L2l tunnel and show connection addess

Hello world

ASA 5505 L2L 5520 tunnel a.

The tunnel is running.

5505 # sh crypto isakmp his

IKEv1 SAs:

ITS enabled: 1
Generate a new key SA: 0 (a tunnel report Active 1 and 1 to generate a new key during the generate a new key)
Total SA IKE: 1

1 IKE Peer: 10.31.2.30
Type: L2L role: initiator
Generate a new key: no State: MM_ACTIVE

There are no SAs IKEv2

SH crypto ipsec his
Interface: Visitor_Edge
Tag crypto map: D_Traffic_Crypto, seq num: 1, local addr: 10.31.2.20

When I sh conn address 10.31.2.20 all the
5 in use, most used 9316
ESP visitor identity Ifc 10.31.2.20 NP 10.31.2.30, idle 0:00:00, 9912 bytes, flags - 1
UDP 10.31.2.30:500 NP identity Ifc 10.31.2.20:500 visitor, slowed down to 0:00:09, 3365216, flags - 2 bytes
ESP visitor identity Ifc 10.31.2.20 NP 10.31.2.30, idle 0:00:00, 3816 bytes, flags - 3

Must understand the connections 1 and 3 are used for what purpose and why they have no port information?

As 2 is tunnel connection using port 500. but the connections 1 and 3 have no port number, why?

Concerning

Mahesh

Connection 1 and 3 represent the traffic going in and out, ESP that sit directly on the IP header, so there is no port information.

Connection 2 represent IKE messages that are exchanging messages on port UDP 500.

Tags: Cisco Security

Similar Questions

Sansa Clip 2 GB shows "Connected" when the charger is plugged

I have a Sansa Clip 2 GB is around the age of 6 months. He played very well for 5 months, but for the last month, he periodically left the game and shows 'Connected' when the charger is connected. I can sometimes turn off and on and it will start working again. He will play for awhile, sometimes minutes, sometimes a few days and then stop playing again and see the "connected". When he is in this state it will load but not play. I tried 3 different Chargers and all have the same problem later. I updated the firmware of 01.01.32 but no help.

Someone knows how to fix this? TIA for any help.

OK, here is the last, this problem is resolved, but he caused a new sorta related problem. What I did I deleted all my files and just put all the songs in the Music"" folder. This seems to have solved the problem where it says 'connected' and stop playing, however, now it plays a day or two and then stops himself. I just press 'Play' and he starts going again, so it is not much more than an annoyance I can live with that, and I could see where maybe he could do so on purpose after she played all the songs, but why it not it that way when I got it? He played continuously day and night for months as a first step. I'm confused, but I can at least live with the Clip now.

Photosmart 6525 will not connect to the internet to get updates day & ePrint. Test page shows connected. ??

Trying to install my photosmart 6525. It works wirelessly to my computer desktop & laptop but when I try to open ePrint it wants to check updates and reports that it cannot connect. That is what it is?

The wireless report Test results show all "TRANSMIT" and shows 'connected' to the internet.

I would first disconnect the router and the printer for about 1 minute. I would plug the router first then the printer. I would then try to enable web services. If not successful, then proceed as follows.

1 obtain the IP address of your printer
a. This can be done by pressing the icon on the printer wireless.
2. Enter the printer's IP address in a browser.
3. Select the tab network at the top of the page.
4. on the left, select network.
5. Select Network (IP) address
6. select manual DNS server
a. manual Preferred DNS should read 8.8.8.8
b. alternate DNS server should read. 8.8.4.4
7. Select apply you could get a fair warning select OK.

Let me know how it goes.

Using VPN L2L static and dynamic dedicated tunnels

We have an ASA 5510 running 8.0 at our company headquarters. We have remote sites who need to create VPN L2L at the HQ ASA tunnels. Some remote sites have static IP addresses and others have dynamic IP addresses.

I found documentation Cisco L2L static IP VPN tunnels and make them work. I found another Cisco documentation for static IP dynamic L2L VPN tunnels using the tunnel-group "DefaultL2LGroup".

My question is, can you have two types of tunnels on the same ASA L2L? If so, simply by using the definitions of "DefaultL2LGroup" tunnel-group and of tunnel-group work? Is there a reason to not do? Is better technology (ASA HQ and a combination of ASA 5505 and 1861 at remote sites) available?

Yes, you can have both types of tunnels L2L. If you use a PSK - remember that the IP address of the remote site is used to 'validate' to connect to Headquarters. As long as you use a sure PSK = 64 characters and all with upper/lower case alpha numeric - you should be OK.

A better way to do it - is to get the static IP addresses for the site that currently have DHCP from ISP.

HTH >

My 5s iphone suddenly showed no service, then I made an attempt to update to ios and itunes connected, now iphone is not enable and display cannot connect to the server and in itunes it shows unable to check your device.please help me

My 5s iphone suddenly showed no service, then I made an attempt to update to ios and itunes connected, now iphone is not enable and display cannot connect to the server and in itunes it shows unable to check your device.please help me

Assuming that you have a valid SIM card in the phone, it is more often symptomatic of a phone that has been hacked or jailbroken to unlock.

Where do you have the phone first?

Canon MX 310 connected but do not print and shows not connected

updated iMac os x el capitan (10.11.4) and now impossible to print with Canon pixma MX 310 - get the message not connected while it appears in my dock and shows point to print failed. The error log is full of messages and doesn't help me at all.

How can I get my Canon printer/scanner is working again.

Unfortunately, Canon did not write all the drivers for v10.11 compatibility El Capitan. See here.

But what you can do is to try a reset. Make sure that the printer is turned on.

Open System Preferences > Printers and Scanners and select the print tab.

Right click or control your printer on the left, then click on: reset the printing system

When she did try printing.

Omen of HP 15: Wifi stop working. Win10 shows only a single network and it connects to the WiFi

Hi guys,.
Since a few days my wifi stopped working.
If I click the Wifi icon it shows only a SINGLE NETWORK (two maximum), but not mine!

And I live in a building of 20 + networks, as you can see on the WiFi Analyzer (I'm the only red to the right)

If I reactive / disable Wifi with fn + f12, it goes back in plane and Wifi mode mode and sees it eventually all networks:

My Wifi is on top. If it is registered, Windows connects to it and then she abandons the connection; If it is not registered, and I try to connect, it says "you are not able to connect to this network.
Is fun is that after a few seconds, each network disappears and alone is shown (probably the one next door... I don't know).

I already tried to RESET the laptop MATERIAL by keeping the power button for 10-15 seconds with the laptop is turned off.
I tried to follow these instructions (http://support.hp.com/us-en/document/c04649175) updated drivers (Intel 18.12.0.3, 18.12.1.2, 18.30.0.9 [10 default Windows], 18.32.0 [last drivers]) without success. Whenever I have install a new driver, I uninstalled the earlier software Wireless + restart.

I tried to uncheked "allow this computer to turn off this device to save power" on my settings of Wifi hardware without success.

HP network support said that I did not choose a Wifi (really? The problem is that I do not see my Wifi on the list!).

This is unrelated to a new 10 Windows upgrade since I installed it months ago and this is the first time I have this problem :/ It has always worked

I tried different settings too:
I changed the channel, I put 802.11 g on my router, APSD off on the router.
I put "Magic off packet, QoS ad hoc off, U-APSD off, fat wide channel, differential flow mode HT off" on the creation of the map without success. Nothing chaned.

The hardware test detects any failure.

Important note: If I close the router, it shows my network connection with full power and he connects to it. Then I come back in my room (probably 3/4 meters away), it MAINTAINS the connection for 30 / 40 min and he drops the connection and I cannot reconnect to it more. It has always worked perfectly in my room during these months (I bought it in March 2015), so the distance is not a problem, I'm 6 / 7 m away from the router.
In this case, it shows my network (connected) and the nearby... and the other 20 networks +?

The only way I have is USB tethering with my Nexus 5.

Linux: I tried the WiFi on Freya elementary (Ubuntu linux OS base) and it displays 20 + networks available on the list. He has not the connection problem with my Wifi, but sometimes it stops working, Web pages stop loading and I have to restart Wifi to reconnect to the it (usually after 30/40 min of use it).

-------------------------------------------------------------------------------------

What is the problem? My Wifi card is broken? Should I call Italian support or if you have any suggestions?

WAWood,
I took a risk.
I did a factory restore with recovery HP (I have a drive dedicated for her)... and it worked!
I had to switch from Win8.1 to 10, but the Wifi problem is solved!

I'm still guessing that was the problem...

Now, I'm under Intel drivers 18.30.0.9 worm and all the networks work.

In the next few days I'm checking the linux problem (reset deleted primary partition).

Ethernet and is showing connected. Network settings of the Troubleshoot Help?

a xp and previously no problem on this computer, after changing the settings or implement?, in some way, I lost the ethernet connection. It shows connected but when trying to connect to internet, it fails. any suggestions? THX

Hello

Maybe this can help, http://www.ezlan.net/debug.html

Jack-MVP Windows Networking. WWW.EZLAN.NET

I opened my laptop and I lit the charge then it shows connect to 65w adapter y at - it a problem with my charger?

I opened my laptop and I lit the charge then it shows connect to 65w adapter y at - it a problem with my charger?

I pressed the f1 key to continue, then my laptop recharges normally.

Huawei Sonic is recognized in devices and printers, and shows paired but not connected in the settings on the phone.

Original title:

Try to connect Huawei Sonic to win7x64 pro edition using bluetooth. Huawei Sonic is recognized in devices and printers, and shows paired but not connected in the settings on the phone. How do I overcame the problem of connection I want to transfer photos from phone to PC?

Hello

1. are you able to communicate and share with other Bluetooth devices?

2. what happens when you transfer files?

3. do you get an error message?

4 you did changes to the computer, before the show?

Method 1:

Connect the phone to another computer and check.

Method 2:

If you are unable to connect to another computer, you can contact the manufacturer of the phone and check.

http://support.Huawei.com/support/

VPN site to Site, Phase 2 is do not fit correctly and no connectivity

Hi all

I am facing a problem with configuring VPN from Site to Site of my HO one of the remote site.

My remote site got the subnet(192.168.10.0/24) LAN, we use also in HO. Remote site wish to access certain servers in HO 192.168.200.0/24&192.168.80.0/24.So we did a NAT policy distance from the ASA 192.168.10.0/24 subnet remote site to 192.168.175.0/24 translation site while reaching the end of the HO.

The VPN the two phases are coming, but not able to reach my iam connectivity. I can see are encapsulating the packets from the remote site and decapsulating in HO, but opposite side does not (i.e. no encapsulation at the end of HO) & no decapsulation at the end of remote site.

a question, I noted at the end of HO "sh crypto ipsec his" shows a different card is attached to it. This cryptomap we have for our remote access VPN is displayed in the ipsec his. Please see the configuration and the output below...

Tag crypto map: non-retail-VPN, seq num: 3, local addr: x.x.x.x

local ident (addr, mask, prot, port): (192.168.200.0/255.255.255.0/0/0)
Remote ident (addr, mask, prot, port): (192.168.175.0/255.255.255.0/0/0)
current_peer: x.x.x.x

I can see hits on my crypto access list, and the two phases are coming. kindly help to solve the problem...

Thanks in advance...

MIKAEL

Config of HO ASA
------------------------------
crypto ISAKMP policy 1
preshared authentication
3des encryption
sha hash
Group 2
life 86400

Crypto ipsec transform-set httsa-Morocco-set esp-3des esp-sha-hmac

card crypto ENOCMAP 23 matches the acl-httsamorocco address
card crypto ENOCMAP 23 set counterpart x.x.x.x
card crypto ENOCMAP 23 the transform-set httsa-Morocco-set value
card crypto ENOCMAP 23 defined security-association life seconds 28800
card crypto ENOCMAP 23 set reverse-road
ENOCMAP interface card crypto outside
crypto ISAKMP allow outside

tunnel-group x.x.x.x type ipsec-l2l
tunnel-group ipsec-attributes x.x.x.x
pre-shared key *.

permit access list acl-sheep line 127 scope ip 192.168.80.0 255.255.255.0 192.168.175.0 255.255.255.0
permit access list acl-sheep line 128 scope ip 192.168.200.0 255.255.255.0 192.168.175.0 255.255.255.0

access list acl-httsamorocco line 1 permit extended 192.168.200.0 ip 255.255.255.0 192.168.175.0 255.255.255.0 (hitcnt = 23)
permit access list acl-httsamorocco line 2 scope ip 192.168.80.0 255.255.255.0 192.168.175.0 255.255.255.0 (hitcnt = 5279)

SH crypto isakamp her HO
------------------------

12 peer IKE: x.x.x.x
Type: L2L role: answering machine
Generate a new key: no State: MM_ACTIVE

SH crypto ipsec his of the HO
------------------------------

ENOCDC-FW03 # sh crypto ipsec his counterpart x.x.x.x
peer address: x.x.x.x
Tag crypto map: non-retail-VPN, seq num: 3, local addr:x.x.x.x

local ident (addr, mask, prot, port): (192.168.80.0/255.255.255.0/0/0)
Remote ident (addr, mask, prot, port): (192.168.175.0/255.255.255.0/0/0)
current_peer: x.x.x.x

#pkts program: encrypt 0, #pkts: 0, #pkts digest: 0
#pkts decaps: 2839, #pkts decrypt: 2839, #pkts check: 2839
compressed #pkts: 0, unzipped #pkts: 0
#pkts uncompressed: 0, comp #pkts failed: 0, #pkts Dang failed: 0
success #frag before: 0, failures before #frag: 0, #fragments created: 0
Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
#send errors: 0, #recv errors: 0

local crypto endpt. : x.x.x.x/4500, remote Start crypto. : x.x.x.x/4500
Path mtu 1500, fresh ipsec generals 66, media, mtu 1500
current outbound SPI: 5E757945
current inbound SPI: 5EF13ACE

SAS of the esp on arrival:
SPI: 0x5EF13ACE (1592867534)
transform: esp-3des esp-sha-hmac no compression
running parameters = {L2L, Tunnel, NAT-T program,}
slot: 0, id_conn: 6619136, crypto-card: non-retail-VPN
calendar of his: service life remaining (KB/s) key: (4373785/26747)
Size IV: 8 bytes
support for replay detection: Y
Anti-replay bitmap:
0xFFFFFFFF to 0xFFFFFFFF
outgoing esp sas:
SPI: 0x5E757945 (1584757061)
transform: esp-3des esp-sha-hmac no compression
running parameters = {L2L, Tunnel, NAT-T program,}
slot: 0, id_conn: 6619136, crypto-card: non-retail-VPN
calendar of his: service life remaining (KB/s) key: (4374000/26745)
Size IV: 8 bytes
support for replay detection: Y
Anti-replay bitmap:
0x00000000 0x00000001

Tag crypto map: Non-retail-VPN, seq num: 3, local addr: x.x.x.x //This crypto-map is that of our remote - VPN access

local ident (addr, mask, prot, port): (192.168.200.0/255.255.255.0/0/0)
Remote ident (addr, mask, prot, port): (192.168.175.0/255.255.255.0/0/0)
current_peer: x.x.x.x

#pkts program: encrypt 0, #pkts: 0, #pkts digest: 0
#pkts decaps: 41, #pkts decrypt: 41, #pkts check: 41
compressed #pkts: 0, unzipped #pkts: 0
#pkts uncompressed: 0, comp #pkts failed: 0, #pkts Dang failed: 0
success #frag before: 0, failures before #frag: 0, #fragments created: 0
Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
#send errors: 0, #recv errors: 0

local crypto endpt. : x.x.x.x/4500, remote Start crypto. : x.x.x.x/4500
Path mtu 1500, fresh ipsec generals 66, media, mtu 1500
current outbound SPI: 35F7B790
current inbound SPI: EE63084D

SAS of the esp on arrival:
SPI: 0xEE63084D (3999467597)
transform: esp-3des esp-sha-hmac no compression
running parameters = {L2L, Tunnel, NAT-T program,}
slot: 0, id_conn: 6619136, crypto-card: non-retail-VPN
calendar of his: service life remaining (KB/s) key: (4373997/26924)
Size IV: 8 bytes
support for replay detection: Y
Anti-replay bitmap:
0x000003FF 0xFFFFFFFF
outgoing esp sas:
SPI: 0x35F7B790 (905426832)
transform: esp-3des esp-sha-hmac no compression
running parameters = {L2L, Tunnel, NAT-T program,}
slot: 0, id_conn: 6619136, crypto-card: non-retail-VPN
calendar of his: service life remaining (KB/s) key: (4374000/26924)
Size IV: 8 bytes
support for replay detection: Y
Anti-replay bitmap:
0x00000000 0x00000001

The ASA Site configuration
---------------------------------------------

192.168.175.0 static (inside and outside) of access list policy-nat

access list policy-nat allowed extended ip 192.168.1.0 255.255.255.0 192.168.80.0 255.255.255.0
access list policy-nat allowed extended ip 192.168.1.0 255.255.255.0 192.168.200.0 255.255.255.0
access list policy-nat extended permit ip 192.168.10.0 255.255.255.0 192.168.200.0 255.255.255.0
access list policy-nat extended permit ip 192.168.10.0 255.255.255.0 192.168.80.0 255.255.255.0

Crypto ipsec transform-set esp-3des esp-sha-hmac enoc-series
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
card crypto ENOCMAP 23 matches the acl-enoc address
card crypto ENOCMAP 23 set counterpart x.x.x.x
card crypto ENOCMAP 23 enoc-set transform-set
card crypto ENOCMAP 23 defined security-association life seconds 28800
card crypto ENOCMAP 23 set reverse-road
crypto ENOCMAP outside interface card
ISAKMP crypto enable ouside

crypto ISAKMP policy 1
preshared authentication
3des encryption
sha hash
Group 2
life 86400

tunnel-group x.x.x.x type ipsec-l2l
tunnel-group ipsec-attributes x.x.x.x
pre-shared key *.

access list acl-enoc extended ip 192.168.175.0 allow 255.255.255.0 192.168.80.0 255.255.255.0
access list acl-enoc extended ip 192.168.175.0 allow 255.255.255.0 192.168.200.0 255.255.255.0

ciscoasa # sh crypto isakmp his

-----------------------------------------------

ITS enabled: 1
Generate a new key SA: 0 (a tunnel report Active 1 and 1 to generate a new key during the generate a new key)
Total SA IKE: 1

1 peer IKE: x.x.x.x
Type: L2L role: initiator
Generate a new key: no State: MM_ACTIVE

ciscoasa # sh crypto ipsec his

----------------------------------------------
Interface: outdoor
Tag crypto map: ENOCMAP, seq num: 23, local addr: 192.168.20.2

access list acl-enoc extended ip 192.168.175.0 allow 255.255.255.0 192.168.200.0 255.255.255.0
local ident (addr, mask, prot, port): (192.168.175.0/255.255.255.0/0/0)
Remote ident (addr, mask, prot, port): (192.168.200.0/255.255.255.0/0/0)
current_peer: x.x.x.x

program #pkts: 59, #pkts encrypt: 59, #pkts digest: 59
#pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0
compressed #pkts: 0, unzipped #pkts: 0
#pkts uncompressed: 59, comp #pkts failed: 0, #pkts Dang failed: 0
success #frag before: 0, failures before #frag: 0, #fragments created: 0
Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
#send errors: 0, #recv errors: 0

local crypto endpt. : 192.168.20.2/4500, remote Start crypto. : x.x.x.x/4500
Path mtu 1500, fresh ipsec generals 66, media, mtu 1500
current outbound SPI: EE63084D
current inbound SPI: 35F7B790

SAS of the esp on arrival:
SPI: 0x35F7B790 (905426832)
transform: esp-3des esp-sha-hmac no compression
running parameters = {L2L, Tunnel, NAT-T program,}
slot: 0, id_conn: 57344, crypto-card: ENOCMAP
calendar of his: service life remaining (KB/s) key: (3915000/26325)
Size IV: 8 bytes
support for replay detection: Y
Anti-replay bitmap:
0x00000000 0x00000001
outgoing esp sas:
SPI: 0xEE63084D (3999467597)
transform: esp-3des esp-sha-hmac no compression
running parameters = {L2L, Tunnel, NAT-T program,}
slot: 0, id_conn: 57344, crypto-card: ENOCMAP
calendar of his: service life remaining (KB/s) key: (3914996/26325)
Size IV: 8 bytes
support for replay detection: Y
Anti-replay bitmap:
0x00000000 0x00000001

Tag crypto map: ENOCMAP, seq num: 23, local addr: 192.168.20.2

access list acl-enoc extended ip 192.168.175.0 allow 255.255.255.0 192.168.80.0 255.255.255.0
local ident (addr, mask, prot, port): (192.168.175.0/255.255.255.0/0/0)
Remote ident (addr, mask, prot, port): (192.168.80.0/255.255.255.0/0/0)
current_peer: x.x.x.x

#pkts program: 3567, #pkts encrypt: 3569, #pkts digest: 3569
#pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0
compressed #pkts: 0, unzipped #pkts: 0
#pkts uncompressed: 3569, model of #pkts failed: 0, #pkts Dang failed: 0
success #frag before: 0, failures before #frag: 0, #fragments created: 0
Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
Errors in #send: 1, #recv errors: 0

local crypto endpt. : 192.168.20.2/4500, remote Start crypto. : x.x.x.x/4500
Path mtu 1500, fresh ipsec generals 66, media, mtu 1500
current outbound SPI: 5EF13ACE
current inbound SPI: 5E757945

SAS of the esp on arrival:
SPI: 0x5E757945 (1584757061)
transform: esp-3des esp-sha-hmac no compression
running parameters = {L2L, Tunnel, NAT-T program,}
slot: 0, id_conn: 57344, crypto-card: ENOCMAP
calendar of his: service life remaining (KB/s) key: (3915000/26143)
Size IV: 8 bytes
support for replay detection: Y
Anti-replay bitmap:
0x00000000 0x00000001
outgoing esp sas:
SPI: 0x5EF13ACE (1592867534)
transform: esp-3des esp-sha-hmac no compression
running parameters = {L2L, Tunnel, NAT-T program,}
slot: 0, id_conn: 57344, crypto-card: ENOCMAP
calendar of his: service life remaining (KB/s) key: (3914728/26142)
Size IV: 8 bytes
support for replay detection: Y
Anti-replay bitmap:
0x00000000 0x00000001

Hello

Clearly, the connection is managed by another card crypto bein.

Check those:

-Where your ASA rounting the destination network. (192.168.175.0 network)

-L' outgoing interface that uses the path has a card encryption? THAT IS "NON-RETAIL-VPN.

-If it is rounting to the wrong interface try reconfigure the route to this destination.

This is most likely your problem. Or at least one of them.

Rate if this can help.

Static L2L Tunnel - will not come to the top

Hi all

Currently have a very big problem with a site that I can't go there for the moment.

We have one HUB ASA5505 SEC + a few other ASA connected via VPN L2L. We have static L2L 1 active, 1 dynamic L2L Active, and I am currently trying to add a second static Tunnel L2L.

I checked that each WAN Interface can ping each other, and both devices have full internet connectivity. There is no double nat or being content filtering. I noticed that my Client remote access VPN Cisco will not properly connect through the ASA despite full internet connectivity, but when I connect directly to a modem, I was able to connect properly. So apparently the ISP isn't blocking IPSEC traffic as far as I KNOW.

Static2 uses currently a temporary license of TAC since our license is currently waiting for arrival, but a release of version see the watch all VPN/3des features are enabled.

Here are the configs:

ASA5505-HUB hostname
domain xxxxxxx.local
activate the password xxxxxxxxxxx
names of
name 192.168.9.50 xxxxxxxxx
name 192.168.9.51 xxxxxxxxx xxxxxxxxxx description
!
interface Vlan1
nameif inside
security-level 100
IP 192.168.9.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
IP address xxxxxxxxxxxxx 255.255.255.248
!
interface Vlan3
nameif dmz
security-level 50
IP 10.10.9.1 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
switchport access vlan 3
!
interface Ethernet0/5
switchport access vlan 3
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd xxxxxxxxxxxx
passive FTP mode
clock timezone CST - 6
clock to summer time recurring CDT
DNS lookup field inside
DNS server-group DefaultDNS
Server name xxxxxxxxxx
Server name xxxxxxxxxxxxxxx
domain xxxxxxxxxxxx.local
permit same-security-traffic intra-interface
permit inside_nat0_outbound to access extended list ip 192.168.0.0 255.255.0.0 192.168.0.0 255.255.0.0
access-list 101 extended allow icmp a whole
access-list standard split allow 192.168.0.0 255.255.0.0
permit to_static1 to access extended list ip 192.168.0.0 255.255.0.0 192.168.14.0 255.255.255.0
permit to_static2 to access extended list ip 192.168.0.0 255.255.0.0 192.168.16.0 255.255.255.0< this="" is="" the="" problem="">
RTP list extended access udp any permitted any 10000 20000 Beach
RTP list extended access permitted tcp everything any 10000 20000 Beach
pager lines 24
monitor debug logging
asdm of logging of information
Within 1500 MTU
Outside 1500 MTU
MTU 1500 dmz
mask IP local RA-pool 192.168.99.1 - 192.168.99.126 255.255.255.128
no failover
ICMP unreachable rate-limit 1 burst-size 1
don't allow no asdm history
ARP timeout 14400
Global 1 interface (outside)
NAT (inside) 0-list of access inside_nat0_outbound
NAT (inside) 1 0.0.0.0 0.0.0.0
Route outside 0.0.0.0 0.0.0.0 75.146.188.94 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout, uauth 0:05:00 absolute
dynamic-access-policy-registration DfltAccessPolicy
Enable http server
http 192.168.0.0 255.255.0.0 inside
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
set of 20 SYSTEM_DEFAULT_CRYPTO_MAP crypto dynamic-map transform-set ESP-3DES-SHA
card crypto outside_map 10 correspondence address to_static1
card crypto outside_map 10 peers set xxxxxxxxxx
outside_map crypto 10 card value transform-set ESP-3DES-SHA
card crypto outside_map 11 match address to_static2
card crypto outside_map 11 counterpart set xxxxxxxxxxxxx< problem="">
card crypto outside_map 11 game of transformation-ESP-3DES-SHA
outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
outside_map interface card crypto outside
crypto ISAKMP allow outside
crypto ISAKMP policy 10
preshared authentication
3des encryption
sha hash
Group 2
life 86400
Telnet 192.168.0.0 255.255.0.0 inside
Telnet timeout 5
SSH timeout 5
Console timeout 0
management-access inside
dhcpd outside auto_config
!
dhcpd address 192.168.9.101 - 192.168.9.199 inside
dhcpd dns 192.168.9.2 xxxxxxxxxxx interface inside
dhcpd xxxxxxxxx.local area inside interface
xxxxxxxx dhcpd option 66 ip inside interface
dhcpd allow inside
!

a basic threat threat detection
Statistics-list of access threat detection
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
message-length maximum 512
type of policy-card inspect sip default_sip
parameters
Journal of decline in the shares of Max-forwards-validation
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the rsh
inspect esmtp
inspect sqlnet
inspect the skinny
inspect sunrpc
inspect xdmcp
inspect the netbios
inspect the rtsp
inspect the default_sip sip
!
global service-policy global_policy
Group xxxxx-RA internal policy
xxxxx-RA group policy attributes
Server DNS value 192.168.9.2 xxxxxxxxxxxxx
Protocol-tunnel-VPN IPSec l2tp ipsec
Split-tunnel-policy tunnelspecified
Split-tunnel-network-list value split
xxxxxxxxx.local value by default-field
allow to NEM
IPSec-attributes tunnel-group DefaultL2LGroup
pre-shared-key *.
type tunnel-group xxxxx-RA remote access
Tunnel-Group global xxxxxx-RA-attributes
address-RA-pool
Group Policy - by default-xxxxx-RA
tunnel-group xxxxxx-ipsec-attributes
pre-shared-key *.
tunnel-group STATIC2_WANIP type ipsec-l2l< problem="">
IPSec-attributes tunnel-group STATIC2_WANIP
pre-shared-key *.
tunnel-group STATIC1_WANIP type ipsec-l2l
IPSec-attributes tunnel-group STATIC1_WANIP
pre-shared-key *.
context of prompt hostname

and...

ASA5505-STATIC2 host name
domain xxxxxxxx.local
activate the password XXXXXX
passwd xxxxxxxxxxx
names of
!
interface Ethernet0/0
switchport access vlan 3
!
interface Ethernet0/1
switchport access vlan 2
!
interface Ethernet0/2
switchport access vlan 2
!
interface Ethernet0/3
switchport access vlan 2
!
interface Ethernet0/4
switchport access vlan 2
!
interface Ethernet0/5
switchport access vlan 2
!
interface Ethernet0/6
switchport access vlan 2
!
interface Ethernet0/7
switchport trunk allowed vlan 1-2
switchport trunk vlan 1 native
switchport mode trunk
!
interface Vlan1
nameif dmz
security-level 50
IP 10.10.0.1 address 255.255.255.0
!
interface Vlan2
nameif inside
security-level 100
192.168.16.1 IP address 255.255.255.0
!
interface Vlan3
nameif outside
security-level 0
IP address xxxxxxxxxxx 255.255.254.0
!
passive FTP mode
clock timezone CST - 6
clock to summer time recurring CDT
DNS lookup field inside
DNS server-group DefaultDNS
Server name xxxxxxxxxx
Server name xxxxxxxxxx
domain xxxxxxxxxx.local
access extensive list ip 192.168.16.0 to_hq allow 255.255.255.0 192.168.0.0 255.
255.0.0
192.168.16.0 IP Access-list extended sheep 255.255.255.0 allow 192.168.0.0 255.
255.0.0
pager lines 24
MTU 1500 dmz
Within 1500 MTU
Outside 1500 MTU
no failover
ICMP unreachable rate-limit 1 burst-size 1
don't allow no asdm history
ARP timeout 14400

Route outside 0.0.0.0 0.0.0.0 xxxxxxxxxxx
Global 1 interface (outside)
NAT (dmz) 1 0.0.0.0 0.0.0.0
NAT (inside) 0 access-list sheep
NAT (inside) 1 0.0.0.0 0.0.0.0
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
Floating conn timeout 0:00:00
dynamic-access-policy-registration DfltAccessPolicy
Enable http server
http 192.168.0.0 255.255.0.0 inside
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
card crypto cmap1 match 10 address to_hq
card crypto cmap1 10 peers set xxxxxxxxxxxxxx
cmap1 crypto 10 card value transform-set ESP-3DES-SHA
crypto ISAKMP policy 10
preshared authentication
3des encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 65535
preshared authentication
3des encryption
sha hash
Group 2
life 86400
No encryption isakmp nat-traversal
Telnet 192.168.0.0 255.255.0.0 inside
Telnet timeout 5
SSH timeout 5
Console timeout 0
management-access inside
dhcpd dns 192.168.9.2 xxxxxxxxxxxx
!
dhcpd address dmz 10.10.0.100 - 10.10.0.199
dhcpd lease 10800 dmz interface
dhcpd enable dmz
!
dhcpd address 192.168.16.101 - 192.168.16.131 inside
lease interface 10800 dhcpd inside
dhcpd xxxxxxxxxx.local area inside interface
dhcpd ip interface 192.168.9.50 option 66 inside
dhcpd allow inside
!

a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
WebVPN
tunnel-group HUB_WANIP type ipsec-l2l
IPSec-attributes tunnel-group HUB_WANIP
pre-shared-key *.
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
maximum message length automatic of customer
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
Review the ip options
inspect the netbios
inspect the rsh
inspect the rtsp
inspect the skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect the tftp
inspect the sip
inspect xdmcp
inspect the icmp
!
global service-policy global_policy
context of prompt hostname

Any help is appreciated

Hello

Seems to me that the ASA named STATIC2-ASA5505 lack some essential associated VPN configurations.

The encryption card is not attached to any interface

Configure this

cmap1 interface card crypto outside

The Crypto ISAKMP is not enabled on any interface

Configure this

crypto ISAKMP allow outside

Hope this helps

-Jouni

Dynamic L2L Tunnel - the Tunnel is up, will not pass the LAN traffic

Hello everyone. I am repurposing an ASA for my business at a remote site and must use a dynamic Configuration of L2L with Split tunneling active. We used these in the past and they work a lot, and I've referenced Cisco official documentation for the implementation. Currently, I am having a problem where I am unable to pass traffic on the local remote network over the VPN tunnel (it does even not raise the tunnel of form). However, if I run the following command in the ASA remote:

Ping inside the 192.168.9.1

I receive the ICMP responses. In addition, this traffic causes the VPN Tunnel to be created as indicated by show ISA SA:

1 peer IKE: xx.xx.xx.xx

Type: L2L role: initiator

Generate a new key: no State: MM_ACTIVE

Here is the IP addressing scheme:

Network remotely (with the ASA problem): 192.168.12.0/24

Basic network (Hub): 192.168.9.0/24

Other rays: 192.168.0.0/16

Config:

ASA Version 8.2 (1)
!
hostname xxxxxxxxx
domain xxxxxxxxxxx.local
activate the xxxxxxxx password
passwd xxxxxxxxx
names of
!
interface Vlan1
nameif inside
security-level 100
192.168.12.1 IP address 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
IP address dhcp setroute
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passive FTP mode
clock timezone CST - 6
clock to summer time recurring CDT
DNS server-group DefaultDNS
domain xxxxxxxx.local
permit same-security-traffic intra-interface
to_hq to access extended list ip 192.168.12.0 allow 255.255.255.0 192.168.0.0 255.255.0.0
inside_nat0_outbound to access extended list ip 192.168.12.0 allow 255.255.255.0 192.168.0.0 255.255.0.0
pager lines 24
Within 1500 MTU
Outside 1500 MTU
ICMP unreachable rate-limit 1 burst-size 1
don't allow no asdm history
ARP timeout 14400
Global 1 interface (outside)
NAT (inside) 1 0.0.0.0 0.0.0.0
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-registration DfltAccessPolicy
Enable http server
http 192.168.0.0 255.255.0.0 inside
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
card crypto outside_map 10 correspondence address to_hq
crypto outside_map 10 card game CORE peers. ASA. WAN. INTELLECTUAL PROPERTY
outside_map crypto 10 card value transform-set ESP-3DES-SHA
outside_map interface card crypto outside
crypto ISAKMP allow outside
crypto ISAKMP policy 10
preshared authentication
3des encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 65535
preshared authentication
3des encryption
sha hash
Group 2
life 86400
Telnet 192.168.0.0 255.255.0.0 inside
Telnet timeout 5
SSH timeout 5
Console timeout 0
management-access inside
dhcpd 192.168.9.2 dns 208.67.222.222
!
dhcpd address 192.168.12.101 - 192.168.12.131 inside
rental contract interface 86400 dhcpd inside
dhcpd xxxxxxxxx.local area inside interface
dhcpd ip interface 192.168.9.50 option 66 inside
dhcpd allow inside
!

a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
WebVPN
tunnel-group basis. ASA. WAN. Type of IP ipsec-l2l
tunnel-group basis. ASA. WAN. IPSec-attributes of intellectual property
pre-shared key xxxxxxxxxxxx
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the netbios
inspect the rsh
inspect the rtsp
inspect the skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect the tftp
inspect the sip
inspect xdmcp
inspect the icmp
!
global service-policy global_policy
context of prompt hostname

Once the tunnel is in place, LAN to the Remote Site traffic won't pass through the VPN Tunnel any upward. On the side of ASA Core, I was able to Telnet in the ASA distance very well, but could not ping the Remote Access Point.

Someone at - it a glimpse of my problem?

Hello

Add:

NAT (inside) 0-list of access inside_nat0_outbound

L2l Tunnel upward, without traffic transits

Two 5505 ASA s for the main site of a customer and a local office. I have the tunnel upward. But I am unable to pass traffic through it. I thought I got it, but it turns out I was wrong so I'll let the pros have to him. Thank you!

Main site:

ASA Version 7.2 (4)

!

City of hostname

activate iNbSyJZ1ffmb9kn1 encrypted password

2KFQnbNIdI.2KYOU encrypted passwd

names of

!

interface Vlan1

nameif inside

security-level 100

IP 192.168.100.254 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

IP address 24.x.x.97 255.255.255.248

!

interface Vlan3

prior to interface Vlan1

nameif dmz

security-level 50

no ip address

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

passive FTP mode

clock timezone IS - 5

clock to summer time EDT recurring

DNS server-group DefaultDNS

outside_in list extended access permit tcp any host 24.x.x.98 eq 3389

outside_in list extended access permit udp any host 24.x.x.98 eq 1194

outside_in list extended access permit tcp any host 24.x.x.98 eq www

extended vpn 192.168.100.0 ip access list allow 255.255.255.0 192.168.199.0 255.255.255.0

extended vpn 192.168.100.0 ip access list allow 255.255.255.0 192.168.1.0 255.255.255.0

outside_1_cryptomap to access extended list ip 192.168.100.0 allow 255.255.255.0 192.168.1.0 255.255.255.0

pager lines 24

Enable logging

timestamp of the record

exploitation forest-size of the buffer of 100000

recording of debug console

debug logging in buffered memory

asdm of logging of information

Within 1500 MTU

Outside 1500 MTU

MTU 1500 dmz

IP local pool vpnpool 192.168.199.10 - 192.168.199.20

ICMP unreachable rate-limit 1 burst-size 1

ASDM image disk0: / asdm - 524.bin

don't allow no asdm history

ARP timeout 14400

Global 1 interface (outside)

NAT (inside) 0-list of access vpn

NAT (inside) 1 192.168.100.0 255.255.255.0

public static 24.x.x.98 (Interior, exterior) 192.168.100.3 netmask 255.255.255.255

Access-group outside_in in external interface

Route outside 0.0.0.0 0.0.0.0 24.x.x.102 1

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

AAA authentication enable LOCAL console

AAA authentication http LOCAL console

the ssh LOCAL console AAA authentication

Enable http server

http 192.168.100.0 255.255.255.0 inside

http 192.168.100.50 255.255.255.255 inside

No snmp server location

No snmp Server contact

Server enable SNMP traps snmp authentication linkup, linkdown cold start

Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

card crypto outside_map 1 match address outside_1_cryptomap

card crypto outside_map 1 set pfs

card crypto outside_map 1 set 24.x.x.54 counterpart

map outside_map 1 set of transformation-ESP-3DES-MD5 crypto

outside_map interface card crypto outside

crypto ISAKMP allow outside

crypto ISAKMP policy 10

preshared authentication

3des encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 20

preshared authentication

3des encryption

md5 hash

Group 2

life 86400

crypto ISAKMP policy 30

preshared authentication

3des encryption

md5 hash

Group 1

life 86400

Telnet 0.0.0.0 0.0.0.0 inside

Telnet timeout 5

SSH 0.0.0.0 0.0.0.0 inside

SSH 0.0.0.0 0.0.0.0 outdoors

SSH timeout 60

Console timeout 0

attributes of Group Policy DfltGrpPolicy

No banner

WINS server no

DNS server no

DHCP-network-scope no

VPN-access-hour no

VPN - connections 3

VPN-idle-timeout 30

VPN-session-timeout no

VPN-filter no

Protocol-tunnel-VPN IPSec l2tp ipsec webvpn

disable the password-storage

disable the IP-comp

Re-xauth disable

Group-lock no

enable PFS

IPSec-udp disable

IPSec-udp-port 10000

Split-tunnel-policy tunnelall

Split-tunnel-network-list no

by default no

Split-dns no

Disable dhcp Intercept 255.255.255.255

disable secure authentication unit

disable authentication of the user

user-authentication-idle-timeout 30

disable the IP-phone-bypass

disable the leap-bypass

disable the NEM

Dungeon-client-config backup servers

MSIE proxy server no

MSIE-proxy method non - change

Internet Explorer proxy except list - no

Disable Internet Explorer-proxy local-bypass

disable the NAC

NAC-sq-period 300

NAC-reval-period 36000

NAC-by default-acl no

address pools no

enable Smartcard-Removal-disconnect

the firewall client no

rule of access-client-none

WebVPN

url-entry functions

HTML-content-filter none

Home page no

4 Keep-alive-ignore

gzip http-comp

no filter

list of URLS no

value of customization DfltCustomization

port - forward, no

port-forward-name value access to applications

SSO-Server no

value of deny message connection succeeded, but because some criteria have not been met, or because of a specific group policy, you are not allowed to use the VPN features. Contact your administrator for more information

SVC no

SVC Dungeon-Installer installed

SVC keepalive no

generate a new key SVC time no

method to generate a new key of SVC no

client of dpd-interval SVC no

dpd-interval SVC bridge no

deflate compression of SVC

tunnel-group 24.x.x.54 type ipsec-l2l

24.x.x.54 group of tunnel ipsec-attributes

pre-shared-key *.

!

class-map inspection_default

match default-inspection-traffic

!

!

type of policy-card inspect dns preset_dns_map

parameters

message-length maximum 512

Policy-map global_policy

class inspection_default

inspect the preset_dns_map dns

inspect the ftp

inspect h323 h225

inspect the h323 ras

inspect the netbios

inspect the rsh

inspect the rtsp

inspect the skinny

inspect esmtp

inspect sqlnet

inspect sunrpc

inspect the tftp

inspect the sip

inspect xdmcp

!

global service-policy global_policy

context of prompt hostname

Cryptochecksum:5180fc35fcb77dbf007b34bc2159c21b

: end

# Sh crypto isa city its

ITS enabled: 1

Generate a new key SA: 0 (a tunnel report Active 1 and 1 to generate a new key during the generate a new key)

Total SA IKE: 1

1 peer IKE: 24.x.x.54

Type: L2L role: initiator

Generate a new key: no State: MM_ACTIVE

# Sh crypto ipsec city its

Interface: outside

Tag crypto map: outside_map, seq num: 1, local addr: 24.x.x.97

outside_1_cryptomap 192.168.100.0 ip access list allow 255.255.255.0 192.168.1.0 255.255.255.0

local ident (addr, mask, prot, port): (192.168.100.0/255.255.255.0/0/0)

Remote ident (addr, mask, prot, port): (192.168.1.0/255.255.255.0/0/0)

current_peer: 24.x.x.54

#pkts program: 56, #pkts encrypt: 56, #pkts digest: 56

#pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0

compressed #pkts: 0, unzipped #pkts: 0

#pkts uncompressed: 56, #pkts comp failed: 0, #pkts Dang failed: 0

success #frag before: 0, failures before #frag: 0, #fragments created: 0

Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0

#send errors: 0, #recv errors: 0

local crypto endpt. : 24.x.x.97, remote Start crypto. : 24.x.x.54

Path mtu 1500, fresh ipsec generals 58, media, mtu 1500

current outbound SPI: 16409623

SAS of the esp on arrival:

SPI: 0xFC3F0652 (4231988818)

transform: esp-3des esp-md5-hmac no

running parameters = {L2L, Tunnel, PFS 2 group}

slot: 0, id_conn: 21, crypto-card: outside_map

calendar of his: service life remaining (KB/s) key: (4275000/28514)

Size IV: 8 bytes

support for replay detection: Y

outgoing esp sas:

SPI: 0 x 16409623 (373331491)

transform: esp-3des esp-md5-hmac no

running parameters = {L2L, Tunnel, PFS 2 group}

slot: 0, id_conn: 21, crypto-card: outside_map

calendar of his: service life remaining (KB/s) key: (4274996/28514)

Size IV: 8 bytes

support for replay detection: Y

Remote Desktop:

ASA Version 8.2 (5)

!

water host name

activate rAAeK7vz0gtMeIgU encrypted password

2KFQnbNIdI.2KYOU encrypted passwd

names of

name 192.168.100.0 City City LAN description

DNS-guard

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

interface Vlan1

nameif inside

security-level 100

IP 192.168.1.2 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

IP address 24.x.x.54 255.255.255.248

!

passive FTP mode

clock timezone IS - 5

clock to summer time EDT recurring

DNS server-group DefaultDNS

outside_1_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 255.255.255.0 city

inside_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 255.255.255.0 city

pager lines 24

Enable logging

timestamp of the record

exploitation forest-size of the buffer of 32768

logging asdm-buffer-size 512

Monitor logging notifications

debug logging in buffered memory

logging trap notifications

notifications of logging asdm

Within 1500 MTU

Outside 1500 MTU

IP local pool water 192.168.1.15 - 192.168.1.20 mask 255.255.255.0

ICMP unreachable rate-limit 1 burst-size 1

don't allow no asdm history

ARP timeout 14400

NAT (inside) 0-list of access inside_nat0_outbound

Route outside 0.0.0.0 0.0.0.0 24.x.x.49 1

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

Floating conn timeout 0:00:00

dynamic-access-policy-registration DfltAccessPolicy

AAA authentication LOCAL telnet console

the ssh LOCAL console AAA authentication

AAA authentication enable LOCAL console

Enable http server

http 192.168.1.0 255.255.255.0 inside

No snmp server location

No snmp Server contact

Server enable SNMP traps snmp authentication linkup, linkdown cold start

Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

life crypto ipsec security association seconds 28800

Crypto ipsec kilobytes of life - safety 4608000 association

Dynamic crypto map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs

Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

card crypto outside_map 1 match address outside_1_cryptomap

card crypto outside_map 1 set pfs

card crypto outside_map 1 set 24.x.x.97 counterpart

map outside_map 1 set of transformation-ESP-3DES-MD5 crypto

outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

outside_map interface card crypto outside

Crypto ca trustpoint _SmartCallHome_ServerCA

Configure CRL

Crypto ca certificate chain _SmartCallHome_ServerCA

certificate ca 6ecc7aa5a7032009b8cebcf4e952d491

308204 4 a0030201 d 308205ec 0202106e cc7aa5a7 032009b 8 cebcf4e9 52d 49130

010105 05003081 09060355 04061302 55533117 ca310b30 0d 864886f7 0d06092a

30150603 55040 has 13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b

13165665 72695369 676e2054 72757374 204e6574 776f726b 313 has 3038 06035504

0b 133128 63292032 30303620 56657269 5369676e 2c20496e 632e202d 20466f72

20617574 7a 656420 75736520 6f6e6c79 31453043 06035504 03133c 56 686f7269

65726953 69676e20 436c 6173 73203320 5075626c 69632050 72696 72792043 61 d

65727469 66696361 74696f6e 20417574 686f7269 7479202d 20473530 1e170d31

30303230 38303030 3030305a 170d 3230 30323037 32333539 35395a 30 81b5310b

30090603 55040613 02555331 17301506 0355040a 130e5665 72695369 676e2c20

496e632e 311f301d 06035504 0b 131656 65726953 69676e20 54727573 74204e65

74776f72 6b313b30 5465726d 20757365 20617420 73206f66 39060355 040b 1332

68747470 7777772e 733a2f2f 76657269 7369676e 2e636f6d 2f727061 20286329

302d 0603 55040313 26566572 69536967 61737320 33205365 6e20436c 3130312f

63757265 20536572 76657220 20473330 82012230 0d06092a 864886f7 4341202d

010101 05000382 010f0030 82010 0d has 02 b187841f 82010100 c20c45f5 bcab2597

a7ada23e 9cbaf6c1 39b88bca c2ac56c6 e5bb658e 444f4dce 6fed094a d4af4e10

9c688b2e 957b899b 13cae234 34c1f35b f3497b62 d188786c 83488174 0253f9bc

7f432657 5833833b 330a17b0 d04e9124 ad867d64 12dc744a 34a11d0a ea961d0b

15fca34b 3bce6388 d0f82d0c 948610ca b69a3dca eb379c00 48358629 5078e845

1941 4ff595ec 7b98d4c4 71b350be 28b38fa0 b9539cf5 ca2c23a9 fd1406e8 63cd

18b49ae8 3c6e81fd e4cd3536 b351d369 ec12ba56 6e6f9b57 c58b14e7 0ec79ced

4a546ac9 4dc5bf11 b1ae1c67 81cb4455 33997f24 9b3f5345 7f861af3 3cfa6d7f

81f5b84a d3f58537 1cb5a6d0 09e4187b 384efa0f 01 has 38201 02030100 df308201

082b 0601 05050701 01042830 26302406 082 b 0601 db303406 05050730 01861868

7474703a 2f2f6f63 73702e76 65726973 69676e2e 636f6d30 12060355 1 d 130101

ff040830 02010030 70060355 b 200469 30673065 060, 6086 480186f8 1 d 060101ff

45010717 03305630 2806082b 06010505 07020116 1 c 687474 70733a2f 2f777777

2e766572 69736967 6e2e636f 6d2f6370 73302 has 06 082 b 0601 05050702 02301e1a

1 c 687474 70733a2f 2f777777 2e766572 69736967 6e2e636f 6d2f7270 61303406

03551d1f 042d302b 3029 has 027 a0258623 68747470 3a2f2f63 726c2e76 65726973

69676e2e 636f6d2f 2d67352e 70636133 63726c 30 0e060355 1d0f0101 ff040403

02010630 6d06082b 06010505 07010c 59305730 55160969 5da05b30 04 61305fa1

6 d 616765 2f676966 3021301f 2b0e0302 30070605 1a04148f e5d31a86 ac8d8e6b

c3cf806a d448182c 7b192e30 25162368 7474703a 2f2f6c6f 676f2e76 65726973

69676e2e 636f6d2f 76736c6f 676f2e67 69663028 0603551d 11042130 1fa41d30

1 b 311930 17060355 04031310 56657269 5369676e 4d504b49 2d322d36 301D 0603

445 1653 44c1827e 1d20ab25 f40163d8 be79a530 1f060355 c 1604140d 551d0e04

1 230418 30168014 7fd365a7 c2ddecbb f03009f3 4339fa02 af333133 300 d 0609 d

2a 864886 05050003 82010100 0c8324ef ddc30cd9 589cfe36 b6eb8a80 f70d0101

4bd1a3f7 9df3cc53 ef829ea3 a1e697c1 589d756c e01d1b4c fad1c12d 05c0ea6e

b2227055 d9203340 3307c 265 83fa8f43 379bea0e 9a6c70ee f69c803b d937f47a

99 c 71928 8705 404167d 1 273aeddc 866d 24f78526 a2bed877 7d494aca 6decd018

481d22cd 0b0b8bbc f4b17bfd b499a8e9 762ae11a 2d876e74 d388dd1e 22c6df16

b62b8214 0a945cf2 50ecafce ff62370d ad65d306 4153ed02 14c8b558 28a1ace0

5becb37f 954afb03 c8ad26db e6667812 4ad99f42 fbe198e6 42839b8f 8f6724e8

6119b5dd cdb50b26 058ec36e c4c875b8 46cfe218 065ea9ae a8819a47 16de0c28

6c2527b9 deb78458 c61f381e a4c4cb66

quit smoking

crypto ISAKMP allow outside

crypto ISAKMP policy 10

preshared authentication

3des encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 20

preshared authentication

3des encryption

md5 hash

Group 2

life 86400

crypto ISAKMP policy 30

preshared authentication

3des encryption

md5 hash

Group 1

life 86400

No encryption isakmp nat-traversal

Telnet 192.168.1.0 255.255.255.0 inside

Telnet timeout 60

SSH 192.168.1.0 255.255.255.0 inside

SSH timeout 5

Console timeout 0

dhcpd outside auto_config

!

a basic threat threat detection

Statistics-list of access threat detection

no statistical threat detection tcp-interception

WebVPN

attributes of Group Policy DfltGrpPolicy

Group internal water policy

attributes of group water policy

value of 192.168.1.1 DNS server

VPN-idle-timeout no

VPN-session-timeout no

Protocol-tunnel-VPN IPSec

attributes of Registrar username

VPN-group-policy DfltGrpPolicy

type water tunnel-group remote access

water General attributes tunnel-group

water of the pool address

Group Policy - by default-water

DHCP server 192.168.1.1

water ipsec-attributes tunnel-group

pre-shared key *.

tunnel-group 24.x.x.97 type ipsec-l2l

24.x.x.97 group of tunnel ipsec-attributes

pre-shared key *.

!

class-map inspection_default

match default-inspection-traffic

!

!

type of policy-card inspect dns preset_dns_map

parameters

maximum message length automatic of customer

message-length maximum 512

Policy-map global_policy

class inspection_default

inspect the preset_dns_map dns

inspect the ftp

inspect h323 h225

inspect the h323 ras

inspect the rsh

inspect the rtsp

inspect esmtp

inspect sqlnet

inspect the skinny

inspect sunrpc

inspect xdmcp

inspect the sip

inspect the netbios

inspect the tftp

Review the ip options

!

global service-policy global_policy

context of prompt hostname

anonymous reporting remote call

Cryptochecksum:06bda38461d2419b3e5c4904333b62e7

: end

# sh crypto isa water his

ITS enabled: 1

Generate a new key SA: 0 (a tunnel report Active 1 and 1 to generate a new key during the generate a new key)

Total SA IKE: 1

1 peer IKE: 24.x.x.97

Type: L2L role: answering machine

Generate a new key: no State: MM_ACTIVE

water # sh crypto ipsec his

Interface: outside

Tag crypto map: outside_map, seq num: 1, local addr: 24.x.x.54

outside_1_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.100.0 255.255.255.0

local ident (addr, mask, prot, port): (192.168.1.0/255.255.255.0/0/0)

Remote ident (addr, mask, prot, port): (Town/255.255.255.0/0/0)

current_peer: 24.x.x.97

#pkts program: encrypt 0, #pkts: 0, #pkts digest: 0

#pkts decaps: 78, #pkts decrypt: 78, #pkts check: 78

compressed #pkts: 0, unzipped #pkts: 0

#pkts uncompressed: 0, comp #pkts failed: 0, #pkts Dang failed: 0

success #frag before: 0, failures before #frag: 0, #fragments created: 0

Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0

#send errors: 0, #recv errors: 0

local crypto endpt. : 24.x.x.54, remote Start crypto. : 24.x.x.97

Path mtu 1500, fresh ipsec generals 58, media, mtu 1500

current outbound SPI: FC3F0652

current inbound SPI: 16409623

SAS of the esp on arrival:

SPI: 0 x 16409623 (373331491)

transform: esp-3des esp-md5-hmac no compression

running parameters = {L2L, Tunnel, PFS 2 group}

slot: 0, id_conn: 126976, crypto-card: outside_map

calendar of his: service life remaining (KB/s) key: (3914995/28408)

Size IV: 8 bytes

support for replay detection: Y

Anti-replay bitmap:

0xFFFFFFFF to 0xFFFFFFFF

outgoing esp sas:

SPI: 0xFC3F0652 (4231988818)

transform: esp-3des esp-md5-hmac no compression

running parameters = {L2L, Tunnel, PFS 2 group}

slot: 0, id_conn: 126976, crypto-card: outside_map

calendar of his: service life remaining (KB/s) key: (3915000/28408)

Size IV: 8 bytes

support for replay detection: Y

Anti-replay bitmap:

0x00000000 0x00000001

Thanks again!

In addition,

Now that I actually think...

The original ICMP you did would go as follows
- 192.168.100.x send ICMP messages to echo
- Happens on ASA local
- Gets sent through the VPN L2L connection
- Arrives on the ASA remote
- ASA forwards traffic on the LAN Host 192.168.1.x
- LAN forward host to respond to its default gateway 192.168.1.1 (NOT ASA)
- ICMP Echo traffic gets lost because of no real route for the return traffic
  - Therefore, you see no encapsulated traffic to destination, ASA, decapsules only traffic that origin of the host that sends the ICMP messages to echo through the VPN L2L
-Jouni

DMVPN Tunnel and EIGRP routing problem

I have redundant paths to a remote 2811 router on my network of sites. The first links is a T1 frame relay connection that has been in place for years, and the new link is on a 54 Mbps fixed wireless that was recently created.

I'm under EIGRP to my process of routing protocol 100 for the two links.

I installed a DMVPN Tunnel between the remote 2811 and no. 2851 router on my host site. The tunnel interface shows to the top and to the top of both sides and I can ping the IP remote tunnel of my networks side host.

However my eigrp routes are not spread over this new tunnel link and if I run a command show ip eigrp neighbor on each router I show only the neighbor for the frame relay link and not the new wireless link.

What I'm missing here?

A tunnel0 to see the shows the following:

Tunnel0 is up, line protocol is up
Material is Tunnel
The Internet address is 10.x.x.x/24
MTU 1514 bytes, BW 54000 Kbps, DLY 10000 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation TUNNEL, loopback not set
KeepAlive not set
Tunnel source (FastEthernet0/1), destination 172.x.x.x 10.x.x.x
Tunnel/GRE/IP transport protocol
Key 0x186A0, sequencing of the people with reduced mobility
Disabled packages parity check
TTL 255 tunnel
Quick tunneling enabled
Tunnel of transmission bandwidth 8000 (Kbps)
Tunnel to receive 8000 (Kbps) bandwidth
Tunnel of protection through IPSec (profile "CiscoCP_Profile1")
Last entry of 00:00:01, exit ever, blocking of output never
Final cleaning of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/dumps); Total output drops: 947
Strategy of queues: fifo
Output queue: 0/0 (size/max)
5 minute input rate 0 bps, 0 packets/s
5 minute output rate 0 bps, 0 packets/s
packages of 880, 63000 bytes, 0 no buffer entry
Received 0 broadcasts, 0 Runts, 0 Giants 0 shifters
errors entry 0, 0 CRC, overgrown plot of 0, 0, 0 ignored, 0 abort
output of 910 packages, 81315 bytes, 0 underruns
0 output errors, 0 collisions, 0 resets interface
unknown protocol 0 drops
output buffer, the output buffers 0 permuted 0 failures

Please go ahead and add a static route on the hub, so it goes through the wireless link and let me know if everything works correctly.

Federico.

L2l tunnel and show connection addess

Similar Questions

Maybe you are looking for