I be right in thinking that because I don't want to have access to the Internet (except VPN) or should I configure IOS firewall features on the router? And there is no point in the configuration of the features IPS wouldn't?

    My thought is that only an entry in list of unique access to deny pi a whole applied inbound to the interface that connects to the Internet would be the best strategy. I think that the command "sysopt connection permit-ipsec" should allow the VPN to form even with the ip address to deny any any ACL (or is it just a Pix command? If Yes, then I have to allow ESP and UDP 500 (ISAKMP) from the public address of the hub at Headquarters to allow the VPN to form wouldn't I?).

    Think I'll probably expand slightly the access list to allow the icmp Protocol, ssh and https traffic from the IP address of firewall seat outside so that I can monitor the remote site and access it safely if the fail VPN.

    And I wouldn't need one access list on the interface connected to the internal network I would like because the range of addresses would be not routable, so they would not be able to initiate connections to the Internet (all the trffic to the remote site is specified under a valuable traffic to bring up the VPN)

    Use one of the IOS Firewall inspect commands or the IPS would be useless and have no effect in this case wouldn't it?

    I really just need to know if the ip address to deny any any ACL on the external interface on the remote site is the best solution (and the simplest), and whether it will be safe.

    We used to use fiewalls Pix for remote VPN site to site, Amazon refuse incoming connections on the external interface by default but now I have been informed that these series 2800 routers will be used later, so I would get my thoughts straight and be able to build safe to do the same work all existing PIX are doing (they are all installed for just the VPN at Headquarters as in) the first paragraph).

    I would like any advice or thoughts on the subject. I don't know there must be a ton of people who put routers for the same purpose.

    Thank you in advance.

    Pete.

    Pete

    I did a lot of implementations site VPN to another using IOS routers. They work very well. Based on my experience I offer these comments and I hope that they will help you:

    -you don't want a list of incoming access on the external interface, but you want more in it than simply refuse an ip. There is no permit-ipsec sysopt connection in IOS so you want to certainly allowed ISAKMP and IPSec/ESP. I suggest that you also want to allow SSH. I would like to allow ICMP but only starting from the address space of the network head end. I do not allow HTTPS since I generally do not allow the http server on the router. If you want HTTPS then certainly enable it. To facilitate the ping and traceroute on the remote I frequently allow icmp echo-reply, timeout and unreachable port from any source.

    -I want to put an inside interface access list. There are certain types of traffic that I don't want to send from the Remote LAN. I have usually refuse any trap SNMP or snmp for LAN devices and refuse out of the local network icmp redirects. I also often configure RPF controls inside interface to catch any device which is misconfigured.

    -If you want to allow SSH when the VPN is not active (and I highly recommend that you do) then you will probably need to configure at least 1 (and maybe more) users and password of the router ID. And you want to configure authentication on the vty use local authentication if the head end authentication server is not available.

    -I'm not clear from your description if you plan to run a dynamic routing via the VPN Protocol. I wish I had a dynamic routing protocol because I want to announce a default route to the remote control via the VPN. I do not locally configure a default route on the remote router. This way if the VPN tunnel is up there is a default route pointing to the tunnel and if the VPN tunnel is not up then there is no local route by default and users on the remote database can not access the Internet. It is a simple and very effective method to ensure that all user traffic must pass through the central site.

    -regarding the routes defined on the remote router, my approach is that I define a static route for the endpoint of the tunnel to allow the tunnel to implement and I set up static routes for the subnet to the head of line I can SSH. And I do not configure other static routes the on the remote router.

    -You probably want to disable cdp on the external interface and also to disable the proxy-arp (and I don't make any ip unreachable).

    -There is frequently a problem when using VPN site-to-site with fragmentation. If a device on the local network sends a frame of maximum size, and then the router needs to add additional headers for IPSec, then the frame is too large and requires fragmentation. I like to use tcp adjust-mss ip to control the chunk size for TCP traffic and avoid any problems with fragmentation.

    -I don't think you want to set up the firewall or IPS from the features of IOS on the 2811.

    I hope that your application is fine and that my suggestions could be useful.

    [edit] after posting my response, I read through your post again and realize that you make to a VPN concentrator. The approach I have proposed on the execution of a routing protocol works for me because I usually have a router IOS in mind. It would not work to connect to a hub.

    HTH

    Rick

  • You try to run a Site to site VPN and remote VPN from the same IP remotely

    We currently have a site to site VPN configuration between our offices call center and a 3rd party that allows them to access our training to their employees to use environment while being trained on our systems. This tunnel is running between our ASA and their ASA without problem; However, when we have managers come out to the call center, they are unable to use remote VPN to access our office.

    Apparently the same IP peer remote that we use for our site to the other tunnel is the same IP that our managers use to access the internet when they are on-site with the customer. When I look at the logs it shows the VPN attempt and then I get treatment Information Exchange has failed. So from what I can understand when our managers are trying to connect to our firewall from the same IP address as the counterpart of site to site it automatically tries to create a tunnel, according to the information of the site to the other tunnel. If our managers are anywhere else, they can connect through remote VPN with no problems.

    My question is if anyone knows of a way to make the firewall allow VPN site to site and remote connections with the same remote IP address.

    Hi John,.

    Basically, in older versions, when you hit a static encryption card and you does not match this static encryption completely map the connection continues until the dynamic encryption card. For this reason, you can connect your IPSec clients before. A bug has been opened on this vulnerability.

    CSCuc75090  Details of bug

    The crypto IPSec Security Association are created by dynamic crypto map to static peers

    Symptom:

    When a static VPN peer adds all traffic to the ACL crypto, a surveillance society is based even if the pair IP is not allowed in the acl to the main façade encryption. Are these SA finally put in correspondence and commissioning the dynamic crypto map instance.

    Conditions:

    It was a planned design since the first day that allowed customers to fall through in the case of static crypto map did not provide a necessary cryptographic services.

    The SA must be made from a peer configured statically and a dynamic crypto map instance must be configured on the receiving end.

    Workaround solution:

    N/A

    Some possible workarounds are:

    Configure a static nat device when you try to use the remote VPN if the firewall remotely will be hit with a different public IP address. It would be a good solution, but it will depend on how many ip addresses public you have available, if you really want one of these ip addresses for that access.

    Also, I thought you could use AnyConnect instead of the IPSec VPN client. I don't know how many users need to connect from your PC to the remote site, but the ASA has 2 licenses SSL available that you could use. Because Anyconnect uses the SSL protocol, it won't have a problem on your environment.

    Below some information:

    http://www.Cisco.com/c/en/us/TD/docs/security/ASA/asa84/configuration/guide/asa_84_cli_config/vpn_anyconnect.html

    Hope this helps,

    Luis.

  • Problems with site-to-site vpn

    Hello world

    I recently received the mission assigned to the site to site vpn configuration and this is my first time. I'm trying to set up a vpn with pix 501 but short questions site. I managed to get that below, but I'm stuck now and do not know what could be the problem. Here's the debug output.

    Any help is greatly appreciated on what could be the potential problem.

    -AK

    ISAKMP (0:0): sending of NAT - T vendor ID - rev 2 & 3
    ISAKMP (0): early changes of Main Mode
    crypto_isakmp_process_block:src:208.249.117.203, dest:70.91.20.245 spt:500 dpt:500
    Exchange OAK_MM
    ISAKMP (0): treatment ITS payload. Message ID = 0

    ISAKMP (0): audit ISAKMP transform 1 against 20 priority policy
    ISAKMP: 3DES-CBC encryption
    ISAKMP: hash SHA
    ISAKMP: default group 2
    ISAKMP: preshared auth
    ISAKMP: type of life in seconds
    ISAKMP: duration of life (basic) of 28800
    ISAKMP (0): atts are acceptable. Next payload is 0
    ISAKMP (0): load useful treatment vendor id

    ISAKMP (0): ITS been pre-shared key, using id ID_IPV4_ADDR type authentication

    to return to the State is IKMP_NO_ERROR
    crypto_isakmp_process_block:src:208.249.117.203, dest:70.91.20.245 spt:500 dpt:5
    00
    Exchange OAK_MM
    ISAKMP (0): processing KE payload. Message ID = 0

    ISAKMP (0): processing NONCE payload. Message ID = 0

    ISAKMP (0): load useful treatment vendor id

    ISAKMP (0): load useful treatment vendor id

    ISAKMP (0): provider v6 code received xauth

    ISAKMP (0): load useful treatment vendor id

    ISAKMP (0): addressing another box of IOS!

    ISAKMP (0): load useful treatment vendor id

    ISAKMP (0): addressing a VPN3000 concentrator

    ISAKMP (0): ID payload
    next payload: 8
    type: 1
    Protocol: 17
    Port: 0
    Length: 8
    ISAKMP (0): the total payload length: 12
    to return to the State is IKMP_NO_ERROR
    crypto_isakmp_process_block:src:208.249.117.203, dest:70.91.20.245 spt:500 dpt:5
    00
    Exchange OAK_MM
    ISAKMP (0): processing ID payload. Message ID = 0
    ISAKMP (0): HASH payload processing. Message ID = 0
    ISAKMP (0): keep treatment alive: proposal = 32767/32767 sec., real = 3276/2 sec.

    ISAKMP (0): load useful treatment vendor id

    ISAKMP (0): Peer Remote supports dead peer detection

    ISAKMP (0): SA has been authenticated.

    ISAKMP (0): start Quick Mode changes, 413131006:189fe0feIPSEC (key_e M - ID
    (Display): had an event of the queue...
    IPSec (spi_response): spi 0x3e9451fa graduation (1049907706) for SA
    from 208.249.117.203 to 70.91.20.245 for prot 3

    to return to the State is IKMP_NO_ERROR
    ISAKMP (0): send to notify INITIAL_CONTACT
    ISAKMP (0): sending message 24578 NOTIFY 1 protocol
    Peer VPN: ISAKMP: approved new addition: ip:208.249.117.203/500 Total VPN peer: 1
    Peer VPN: ISAKMP: ip:208.249.117.203/500 Ref cnt is incremented to peers: 1 Total VPN
    Peers: 1
    crypto_isakmp_process_block:src:208.249.117.203, dest:70.91.20.245 spt:500 dpt:5
    00
    ISAKMP (0): processing DELETE payload. Message ID = 3425658127, spi size = 16
    ISAKMP (0): delete SA: src 70.91.20.245 dst 208.249.117.203
    to return to the State is IKMP_NO_ERR_NO_TRANS
    ISADB: Reaper checking HIS 0xac149c, id_conn = 0 DELETE IT!

    Peer VPN: ISAKMP: ip:208.249.117.203/500 Ref cnt decremented to peers: 0 Total VPN
    Peers: 1
    Peer VPN: ISAKMP: deleted peer: ip:208.249.117.203/500 VPN peer Total: 0IPSEC (ke
    y_engine): got an event from the queue.
    IPSec (key_engine_delete_sas): rec would remove the ISAKMP notify
    IPSec (key_engine_delete_sas): remove all SAs shared with 208.249.117.203
    IPSec (key_engine): request timer shot: count = 2,.
    local (identity) = 70.91.20.245, distance = 208.249.117.203.
    local_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4),
    remote_proxy = 206.200.22.0/255.255.255.0/0/0 (type = 4)

    Hello

    Newspapers, I see you are using a VPN 3000 Concentrator as the remote vpn end point. Now, also of the debugs next section is interesting:

    local (identity) = 70.91.20.245, distance = 208.249.117.203.
    local_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4),
    remote_proxy = 206.200.22.0/255.255.255.0/0/0 (type = 4)

    -Looks like our traffic interesting PIX and the hub are not mirrors of each other, and does not. Can you please paste the PIX here cryptographic access lists, so that I can analyze the entries.

    -Also, please make sure that you have followed all the steps during the vpn configuration according to the following links:

    If your PIX is running at version 7.x and more: http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a008064a06f.shtml

    If your PIX is running version 6.3.x: http://www.cisco.com/en/US/products/hw/vpndevc/ps2284/products_configuration_example09186a00800949d2.shtml

    Once you check the config on PIX and concentrator, please provide me with the output of "sh cry isa his" and "sh cry ipsec his ' of the PIX. With this release, we can continue to troubleshoot if there is more questions.

    Let me know if this can help,

    See you soon,.

    Christian V

  • Site to SIte VPN through a NAT device

    I have, I am having trouble running a vpn site-to site between two 3725 routers running c3725-advsecurityk9-mz124 - 15 T 1, that I hope I can get some help with, I am probably missing something here. The VPN ran very well when both VPN routers were connected directly to the internet and had on WAN interfaces public IP addresses, but I had to move one of the firewall inside on a private IP address. Installation is now as below

    Router VPN one (192.168.248.253) - internal company network - Fortigate FW - internet-(217.155.113.179) router VPN B

    The fortigate FW is doing some translations address
    -traffic between 192.168.248.253 and 217.155.113.179 has its source in 37.205.62.5
    -traffic between 217.155.113.179 and 37.205.62.5 has its destination translated to 192.168.248.253
    -Firewall rules allow all traffic between the 2 devices, no port locking enabled.

    -The 37.205.62.5 address is used by anything else.

    I basically have a GRE tunnel between two routers, and I'm trying to encrypt it.

    The router shows below

    Card crypto SERVER-RTR #show
    "S2S_VPN" 10 ipsec-isakmp crypto map
    Peer = 217.155.113.179
    Expand the access IP 101 list
    access-list 101 permit gre 192.168.248.253 host 217.155.113.179
    Current counterpart: 217.155.113.179
    Life safety association: 4608000 Kbytes / 3600 seconds
    PFS (Y/N): N
    Transform sets = {}
    STRONG,
    }
    Interfaces using crypto card S2S_VPN:
    FastEthernet0/1

    SERVER-RTR #show crypto sessio
    Current state of the session crypto

    Interface: FastEthernet0/1
    The session state: down
    Peer: 217.155.113.179 port 500
    FLOW IPSEC: allowed 47 192.168.248.253 host 217.155.113.179
    Active sAs: 0, origin: card crypto

    Interface: FastEthernet0/1
    The session state: IDLE-UP
    Peer: 217.155.113.179 port 4500
    IKE SA: local 192.168.248.253/4500 remote 217.155.113.179/4500 Active
    IKE SA: local 192.168.248.253/4500 remote 217.155.113.179/4500 inactive
    IKE SA: local 192.168.248.253/4500 remote 217.155.113.179/4500 inactive

    Router B shows below

    Card crypto BSU - RTR #show
    "S2S_VPN" 10 ipsec-isakmp crypto map
    Peer = 37.205.62.5
    Expand the access IP 101 list
    access-list 101 permit gre 217.155.113.179 host 37.205.62.5
    Current counterpart: 37.205.62.5
    Life safety association: 4608000 Kbytes / 3600 seconds
    PFS (Y/N): N
    Transform sets = {}
    STRONG,
    }
    Interfaces using crypto card S2S_VPN:
    FastEthernet0/1

    BSU - RTR #show sess crypto
    Current state of the session crypto

    Interface: FastEthernet0/1
    The session state: down
    Peer: 37.205.62.5 port 500
    FLOW IPSEC: allowed 47 217.155.113.179 host 37.205.62.5
    Active sAs: 0, origin: card crypto

    Interface: FastEthernet0/1
    The session state: IDLE-UP
    Peer: 37.205.62.5 port 4500
    IKE SA: local 217.155.113.179/4500 remote 37.205.62.5/4500 Active
    IKE SA: local 217.155.113.179/4500 remote 37.205.62.5/4500 inactive
    IKE SA: local 217.155.113.179/4500 remote 37.205.62.5/4500 inactive

    I can see counters incrementing on the ACL on both routers, so I don't know the traffic free WILL is interesting.

    Here are a few debugs too
    --------------
    Router

    Debug crypto ISAKMP

    * 23:07:10.898 Mar 2: ISAKMP: (1024): purge the node 940426884
    * 23:07:10.898 Mar 2: ISAKMP: (1024): purge the node 1837874301
    * 23:07:10.898 Mar 2: ISAKMP: (1024): purge the node-475409474
    * 23:07:20.794 Mar 2: ISAKMP (0:0): received 217.155.113.179 packet dport 500 sport 500 SA NEW Global (N)
    * 23:07:20.794 Mar 2: ISAKMP: created a struct peer 217.155.113.179, peer port 500
    * 23:07:20.794 Mar 2: ISAKMP: new position created post = 0x64960C04 peer_handle = 0x80000F0E
    * 23:07:20.794 Mar 2: ISAKMP: lock struct 0x64960C04, refcount 1 to peer crypto_isakmp_process_block
    * 23:07:20.794 Mar 2: ISAKMP: 500 local port, remote port 500
    * 23:07:20.794 Mar 2: ISAKMP: find a dup her to the tree during the isadb_insert his 6464D3F0 = call BVA
    * 23:07:20.794 Mar 2: ISAKMP: (0): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    * 23:07:20.794 Mar 2: ISAKMP: (0): former State = new State IKE_READY = IKE_R_MM1

    * 2 Mar 23:07:20.794: ISAKMP: (0): treatment ITS payload. Message ID = 0
    * 2 Mar 23:07:20.794: ISAKMP: (0): load useful vendor id of treatment
    * 2 Mar 23:07:20.794: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 69
    * 23:07:20.798 Mar 2: ISAKMP (0:0): provider ID is NAT - T RFC 3947
    * 2 Mar 23:07:20.798: ISAKMP: (0): load useful vendor id of treatment
    * 2 Mar 23:07:20.798: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 245
    * 23:07:20.798 Mar 2: ISAKMP (0:0): provider ID is NAT - T v7
    * 2 Mar 23:07:20.798: ISAKMP: (0): load useful vendor id of treatment
    * 2 Mar 23:07:20.798: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 157
    * 2 Mar 23:07:20.798: ISAKMP: (0): provider ID is NAT - T v3
    * 2 Mar 23:07:20.798: ISAKMP: (0): load useful vendor id of treatment
    * 2 Mar 23:07:20.798: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 123
    * 2 Mar 23:07:20.798: ISAKMP: (0): provider ID is NAT - T v2
    * 23:07:20.798 Mar 2: ISAKMP: (0): pair found pre-shared key matching 217.155.113.179
    * 2 Mar 23:07:20.798: ISAKMP: (0): pre-shared key local found
    * 23:07:20.798 Mar 2: ISAKMP: analysis of the profiles for xauth...
    * 23:07:20.798 Mar 2: ISAKMP: (0): audit ISAKMP transform 1 against the policy of priority 1
    * 23:07:20.798 Mar 2: ISAKMP: DES-CBC encryption
    * 23:07:20.798 Mar 2: ISAKMP: SHA hash
    * 23:07:20.798 Mar 2: ISAKMP: default group 1
    * 23:07:20.798 Mar 2: ISAKMP: pre-shared key auth
    * 23:07:20.798 Mar 2: ISAKMP: type of life in seconds
    * 23:07:20.798 Mar 2: ISAKMP: life (IPV) 0 x 0 0 x 1 0 x 51 0x80
    * 23:07:20.798 Mar 2: ISAKMP: (0): atts are acceptable. Next payload is 0
    * 23:07:20.798 Mar 2: ISAKMP: (0): Acceptable atts: real life: 0
    * 23:07:20.798 Mar 2: ISAKMP: (0): Acceptable atts:life: 0
    * 23:07:20.798 Mar 2: ISAKMP: (0): fill atts in his vpi_length:4
    * 23:07:20.798 Mar 2: ISAKMP: (0): fill atts in his life_in_seconds:86400
    * 23:07:20.798 Mar 2: ISAKMP: (0): return real life: 86400
    * 23:07:20.798 Mar 2: ISAKMP: (0): timer life Started: 86400.

    * 2 Mar 23:07:20.798: ISAKMP: (0): load useful vendor id of treatment
    * 2 Mar 23:07:20.798: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 69
    * 23:07:20.798 Mar 2: ISAKMP (0:0): provider ID is NAT - T RFC 3947
    * 2 Mar 23:07:20.798: ISAKMP: (0): load useful vendor id of treatment
    * 2 Mar 23:07:20.798: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 245
    * 23:07:20.798 Mar 2: ISAKMP (0:0): provider ID is NAT - T v7
    * 2 Mar 23:07:20.798: ISAKMP: (0): load useful vendor id of treatment
    * 2 Mar 23:07:20.798: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 157
    * 2 Mar 23:07:20.798: ISAKMP: (0): provider ID is NAT - T v3
    * 2 Mar 23:07:20.798: ISAKMP: (0): load useful vendor id of treatment
    * 2 Mar 23:07:20.798: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 123
    * 2 Mar 23:07:20.798: ISAKMP: (0): provider ID is NAT - T v2
    * 23:07:20.798 Mar 2: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    * 23:07:20.798 Mar 2: ISAKMP: (0): former State = new State IKE_R_MM1 = IKE_R_MM1

    * 2 Mar 23:07:20.802: ISAKMP: (0): built of NAT - T of the seller-rfc3947 ID
    * 2 Mar 23:07:20.802: ISAKMP: (0): lot of 217.155.113.179 sending my_port 500 peer_port 500 (R) MM_SA_SETUP
    * 23:07:20.802 Mar 2: ISAKMP: (0): sending a packet IPv4 IKE.
    * 23:07:20.802 Mar 2: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    * 23:07:20.802 Mar 2: ISAKMP: (0): former State = new State IKE_R_MM1 = IKE_R_MM2

    * 23:07:20.822 Mar 2: ISAKMP (0:0): received 217.155.113.179 packet 500 Global 500 (R) sport dport MM_SA_SETUP
    * 23:07:20.822 Mar 2: ISAKMP: (0): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    * 23:07:20.822 Mar 2: ISAKMP: (0): former State = new State IKE_R_MM2 = IKE_R_MM3

    * 2 Mar 23:07:20.822: ISAKMP: (0): processing KE payload. Message ID = 0
    * 2 Mar 23:07:20.850: ISAKMP: (0): processing NONCE payload. Message ID = 0
    * 23:07:20.854 Mar 2: ISAKMP: (0): pair found pre-shared key matching 217.155.113.179
    * 2 Mar 23:07:20.854: ISAKMP: (1027): load useful vendor id of treatment
    * 2 Mar 23:07:20.854: ISAKMP: (1027): provider ID is the unit
    * 2 Mar 23:07:20.854: ISAKMP: (1027): load useful vendor id of treatment
    * 2 Mar 23:07:20.854: ISAKMP: (1027): provider ID is DPD
    * 2 Mar 23:07:20.854: ISAKMP: (1027): load useful vendor id of treatment
    * 2 Mar 23:07:20.854: ISAKMP: (1027): addressing another box of IOS!
    * 23:07:20.854 Mar 2: ISAKMP: receives the payload type 20
    * 23:07:20.854 Mar 2: ISAKMP (0:1027): NAT found, the node inside the NAT
    * 23:07:20.854 Mar 2: ISAKMP: receives the payload type 20
    * 23:07:20.854 Mar 2: ISAKMP: (1027): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    * 23:07:20.854 Mar 2: ISAKMP: (1027): former State = new State IKE_R_MM3 = IKE_R_MM3

    * 2 Mar 23:07:20.854: ISAKMP: (1027): lot of 217.155.113.179 sending my_port 500 peer_port 500 (R) MM_KEY_EXCH
    * 23:07:20.854 Mar 2: ISAKMP: (1027): sending a packet IPv4 IKE.
    * 23:07:20.858 Mar 2: ISAKMP: (1027): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    * 23:07:20.858 Mar 2: ISAKMP: (1027): former State = new State IKE_R_MM3 = IKE_R_MM4

    * 23:07:20.898 Mar 2: ISAKMP: (1024): serving SA., his is 64D5723C, delme is 64D5723C
    * 23:07:20.902 Mar 2: ISAKMP (0:1027): received 217.155.113.179 packet dport 4500 4500 Global (R) MM_KEY_EXCH sport
    * 23:07:20.902 Mar 2: ISAKMP: (1027): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    * 23:07:20.902 Mar 2: ISAKMP: (1027): former State = new State IKE_R_MM4 = IKE_R_MM5

    * 2 Mar 23:07:20.902: ISAKMP: (1027): payload ID for treatment. Message ID = 0
    * 23:07:20.902 Mar 2: ISAKMP (0:1027): payload ID
    next payload: 8
    type: 1
    address: 217.155.113.179
    Protocol: 17
    Port: 0
    Length: 12
    * 2 Mar 23:07:20.902: ISAKMP: (0): peer games * no * profiles
    * 2 Mar 23:07:20.906: ISAKMP: (1027): HASH payload processing. Message ID = 0
    * 2 Mar 23:07:20.906: ISAKMP: (1027): treatment protocol NOTIFIER INITIAL_CONTACT 1
    SPI 0, message ID = 0, a = 6464D3F0
    * 23:07:20.906 Mar 2: ISAKMP: (1027): SA authentication status:
    authenticated
    * 23:07:20.906 Mar 2: ISAKMP: (1027): SA has been authenticated with 217.155.113.179
    * 23:07:20.906 Mar 2: ISAKMP: (1027): port detected floating port = 4500
    * 23:07:20.906 Mar 2: ISAKMP: try to find found and existing peer 192.168.248.253/217.155.113.179/4500/ peer 648EAD00 to reuse existing, free 64960 04
    * 23:07:20.906 Mar 2: ISAKMP: Unlocking counterpart struct 0x64960C04 Reuse existing peer count 0
    * 23:07:20.906 Mar 2: ISAKMP: delete peer node by peer_reap for 217.155.113.179: 64960 04
    * 23:07:20.906 Mar 2: ISAKMP: lock struct 0x648EAD00, refcount 2 for peer peer reuse existing
    * 23:07:20.906 Mar 2: ISAKMP: (1027): SA authentication status:
    authenticated
    * 2 Mar 23:07:20.906: ISAKMP: (1027): process of first contact.
    lowering existing phase 1 and 2 with local 192.168.248.253 217.155.113.179 remote remote port 4500
    * 23:07:20.906 Mar 2: ISAKMP: (1026): received first contact, delete SA
    * 23:07:20.906 Mar 2: ISAKMP: (1026): peer does not paranoid KeepAlive.

    * 23:07:20.906 Mar 2: ISAKMP: (1026): deletion of 'Initial of receive Contact' State HIS reason (R) QM_IDLE (post 217.155.113.179)
    * 23:07:20.906 Mar 2: ISAKMP: (0): cannot decrement IKE Call Admission Control incoming_active stat because he's already 0.
    * 23:07:20.906 Mar 2: ISAKMP: (1027): UDP ENC parameter counterpart struct 0x0 his = 0x6464D3F0
    * 23:07:20.906 Mar 2: ISAKMP: (1027): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    * 23:07:20.906 Mar 2: ISAKMP: (1027): former State = new State IKE_R_MM5 = IKE_R_MM5

    * 23:07:20.910 Mar 2: ISAKMP: node set-98987637 to QM_IDLE
    * 2 Mar 23:07:20.910: ISAKMP: (1026): lot of 217.155.113.179 sending peer_port my_port 4500 4500 (R) QM_IDLE
    * 23:07:20.910 Mar 2: ISAKMP: (1026): sending a packet IPv4 IKE.
    * 23:07:20.910 Mar 2: ISAKMP: (1026): purge the node-98987637
    * 23:07:20.910 Mar 2: ISAKMP: (1026): entry = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
    * 23:07:20.910 Mar 2: ISAKMP: (1026): former State = new State IKE_P1_COMPLETE = IKE_DEST_SA

    * 23:07:20.910 Mar 2: ISAKMP: (1027): ITS been pre-shared key, using id ID_IPV4_ADDR type authentication
    * 23:07:20.910 Mar 2: ISAKMP (0:1027): payload ID
    next payload: 8
    type: 1
    address: 192.168.248.253
    Protocol: 17
    Port: 0
    Length: 12
    * 23:07:20.910 Mar 2: ISAKMP: (1027): the total payload length: 12
    * 2 Mar 23:07:20.914: ISAKMP: (1027): lot of 217.155.113.179 sending peer_port my_port 4500 4500 (R) MM_KEY_EXCH
    * 23:07:20.914 Mar 2: ISAKMP: (1027): sending a packet IPv4 IKE.
    * 23:07:20.914 Mar 2: ISAKMP: (1027): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    * 23:07:20.914 Mar 2: ISAKMP: (1027): former State = new State IKE_R_MM5 = IKE_P1_COMPLETE

    * 23:07:20.914 Mar 2: ISAKMP: (1026): deletion of 'Initial of receive Contact' State HIS reason (R) QM_IDLE (post 217.155.113.179)
    * 23:07:20.914 Mar 2: ISAKMP: Unlocking counterpart struct 0x648EAD00 for isadb_mark_sa_deleted(), count 1
    * 23:07:20.914 Mar 2: ISAKMP: (1026): error suppression node 334747020 FALSE reason 'IKE deleted.
    * 23:07:20.914 Mar 2: ISAKMP: (1026): node-1580729900 error suppression FALSE reason 'IKE deleted.
    * 23:07:20.914 Mar 2: ISAKMP: (1026): node-893929227 error suppression FALSE reason 'IKE deleted.
    * 23:07:20.914 Mar 2: ISAKMP: (1026): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    * 23:07:20.914 Mar 2: ISAKMP: (1026): former State = new State IKE_DEST_SA = IKE_DEST_SA

    * 23:07:20.914 Mar 2: ISAKMP: (1027): entry = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
    * 23:07:20.914 Mar 2: ISAKMP: (1027): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE

    * 23:07:20.930 Mar 2: ISAKMP (0:1026): received 217.155.113.179 packet dport 4500 4500 Global (R) MM_NO_STATE sport
    * 23:07:20.934 Mar 2: ISAKMP (0:1027): received 217.155.113.179 packet dport 4500 4500 Global (R) QM_IDLE sport
    * 23:07:20.934 Mar 2: ISAKMP: node set 1860263019 to QM_IDLE
    * 2 Mar 23:07:20.934: ISAKMP: (1027): HASH payload processing. Message ID = 1860263019
    * 2 Mar 23:07:20.934: ISAKMP: (1027): treatment ITS payload. Message ID = 1860263019
    * 23:07:20.934 Mar 2: ISAKMP: (1027): proposal of IPSec checking 1
    * 23:07:20.934 Mar 2: ISAKMP: turn 1, ESP_AES
    * 23:07:20.934 Mar 2: ISAKMP: attributes of transformation:
    * 23:07:20.934 Mar 2: ISAKMP: program is 3 (Tunnel-UDP)
    * 23:07:20.934 Mar 2: ISAKMP: type of life in seconds
    * 23:07:20.934 Mar 2: ISAKMP: life of HIS (basic) 3600
    * 23:07:20.934 Mar 2: ISAKMP: type of life in kilobytes
    * 23:07:20.934 Mar 2: ISAKMP: service life of SA (IPV) 0x0 0 x 46 0 50 x 0 x 0
    * 23:07:20.934 Mar 2: ISAKMP: key length is 128
    * 23:07:20.934 Mar 2: ISAKMP: (1027): atts are acceptable.
    * 2 Mar 23:07:20.934: ISAKMP: (1027): IPSec policy invalidated proposal with error 32
    * 2 Mar 23:07:20.934: ISAKMP: (1027): politics of ITS phase 2 is not acceptable! (local 192.168.248.253 remote 217.155.113.179)
    * 23:07:20.938 Mar 2: ISAKMP: node set 1961554007 to QM_IDLE
    * 23:07:20.938 Mar 2: ISAKMP: (1027): Protocol to send NOTIFIER PROPOSAL_NOT_CHOSEN 3
    SPI 1688526152, message ID = 1961554007
    * 2 Mar 23:07:20.938: ISAKMP: (1027): lot of 217.155.113.179 sending peer_port my_port 4500 4500 (R) QM_IDLE
    * 23:07:20.938 Mar 2: ISAKMP: (1027): sending a packet IPv4 IKE.
    * 23:07:20.938 Mar 2: ISAKMP: (1027): purge the node 1961554007
    * 23:07:20.938 Mar 2: ISAKMP: (1027): error suppression node 1860263019 REAL reason "QM rejected."
    * 23:07:20.938 Mar 2: ISAKMP: (1027): entrance, node 1860263019 = IKE_MESG_FROM_PEER, IKE_QM_EXCH
    * 23:07:20.938 Mar 2: ISAKMP: (1027): former State = new State IKE_QM_READY = IKE_QM_READY
    * 23:07:24.510 Mar 2: ISAKMP: set new node 0 to QM_IDLE
    * 2 Mar 23:07:24.510: ITS a exceptional applications (100.100.213.56 local port 4500, 100.100.213.84 remote port 4500)
    * 2 Mar 23:07:24.510: ISAKMP: (1027): sitting IDLE. From QM immediately (QM_IDLE)
    * 23:07:24.510 Mar 2: ISAKMP: (1027): start Quick Mode Exchange, M - ID 670698820
    * 23:07:24.510 Mar 2: ISAKMP: (1027): initiator QM gets spi
    * 2 Mar 23:07:24.510: ISAKMP: (1027): lot of 217.155.113.179 sending peer_port my_port 4500 4500 (R) QM_IDLE
    * 23:07:24.510 Mar 2: ISAKMP: (1027): sending a packet IPv4 IKE.
    * 23:07:24.514 Mar 2: ISAKMP: (1027): entrance, node 670698820 = IKE_MESG_INTERNAL, IKE_INIT_QM
    * 23:07:24.514 Mar 2: ISAKMP: (1027): former State = new State IKE_QM_READY = IKE_QM_I_QM1
    * 23:07:24.530 Mar 2: ISAKMP (0:1027): received 217.155.113.179 packet dport 4500 4500 Global (R) QM_IDLE sport
    * 23:07:24.534 Mar 2: ISAKMP: node set 1318257670 to QM_IDLE
    * 2 Mar 23:07:24.534: ISAKMP: (1027): HASH payload processing. Message ID = 1318257670
    * 2 Mar 23:07:24.534: ISAKMP: (1027): treatment protocol NOTIFIER PROPOSAL_NOT_CHOSEN 3
    SPI 3268378219, message ID = 1318257670, a = 6464D3F0
    * 2 Mar 23:07:24.534: ISAKMP: (1027): removal of spi 3268378219 message ID = 670698820
    * 23:07:24.534 Mar 2: ISAKMP: (1027): node 670698820 REAL reason error suppression "remove larval.
    * 23:07:24.534 Mar 2: ISAKMP: (1027): error suppression node 1318257670 FALSE reason 'informational (en) State 1.
    * 23:07:24.534 Mar 2: ISAKMP: (1027): entry = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY
    * 23:07:24.534 Mar 2: ISAKMP: (1027): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE

    * 23:07:40.898 Mar 2: ISAKMP: (1025): purge the node-238086324
    * 23:07:40.898 Mar 2: ISAKMP: (1025): purge the node-1899972726
    * 23:07:40.898 Mar 2: ISAKMP: (1025): purge the node-321906720

    Router B
    ----------
    Debug crypto ISAKMP

    1d23h: ISAKMP: (0): profile of THE request is (NULL)
    1d23h: ISAKMP: created a struct peer 37.205.62.5, peer port 500
    1d23h: ISAKMP: new position created post = 0x652C3B54 peer_handle = 0x80000D8C
    1d23h: ISAKMP: lock struct 0x652C3B54, refcount 1 to peer isakmp_initiator
    1d23h: ISAKMP: 500 local port, remote port 500
    1d23h: ISAKMP: set new node 0 to QM_IDLE
    1d23h: ISAKMP: find a dup her to the tree during the isadb_insert his 652CBDC4 = call BVA
    1d23h: ISAKMP: (0): cannot start aggressive mode, try the main mode.
    1d23h: ISAKMP: (0): pair found pre-shared key matching 37.205.62.5
    1d23h: ISAKMP: (0): built of NAT - T of the seller-rfc3947 ID
    1d23h: ISAKMP: (0): built the seller-07 ID NAT - t
    1d23h: ISAKMP: (0): built of NAT - T of the seller-03 ID
    1d23h: ISAKMP: (0): built the seller-02 ID NAT - t
    1d23h: ISAKMP: (0): entry = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
    1d23h: ISAKMP: (0): former State = new State IKE_READY = IKE_I_MM1

    1d23h: ISAKMP: (0): Beginner Main Mode Exchange
    1d23h: ISAKMP: (0): lot of 37.205.62.5 sending my_port 500 peer_port 500 (I) MM_NO_STATE
    1d23h: ISAKMP: (0): sending a packet IPv4 IKE.
    1d23h: ISAKMP (0:0): received 37.205.62.5 packet dport 500 sport Global 500 (I) MM_NO_STATE
    1d23h: ISAKMP: (0): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    1d23h: ISAKMP: (0): former State = new State IKE_I_MM1 = IKE_I_MM2

    1d23h: ISAKMP: (0): treatment ITS payload. Message ID = 0
    1d23h: ISAKMP: (0): load useful vendor id of treatment
    1d23h: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 69
    1d23h: ISAKMP (0:0): provider ID is NAT - T RFC 3947
    1d23h: ISAKMP: (0): pair found pre-shared key matching 37.205.62.5
    1d23h: ISAKMP: (0): pre-shared key local found
    1d23h: ISAKMP: analysis of the profiles for xauth...
    1d23h: ISAKMP: (0): audit ISAKMP transform 1 against the policy of priority 1
    1d23h: ISAKMP: DES-CBC encryption
    1d23h: ISAKMP: SHA hash
    1d23h: ISAKMP: default group 1
    1d23h: ISAKMP: pre-shared key auth
    1d23h: ISAKMP: type of life in seconds
    1d23h: ISAKMP: life (IPV) 0 x 0 0 x 1 0 x 51 0x80
    1d23h: ISAKMP: (0): atts are acceptable. Next payload is 0
    1d23h: ISAKMP: (0): Acceptable atts: real life: 0
    1d23h: ISAKMP: (0): Acceptable atts:life: 0
    1d23h: ISAKMP: (0): fill atts in his vpi_length:4
    1d23h: ISAKMP: (0): fill atts in his life_in_seconds:86400
    1d23h: ISAKMP: (0): return real life: 86400
    1d23h: ISAKMP: (0): timer life Started: 86400.

    1d23h: ISAKMP: (0): load useful vendor id of treatment
    1d23h: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 69
    1d23h: ISAKMP (0:0): provider ID is NAT - T RFC 3947
    1d23h: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    1d23h: ISAKMP: (0): former State = new State IKE_I_MM2 = IKE_I_MM2

    1d23h: ISAKMP: (0): lot of 37.205.62.5 sending my_port 500 peer_port 500 (I) MM_SA_SETUP
    1d23h: ISAKMP: (0): sending a packet IPv4 IKE.
    1d23h: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    1d23h: ISAKMP: (0): former State = new State IKE_I_MM2 = IKE_I_MM3

    1d23h: ISAKMP (0:0): received 37.205.62.5 packet dport 500 sport Global 500 (I) MM_SA_SETUP
    1d23h: ISAKMP: (0): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    1d23h: ISAKMP: (0): former State = new State IKE_I_MM3 = IKE_I_MM4

    1d23h: ISAKMP: (0): processing KE payload. Message ID = 0
    1d23h: ISAKMP: (0): processing NONCE payload. Message ID = 0
    1d23h: ISAKMP: (0): pair found pre-shared key matching 37.205.62.5
    1d23h: ISAKMP: (1034): load useful vendor id of treatment
    1d23h: ISAKMP: (1034): provider ID is the unit
    1d23h: ISAKMP: (1034): load useful vendor id of treatment
    1d23h: ISAKMP: (1034): provider ID is DPD
    1d23h: ISAKMP: (1034): load useful vendor id of treatment
    1d23h: ISAKMP: (1034): addressing another box of IOS!
    1d23h: ISAKMP: receives the payload type 20
    1d23h: ISAKMP: receives the payload type 20
    1d23h: ISAKMP (0:1034): NAT found, the node outside NAT
    1d23h: ISAKMP: (1034): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    1d23h: ISAKMP: (1034): former State = new State IKE_I_MM4 = IKE_I_MM4

    1d23h: ISAKMP: (1034): send initial contact
    1d23h: ISAKMP: (1034): ITS been pre-shared key, using id ID_IPV4_ADDR type authentication
    1d23h: ISAKMP (0:1034): payload ID
    next payload: 8
    type: 1
    address: 217.155.113.179
    Protocol: 17
    Port: 0
    Length: 12
    1d23h: ISAKMP: (1034): the total payload length: 12
    1d23h: ISAKMP: (1034): lot of 37.205.62.5 sending peer_port my_port 4500 4500 (I) MM_KEY_EXCH
    1d23h: ISAKMP: (1034): sending a packet IPv4 IKE.
    1d23h: ISAKMP: (1034): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    1d23h: ISAKMP: (1034): former State = new State IKE_I_MM4 = IKE_I_MM5

    1d23h: ISAKMP: (1031): serving SA., his is 652D60C8, delme is 652D60C8
    1d23h: ISAKMP (0:1033): received 37.205.62.5 packet dport 4500 sport Global 4500 (I) QM_IDLE
    1d23h: ISAKMP: node set 33481563 to QM_IDLE
    1d23h: ISAKMP: (1033): HASH payload processing. Message ID = 33481563
    1d23h: ISAKMP: receives the payload type 18
    1d23h: ISAKMP: (1033): treatment remove with load useful reason
    1d23h: ISAKMP: (1033): remove the doi = 1
    1d23h: ISAKMP: (1033): remove Protocol id = 1
    1d23h: ISAKMP: (1033): remove spi_size = 16
    1d23h: ISAKMP: (1033): remove the spis num = 1
    1d23h: ISAKMP: (1033): delete_reason = 11
    1d23h: ISAKMP: (1033): load DELETE_WITH_REASON, processing of message ID = 33481563, reason: Unknown delete reason!
    1d23h: ISAKMP: (1033): peer does not paranoid KeepAlive.

    1d23h: ISAKMP: (1033): deletion of 'Initial of receive Contact' State HIS reason (I) QM_IDLE (post 37.205.62.5)
    1d23h: ISAKMP: (1033): error suppression node 33481563 FALSE reason 'informational (en) State 1.
    1d23h: ISAKMP: node set 1618266182 to QM_IDLE
    1d23h: ISAKMP: (1033): lot of 37.205.62.5 sending peer_port my_port 4500 4500 (I) QM_IDLE
    1d23h: ISAKMP: (1033): sending a packet IPv4 IKE.
    1d23h: ISAKMP: (1033): purge the node 1618266182
    1d23h: ISAKMP: (1033): entry = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
    1d23h: ISAKMP: (1033): former State = new State IKE_P1_COMPLETE = IKE_DEST_SA

    1d23h: ISAKMP (0:1034): received 37.205.62.5 packet dport 4500 sport Global 4500 (I) MM_KEY_EXCH
    1d23h: ISAKMP: (1034): payload ID for treatment. Message ID = 0
    1d23h: ISAKMP (0:1034): payload ID
    next payload: 8
    type: 1
    address: 192.168.248.253
    Protocol: 17
    Port: 0
    Length: 12
    1d23h: ISAKMP: (0): peer games * no * profiles
    1d23h: ISAKMP: (1034): HASH payload processing. Message ID = 0
    1d23h: ISAKMP: (1034): SA authentication status:
    authenticated
    1d23h: ISAKMP: (1034): SA has been authenticated with 37.205.62.5
    1d23h: ISAKMP: try to insert a 217.155.113.179/37.205.62.5/4500/ peer and found existing in a 643BCA10 to reuse, free 652C3B54
    1d23h: ISAKMP: Unlocking counterpart struct 0x652C3B54 Reuse existing peer count 0
    1d23h: ISAKMP: delete peer node by peer_reap for 37.205.62.5: 652C3B54
    1d23h: ISAKMP: lock struct 0x643BCA10, refcount 2 for peer peer reuse existing
    1d23h: ISAKMP: (1034): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    1d23h: ISAKMP: (1034): former State = new State IKE_I_MM5 = IKE_I_MM6

    1d23h: ISAKMP: (1033): deletion of 'Initial of receive Contact' State HIS reason (I) QM_IDLE (post 37.205.62.5)
    1d23h: ISAKMP: (0): cannot decrement IKE Call Admission Control outgoing_active stat because he's already 0.
    1d23h: ISAKMP: Unlocking counterpart struct 0x643BCA10 for isadb_mark_sa_deleted(), count 1
    1d23h: ISAKMP: (1033): error suppression node 1267924911 FALSE reason 'IKE deleted.
    1d23h: ISAKMP: (1033): error suppression node 1074093103 FALSE reason 'IKE deleted.
    1d23h: ISAKMP: (1033): node-183194519 error suppression FALSE reason 'IKE deleted.
    1d23h: ISAKMP: (1033): error suppression node 33481563 FALSE reason 'IKE deleted.
    1d23h: ISAKMP: (1033): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    1d23h: ISAKMP: (1033): former State = new State IKE_DEST_SA = IKE_DEST_SA

    1d23h: ISAKMP: (1034): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    1d23h: ISAKMP: (1034): former State = new State IKE_I_MM6 = IKE_I_MM6

    1d23h: ISAKMP: (1034): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    1d23h: ISAKMP: (1034): former State = new State IKE_I_MM6 = IKE_P1_COMPLETE

    1d23h: ISAKMP: (1034): start Quick Mode Exchange, M - ID 1297417008
    1d23h: ISAKMP: (1034): initiator QM gets spi
    1d23h: ISAKMP: (1034): lot of 37.205.62.5 sending peer_port my_port 4500 4500 (I) QM_IDLE
    1d23h: ISAKMP: (1034): sending a packet IPv4 IKE.
    1d23h: ISAKMP: (1034): entrance, node 1297417008 = IKE_MESG_INTERNAL, IKE_INIT_QM
    1d23h: ISAKMP: (1034): former State = new State IKE_QM_READY = IKE_QM_I_QM1
    1d23h: ISAKMP: (1034): entry = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
    1d23h: ISAKMP: (1034): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE

    1d23h: ISAKMP (0:1034): received 37.205.62.5 packet dport 4500 sport Global 4500 (I) QM_IDLE
    1d23h: ISAKMP: node set-874376893 to QM_IDLE
    1d23h: ISAKMP: (1034): HASH payload processing. Message ID =-874376893
    1d23h: ISAKMP: (1034): treatment protocol NOTIFIER PROPOSAL_NOT_CHOSEN 3
    SPI 56853244, message ID =-874376893, his 652CBDC4 =
    1d23h: ISAKMP: (1034): removal of spi 56853244 message ID = 1297417008
    1d23h: ISAKMP: (1034): node 1297417008 REAL reason error suppression "remove larval.
    1d23h: ISAKMP: (1034): node-874376893 error suppression FALSE reason 'informational (en) State 1.
    1d23h: ISAKMP: (1034): entry = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY
    1d23h: ISAKMP: (1034): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE

    1d23h: ISAKMP (0:1034): received 37.205.62.5 packet dport 4500 sport Global 4500 (I) QM_IDLE
    1d23h: ISAKMP: node set 439453045 to QM_IDLE
    1d23h: ISAKMP: (1034): HASH payload processing. Message ID = 439453045
    1d23h: ISAKMP: (1034): treatment ITS payload. Message ID = 439453045
    1d23h: ISAKMP: (1034): proposal of IPSec checking 1
    1d23h: ISAKMP: turn 1, ESP_AES
    1d23h: ISAKMP: attributes of transformation:
    1d23h: ISAKMP: program is 3 (Tunnel-UDP)
    1d23h: ISAKMP: type of life in seconds
    1d23h: ISAKMP: life of HIS (basic) 3600
    1d23h: ISAKMP: type of life in kilobytes
    1d23h: ISAKMP: service life of SA (IPV) 0x0 0 x 46 0 50 x 0 x 0
    1d23h: ISAKMP: key length is 128
    1d23h: ISAKMP: (1034): atts are acceptable.
    1d23h: ISAKMP: (1034): IPSec policy invalidated proposal with error 32
    1d23h: ISAKMP: (1034): politics of ITS phase 2 is not acceptable! (local 217.155.113.179 remote 37.205.62.5)
    1d23h: ISAKMP: node set 1494356901 to QM_IDLE
    1d23h: ISAKMP: (1034): Protocol to send NOTIFIER PROPOSAL_NOT_CHOSEN 3
    SPI 1687353736, message ID = 1494356901
    1d23h: ISAKMP: (1034): lot of 37.205.62.5 sending peer_port my_port 4500 4500 (I) QM_IDLE
    1d23h: ISAKMP: (1034): sending a packet IPv4 IKE.
    1d23h: ISAKMP: (1034): purge the node 1494356901
    1d23h: ISAKMP: (1034): error suppression node 439453045 REAL reason "QM rejected."
    1d23h: ISAKMP: (1034): entrance, node 439453045 = IKE_MESG_FROM_PEER, IKE_QM_EXCH
    1d23h: ISAKMP: (1034): former State = new State IKE_QM_READY = IKE_QM_READY
    1d23h: ISAKMP: (1032): purge the node 1513722556
    1d23h: ISAKMP: (1032): purge the node-643121396
    1d23h: ISAKMP: (1032): purge the node 1350014243
    1d23h: ISAKMP: (1032): purge the node 83247347

    Hi Nav,

    I'm happy it's working now. Your interpretation is correct. Transport mode IPSEC encrypts the payload, while tunnel mode figure the whole ip packet (original header / payload) and inserts a new ip header. Thus, the tunnel mode is used for ipsec site to site VPN and transport is used for point to point VPN ipsec. GRE is used with ipsec, all packages will be encapsulated with a GRE header first, so, essentially, this is a point to point VPN ipsec.

    The problem that you are having with tunnel mode, the router's package is going to be wrapped with the header 192.168.248.253 GRE source 217.155.113.179 destination. The whole package is then encrypted and a new header is added with the same source/destination. This new header will be coordinated by the FW, but not incorporated or encrypted GRE header. When the packet arrives at Router B, after decrypt them the package, router B will see the GRE header, which is different from that of source/destination tunnel she uses. This breaks the GRE tunnel and the routing between router A and router B Protocol.

    HTH,

    Lei Tian

  • ASA ASA from Site to Site VPN IPSec Tunnel

    Any help would be greatly appreciated...

    I have two devices Cisco ASA with a Site for the configuration of the tunnel VPN IPSec Site as follows: -.

    Site #1 - Cisco ASA running version 8.2 (1) with an internal range of 10.0.0.x/24

    Site #2 - Cisco ASA running version 8.2 (1) with an internal range of 10.1.1.x/24

    Site #1 is simple and has a dynamic NAT rule which translates all of the inside and the outside (public IP) of the SAA.

    Internet access works very well in all workstations of this site.  A static route is configured to redirect all traffic to a public router upstream.

    Site #2 is slightly more complicated; the Cisco ASA is configured with 10.1.1.254/24 as its interior IP address and 10.1.2.254/24 as its external IP address.  A dynamic NAT rule is configured to translate everything inside as the 10.1.2.254 (outside) address of the ASA.  A default static route is then configured to redirect all traffic to a Draytek device on 10.1.2.253.  This device then performs its own private Public NAT.  Again the Internet works fine all hosts inside the Cisco ASA (10.1.1.x)

    The IPSec tunnel is created with the networks local and remote endpoint as above (10.0.0.x/24) and (10.1.1.x/24).  The Draytek at the Site #2 device is configured with a form of DMZ that allows essentially ALL traffic toward the front directly on the external interface of the ASA (10.1.2.254).  The Phase 1 and Phase 2 negotiation of the tunnel ends correctly, and the tunnel is formed without any problem.  However, all traffic passing on networks ICMP does not end and the Syslog reports the following-

    Site #1-

    6 January 19, 2011 15:27:21 302020 ZEFF-SB-01_LAN 1 10.1.1.51 0 Built of outbound ICMP connection for faddr 10.1.1.51/0 gaddr ZEFF-SB-01_LAN/1 laddr ZEFF-SB-01_LAN/1
    6 January 19, 2011 15:27:23 302021 10.1.1.51 0 ZEFF-SB-01_LAN 1 Connection of ICMP disassembly for faddr 10.1.1.51/0 gaddr ZEFF-SB-01_LAN/1 laddr ZEFF-SB-01_LAN/1

    Site #2-

    6 January 19, 2011 15:24:47 302020 10.1.1.51 0 10.0.0.30 1 Built of outbound ICMP connection for faddr gaddr laddr 10.1.1.51/0 10.1.1.51/0 10.0.0.30/1
    6 January 19, 2011 15:24:49 302021 10.0.0.30 1 10.1.1.51 0 Connection of disassembly for faddr gaddr laddr 10.1.1.51/0 10.1.1.51/0 10.0.0.30/1 ICMP

    It's the same for any form of traffic passing over the tunnel.  The ACL is configured to allow segments of LAN out to any destination.  At this point, I left scratching my head, as my original theory was to blame the Draytek, but after reading the documentation given to the DMZ host configuration, it appears this parameter is configured all traffic is simply forwarded to the IP address (in this case, the Cisco ASA interface outside).

    Anyone can shed light on a possible cause of this problem?

    Thank you

    Nick

    did you bypass the vpn traffic between 10.0.0 and 10.1.1 to be NAT - ed on the two ASA?

    Please provide the following information

    -set up the tunnel

    -show the isa cry his

    -show the ipsec cry his

    -ping of the site 1 site 2 via tunnel

    -capture "crypto ipsec to show his" once again

    -ping from site 2 to 1 by the tunnel of the site

    -capture "crypto ipsec to show his" once again

    -two ASA configuration.

Maybe you are looking for

  • A few questions about the USB DVB - T (DTT) PX1211E-1TVD Tuner

    Hello Recently, I saw the USB DVB - T (DTT) Tuner part number: PX1211E-1TVD announced on this site. It seems very initiative but I wanted to clarify the features actually described on the site, because it is not very clear... 1. Why is there a USB DV

  • Facing problem in OCR

    Hello world. I want to read the characters in the document. and I do not select the return on investment. My numbers will be in one line but its position will vary and this number are locked in the border. How can I detect numbers?

  • M830z + error 31.03.34

    I have a M830mfp with an intermittent error 31.03.34. If I reinstall the background unit, the error disappears, but returned about two minutes later. No mention in the Service Manual of hp on this error or any resolution of this error Any help would

  • 8600 more duplex in Word format - no option shows

    I bought this printer for duplex printing, but when I go to print a Word document on my iMac (last version of Word for Mac) and the latest Mac operating system, there is no option for double-sided printing. However, when I looked online for the 8600

  • 64-bit version of itunes need to work on my Dell XPS?

    just bought a Dell XPS and I try to download itunes.  says he needs a 64-bit version and is not installed correctly.  How can I get it?  Apple support did not