IPSec VPN between Cisco ASA and Fortigate1000

Hello

I find a useful document on how to create a tunnel VPN IPSec with ASA 5510 firewall Fortigate 1000...

the configuration of the coast FG is done without any problem, BUT the document (. doc FG) said I must configure the ASA with a GRE interface and assign an internal IP address in order to communicate with the FG...

The question is: How do I configure the interface on the SAA ACCORD?

Thanks in advance, Experts...

Kind regards...

ASA firewall does not support the interface/GRE GRE tunnel.

If you need to have GRE configured, you will need to complete the GRE tunnel on router IOS.

If you want to configure just pure tunnel VPN IPSec (lan-to-lan), here is an example of configuration on the side of the ASA:

http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a0080950890.shtml

Hope that helps.

Tags: Cisco Security

Similar Questions

IPSec VPN between Cisco and ScreenOS

Hello

I'm trying to set up a simple IPSec VPN between a Cisco 2911 router and a Juniper Netscreen ScreenOS (not exactly now the model) device. Initially the debbuging seems good (QM_IDLE), but the ISAKMP Security Association is deleted.

The guy managing the Juniper device send me an extract from his diary:

###########################################################################

2012-08-28 10:24:16 info 00536 IKE Phase 2 msg ID System

9b 839579: negotiations failed.

2012-08-28 10:24:16 info system 00536 rejected a package of IKE loopback.11

of : 500 to

217.150.152.45:500 with cookies

87960e39d074ca49 and 9302d26c7ce324a5

because there is no acceptable Phase

2 proposals...

It has defined the following phase 2 proposals:

IKE the value p2-proposal "G2_esp_aes256_sha_1800s" group2 esp aes256-sha-1, 1800 second

###########################################################################

And I use these:

###########################################################################

crypto ISAKMP policy 1

BA aes 256

preshared authentication

Group 2

!

ISAKMP crypto key address 217.150.152.45

Crypto ipsec transform-set esp - aes esp - aes 256 esp-sha-hmac

card crypto ipsec vpn 2 isakmp

Description * VPN Anbindung nach PKI in Magdeburg *.

defined by peer 217.150.152.45

define security-association life seconds 1800

the value of the transform-set esp - aes

match address PKI-TRAFFIC

!

###########################################################################

Here is my Log:

#################################################################################################################

28 August 08:23:46.416: ISAKMP: (0): profile of THE request is (NULL)

28 August 08:23:46.416: ISAKMP: created a struct peer 217.150.152.45, peer port 500

28 August 08:23:46.416: ISAKMP: new position created post = 0x2A2D7150 peer_handle = 0x8000003A

28 August 08:23:46.416: ISAKMP: lock struct 0x2A2D7150, refcount 1 to peer isakmp_initiator

28 August 08:23:46.416: ISAKMP: 500 local port, remote port 500

28 August 08:23:46.416: ISAKMP: set new node 0 to QM_IDLE

28 August 08:23:46.416: ISAKMP: (0): insert his with his 31627E04 = success

28 August 08:23:46.416: ISAKMP: (0): cannot start aggressive mode, try the main mode.

28 August 08:23:46.416: ISAKMP: (0): pair found pre-shared key matching 217.150.152.45

28 August 08:23:46.416: ISAKMP: (0): built of NAT - T of the seller-rfc3947 ID

28 August 08:23:46.416: ISAKMP: (0): built the seller-07 ID NAT - t

28 August 08:23:46.416: ISAKMP: (0): built of NAT - T of the seller-03 ID

28 August 08:23:46.416: ISAKMP: (0): built the seller-02 ID NAT - t

28 August 08:23:46.416: ISAKMP: (0): entry = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM

28 August 08:23:46.416: ISAKMP: (0): former State = new State IKE_READY = IKE_I_MM1

28 August 08:23:46.416: ISAKMP: (0): Beginner Main Mode Exchange

28 August 08:23:46.416: ISAKMP: (0): lot of 217.150.152.45 sending my_port 500 peer_port 500 (I) MM_NO_STATE

28 August 08:23:46.416: ISAKMP: (0): sending a packet IPv4 IKE.

28 August 08:23:46.448: ISAKMP (0): received 217.150.152.45 packet dport 500 sport Global 500 (I) MM_NO_STATE

28 August 08:23:46.448: ISAKMP: (0): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH

28 August 08:23:46.448: ISAKMP: (0): former State = new State IKE_I_MM1 = IKE_I_MM2

28 August 08:23:46.448: ISAKMP: (0): treatment ITS payload. Message ID = 0

28 August 08:23:46.448: ISAKMP: (0): load useful vendor id of treatment

28 August 08:23:46.448: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 239

28 August 08:23:46.448: ISAKMP: (0): load useful vendor id of treatment

28 August 08:23:46.448: ISAKMP: (0): provider ID is DPD

28 August 08:23:46.448: ISAKMP: (0): load useful vendor id of treatment

28 August 08:23:46.448: ISAKMP: (0): IKE frag vendor processing id payload

28 August 08:23:46.448: ISAKMP: (0): IKE Fragmentation support not enabled

28 August 08:23:46.448: ISAKMP: (0): pair found pre-shared key matching 217.150.152.45

28 August 08:23:46.448: ISAKMP: (0): pre-shared key local found

28 August 08:23:46.448: ISAKMP: analysis of the profiles for xauth...

28 August 08:23:46.448: ISAKMP: (0): audit ISAKMP transform 1 against the policy of priority 1

28 August 08:23:46.448: ISAKMP: AES - CBC encryption

28 August 08:23:46.448: ISAKMP: SHA hash

28 August 08:23:46.448: ISAKMP: group by default 2

28 August 08:23:46.448: ISAKMP: pre-shared key auth

28 August 08:23:46.448: ISAKMP: keylength 256

28 August 08:23:46.448: ISAKMP: type of life in seconds

28 August 08:23:46.448: ISAKMP: life (IPV) 0 x 0 0 x 1 0 x 51 0x80

28 August 08:23:46.448: ISAKMP: (0): atts are acceptable. Next payload is 0

28 August 08:23:46.448: ISAKMP: (0): Acceptable atts: real life: 0

28 August 08:23:46.448: ISAKMP: (0): Acceptable atts:life: 0

28 August 08:23:46.448: ISAKMP: (0): fill atts in his vpi_length:4

28 August 08:23:46.448: ISAKMP: (0): fill atts in his life_in_seconds:86400

28 August 08:23:46.448: ISAKMP: (0): return real life: 86400

28 August 08:23:46.448: ISAKMP: (0): timer life Started: 86400.

28 August 08:23:46.448: ISAKMP: (0): load useful vendor id of treatment

28 August 08:23:46.448: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 239

28 August 08:23:46.448: ISAKMP: (0): load useful vendor id of treatment

28 August 08:23:46.448: ISAKMP: (0): provider ID is DPD

28 August 08:23:46.448: ISAKMP: (0): load useful vendor id of treatment

28 August 08:23:46.448: ISAKMP: (0): IKE frag vendor processing id payload

28 August 08:23:46.448: ISAKMP: (0): IKE Fragmentation support not enabled

28 August 08:23:46.448: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE

28 August 08:23:46.448: ISAKMP: (0): former State = new State IKE_I_MM2 = IKE_I_MM2

28 August 08:23:46.448: ISAKMP: (0): lot of 217.150.152.45 sending my_port 500 peer_port 500 (I) MM_SA_SETUP

28 August 08:23:46.448: ISAKMP: (0): sending a packet IPv4 IKE.

28 August 08:23:46.452: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE

28 August 08:23:46.452: ISAKMP: (0): former State = new State IKE_I_MM2 = IKE_I_MM3

28 August 08:23:46.484: ISAKMP (0): received 217.150.152.45 packet dport 500 sport Global 500 (I) MM_SA_SETUP

28 August 08:23:46.484: ISAKMP: (0): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH

28 August 08:23:46.484: ISAKMP: (0): former State = new State IKE_I_MM3 = IKE_I_MM4

28 August 08:23:46.484: ISAKMP: (0): processing KE payload. Message ID = 0

28 August 08:23:46.508: ISAKMP: (0): processing NONCE payload. Message ID = 0

28 August 08:23:46.508: ISAKMP: (0): pair found pre-shared key matching 217.150.152.45

28 August 08:23:46.508: ISAKMP: (1049): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE

28 August 08:23:46.508: ISAKMP: (1049): former State = new State IKE_I_MM4 = IKE_I_MM4

28 August 08:23:46.508: ISAKMP: (1049): send initial contact

28 August 08:23:46.508: ISAKMP: (1049): ITS been pre-shared key, using id ID_IPV4_ADDR type authentication

28 August 08:23:46.508: ISAKMP (1049): payload ID

next payload: 8

type: 1

address: 92.67.80.237

Protocol: 17

Port: 500

Length: 12

28 August 08:23:46.508: ISAKMP: (1049): the total payload length: 12

28 August 08:23:46.508: ISAKMP: (1049): lot of 217.150.152.45 sending my_port 500 peer_port 500 (I) MM_KEY_EXCH

28 August 08:23:46.508: ISAKMP: (1049): sending a packet IPv4 IKE.

28 August 08:23:46.508: ISAKMP: (1049): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE

28 August 08:23:46.508: ISAKMP: (1049): former State = new State IKE_I_MM4 = IKE_I_MM5

28 August 08:23:46.540: ISAKMP (1049): received 217.150.152.45 packet dport 500 sport Global 500 (I) MM_KEY_EXCH

28 August 08:23:46.540: ISAKMP: (1049): payload ID for treatment. Message ID = 0

28 August 08:23:46.540: ISAKMP (1049): payload ID

next payload: 8

type: 1

address: 217.150.152.45

Protocol: 17

Port: 500

Length: 12

28 August 08:23:46.540: ISAKMP: (0): peer games * no * profiles

28 August 08:23:46.540: ISAKMP: (1049): HASH payload processing. Message ID = 0

28 August 08:23:46.540: ISAKMP: (1049): SA authentication status:

authenticated

28 August 08:23:46.540: ISAKMP: (1049): SA has been authenticated with 217.150.152.45

28 August 08:23:46.540: ISAKMP: try inserting a peer /217.150.152.45/500/ and inserted 2A2D7150 successfully.

28 August 08:23:46.540: ISAKMP: (1049): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH

28 August 08:23:46.540: ISAKMP: (1049): former State = new State IKE_I_MM5 = IKE_I_MM6

28 August 08:23:46.540: ISAKMP: (1049): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE

28 August 08:23:46.540: ISAKMP: (1049): former State = new State IKE_I_MM6 = IKE_I_MM6

28 August 08:23:46.540: ISAKMP: (1049): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE

28 August 08:23:46.540: ISAKMP: (1049): former State = new State IKE_I_MM6 = IKE_P1_COMPLETE

28 August 08:23:46.540: ISAKMP: (1049): start Quick Mode Exchange, M - ID of 1582159006

28 August 08:23:46.552: ISAKMP: (1049): initiator QM gets spi

28 August 08:23:46.552: ISAKMP: (1049): lot of 217.150.152.45 sending my_port 500 peer_port 500 (I) QM_IDLE

28 August 08:23:46.552: ISAKMP: (1049): sending a packet IPv4 IKE.

28 August 08:23:46.552: ISAKMP: (1049): entrance, node-1582159006 = IKE_MESG_INTERNAL, IKE_INIT_QM

28 August 08:23:46.552: ISAKMP: (1049): former State = new State IKE_QM_READY = IKE_QM_I_QM1

28 August 08:23:46.552: ISAKMP: (1049): entry = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE

28 August 08:23:46.552: ISAKMP: (1049): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE

28 August 08:23:46.584: ISAKMP (1049): received 217.150.152.45 packet dport 500 sport Global 500 (I) QM_IDLE

28 August 08:23:46.584: ISAKMP: node set-452721455 to QM_IDLE

28 August 08:23:46.584: ISAKMP: (1049): HASH payload processing. Message ID =-452721455

28 August 08:23:46.584: ISAKMP: (1049): treatment protocol NOTIFIER PROPOSAL_NOT_CHOSEN 1

SPI 0, message ID =-452721455, his 0x31627E04 =

28 August 08:23:46.584: ISAKMP: (1049): peer does not paranoid KeepAlive.

28 August 08:23:46.584: ISAKMP: (1049): remove the reason for HIS "fatal Recevied of information' State (I) QM_IDLE (post 217.150.152.45)

28 August 08:23:46.584: ISAKMP: (1049): node-452721455 error suppression FALSE reason 'informational (en) State 1.

28 August 08:23:46.584: ISAKMP: (1049): entry = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY

28 August 08:23:46.584: ISAKMP: (1049): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE

28 August 08:23:46.584: ISAKMP: node set 494253780 to QM_IDLE

28 August 08:23:46.584: ISAKMP: (1049): lot of 217.150.152.45 sending my_port 500 peer_port 500 (I) QM_IDLE

28 August 08:23:46.584: ISAKMP: (1049): sending a packet IPv4 IKE.

28 August 08:23:46.584: ISAKMP: (1049): purge the node 494253780

28 August 08:23:46.584: ISAKMP: (1049): entry = IKE_MESG_INTERNAL, IKE_PHASE1_DEL

28 August 08:23:46.584: ISAKMP: (1049): former State = new State IKE_P1_COMPLETE = IKE_DEST_SA

28 August 08:23:46.584: ISAKMP: (1049): remove the reason for HIS "fatal Recevied of information' State (I) QM_IDLE (post 217.150.152.45)

Intertoys_Zentrale_Waddinxveen_01 #.

28 August 08:23:46.584: ISAKMP: Unlocking counterpart struct 0x2A2D7150 for isadb_mark_sa_deleted(), count 0

28 August 08:23:46.584: ISAKMP: delete peer node by peer_reap for 217.150.152.45: 2A2D7150

28 August 08:23:46.584: ISAKMP: (1049): node-1582159006 error suppression FALSE reason 'IKE deleted.

28 August 08:23:46.584: ISAKMP: (1049): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH

28 August 08:23:46.584: ISAKMP: (1049): former State = new State IKE_DEST_SA = IKE_DEST_SA

#################################################################################################################

Is there something special that needs to be addressed when creating a VPN for Juniper devices?

Greetings

Thomas

The peer IPSec a PFS enabled, do the same in your crypto-map:

card crypto ipsec vpn 2 isakmp

PFS group2 Set

--
Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
http://www.Kiva.org/invitedBy/karsteni

ASA 5505 - I can't create an IPSEC VPN between two ASA 5505

Hello

I have two ASA 5505 with basic license and I'm trying to create a VPN IPSEC using the CLI. Here are the steps I did:

1 Configure ASA-1 (host name, vlan 1 and vlan 2).

2. configure a static route

3. create object network (local and remote)

4. create the access list

5. create ikev1 crypto

6. create tunnel-group

7 Configure nat

and I repeat the steps above with the ASA but another change IP.

Are to correct the above steps?

Why can I not create an IPSEC VPN between devices?.

No, you needn't. The ASA configuration is ok. Packet trace proved it. I think it can be a problem on the hosts. Please, check the firewall on the PC and try to put out of service, if it is running.

Configure several IPSec VPN between Cisco routers

I would like to create multiple ipsec VPN between 3 routers. Before applying it, I would like to check on the config I wrote to see if it works. It's just on RouterA configuration for virtual private networks to RouterB, and RouterC.

As you can apply in a cyptomap by interface, I say with the roadmap, that it should be able to manage traffic for both routers. Or is there a better way to do it?

RouterA - 1.1.1.1

RouterB - 2.2.2.2

RouterC - 3.3.3.3

RouterA

crypto ISAKMP policy 10

BA 3des

preshared authentication

Group 2

ISAKMP crypto key RouterB address 2.2.2.2

ISAKMP crypto keys RouterC address 3.3.3.3

invalid-spi-recovery crypto ISAKMP

ISAKMP crypto keepalive 5 10 periodicals

ISAKMP crypto nat keepalive 30

!

life crypto ipsec security association seconds 28800

!

Crypto ipsec transform-set AES - SHA esp - aes 256 esp-sha-hmac

!

outsidemap 20 ipsec-isakmp crypto map

defined peer 2.2.2.2

game of transformation-AES-SHA

match address 222

outsidemap 30 ipsec-isakmp crypto map

defined peer 3.3.3.3

game of transformation-AES-SHA

match address 333

!

interface GigabitEthernet0/0

Description * Internet *.

NAT outside IP

outsidemap card crypto

!

interface GigabitEthernet0/1

Description * LAN *.

IP 1.1.1.1 255.255.255.0

IP nat inside

!

IP nat inside source map route RouterA interface GigabitEthernet0/0 overload

!

access-list 222 allow ip 1.1.1.0 0.0.0.255 2.2.2.0 0.0.0.255

access-list 223 deny ip 1.1.1.0 0.0.0.255 2.2.2.0 0.0.0.255

access-list 223 allow ip 1.1.1.0 0.0.0.255 any

access-list 333 allow ip 1.1.1.0 0.0.0.255 3.3.3.0 0.0.0.255

access-list 334 deny ip 1.1.1.0 0.0.0.255 3.3.3.0 0.0.0.255

access-list 334 allow ip 1.1.1.0 0.0.0.255 any

!

!

RouterA route map permit 10

corresponds to the IP 223 334

Hi Chris,

The two will remain active.

The configuration you have is for several ste VPN site is not for the redundant VPN.

The config for the redundant VPN is completely different allows so don't confuse is not with it.

In the redundant VPN configuration both peers are defined in the same card encryption.

Traffic that should be passed through the tunnel still depend on the access list, we call in the card encryption.

This access-lsist is firstly cheked and as a result, the traffic is passed through the correct tunnel

HTH!

Concerning

Regnier

Please note all useful posts

Site to Site VPN between Cisco ASA 5505 and Sonicwall TZ170

I'm trying to implement a VPN site-to site between our data center and office. The data center has a Cisco ASA 5505 and the Office has a Sonicwall TZ170. I managed to configure the two so that the vpn connects. Each of the firewall I ping the IP Address of the internet firewall on the other side and a desktop computer I can ping the IP Address of the firewall internal datacenter but I can't carry traffic between private subnets datacenter and desktop. Can anyone help?

The config below has had IPs/passwords has changed.

External Datacenter: 1.1.1.4

External office: 1.1.1.1

Internal data center: 10.5.0.1/24

Internal office: 10.10.0.1/24

: Saved
:
ASA Version 8.2 (1)
!
hostname datacenterfirewall
mydomain.tld domain name
activate the password encrypted
passwd encrypted
names of
name 10.10.0.0 OfficeNetwork
10.5.0.0 DatacenterNetwork name
!
interface Vlan1
nameif inside
security-level 100
10.5.0.1 IP address 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
1.1.1.4 IP address 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passive FTP mode
clock timezone IS - 5
clock to summer time EDT recurring
DNS server-group DefaultDNS
buydomains.com domain name
permit same-security-traffic inter-interface
permit same-security-traffic intra-interface
inside_access_in list extended access permit icmp any one
inside_access_in list extended access permitted tcp a whole
inside_access_in list extended access udp allowed a whole
inside_access_in of access allowed any ip an extended list
outside_access_in list extended access permit icmp any one
outside_access_in list extended access udp allowed any any eq isakmp
IP DatacenterNetwork 255.255.255.0 OfficeNetwork 255.255.255.0 allow Access-list extended pixtosw
pixtosw list extended access allow icmp DatacenterNetwork 255.255.255.0 OfficeNetwork 255.255.255.0
IP OfficeNetwork 255.255.255.0 DatacenterNetwork 255.255.255.0 allow Access-list extended pixtosw
pixtosw list extended access allow icmp OfficeNetwork 255.255.255.0 DatacenterNetwork 255.255.255.0
outside_cryptomap_66.1 list of allowed ip extended access all OfficeNetwork 255.255.255.0
outside_cryptomap_66.1 ip OfficeNetwork 255.255.255.0 allowed extended access list all
outside_cryptomap_66.1 list extended access permit icmp any OfficeNetwork 255.255.255.0
outside_cryptomap_66.1 list extended access allowed icmp OfficeNetwork 255.255.255.0 everything
pager lines 24
Enable logging
asdm of logging of information
Within 1500 MTU
Outside 1500 MTU
IP verify reverse path to the outside interface
ICMP unreachable rate-limit 1 burst-size 1
ASDM image disk0: / asdm - 623.bin
don't allow no asdm history
ARP timeout 14400
NAT-control
Global 1 interface (outside)
NAT (inside) 1 0.0.0.0 0.0.0.0
inside_access_in access to the interface inside group
Access-group outside_access_in in interface outside
Route inside 0.0.0.0 0.0.0.0 1.1.1.1 1
Route OfficeNetwork 255.255.255.0 outside 1.1.1.1 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-registration DfltAccessPolicy
Enable http server
http 10.5.0.0 255.255.255.0 inside
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac
Crypto ipsec transform-set esp-aes-256 walthamoffice, esp-sha-hmac
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
Crypto dynamic-map ciscopix 1 corresponds to the address outside_cryptomap_66.1
Crypto dynamic-map ciscopix 1 transform-set walthamoffice
Crypto dynamic-map ciscopix 1 the value reverse-road
map dynmaptosw 66-isakmp ipsec crypto dynamic ciscopix
dynmaptosw interface card crypto outside
crypto isakmp identity address
crypto ISAKMP allow outside
crypto ISAKMP policy 10
preshared authentication
3des encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 13
preshared authentication
aes-256 encryption
sha hash
Group 2
lifetime 28800
crypto ISAKMP policy 30
preshared authentication
aes-256 encryption
sha hash
Group 2
life 86400
No encryption isakmp nat-traversal
Telnet 10.5.0.0 255.255.255.0 inside
Telnet timeout 5
SSH 10.5.0.0 255.255.255.0 inside
SSH timeout 5
Console timeout 0
management-access inside
dhcpd address 10.5.0.2 - 10.5.0.254 inside
dhcpd allow inside
!

a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
NTP server 66.250.45.2 source outdoors
NTP server 72.18.205.157 source outdoors
NTP server 208.53.158.34 source outdoors
WebVPN
attributes of Group Policy DfltGrpPolicy
VPN-idle-timeout no
username admin password encrypted
tunnel-group 1.1.1.1 type ipsec-l2l
tunnel-group 1.1.1.1 ipsec-attributes
pre-shared-key *.
!
!
!
type of policy-card inspect dns preset_dns_map
parameters
message-length maximum 512
!
context of prompt hostname
Cryptochecksum:7f319172e5de9c0e550804a263f8e49e
: end

Mattew, obvious lack of education is the rule exempt from nat for your tunnel, your access list pixtosw is similar on this example, I assume that you have gone through this link, if it does not see the configs on both sides.

Add the statement of rule sheep in asa and try again.

NAT (inside) 0-list of access pixtosw

http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a008052c9d4.shtml

Concerning

IPSec Tunnel between Cisco 2801 and Netscren 50 with NAT and static

Hello

My problem isn't really the IPSec connection between two devices (it is already done...) But my problem is that I have a mail server on the site of Cisco, who have a static NAT from inside to outside. Due to the static NAT, I do not see the server in the VPN tunnel. I found a document that almost describes the problem:

"Configuration of a router IPSEC Tunnel private-to-private network with NAT and static" (Document ID 14144)

NAT takes place before the encryption verification!

In this document, the solution is 'routing policy' using the loopback interface. But, how can I handle this with the Netscreen firewall. Someone has an idea?

Thanks for any help

Best regards

Heiko

Hello

Try to change your static NAT with static NAT based policy.

That is to say the static NAT should not be applicable for VPN traffic

permissible static route map 1

corresponds to the IP 104

access-list 104 refuse host ip 10.1.110.10 10.1.0.0 255.255.0.0

access-list 104 allow the host ip 10.1.110.10 all

IP nat inside source static 10.1.110.10 81.222.33.90 map of static route

HTH

Kind regards

GE.

IKE Dead Peer Detection between Cisco ASA and Cisco PIX

I have a network environment in Star with about 30 offices of satellite remote using VPN Site to Site connectivity. The majority of remote satellite offices have the features of Cisco PIX 501 running PIX Version 6.3. The hub office runs a version 8.2 (1) Cisco ASA.

I configured Dead Peer Detection on the Cisco ASA device at the office hub with the default settings of the following-

Confidence interval - 10 seconds

Retry interval - 2 seconds

I think I'm right assuming that raises are limited to 3 before the tunnel is completely demolished. Basically, the problem that I am facing is with several remote satellite offices. What seems to be the case, the tunnel between the remote offices and the hub is demolished (probably because of the length of IKE, always 86400 seconds) and the tunnel then fails to renegotiate unless traffic is physically forced from the hub office. The tunnel NOT to renegotiate after satellite office, ONLY the end of the hub; so that means sending traffic to the satellite when the VPN tunnel is out of service, not to renegotiate the tunnel. The Hub office is a colo and therefore traffic rarely comes to that end, the tunnel remains so down until manual intervention occurs and the ICMP traffic is forced into the tunnel.

Should the KeepAlive and retry interval settings corresponds to both ends, for example if the two devices be configured for DPD?

What are the potential pitfalls to the extension of the life of IKE, and this will help or even hinder the problem?

Thank you in advance for helping out with this.

Hi Nicolas,.

I think that the two DPD settings must match on both ends, if these do not match then problems like yours might arise which seems to happen here, is that one end shows a tunnel down, but the other end may not detect it down, we could have to watch debugs, or record two ends to see if this is the case , setting in the meantime ike DPD for same timers could hetlp on.

In regard to the increase in the life expectancy of IKE, well you just need to be aware that this could allow keys to be discovered since these are not renegotiated unless the tunnel is down on the level of IKE. Other than that I don't see why this would affect you.

Problem with IPSEC tunnel between Cisco PIX and Cisco ASA

Hi all!

Have a strange problem with one of our tunnel ipsec for one of our customers, we can open the tunnel of the customers of the site, but not from our site, don't understand what's wrong, if it would be a configuration problem should can we not all up the tunnel.

On our side as initiator:

Jan 14 13:53:26 172.27.1.254% PIX-7-702208: ISAKMP Phase 1 Exchange started (local 1.1.1.1 (initiator), remote 2.2.2.2)

Jan 14 13:53:26 172.27.1.254% PIX-7-702210: Exchange of ISAKMP Phase 1 is complete (local 1.1.1.1 (initiator), remote 2.2.2.2)

Jan 14 13:53:26 172.27.1.254% 6-PIX-602202: ISAKMP connected session (local 1.1.1.1 (initiator), remote 2.2.2.2)

Jan 14 13:53:26 172.27.1.254% PIX-6-602201: Phase 1 ISAKMP Security Association created (local 1.1.1.1/500 (initiator), 2.2.2.2/500 remotely, authentication = pre-action, encryption = 3DES-CBC, hash = SHA, group = 2, life = 86400 s)

Jan 14 13:53:26 172.27.1.254% PIX-7-702209: ISAKMP Phase 2 Exchange started (local 1.1.1.1 (initiator), remote 2.2.2.2)

Jan 14 13:53:26 172.27.1.254% PIX-7-702201: ISAKMP Phase 1 delete received (local 1.1.1.1 (initiator), remote 2.2.2.2)

Jan 14 13:53:26 172.27.1.254% PIX-6-602203: ISAKMP disconnected session (local 1.1.1.1 (initiator), remote 2.2.2.2)

Jan 14 13:53:56 172.27.1.254% PIX-7-702303: sa_request, CBC (MSG key in English) = 1.1.1.1, dest = 2.2.2.2, src_proxy = 172.27.1.10/255.255.255.255/0/0 (type = 1), dest_proxy = 192.168.100.18/255.255.255.255/0/0 (type = 1), Protocol is ESP transform = lifedur hmac-sha-esp, esp-3des 28800 = s and 4608000 Ko, spi = 0 x 0 (0), id_conn = 0, keysize = 0, flags = 0 x 4004

The site of the customer like an answering machine:

14 jan 11:58:23 172.27.1.254% PIX-7-702208: ISAKMP Phase 1 Exchange started (local 1.1.1.1 (answering machine), 2.2.2.2 remote)

14 jan 11:58:23 172.27.1.254% PIX-7-702210: Exchange of ISAKMP Phase 1 is complete (local 1.1.1.1 (answering machine), 2.2.2.2 remote)

14 jan 11:58:23 172.27.1.254% 6-PIX-602202: ISAKMP connected session (local 1.1.1.1 (answering machine), 2.2.2.2 remote)

14 jan 11:58:23 172.27.1.254% PIX-6-602201: Phase 1 ISAKMP Security Association created (local 1.1.1.1/500 (answering machine), distance 2.2.2.2/500, authentication = pre-action, encryption = 3DES-CBC, hash = MD5, group = 1, life = 86400 s)

14 jan 11:58:23 172.27.1.254% PIX-7-702209: ISAKMP Phase 2 Exchange started (local 1.1.1.1 (answering machine), 2.2.2.2 remote)

14 jan 11:58:23 172.27.1.254% PIX-6-602301: its created, (his) sa_dest = 2.2.2.2, sa_prot = 50, sa_spi = 0x9de820bd (2649235645) sa_trans = sa_conn_id of hmac-sha-esp, esp-3des = 116

14 jan 11:58:23 172.27.1.254% PIX-7-702211: Exchange of ISAKMP Phase 2 is complete (local 1.1.1.1 (answering machine), 2.2.2.2 remote)

Jan 14 12:28:54 172.27.1.254% PIX-6-602302: SA deletion, (his) sa_dest = 2.2.2.2, sa_prot = 50, sa_spi = 0x9de820bd (2649235645), sa_trans = esp-3desesp-sha-hmac, sa_conn_id = 116

Kind regards

Johan

From my experience when a tunnel is launched on one side, but it is not on the other hand, that the problem is with an inconsistency of the isakmp and ipsec policies, mainly as ipsec policies change sets and corresponding address with ASA platform when a tunnel is not a statically defined encryption card he sometimes use the dynamic tag to allocate this vpn connection. To check if this is the case go ahead and make a "crypto ipsec to show his" when the tunnel is active on both sides, see on the SAA if the corresponding tunnel is the static encryption card set or if it presents the dynamic encryption card.

I advise you to go to the settings on both sides and ensure that they are both in the opposite direction.

IPSEC VPN between Pix 515E and 1841 router

Hi all

BACKGROUND

We have implemented a site to site VPN IPSEC between a Pix 515E 8.0 operation (4) and an 1841 using static IP addresses at both ends. We used CCP on the router and the ASDM the pix to build initial tunnels. Now the site with the router is evolving into a dynamic IP address from the ISP so we have implemented dynamic DNS to update dynamic IP address.

PROBLEM

The problem is that ASDM will not allow us to set a domain as the address of peers, it will not accept an IP address. We believe that the solution will be to remove the static Crypto map and replace it with a dynamic Crypto map on the side of Pix. Our questions are simply; is this the best solution? can change us the original static list or is it better to delete and make a new dynamic encryption card? Y at - it a shortcut to change the config command-line? This is a real network, so just check it out before make us any changes on the live kit.

Any help much appreciated.

You don't have to change anything when the peer-address changes. The dynamic crypto map aims to take dynamic peer connections. The only thing to remember, is that only the dynamic peer can initiate the connection. And you reduce your security if you use Pre-Shared key that now you can use a generic-PSK character.

As I remember, the PIX / ASA does not support the dynamic use of FQDNs for peer-resolution. This feature is supported in IOS.

For a feature, it would be preferable to static IP addresses on both sides.

IPsec VPN with Cisco AnyConnect and 1921 ISR G2 router

Hello

Is it possible to establish a remote access VPN IPSec using Cisco Anyconnect client with router Cisco ISR G2 1921.

If someone does share it please the sample configuration. as I've been on this topic since last week a.

My Cisco rep recommended I have not try AnyConnect a router ISR or ASR. So I used an Open Source client. Don't say that AnyConnect won't work, just the route I took on my project. I work good known configuration for a 1921 with strongSwan as a Client. It is with IPSEC and IKEV2 using certificates for authentication.

SSL VPN from Cisco ASA and ACS 5.1 change password

Dear Sir.

I am tring configure ASA to change the local password on ACS 5.1. When the user access with ssl vpn if the ACS 5.1 password expiration date. ASA will display the dialog box or window popup to change the password. But it does not work. I'm tring to Setup with the functionality of password management on the SAA. When I enable password management it will not work and is unable to change the password. Could you tell me about this problem?

Thank you

Aphichat
```
Dear Sir,
I'm tring to setup ASA to change local password on ACS 5.1. When user access with ssl vpn if password on ACS 5.1 expire. ASA will show dialog box or pop-up to change password. But It don't work. I'm tring to setup with password management feature on ASA . When I enable password management it don't work and can't to change password. Could you advise me about this problem?
Thank you
Aphichat
```
Hi Aphichat,

Go to the password link below change promt via AEC in ASA: -.

https://supportforums.Cisco.com/docs/doc-1328;JSESSIONID=A51E68318579261787BD60DDA0707819. Node0

Hope to help!

Ganesh.H

Don't forget to note the useful message

Remote IPSec VPN - client Windows 7 and ASA 5505

Hello

I'm having trouble with configuring IPSec VPN with Cisco ASA 5505 and Windows 7 client native VPN remotely. My client PC Gets the VPN IP pool address and can access a remote network behind ASA, but then I lose my internet connection. I read that this should be a problem with the split tunneling, but I did as it says here and no luck.

Windows VPN Client settings, if I uncheck "use default gateway on remote network" I have an internet connection (given that the customer is using a local gateway), but then I can't ping remote network.

In the log, I see the warnings of this type:

TCP connection of disassembly 256 for outside:192.168.150.1/49562 to outside:213.199.181.90/80 duration 0: 00:00 0 stream bytes is a loopback (cisco)

I have attached my configuration file (without configuring split tunneling, I tried). If you need additional newspapers, I'll send them right away.

Thank you for your help.

Petar Koraca

That's what you would have needed on versions 8.3 and earlier versions:

permit same-security-traffic intra-interface

Global 1 interface (outside)

NAT (outside) 1 192.168.150.0 255.255.255.0

However I see that you are running 8.4 so I think that all you need is this (I never did on 8.4 so it may not be accurate)

permit same-security-traffic intra-interface

network of the NETWORK_OBJ_192.168.150.0_24 object

dynamic NAT interface (outdoors, outdoor)

Give it a shot and let me know how it goes.

Problem with IPsec VPN between ASA and router Cisco - ping is not response

Hello

I don't know because the IPsec VPN does not work. This is my setup (IPsec VPN between ASA and R2):

my network topology data:

LAN 1 connect ASA - 1 (inside the LAN)

PC - 10.0.1.3 255.255.255.0 10.0.1.1

ASA - GigabitEthernet 1: 10.0.1.1 255.255.255.0

-----------------------------------------------------------------

ASA - 1 Connect (LAN outide) R1

ASA - GigabitEthernet 0: 172.30.1.2 255.255.255.252

R1 - FastEthernet 0/0: 172.30.1.1 255.255.255.252

---------------------------------------------------------------------

R1 R2 to connect

R1 - FastEthernet 0/1: 172.30.2.1 255.255.255.252

R2 - FastEthernet 0/1: 172.30.2.2 255.255.255.252

R2 for lan connection 2

--------------------------------------------------------------------

R2 to connect LAN2

R2 - FastEthernet 0/0: 10.0.2.1 255.255.255.0

PC - 10.0.2.3 255.255.255.0 10.0.2.1

ASA configuration:

1 GigabitEthernet interface
nameif inside
security-level 100
IP 10.0.1.1 255.255.255.0
no downtime
interface GigabitEthernet 0
nameif outside
security-level 0
IP 172.30.1.2 255.255.255.252
no downtime
Route outside 0.0.0.0 0.0.0.0 172.30.1.1

------------------------------------------------------------

access-list scope LAN1 to LAN2 ip 10.0.1.0 allow 255.255.255.0 10.0.2.0 255.255.255.0
object obj LAN
subnet 10.0.1.0 255.255.255.0
object obj remote network
10.0.2.0 subnet 255.255.255.0
NAT (inside, outside) 1 static source obj-local obj-local destination obj-remote control remote obj non-proxy-arp static

-----------------------------------------------------------
IKEv1 crypto policy 10
preshared authentication
aes encryption
sha hash
Group 2
life 3600
Crypto ikev1 allow outside
crypto isakmp identity address

------------------------------------------------------------
tunnel-group 172.30.2.2 type ipsec-l2l
tunnel-group 172.30.2.2 ipsec-attributes
IKEv1 pre-shared-key cisco123
Crypto ipsec transform-set esp-aes-192 ASA1TS, esp-sha-hmac ikev1

-------------------------------------------------------------
card crypto ASA1VPN 10 is the LAN1 to LAN2 address
card crypto ASA1VPN 10 set peer 172.30.2.2
card crypto ASA1VPN 10 set transform-set ASA1TS ikev1
card crypto ASA1VPN set 10 security-association life seconds 3600
ASA1VPN interface card crypto outside

R2 configuration:

interface fastEthernet 0/0
IP 10.0.2.1 255.255.255.0
no downtime
interface fastEthernet 0/1
IP 172.30.2.2 255.255.255.252
no downtime

-----------------------------------------------------

router RIP
version 2
Network 10.0.2.0
network 172.30.2.0

------------------------------------------------------
access-list 102 permit ahp 172.30.1.2 host 172.30.2.2
access-list 102 permit esp 172.30.1.2 host 172.30.2.2
access-list 102 permit udp host 172.30.1.2 host 172.30.2.2 eq isakmp
interface fastEthernet 0/1
IP access-group 102 to

------------------------------------------------------
crypto ISAKMP policy 110
preshared authentication
aes encryption
sha hash
Group 2
life 42300

------------------------------------------------------
ISAKMP crypto key cisco123 address 172.30.1.2

-----------------------------------------------------
Crypto ipsec transform-set esp - aes 128 R2TS

------------------------------------------------------

access-list 101 permit tcp 10.0.2.0 0.0.0.255 10.0.1.0 0.0.0.255

------------------------------------------------------

R2VPN 10 ipsec-isakmp crypto map
match address 101
defined by peer 172.30.1.2
PFS Group1 Set
R2TS transformation game
86400 seconds, life of security association set
interface fastEthernet 0/1
card crypto R2VPN

I don't know what the problem

Thank you

If the RIP is not absolutely necessary for you, try adding the default route to R2:

IP route 0.0.0.0 0.0.0.0 172.16.2.1

If you want to use RIP much, add permissions ACL 102:

access-list 102 permit udp any any eq 520

Cisco ASA and dynamic VPN L2L Fortigate configuration

I met a problem recently with an ASA 5510 (7.0) and a bunch of Fortigate 50 (3.0 MR7). The ASA is the hub and Fortigates are rays with a dynamic public IP.

I followed this document on the site Web of Cisco (http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805733df.shtml) to set up my ASA and the parameters passed to my counterparts to set up their Fortigates.

However, the ASA journal reveals that attemtps Fortigate connection always tried with DefaultRAGroup before falling back to DefaultL2LGroup and finally died. Experience with putting in place a dynamic VPN between Cisco and Fortigate someone? Which could not fail at each end? Here's a typical piece of error log ASA. The ASA is currently having a static VPN tunnel and a site-2-client VPN in two groups by default.

6. January 10, 2011 20:58:45 | 713905: Group DefaultL2LGroup, IP = 116.230.243.205, P1 = relay msg sent to the WSF MM
5. January 10, 2011 20:58:45 | 713201: Group = DefaultL2LGroup, IP = 116.230.243.205, in double Phase 1 detected package. Retransmit the last packet.
6. January 10, 2011 20:58:45 | 713905: Group DefaultL2LGroup, IP = 116.230.243.205, P1 = relay msg sent to the WSF MM
5. January 10, 2011 20:58:45 | 713201: Group = DefaultL2LGroup, IP = 116.230.243.205, in double Phase 1 detected package. Retransmit the last packet.
6. January 10, 2011 20:58:41 | 713905: Group DefaultL2LGroup, IP = 116.230.243.205, P1 = relay msg sent to the WSF MM
5. January 10, 2011 20:58:41 | 713201: Group = DefaultL2LGroup, IP = 116.230.243.205, in double Phase 1 detected package. Retransmit the last packet.
4. January 10, 2011 20:58:39 | 713903: Group = DefaultL2LGroup, IP = 116.230.243.205, ERROR, had decrypt packets, probably due to problems not match pre-shared key. Abandonment
5. January 10, 2011 20:58:39 | 713904: Group = DefaultL2LGroup, IP = 116.230.243.205, received the package of Mode main Oakley encrypted with invalid payloads, MessID = 0
6. January 10, 2011 20:58:39 | 713905: Group = DefaultRAGroup, IP = 116.230.243.205, WARNING, had decrypt packets, probably due to problems not match pre-shared key. User switching to the tunnel-group: DefaultL2LGroup
5. January 10, 2011 20:58:39 | 713904: Group = DefaultRAGroup, IP = 116.230.243.205, received the package of Mode main Oakley encrypted with invalid payloads, MessID = 0
4. January 10, 2011 20:58:33 | 713903: Group = DefaultRAGroup, IP = 116.230.243.205, error: cannot delete PeerTblEntry
3. January 10, 2011 20:58:33 | 713902: Group = DefaultRAGroup, IP = 116.230.243.205, Removing peer to peer table has no, no match!
6. January 10, 2011 20:58:33 | 713905: Group DefaultRAGroup, IP = 116.230.243.205, P1 = relay msg sent to the WSF MM
5. January 10, 2011 20:58:33 | 713201: Group = DefaultRAGroup, IP = 116.230.243.205, in double Phase 1 detected package. Retransmit the last packet.
6. January 10, 2011 20:58:25 | 713905: Group DefaultRAGroup, IP = 116.230.243.205, P1 = relay msg sent to the WSF MM
5. January 10, 2011 20:58:25 | 713201: Group = DefaultRAGroup, IP = 116.230.243.205, in double Phase 1 detected package. Retransmit the last packet.
6. January 10, 2011 20:58:21 | 713905: Group DefaultRAGroup, IP = 116.230.243.205, P1 = relay msg sent to the WSF MM
5. January 10, 2011 20:58:21 | 713201: Group = DefaultRAGroup, IP = 116.230.243.205, in double Phase 1 detected package. Retransmit the last packet.
5. January 10, 2011 20:58:19 | 713904: IP = 116.230.243.205, encrypted packet received with any HIS correspondent, drop

Yes, sounds about right. He will try to match with the DefaultRAGroup first, and when you know that it's a dynamic IPSec in LAN-to-LAN, it will be

then back to the DefaultL2LGroup, because he doesn't know if the VPN Client or L2L again when he is contacted fist as they are connecting from dynamic IP peer.

You must ensure that your L2L tunnel-group by default has been configured with the corresponding pre-shared key.

Assuming that you have configured the dynamic map and assign to the card encryption.

Here is an example of configuration where ASA has a static and peripheral ip address pair has dynamic IP:

http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00807ea936.shtml

Hope that helps.

Setting up a VPN between a WRVS4400N and ASA device

I'm a newbie when it comes to Cisco devices and I have a problem setting a VPN between a local and a seat some distance away.

Here, our local office, we have a device Cisco WRVS4400N Small Business.

At Headquarters, they have a feature of Cisco ASA.

We must set up a point to point VPN and I have no idea how to proceed with these devices.

To compound things, resources, I'm at the other end in an unknown entity that also does not seem to have a lot of experience with this.

Is there any type of step by step guide for such a configuration?

If not, can someone please help with this?

Hello William,.

I would call 1866-606-1866 Support Center for assistance on the side the tunnel then the entire side of the ASA WRVS has to do is match the settings. If the side ASA needs support with which we can transfer more TAC.

Cisco Small Business Support Center

Randy Manthey

CCNA, CCNA - security

IPSec VPN between Cisco ASA and Fortigate1000

Similar Questions

Maybe you are looking for