IPSec tunnel on router from closure

Is it possible to get a VPN IPSec tunnel on a router from the loopback interface? If so, how?

Hello

Yes it is possible. The command is:

card crypto-address loopback

Please make sure that the loopback interface has a public IP address that is accessible.

http://www.Cisco.com/univercd/CC/TD/doc/product/software/ios124/124tcr/tsec_r/sec_c3ht.htm#wp1274324

HTH,

* Please rate if this helps,

Kind regards

Kamal

Tags: Cisco Security

Similar Questions

PIX IPSec tunnel - IOS, routing Options

Hello

I have an IPSec Tunnel between a PIX firewall and a router Cisco 1721.

Have I not all options about any routing protocol can I use?

Are there plans to add GRE support to PIX, so that EIGRP, OSPF can be used?

------Naman

Here's a URL that tells how to configure GRE over IPSEC with OSPF. http://www.Cisco.com/warp/public/707/gre_ipsec_ospf.html

IPSEC tunnel and Routing Support protocols

Hello world

I read that IPSEC does not support routing with VPN's Site to the other protocols because both are Layer4.

This means that if Site A must reach the B Site over a WAN link, we use static IP on the Site A and Site B router?

In my lab at home I config Site to Site VPN systems and they work correctly using OSPF does that mean that IPSEC supports the routing protocol?

IF someone can explain this please?

OSPF config one side

router ospf 1

3.4.4.4 router ID

Log-adjacency-changes

area 10-link virtual 10.4.4.1

passive-interface Vlan10

passive-interface Vlan20

3.4.4.4 to network 0.0.0.0 area 0

network 192.168.4.0 0.0.0.255 area 10

network 192.168.5.0 0.0.0.255 area 0

network 192.168.10.0 0.0.0.255 area 0

network 192.168.20.0 0.0.0.255 area 0

network 192.168.30.0 0.0.0.255 area 0

network 192.168.98.0 0.0.0.255 area 0

network 192.168.99.0 0.0.0.255 area 0

3550SMIA #sh ip route

Code: C - connected, S - static, mobile R - RIP, M-, B - BGP

D - EIGRP, OSPF, IA - external EIGRP, O - EX - OSPF inter zone

N1 - type external OSPF NSSA 1, N2 - type external OSPF NSSA 2

E1 - OSPF external type 1, E2 - external OSPF of type 2

i - IS - Su - summary IS, L1 - IS - IS level 1, L2 - IS level - 2

-IS inter area, * - candidate failure, U - static route by user

o - ODR, P - periodic downloaded route static

Gateway of last resort is 192.168.5.3 to network 0.0.0.0

192.168.12.0/24 [13/110] through 192.168.5.3, 3d17h, FastEthernet0/11

100.0.0.0/32 is divided into subnets, subnets 1

O 100.100.100.100 [110/3] through 192.168.5.3, 3d17h, FastEthernet0/11

3.0.0.0/8 is variably divided into subnets, 2 subnets, 2 masks

O 3.3.3.3/32 [110/2] via 192.168.5.3, 3d17h, FastEthernet0/11

C 3.4.4.0/24 is directly connected, Loopback0

C 192.168.30.0/24 is directly connected, Vlan30

64.0.0.0/32 is divided into subnets, subnets 1

O E2 64.59.135.150 [110/300] through 192.168.5.3, 1d09h, FastEthernet0/11

4.0.0.0/32 is divided into subnets, subnets 1

O 4.4.4.4 [110/2] via 192.168.5.3, 3d17h, FastEthernet0/11

C 192.168.10.0/24 is directly connected, Vlan10

172.31.0.0/24 is divided into subnets, 4 subnets

O E2 172.31.3.0 [110/300] through 192.168.5.3, 3d17h, FastEthernet0/11

O E2 172.31.2.0 [110/300] through 192.168.5.3, 3d17h, FastEthernet0/11

O E2 172.31.1.0 [110/300] through 192.168.5.3, 3d17h, FastEthernet0/11

O E2 172.31.0.0 [110/300] through 192.168.5.3, 3d17h, FastEthernet0/11

O 192.168.11.0/24 [110/3] through 192.168.5.3, 3d17h, FastEthernet0/11

O 192.168.98.0/24 [110/2] via 192.168.99.1, 3d17h, FastEthernet0/8

C 192.168.99.0/24 is directly connected, FastEthernet0/8

192.168.20.0/24 C is directly connected, Vlan20

192.168.5.0/31 is divided into subnets, subnets 1

C 192.168.5.2 is directly connected, FastEthernet0/11

C 10.0.0.0/8 is directly connected, Tunnel0

192.168.6.0/31 is divided into subnets, subnets 1

O 192.168.6.2 [110/2] via 192.168.5.3, 3d17h, FastEthernet0/11

192.168.1.0/24 [13/110] through 192.168.5.3, 3d17h, FastEthernet0/11

O * E2 0.0.0.0/0 [110/1] via 192.168.5.3, 1d09h, FastEthernet0/11

B side Config

Side A

router ospf 1

Log-adjacency-changes

network 192.168.97.0 0.0.0.255 area 0

network 192.168.98.0 0.0.0.255 area 0

network 192.168.99.0 0.0.0.255 area 0

1811w # sh ip route

Code: C - connected, S - static, mobile R - RIP, M-, B - BGP

D - EIGRP, OSPF, IA - external EIGRP, O - EX - OSPF inter zone

N1 - type external OSPF NSSA 1, N2 - type external OSPF NSSA 2

E1 - OSPF external type 1, E2 - external OSPF of type 2

i - IS - Su - summary IS, L1 - IS - IS level 1, L2 - IS level - 2

-IS inter area, * - candidate failure, U - static route by user

o - ODR, P - periodic downloaded route static

Gateway of last resort is 192.168.99.2 to network 0.0.0.0

192.168.12.0/24 [110/14] through 192.168.99.2, 3d17h, FastEthernet0

100.0.0.0/32 is divided into subnets, subnets 1

O 100.100.100.100 [110/4] through 192.168.99.2, 3d17h, FastEthernet0

3.0.0.0/32 is divided into subnets, 2 subnets

O 3.3.3.3 [110/3] through 192.168.99.2, 3d17h, FastEthernet0

O 3.4.4.4 [110/2] via 192.168.99.2, 3d17h, FastEthernet0

O 192.168.30.0/24 [110/2] via 192.168.99.2, 3d17h, FastEthernet0

64.0.0.0/32 is divided into subnets, subnets 1

O E2 64.59.135.150 [110/300] through 192.168.99.2, 1d09h, FastEthernet0

4.0.0.0/32 is divided into subnets, subnets 1

O 4.4.4.4 [110/3] through 192.168.99.2, 3d17h, FastEthernet0

O 192.168.10.0/24 [110/2] via 192.168.99.2, 3d17h, FastEthernet0

172.31.0.0/24 is divided into subnets, 4 subnets

O E2 172.31.3.0 [110/300] through 192.168.99.2, 3d17h, FastEthernet0

O E2 172.31.2.0 [110/300] through 192.168.99.2, 3d17h, FastEthernet0

O E2 172.31.1.0 [110/300] through 192.168.99.2, 3d17h, FastEthernet0

O E2 172.31.0.0 [110/300] through 192.168.99.2, 3d17h, FastEthernet0

O 192.168.11.0/24 [110/4] through 192.168.99.2, 3d17h, FastEthernet0

C 192.168.98.0/24 is directly connected, BVI98

C 192.168.99.0/24 is directly connected, FastEthernet0

O 192.168.20.0/24 [110/2] via 192.168.99.2, 3d17h, FastEthernet0

192.168.5.0/31 is divided into subnets, subnets 1

O 192.168.5.2 [110/2] via 192.168.99.2, 3d17h, FastEthernet0

192.168.6.0/31 is divided into subnets, subnets 1

O 192.168.6.2 [110/3] through 192.168.99.2, 3d17h, FastEthernet0

192.168.1.0/24 [110/14] through 192.168.99.2, 3d17h, FastEthernet0

O * E2 0.0.0.0/0 [110/1] via 192.168.99.2, 1d09h, FastEthernet0

Thank you

Mahesh

Mahesh.

Indeed, solution based purely crypto-card are not compatible with a routing protocol. Crypto card however is the legacy config we support on IOS. The best practice is to use the protection of tunnel. Any routing protocol would work then.

for example

https://learningnetwork.Cisco.com/docs/doc-2457

It's the best solution we currenty have

ASA: VPN IPSEC Tunnel from 5505(ver=8.47) to 5512 (ver = 9.23)

Hi-

We have connected tunnel / VPN configuration between an ASA 5505 - worm = 8.4 (7) and 5512 - worm = 9.2 (3).
We can only ping in a sense - 5505 to the 5512, but not of vice-versa(5512 to 5505).

Networks:

Local: 192.168.1.0 (answering machine)
Distance: 192.168.54.0 (initiator)

See details below on our config:

SH run card cry

card crypto outside_map 2 match address outside_cryptomap_ibfw
card crypto outside_map 2 pfs set group5
outside_map 2 peer XX crypto card game. XX.XXX.XXX
card crypto outside_map 2 set transform-set ESP-AES-256-SHA ikev1
crypto map outside_map 2 set ikev2 AES256 ipsec-proposal

outside_map interface card crypto outside

Note:
Getting to hit numbers below on rules/ACL...

SH-access list. I have 54.0

permit for access list 6 outside_access_out line scope ip 192.168.1.0 255.255.255.0 192.168.54.0 255.255.255.0 (hitcnt = 15931) 0x01aecbcc
permit for access list 1 outside_cryptomap_ibfw line extended ip object NETWORK_OBJ_192.168.1.0_24 object NETWORK_OBJ_192.168.54.0_24 (hitcnt = 3) 0xa75f0671
access-list 1 permit line outside_cryptomap_ibfw extended ip 192.168.1.0 255.255.255.0 192.168.54.0 255.255.255.0 (hitcnt = 3) 0xa75f0671

SH run | I have access-group
Access-group outside_access_out outside interface

NOTE:
WE have another working on the 5512 - VPN tunnel we use IKE peer #2 below (in BOLD)...

HS cry his ikev1

IKEv1 SAs:

HIS active: 2
Generate a new key SA: 0 (a tunnel report Active 1 and 1 to generate a new key during the generate a new key)
Total SA IKE: 2

1 peer IKE: XX. XX.XXX.XXX
Type: L2L role: answering machine
Generate a new key: no State: MM_ACTIVE
2 IKE peers: XXX.XXX.XXX.XXX
Type: L2L role: answering machine
Generate a new key: no State: MM_ACTIVE

SH run tunnel-group XX. XX.XXX.XXX
tunnel-group XX. XX.XXX.XXX type ipsec-l2l
tunnel-group XX. XX.XXX.XXX General-attributes
Group - default policy - GroupPolicy_XX.XXX.XXX.XXX
tunnel-group XX. XX.XXX.XXX ipsec-attributes
IKEv1 pre-shared-key *.
remote control-IKEv2 pre-shared-key authentication *.

SH run | I have political ikev1

ikev1 160 crypto policy
preshared authentication
aes-256 encryption
Group 5
life 86400

SH run | I Dynamics
NAT interface dynamic obj - 0.0.0.0 source (indoor, outdoor)
NAT source auto after (indoor, outdoor) dynamic one interface

NOTE:
To from 5512 at 5505-, we can ping a host on the remote network of ASA local

# ping inside the 192.168.54.20
Type to abort escape sequence.
Send 5, echoes ICMP 100 bytes to 192.168.54.20, wait time is 2 seconds:
!!!!!
Success rate is 100 per cent (5/5), round-trip min/avg/max = 30/32/40 ms

Determination of 192.168.1.79 - local host route to 192.168.54.20 - remote host - derivation tunnel?

The IPSEC tunnel check - seems OK?

SH crypto ipsec his
Interface: outside
Tag crypto map: outside_map, seq num: 2, local addr: XX.XXX.XXX.XXX

outside_cryptomap_ibfw to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.54.0 255.255.255.0
local ident (addr, mask, prot, port): (192.168.1.0/255.255.255.0/0/0)
Remote ident (addr, mask, prot, port): (192.168.54.0/255.255.255.0/0/0)
current_peer: XX. XX.XXX.XXX

#pkts program: 4609, #pkts encrypt: 4609, #pkts digest: 4609
#pkts decaps: 3851, #pkts decrypt: 3851, #pkts check: 3851
compressed #pkts: 0, unzipped #pkts: 0
#pkts uncompressed: 4609, model of #pkts failed: 0, #pkts Dang failed: 0
success #frag before: 0, failures before #frag: 0, #fragments created: 0
Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
#TFC rcvd: 0, #TFC sent: 0
#Valid errors ICMP rcvd: 0, #Invalid ICMP errors received: 0
#send errors: 0, #recv errors: 0

local crypto endpt. : XX.XXX.XXX.XXX/0, remote Start crypto. : XX. XX.XXX.XXX/0
Path mtu 1500, ipsec 74 (44) generals, media, mtu 1500
PMTU time remaining: 0, political of DF: copy / df
Validation of ICMP error: disabled, TFC packets: disabled
current outbound SPI: CDC99C9F
current inbound SPI: 06821CBB

SAS of the esp on arrival:
SPI: 0x06821CBB (109190331)
transform: aes-256-esp esp-sha-hmac no compression
running parameters = {L2L, Tunnel, group 5 PFS, IKEv1}
slot: 0, id_conn: 339968, crypto-card: outside_map
calendar of his: service life remaining (KB/s) key: (3914789/25743)
Size IV: 16 bytes
support for replay detection: Y
Anti-replay bitmap:
0xFFFFFFFF to 0xFFFFFFFF
outgoing esp sas:
SPI: 0xCDC99C9F (3452542111)
transform: aes-256-esp esp-sha-hmac no compression
running parameters = {L2L, Tunnel, group 5 PFS, IKEv1}
slot: 0, id_conn: 339968, crypto-card: outside_map
calendar of his: service life remaining (KB/s) key: (3913553/25743)
Size IV: 16 bytes
support for replay detection: Y
Anti-replay bitmap:
0x00000000 0x00000001

--> The local ASA 5512 - where we have questions - tried Packet Tracer... seems we receive requests/responses...

SH cap CAP

34 packets captured

1: 16:41:08.120477 192.168.1.79 > 192.168.54.20: icmp: echo request
2: 16:41:08.278138 192.168.54.20 > 192.168.1.79: icmp: echo request
3: 16:41:08.278427 192.168.1.79 > 192.168.54.20: icmp: echo reply
4: 16:41:09.291992 192.168.54.20 > 192.168.1.79: icmp: echo request
5: 16:41:09.292282 192.168.1.79 > 192.168.54.20: icmp: echo reply

--> On the ASA 5505 distance - we can ping through the 5512 to the local host (192.168.1.79)

SH cap A2

42 packets captured

1: 16:56:16.136559 802. 1 q vlan P0 192.168.54.20 #1 > 192.168.1.79: icmp: echo request
2: 16:56:16.168860 802. 1 q vlan P0 192.168.1.79 #1 > 192.168.54.20: icmp: echo reply
3: 16:56:17.140434 802. 1 q vlan P0 192.168.54.20 #1 > 192.168.1.79: icmp: echo request
4: 16:56:17.171652 802. 1 q vlan P0 192.168.1.79 #1 > 192.168.54.20: icmp: echo reply
5: 16:56:18.154426 802. 1 q vlan P0 192.168.54.20 #1 > 192.168.1.79: icmp: echo request
6: 16:56:18.186178 802. 1 q vlan P0 192.168.1.79 #1 > 192.168.54.20: icmp: echo reply
7: 16:56:19.168417 802. 1 q vlan P0 192.168.54.20 #1 > 192.168.1.79: icmp: echo request

--> Package trace on 5512 does no problem... but we cannot ping from host to host?

entry Packet-trace within the icmp 192.168.1.79 8 0 detailed 192.168.54.20

Phase: 4
Type: CONN-SETTINGS
Subtype:
Result: ALLOW
Config:
class-map default class
match any
Policy-map global_policy
class class by default
Decrement-ttl connection set
global service-policy global_policy
Additional information:
Direct flow from returns search rule:
ID = 0x7fffa2d0ba90, priority = 7, area = conn-set, deny = false
hits = 4417526, user_data = 0x7fffa2d09040, cs_id = 0 x 0, use_real_addr, flags = 0 x 0 = 0 protocol
IP/ID=0.0.0.0 SRC, mask = 0.0.0.0, port = 0, = 0 tag
IP/ID=0.0.0.0 DST, mask is 0.0.0.0, port = 0, tag = 0, dscp = 0 x 0
input_ifc = output_ifc = any to inside,

Phase: 5
Type: NAT
Subtype:
Result: ALLOW
Config:
NAT interface dynamic obj - 0.0.0.0 source (indoor, outdoor)
Additional information:
Definition of dynamic 192.168.1.79/0 to XX.XXX.XXX.XXX/43904
Direct flow from returns search rule:
ID = 0x7fffa222d130, priority = 6, area = nat, deny = false
hits = 4341877, user_data = 0x7fffa222b970, cs_id = 0 x 0, flags = 0 x 0 = 0 protocol
IP/ID=0.0.0.0 SRC, mask = 0.0.0.0, port = 0, = 0 tag
IP/ID=0.0.0.0 DST, mask is 0.0.0.0, port = 0, tag = 0, dscp = 0 x 0
input_ifc = inside, outside = output_ifc

...

Phase: 14
Type: CREATING STREAMS
Subtype:
Result: ALLOW
Config:
Additional information:
New workflow created with the 7422689 id, package sent to the next module
Information module for forward flow...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_inspect_icmp
snp_fp_translate
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat

Information for reverse flow...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_translate
snp_fp_inspect_icmp
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat

Result:
input interface: inside
entry status: to the top
entry-line-status: to the top
output interface: outside
the status of the output: to the top
output-line-status: to the top
Action: allow

--> On remote ASA 5505 - Packet track is good and we can ping remote host very well... dunno why he "of Nations United-NAT?

Destination - initiator:

entry Packet-trace within the icmp 192.168.54.20 8 0 detailed 192.168.1.79

...
Phase: 4
Type: UN - NAT
Subtype: static
Result: ALLOW
Config:
NAT (inside, outside) static source NETWORK_OBJ_192.168.54.0_24 NETWORK_OBJ_192.168.54.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 non-proxy-arp-search of route static destination
Additional information:
NAT divert on exit to the outside interface
Untranslate 192.168.1.79/0 to 192.168.1.79/0
...

Summary:
We "don't" ping from a host (192,168.1.79) on 5512 - within the network of the 5505 - inside the network host (192.168.54.20).
But we can ping the 5505 - inside the network host (192.168.54.20) 5512 - inside the network host (192.168.1.79).

Please let us know what other details we can provide to help solve, thanks for any help in advance.

-SP

Well, I think it is a NAT ordering the issue.

Basically as static and this NAT rule-

NAT interface dynamic obj - 0.0.0.0 source (indoor, outdoor)

are both in article 1 and in this article, it is done on the order of the rules so it does match the dynamic NAT rule rather than static because that seems to be higher in the order.

To check just run a 'sh nat"and this will show you what order everthing is in.

The ASA is working its way through the sections.

You also have this-

NAT source auto after (indoor, outdoor) dynamic one interface

which does the same thing as first statement but is in section 3, it is never used.

If you do one of two things-

(1) configure the static NAT statement is above the dynamic NAT in section 1 that is to say. You can specify the command line

or

(2) remove the dynamic NAT of section 1 and then your ASA will use the entry in section 3.

There is a very good document on this site for NAT and it is recommended to use section 3 for your general purpose NAT dynamic due precisely these questions.

It is interesting on your ASA 5505 you duplicated your instructions of dynamic NAT again but this time with article 2 and the instructions in section 3 that is why your static NAT works because he's put in correspondence before all your dynamic rules.

The only thing I'm not sure of is you remove the dynamic NAT statement in article 1 and rely on the statement in section 3, if she tears the current connections (sorry can't remember).

Then you can simply try to rearrange so your static NAT is above it just to see if it works.

Just in case you want to see the document here is the link-

https://supportforums.Cisco.com/document/132066/ASA-NAT-83-NAT-operation-and-configuration-format-CLI

Jon

ASA ASA from Site to Site VPN IPSec Tunnel

Any help would be greatly appreciated...

I have two devices Cisco ASA with a Site for the configuration of the tunnel VPN IPSec Site as follows: -.

Site #1 - Cisco ASA running version 8.2 (1) with an internal range of 10.0.0.x/24

Site #2 - Cisco ASA running version 8.2 (1) with an internal range of 10.1.1.x/24

Site #1 is simple and has a dynamic NAT rule which translates all of the inside and the outside (public IP) of the SAA.

Internet access works very well in all workstations of this site. A static route is configured to redirect all traffic to a public router upstream.

Site #2 is slightly more complicated; the Cisco ASA is configured with 10.1.1.254/24 as its interior IP address and 10.1.2.254/24 as its external IP address. A dynamic NAT rule is configured to translate everything inside as the 10.1.2.254 (outside) address of the ASA. A default static route is then configured to redirect all traffic to a Draytek device on 10.1.2.253. This device then performs its own private Public NAT. Again the Internet works fine all hosts inside the Cisco ASA (10.1.1.x)

The IPSec tunnel is created with the networks local and remote endpoint as above (10.0.0.x/24) and (10.1.1.x/24). The Draytek at the Site #2 device is configured with a form of DMZ that allows essentially ALL traffic toward the front directly on the external interface of the ASA (10.1.2.254). The Phase 1 and Phase 2 negotiation of the tunnel ends correctly, and the tunnel is formed without any problem. However, all traffic passing on networks ICMP does not end and the Syslog reports the following-

Site #1-

6 January 19, 2011 15:27:21 302020 ZEFF-SB-01_LAN 1 10.1.1.51 0 Built of outbound ICMP connection for faddr 10.1.1.51/0 gaddr ZEFF-SB-01_LAN/1 laddr ZEFF-SB-01_LAN/1

6 January 19, 2011 15:27:23 302021 10.1.1.51 0 ZEFF-SB-01_LAN 1 Connection of ICMP disassembly for faddr 10.1.1.51/0 gaddr ZEFF-SB-01_LAN/1 laddr ZEFF-SB-01_LAN/1

Site #2-

6 January 19, 2011 15:24:47 302020 10.1.1.51 0 10.0.0.30 1 Built of outbound ICMP connection for faddr gaddr laddr 10.1.1.51/0 10.1.1.51/0 10.0.0.30/1

6 January 19, 2011 15:24:49 302021 10.0.0.30 1 10.1.1.51 0 Connection of disassembly for faddr gaddr laddr 10.1.1.51/0 10.1.1.51/0 10.0.0.30/1 ICMP

It's the same for any form of traffic passing over the tunnel. The ACL is configured to allow segments of LAN out to any destination. At this point, I left scratching my head, as my original theory was to blame the Draytek, but after reading the documentation given to the DMZ host configuration, it appears this parameter is configured all traffic is simply forwarded to the IP address (in this case, the Cisco ASA interface outside).

Anyone can shed light on a possible cause of this problem?

Thank you

Nick

did you bypass the vpn traffic between 10.0.0 and 10.1.1 to be NAT - ed on the two ASA?

Please provide the following information

-set up the tunnel

-show the isa cry his

-show the ipsec cry his

-ping of the site 1 site 2 via tunnel

-capture "crypto ipsec to show his" once again

-ping from site 2 to 1 by the tunnel of the site

-capture "crypto ipsec to show his" once again

-two ASA configuration.

Tunnels of router that support s multiple VPN IPsec AND SSL VPN

I have a main office and an office, each with a RVL200 connected via the IPSec VPN tunnel. We grow faster than we thought and add 2 more branches. Is there a router that is similar to the RVL200 can I put in my main office in support of multiple IPSec tunnels connected to RVL200 in branches, but also keep the SSL VPN?

It seems that the Cisco ASA 5505 will do.

IPSec Tunnel upward, but not accessible from local networks

Hello

I have an ASA5520 and a Snapgear. The IPSec tunnel is in place and works very well. But I am not able to access the local LAN on both sides. Here are a few setups:

SH crypt isakmp his

Active SA: 1 Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey) Total IKE SA: 1 1 IKE Peer: 10.10.10.2 Type : L2L Role : responder Rekey : no State : AM_ACTIVE

Crypto/isakmp:

crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec security-association lifetime seconds 28800 crypto ipsec security-association lifetime kilobytes 4608000 crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1 crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5 crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP crypto map outside_map interface outside crypto map IPSECTEST_map0 1 match address IPSECTEST_cryptomap crypto map IPSECTEST_map0 1 set peer 10.10.10.2 crypto map IPSECTEST_map0 1 set transform-set ESP-3DES-SHA crypto map IPSECTEST_map0 1 set nat-t-disable crypto map IPSECTEST_map0 1 set phase1-mode aggressive crypto map IPSECTEST_map0 interface IPSECTEST crypto isakmp enable outside crypto isakmp enable IPSECTEST crypto isakmp policy 10 authentication pre-share encryption 3des hash sha group 2 lifetime 3600

Route SH:

C 172.16.3.0 255.255.255.0 is directly connected, VLAN10 C 10.10.10.0 255.255.255.0 is directly connected, IPSECTEST C 192.168.112.0 255.255.254.0 is directly connected, inside

access-list:

IPSECTEST_cryptomap list extended access allowed object-group DM_INLINE_PROTOCOL_1 172.16.3.0 255.255.255.0 object 172.20.20.0

and here's the scenario:

If I make a ping of the asa to the Remote LAN, I got this:

ciscoasa (config) # ping 172.20.20.1
Type to abort escape sequence.
Send 5, echoes ICMP 100 bytes to 10.172.20.20.1, wait time is 2 seconds:
No route to the host 172.20.20.1

Success rate is 0% (0/1)

No idea what I lack?

Here's how to set up NAT ASA 8.3 exemption:

network object obj - 172.16.3.0
172.16.3.0 subnet 255.255.255.0

network object obj - 172.20.20.0
172.20.20.0 subnet 255.255.255.0

NAT (inside, outside) source static obj - 172.16.3.0 obj - 172.16.3.0 destination static obj - 172.20.20.0 obj - 172.20.20.0

Here's how it looks to the ASA 8.2 and below:

Inside_nat0_outbound to access extended list ip 172.16.3.0 allow 255.255.255.0 172.20.20.0 255.255.255.0
NAT (inside) 0-list of access Inside_nat0_outbound

Deployment to connect on a router that is already running an ssh IPSec tunnel

I have a bunch of routers that have been made (by someone else!) with Internet IPsec tunnels to the base, but with a telnet vty access network. It must be updated so that only ssh is available for use vty.

Its pretty easy to deploy ssh, but part of the task is to generate an encryption key, "generate the rsa encryption key" etc, if I try to do the configuration without this command, I get an error message asking me to do.

And there is the problem: when I generate a key, it screws the existing IPsec tunnel somehow. Worse still, is not do so immediately, he's waiting for an indefinite period, probably (I guess) until after the tunnel IPsec has been idle for a period and has stopped/started, while I * think * is happening is that on the re-opening of the tunnel, he picks up the wrong key, and the other end kills the link. Newspapers have nothing relevant in them, and I always try to have the failure occur on a router running the debugging.

Has anyone tried to do this before update? should we put ssh first, and then rebuild the config of IPsec tunnel?

Thanks for your ideas/comments

Jim

If the IPSec VPN using certificate authentication, RSA keys regeneration may be bad. Without knowing your IPSec configuration, I would say that the best approach would be to generate an SSH key that will not interfere with it. Try something like this:
```
 crypto key generate rsa modulus 2048 label RSA_Key_SSH ip ssh rsa keypair-name RSA_Key_SSH
```
This will generate a new key, which is independent of any existing keys and configure SSH to use.

How to disable a particular IPSec tunnel on Cisco router

Hi guys,.

Someone knows a way to termporarily disable an IPSec tunnel on a Cisco router provided individual:

-No configuration changes

-Without affecting the other IPSec tunnels running

-GRE is not used, so there is no tunnel interface to close

Or in any event nearest to you to meet the requirement above?

Thank you

Andrew

Andrew,

There is no way to 'turn off' the tunnel without changing the config.

I think the easiest would be to get the card crypto for this particular tunnel and remove the peer or the ACL:

for example:

labmap 10 ipsec-isakmp crypto map

no counterpart set 10.0.0.1

labmap 10 ipsec-isakmp crypto map

no correspondence address 100

or you can remove the key isakmp for this tunnel, that would, for example:

No cisco123 key crypto isakmp 10.0.0.1 address

That would prevent the tunnel to come without affecting the other tunnels.

I hope this helps.

Raga

Can I use private as Source IPs from a remote network IP addresses while building the IPSec tunnel?

Can I use private as Source IPs from a remote network IP addresses while building the IPSec tunnel? If not why? If so, how?

Your explanation is much appreciated.

Hi Deepak,

In such a situation, you usually NAT traffic that goes to the internet, but exempt traffic that goes through the VPN, because it will be wrapped in packages with public IP (tunnel) addresses. You can use the same IP address on your interface in the face of internet for the NAT/PAT and source of IPSEC Tunnel.

Using Loopback Interface as Source GRE/IPSec tunnel

Hi all:

I need one to spend a working router to router VPN tunnel using an IP WAN IP interface loopback as a source. I am able to ping the loopback from the other router. As soon as I change the source of tunnel to use the loopback IP address, change the encryption ACL map, and move the cryptographic card of the WAN interface to the loopback interface, the tunnel will not come to the top. If I remove all the crypto config, the tunnel comes up fine as just a GRE tunnel. On the other router, I see the message that says that's not encrypting the traffic below.

* 00:10:33.515 Mar 1: % CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd package not an IPSEC packet. (ip) vrf/adr_dest = 192.168.0.1, src_addr = 192.168.1.2, prot = 47

What Miss me? Is there something else that needs to be done to use the closure of a GRE/IPSec tunnel?

I have install below config in the laboratory to see if I can get it even work in a non-production environment.

R1 WAN IP: 192.168.0.1

R2 WAN IP: 192.168.0.2

R2 Closure: 192.168.1.2

hostname R2

!

crypto ISAKMP policy 1

BA 3des

md5 hash

preshared authentication

Group 2

ISAKMP crypto key abc123 address 192.168.0.1

!

Crypto ipsec transform-set esp-3des esp-md5-hmac T1

transport mode

!

crypto map 1 VPN ipsec-isakmp

Description remote control

defined peer 192.168.0.1

game of transformation-T1

match address VPN1

!

interface Loopback0

IP 192.168.1.2 255.255.255.255

VPN crypto card

!

Tunnel1 interface

IP 172.30.240.2 255.255.255.252

IP mtu 1440

KeepAlive 10 3

tunnel source 192.168.1.2

tunnel destination 192.168.0.1

VPN crypto card

!

interface FastEthernet0

IP 192.168.0.2 255.255.255.0

!

VPN1 extended IP access list

allow ACCORD 192.168.1.2 host 192.168.0.1

you have tried to add "card crypto VPN 1 - address Loopback0".

IPSec Tunnel between Cisco 2801 and Netscren 50 with NAT and static

Hello

My problem isn't really the IPSec connection between two devices (it is already done...) But my problem is that I have a mail server on the site of Cisco, who have a static NAT from inside to outside. Due to the static NAT, I do not see the server in the VPN tunnel. I found a document that almost describes the problem:

"Configuration of a router IPSEC Tunnel private-to-private network with NAT and static" (Document ID 14144)

NAT takes place before the encryption verification!

In this document, the solution is 'routing policy' using the loopback interface. But, how can I handle this with the Netscreen firewall. Someone has an idea?

Thanks for any help

Best regards

Heiko

Hello

Try to change your static NAT with static NAT based policy.

That is to say the static NAT should not be applicable for VPN traffic

permissible static route map 1

corresponds to the IP 104

access-list 104 refuse host ip 10.1.110.10 10.1.0.0 255.255.0.0

access-list 104 allow the host ip 10.1.110.10 all

IP nat inside source static 10.1.110.10 81.222.33.90 map of static route

HTH

Kind regards

GE.

How to troubleshoot an IPSec tunnel GRE?

Hello

My topology includes two firewalls connected through the Internet "" (router) and behind each firewall, there is a router.

The routers I configured a GRE tunnel that is successful, then I configured an IPsec tunnel on the firewall.

I does not change the mode to transport mode in the transform-set configuration.

Everything works; If I connect a PC to the router, it can ping another PC on the other router. However if I change mode of transport mode that they cannot.

I was wondering how can I ensure that the IPSec tunnel WILL really works? How can I fix it or package tracking?

Thank you.

I was wondering how can I ensure that the IPSec tunnel WILL really works? How can I fix it or package tracking?

To verify that the VPN tunnel works well, check the output of
ISAKMP crypto to show his
Crypto ipsec to show his

Here are the commands of debug
Debug condition crypto x.x.x.x, where x.x.x.x IP = peer peer
Debug crypto isakmp 200
Debug crypto ipsec 200

You will see ACTIVE int the first output and program non-zero and decaps on the output of the latter.

For the GRE tunnel.
check the condition of the tunnel via "int ip see the brief.

In addition, you can configure keepalive via the command:

Router # configure terminal
Router (config) #interface tunnel0
Router(Config-if) 5 4 #keepalive

and then run "debug keepalive tunnel" to see packets hello tunnel going and coming from the router.

Kind regards
Dinesh Moudgil

PS Please rate helpful messages.

IPSec tunnels does not work

I have 2 Cat6, with IPsec SPA card, while the other did not.

I tried setting IPsec tunnel between them, but somehow can't bring up the tunnel, can someone help me to watch set it up?

A (with SPA):

crypto ISAKMP policy 1

BA aes 256

preshared authentication

Group 5

ISAKMP crypto cisco123 key address 0.0.0.0 0.0.0.0

ISAKMP crypto keepalive 10

Crypto ipsec transform-set esp - aes 256 esp-sha-hmac testT1

!

Crypto ipsec profile P1

Set transform-set testT1

!

Crypto call admission limit ike his 3000

!

Crypto call admission limit ike in-negotiation-sa 115

!

interface Tunnel962

Loopback962 IP unnumbered

tunnel GigabitEthernet2/37.962 source

tunnel destination 172.16.16.6

ipv4 ipsec tunnel mode

Profile of tunnel P1 ipsec protection

interface GigabitEthernet2/37.962

encapsulation dot1Q 962

IP 172.16.16.5 255.255.255.252

interface Loopback962

1.1.4.200 the IP 255.255.255.255

IP route 2.2.4.200 255.255.255.255 Tunnel962

B (wuthout SPA):

crypto ISAKMP policy 1

BA aes 256

preshared authentication

Group 5

ISAKMP crypto cisco123 key address 0.0.0.0 0.0.0.0

!

!

Crypto ipsec transform-set esp - aes 256 esp-sha-hmac T1

!

Crypto ipsec profile P1

game of transformation-T1

interface Tunnel200

Loopback200 IP unnumbered

tunnel GigabitEthernet2/1.1 source

tunnel destination 172.16.16.5

ipv4 ipsec tunnel mode

Profile of tunnel T1 ipsec protection

interface Loopback200

2.2.4.200 the IP 255.255.255.255

interface GigabitEthernet2/1.1

encapsulation dot1Q 962

IP 172.16.16.6 255.255.255.252

IP route 1.1.4.200 255.255.255.255 Tunnel200

I can ping from 172.16.16.6 to 172.16.16.5, but the tunnel just can not upwards. When I turned on "debugging ipsec cry ' and ' debug cry isa", nothing comes out, when I trun on 'cry of debugging sciences', I got:

"00:25:17: crypto_engine_select_crypto_engine: can't handle more."

Hello

You need a map of IPSEC SPA on chassis B do IPSEC encryption. Please see the below URL for more details.

Without a SPA-IPSEC - 2G or IPsec VPN Services Module of acceleration, the IPsec network security feature (configured with the crypto ipsec command) is supported in the software only for administrative for Catalyst 6500 series switches and routers for the Cisco 7600 Series connections.

http://www.Cisco.com/en/us/docs/switches/LAN/catalyst6500/IOS/12.2SXF/native/release/notes/OL_4164.html

Kind regards

Arul

* Rate pls if it helps *.

NAT in the IPSec tunnel between 2 routers x IOS (877)

Hi all

We have a customer with 2 x 877 routers connected to the internet. These routers are configured with an IPSec tunnel (which works fine). The question is the inbound static NAT translation problems with the tunnel - port 25 is mapped to the address inside the mail server. The existing configuration works very well for incoming mail, but prevents users from access to the direct mail server (using the private IP address) on port 25.

Here is the Config NAT:

nat INET_POOL netmask 255.255.255.252 IP pool

IP nat inside source map route INET_NAT pool INET_POOL overload

IP nat inside source static tcp 10.10.0.8 25 25 expandable

IP nat inside source static tcp 10.10.0.8 80 80 extensible

IP nat inside source static tcp 10.10.0.8 443 443 extensible

IP nat inside source static tcp 10.10.0.7 1433 1433 extensible

IP nat inside source static tcp 10.10.0.7 extensible 3389 3389

allowed INET_NAT 1 route map

corresponds to the IP 101

access-list 101 deny ip 10.10.0.0 0.0.0.255 192.168.1.0 0.0.0.255

access-list 101 permit ip 10.10.0.0 0.0.0.255 any

On the SAA, I would setup a NAT exemption, but how do I get the same thing in the IOS?

See you soon,.

Luke

Take a look at this link:

http://www.Cisco.com/en/us/docs/iOS/12_2t/12_2t4/feature/guide/ftnatrt.html

Concerning

Farrukh

IPSec tunnel on router from closure

Similar Questions

Maybe you are looking for