L2l tunnel question

Similar Questions

• L2l Tunnel between 2POIGNEES: general query on ACL sheep/crypto

  Hi all

  For the L2L tunnel between 2POIGNEES work very well, we configure normally same network to network - sheep & cryptos ACL on both ends of the SAA. My question is...

  It will work without any problem, if on one end of the ASA, the ACL sheep & crypto are combined to form the group object (to limit the ASA configs) and on the other end address net net address ACL sheep & crypto still exists (not consolidated in the Group of objects)... ? If it works, it works even if the tunnel is between ASA--> router.

  Thanks in advance

  MS

  MS, it will work if the other side does not use the same scenario of acl consolidated using groups of objects. ACLs and groups of objects are significant locally on the device.

  You can consolidate the ACLs on the ASA/PIX using TCP or UDP-groups of objects or groups of objects network and that your acl to the respective object-group, they always have the same effect as when they have been configured individually line by line.

  This works even if the tunnel is between ASA--> router

  Yes

  HTH

  Jorge

• Making the NAT for VPN through L2L tunnel clients

  Hi.I has the following situation in my network. We need for users who log on our site with the VPN clients to connect to another site via a tunnel L2L. The problem is that I need NAT addresses from the pool of VPN client in another beach before going on the L2L tunnel because on the other side, we have duplication of networks.

  I tried to do NAT with little success as follows:

  ACL for pool NAT of VPN:

  Extended list ip 192.168.253.0 access TEST allow 255.255.255.0 192.168.0.0 255.255.255.0

  Extended list ip 192.168.253.0 access TEST allow 255.255.255.0 192.168.5.0 255.255.255.0

  NAT:

  Global 172.20.105.1 - 172.20.105.254 15 (outdoor)

  NAT (inside) 15 TEST access-list

  CRYPTO ACL:

  allowed ro access list extended LAN ip 255.255.0.0 192.168.0.0 255.255.255.0

  allowed ro access list extended LAN ip 255.255.0.0 192.168.5.0 255.255.255.0

  IP 172.20.105.0 RO allow extended access list 255.255.255.0 192.168.0.0 255.255.255.0

  IP 172.20.105.0 RO allow extended access list 255.255.255.0 192.168.5.0 255.255.255.0

  permit same-security-traffic intra-interface

  Am I missing something here? Something like this is possible at all?

  Thanks in advance for any help.

  We use the ASA 5510 with software version 8.0 (3) 6.

  You need nat to the outside, not the inside.

  NAT (outside) 15 TEST access-list

• I get the error message on debugging ipsec-l2l tunnel

  Hello

  Can someone help me understand the debug message?
  I get the error message on debugging ipsec-l2l tunnel

  I tried to configure an ASA5520 with an ipsec-l2l to ios router 1721

  = 1721 router =.

  Cisco 1721 (flash: c1700-k9o3sy7 - mz.123 - 2.XC2.bin)
  80.89.47.102 outside
  inside 10.100.110.1 255.255.255.0

  Debug crypto ipsec
  Debug crypto ISAKMP

  -config-
  crypto ISAKMP policy 1
  BA 3des
  md5 hash
  preshared authentication
  Group 2
  0 1234567890 128.39.189.10 crypto isakmp key address
  !
  !
  Crypto ipsec transform-set esp-3des pix-series
  !
  ASA 10 ipsec-isakmp crypto map
  defined by peer 128.39.189.10
  transform-set pix - Set
  match address 101
  !
  !
  interface FastEthernet0

  Outside-interface description

  IP 80.89.47.102 255.255.255.252

  NAT outside IP

  card crypto asa

  !

  interface Vlan10
  Inside description
  IP 10.100.110.1 255.255.255.0
  IP nat inside

  !

  !

  IP nat inside source overload map route interface FastEthernet0 sheep

  !

  access-list 101 permit ip 10.100.110.0 0.0.0.255 10.100.4.0 0.0.3.255

  !

  access-list 110 deny ip 10.100.110.0 0.0.0.255 10.100.4.0 0.0.3.255
  access-list 110 permit ip 10.100.110.0 0.0.0.255 any
  !
  sheep allowed 10 route map
  corresponds to the IP 110
  !

  = Config ASA =.

  Cisco 5520 ASA Version 8.2 (1)
  128.39.189.10 outside
  inside 10.100.4.255 255.255.252.0

  Debug crypto ipsec
  Debug crypto ISAKMP

  -Config-
  !
  Allow Access-list extended sheep 255.255.252.0 IP 10.100.4.0 10.100.110.0 255.255.255.0
  !
  access extensive list ip 10.100.4.0 outside110 allow 255.255.252.0 10.100.110.0 255.255.255.0
  !

  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
  86400 seconds, duration of life crypto ipsec security association
  Crypto ipsec kilobytes of life - safety 4608000 association
  card crypto outside_map 11 match address outside110
  peer set card crypto outside_map 11 80.89.47.102
  card crypto outside_map 11 game of transformation-ESP-3DES-MD5
  outside_map interface card crypto outside
  crypto ISAKMP allow outside
  crypto ISAKMP policy 10
  preshared authentication
  3des encryption
  md5 hash
  Group 2
  life 86400

  !

  attributes of Group Policy DfltGrpPolicy
  VPN-idle-timeout no
  Protocol-tunnel-VPN IPSec

  !

  tunnel-group 80.89.47.102 type ipsec-l2l
  IPSec-attributes tunnel-group 80.89.47.102
  pre-shared key 1234567890

  Concerning
  Tor

  You have a transformation defined on the SAA named ESP-3DES-MD5? Your crypto card refers to that but I don't see it listed in the config you have posted. I don't have much experience with routers, but is MD5 hashing algoritm (and why it is not)?

  James

• Dynamic L2L Tunnel - the Tunnel is up, will not pass the LAN traffic

  Hello everyone. I am repurposing an ASA for my business at a remote site and must use a dynamic Configuration of L2L with Split tunneling active. We used these in the past and they work a lot, and I've referenced Cisco official documentation for the implementation. Currently, I am having a problem where I am unable to pass traffic on the local remote network over the VPN tunnel (it does even not raise the tunnel of form). However, if I run the following command in the ASA remote:

  Ping inside the 192.168.9.1

  I receive the ICMP responses. In addition, this traffic causes the VPN Tunnel to be created as indicated by show ISA SA:

  1 peer IKE: xx.xx.xx.xx

  Type: L2L role: initiator

  Generate a new key: no State: MM_ACTIVE

  Here is the IP addressing scheme:

  Network remotely (with the ASA problem): 192.168.12.0/24

  Basic network (Hub): 192.168.9.0/24

  Other rays: 192.168.0.0/16

  Config:

  ASA Version 8.2 (1)
  !
  hostname xxxxxxxxx
  domain xxxxxxxxxxx.local
  activate the xxxxxxxx password
  passwd xxxxxxxxx
  names of
  !
  interface Vlan1
  nameif inside
  security-level 100
  192.168.12.1 IP address 255.255.255.0
  !
  interface Vlan2
  nameif outside
  security-level 0
  IP address dhcp setroute
  !
  interface Ethernet0/0
  switchport access vlan 2
  !
  interface Ethernet0/1
  !
  interface Ethernet0/2
  !
  interface Ethernet0/3
  !
  interface Ethernet0/4
  !
  interface Ethernet0/5
  !
  interface Ethernet0/6
  !
  interface Ethernet0/7
  !
  passive FTP mode
  clock timezone CST - 6
  clock to summer time recurring CDT
  DNS server-group DefaultDNS
  domain xxxxxxxx.local
  permit same-security-traffic intra-interface
  to_hq to access extended list ip 192.168.12.0 allow 255.255.255.0 192.168.0.0 255.255.0.0
  inside_nat0_outbound to access extended list ip 192.168.12.0 allow 255.255.255.0 192.168.0.0 255.255.0.0
  pager lines 24
  Within 1500 MTU
  Outside 1500 MTU
  ICMP unreachable rate-limit 1 burst-size 1
  don't allow no asdm history
  ARP timeout 14400
  Global 1 interface (outside)
  NAT (inside) 1 0.0.0.0 0.0.0.0
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  dynamic-access-policy-registration DfltAccessPolicy
  Enable http server
  http 192.168.0.0 255.255.0.0 inside
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown cold start
  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
  life crypto ipsec security association seconds 28800
  Crypto ipsec kilobytes of life - safety 4608000 association
  card crypto outside_map 10 correspondence address to_hq
  crypto outside_map 10 card game CORE peers. ASA. WAN. INTELLECTUAL PROPERTY
  outside_map crypto 10 card value transform-set ESP-3DES-SHA
  outside_map interface card crypto outside
  crypto ISAKMP allow outside
  crypto ISAKMP policy 10
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  crypto ISAKMP policy 65535
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  Telnet 192.168.0.0 255.255.0.0 inside
  Telnet timeout 5
  SSH timeout 5
  Console timeout 0
  management-access inside
  dhcpd 192.168.9.2 dns 208.67.222.222
  !
  dhcpd address 192.168.12.101 - 192.168.12.131 inside
  rental contract interface 86400 dhcpd inside
  dhcpd xxxxxxxxx.local area inside interface
  dhcpd ip interface 192.168.9.50 option 66 inside
  dhcpd allow inside
  !

  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  WebVPN
  tunnel-group basis. ASA. WAN. Type of IP ipsec-l2l
  tunnel-group basis. ASA. WAN. IPSec-attributes of intellectual property
  pre-shared key xxxxxxxxxxxx
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the netbios
  inspect the rsh
  inspect the rtsp
  inspect the skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect the tftp
  inspect the sip
  inspect xdmcp
  inspect the icmp
  !
  global service-policy global_policy
  context of prompt hostname

  Once the tunnel is in place, LAN to the Remote Site traffic won't pass through the VPN Tunnel any upward. On the side of ASA Core, I was able to Telnet in the ASA distance very well, but could not ping the Remote Access Point.

  Someone at - it a glimpse of my problem?

  Hello

  Add:

  NAT (inside) 0-list of access inside_nat0_outbound

• L2l Tunnel upward, without traffic transits

  Two 5505 ASA s for the main site of a customer and a local office.  I have the tunnel upward.  But I am unable to pass traffic through it.  I thought I got it, but it turns out I was wrong so I'll let the pros have to him.  Thank you!

  Main site:

  ASA Version 7.2 (4)

  !

  City of hostname

  activate iNbSyJZ1ffmb9kn1 encrypted password

  2KFQnbNIdI.2KYOU encrypted passwd

  names of

  !

  interface Vlan1

  nameif inside

  security-level 100

  IP 192.168.100.254 255.255.255.0

  !

  interface Vlan2

  nameif outside

  security-level 0

  IP address 24.x.x.97 255.255.255.248

  !

  interface Vlan3

  prior to interface Vlan1

  nameif dmz

  security-level 50

  no ip address

  !

  interface Ethernet0/0

  switchport access vlan 2

  !

  interface Ethernet0/1

  !

  interface Ethernet0/2

  !

  interface Ethernet0/3

  !

  interface Ethernet0/4

  !

  interface Ethernet0/5

  !

  interface Ethernet0/6

  !

  interface Ethernet0/7

  !

  passive FTP mode

  clock timezone IS - 5

  clock to summer time EDT recurring

  DNS server-group DefaultDNS

  outside_in list extended access permit tcp any host 24.x.x.98 eq 3389

  outside_in list extended access permit udp any host 24.x.x.98 eq 1194

  outside_in list extended access permit tcp any host 24.x.x.98 eq www

  extended vpn 192.168.100.0 ip access list allow 255.255.255.0 192.168.199.0 255.255.255.0

  extended vpn 192.168.100.0 ip access list allow 255.255.255.0 192.168.1.0 255.255.255.0

  outside_1_cryptomap to access extended list ip 192.168.100.0 allow 255.255.255.0 192.168.1.0 255.255.255.0

  pager lines 24

  Enable logging

  timestamp of the record

  exploitation forest-size of the buffer of 100000

  recording of debug console

  debug logging in buffered memory

  asdm of logging of information

  Within 1500 MTU

  Outside 1500 MTU

  MTU 1500 dmz

  IP local pool vpnpool 192.168.199.10 - 192.168.199.20

  ICMP unreachable rate-limit 1 burst-size 1

  ASDM image disk0: / asdm - 524.bin

  don't allow no asdm history

  ARP timeout 14400

  Global 1 interface (outside)

  NAT (inside) 0-list of access vpn

  NAT (inside) 1 192.168.100.0 255.255.255.0

  public static 24.x.x.98 (Interior, exterior) 192.168.100.3 netmask 255.255.255.255

  Access-group outside_in in external interface

  Route outside 0.0.0.0 0.0.0.0 24.x.x.102 1

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  AAA authentication enable LOCAL console

  AAA authentication http LOCAL console

  the ssh LOCAL console AAA authentication

  Enable http server

  http 192.168.100.0 255.255.255.0 inside

  http 192.168.100.50 255.255.255.255 inside

  No snmp server location

  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown cold start

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

  card crypto outside_map 1 match address outside_1_cryptomap

  card crypto outside_map 1 set pfs

  card crypto outside_map 1 set 24.x.x.54 counterpart

  map outside_map 1 set of transformation-ESP-3DES-MD5 crypto

  outside_map interface card crypto outside

  crypto ISAKMP allow outside

  crypto ISAKMP policy 10

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  crypto ISAKMP policy 20

  preshared authentication

  3des encryption

  md5 hash

  Group 2

  life 86400

  crypto ISAKMP policy 30

  preshared authentication

  3des encryption

  md5 hash

  Group 1

  life 86400

  Telnet 0.0.0.0 0.0.0.0 inside

  Telnet timeout 5

  SSH 0.0.0.0 0.0.0.0 inside

  SSH 0.0.0.0 0.0.0.0 outdoors

  SSH timeout 60

  Console timeout 0

  attributes of Group Policy DfltGrpPolicy

  No banner

  WINS server no

  DNS server no

  DHCP-network-scope no

  VPN-access-hour no

  VPN - connections 3

  VPN-idle-timeout 30

  VPN-session-timeout no

  VPN-filter no

  Protocol-tunnel-VPN IPSec l2tp ipsec webvpn

  disable the password-storage

  disable the IP-comp

  Re-xauth disable

  Group-lock no

  enable PFS

  IPSec-udp disable

  IPSec-udp-port 10000

  Split-tunnel-policy tunnelall

  Split-tunnel-network-list no

  by default no

  Split-dns no

  Disable dhcp Intercept 255.255.255.255

  disable secure authentication unit

  disable authentication of the user

  user-authentication-idle-timeout 30

  disable the IP-phone-bypass

  disable the leap-bypass

  disable the NEM

  Dungeon-client-config backup servers

  MSIE proxy server no

  MSIE-proxy method non - change

  Internet Explorer proxy except list - no

  Disable Internet Explorer-proxy local-bypass

  disable the NAC

  NAC-sq-period 300

  NAC-reval-period 36000

  NAC-by default-acl no

  address pools no

  enable Smartcard-Removal-disconnect

  the firewall client no

  rule of access-client-none

  WebVPN

  url-entry functions

  HTML-content-filter none

  Home page no

  4 Keep-alive-ignore

  gzip http-comp

  no filter

  list of URLS no

  value of customization DfltCustomization

  port - forward, no

  port-forward-name value access to applications

  SSO-Server no

  value of deny message connection succeeded, but because some criteria have not been met, or because of a specific group policy, you are not allowed to use the VPN features. Contact your administrator for more information

  SVC no

  SVC Dungeon-Installer installed

  SVC keepalive no

  generate a new key SVC time no

  method to generate a new key of SVC no

  client of dpd-interval SVC no

  dpd-interval SVC bridge no

  deflate compression of SVC

  tunnel-group 24.x.x.54 type ipsec-l2l

  24.x.x.54 group of tunnel ipsec-attributes

  pre-shared-key *.

  !

  class-map inspection_default

  match default-inspection-traffic

  !

  !

  type of policy-card inspect dns preset_dns_map

  parameters

  message-length maximum 512

  Policy-map global_policy

  class inspection_default

  inspect the preset_dns_map dns

  inspect the ftp

  inspect h323 h225

  inspect the h323 ras

  inspect the netbios

  inspect the rsh

  inspect the rtsp

  inspect the skinny

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect the tftp

  inspect the sip

  inspect xdmcp

  !

  global service-policy global_policy

  context of prompt hostname

  Cryptochecksum:5180fc35fcb77dbf007b34bc2159c21b

  : end

  # Sh crypto isa city its

  ITS enabled: 1

  Generate a new key SA: 0 (a tunnel report Active 1 and 1 to generate a new key during the generate a new key)

  Total SA IKE: 1

  1 peer IKE: 24.x.x.54

  Type: L2L role: initiator

  Generate a new key: no State: MM_ACTIVE

  # Sh crypto ipsec city its

  Interface: outside

  Tag crypto map: outside_map, seq num: 1, local addr: 24.x.x.97

  outside_1_cryptomap 192.168.100.0 ip access list allow 255.255.255.0 192.168.1.0 255.255.255.0

  local ident (addr, mask, prot, port): (192.168.100.0/255.255.255.0/0/0)

  Remote ident (addr, mask, prot, port): (192.168.1.0/255.255.255.0/0/0)

  current_peer: 24.x.x.54

  #pkts program: 56, #pkts encrypt: 56, #pkts digest: 56

  #pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0

  compressed #pkts: 0, unzipped #pkts: 0

  #pkts uncompressed: 56, #pkts comp failed: 0, #pkts Dang failed: 0

  success #frag before: 0, failures before #frag: 0, #fragments created: 0

  Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0

  #send errors: 0, #recv errors: 0

  local crypto endpt. : 24.x.x.97, remote Start crypto. : 24.x.x.54

  Path mtu 1500, fresh ipsec generals 58, media, mtu 1500

  current outbound SPI: 16409623

  SAS of the esp on arrival:

  SPI: 0xFC3F0652 (4231988818)

  transform: esp-3des esp-md5-hmac no

  running parameters = {L2L, Tunnel, PFS 2 group}

  slot: 0, id_conn: 21, crypto-card: outside_map

  calendar of his: service life remaining (KB/s) key: (4275000/28514)

  Size IV: 8 bytes

  support for replay detection: Y

  outgoing esp sas:

  SPI: 0 x 16409623 (373331491)

  transform: esp-3des esp-md5-hmac no

  running parameters = {L2L, Tunnel, PFS 2 group}

  slot: 0, id_conn: 21, crypto-card: outside_map

  calendar of his: service life remaining (KB/s) key: (4274996/28514)

  Size IV: 8 bytes

  support for replay detection: Y

  Remote Desktop:

  ASA Version 8.2 (5)

  !

  water host name

  activate rAAeK7vz0gtMeIgU encrypted password

  2KFQnbNIdI.2KYOU encrypted passwd

  names of

  name 192.168.100.0 City City LAN description

  DNS-guard

  !

  interface Ethernet0/0

  switchport access vlan 2

  !

  interface Ethernet0/1

  !

  interface Ethernet0/2

  !

  interface Ethernet0/3

  !

  interface Ethernet0/4

  !

  interface Ethernet0/5

  !

  interface Ethernet0/6

  !

  interface Ethernet0/7

  !

  interface Vlan1

  nameif inside

  security-level 100

  IP 192.168.1.2 255.255.255.0

  !

  interface Vlan2

  nameif outside

  security-level 0

  IP address 24.x.x.54 255.255.255.248

  !

  passive FTP mode

  clock timezone IS - 5

  clock to summer time EDT recurring

  DNS server-group DefaultDNS

  outside_1_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 255.255.255.0 city

  inside_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 255.255.255.0 city

  pager lines 24

  Enable logging

  timestamp of the record

  exploitation forest-size of the buffer of 32768

  logging asdm-buffer-size 512

  Monitor logging notifications

  debug logging in buffered memory

  logging trap notifications

  notifications of logging asdm

  Within 1500 MTU

  Outside 1500 MTU

  IP local pool water 192.168.1.15 - 192.168.1.20 mask 255.255.255.0

  ICMP unreachable rate-limit 1 burst-size 1

  don't allow no asdm history

  ARP timeout 14400

  NAT (inside) 0-list of access inside_nat0_outbound

  Route outside 0.0.0.0 0.0.0.0 24.x.x.49 1

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  timeout tcp-proxy-reassembly 0:01:00

  Floating conn timeout 0:00:00

  dynamic-access-policy-registration DfltAccessPolicy

  AAA authentication LOCAL telnet console

  the ssh LOCAL console AAA authentication

  AAA authentication enable LOCAL console

  Enable http server

  http 192.168.1.0 255.255.255.0 inside

  No snmp server location

  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown cold start

  Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

  Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

  Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

  Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

  Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

  life crypto ipsec security association seconds 28800

  Crypto ipsec kilobytes of life - safety 4608000 association

  Dynamic crypto map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs

  Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

  card crypto outside_map 1 match address outside_1_cryptomap

  card crypto outside_map 1 set pfs

  card crypto outside_map 1 set 24.x.x.97 counterpart

  map outside_map 1 set of transformation-ESP-3DES-MD5 crypto

  outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

  outside_map interface card crypto outside

  Crypto ca trustpoint _SmartCallHome_ServerCA

  Configure CRL

  Crypto ca certificate chain _SmartCallHome_ServerCA

  certificate ca 6ecc7aa5a7032009b8cebcf4e952d491

  308204 4 a0030201 d 308205ec 0202106e cc7aa5a7 032009b 8 cebcf4e9 52d 49130

  010105 05003081 09060355 04061302 55533117 ca310b30 0d 864886f7 0d06092a

  30150603 55040 has 13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b

  13165665 72695369 676e2054 72757374 204e6574 776f726b 313 has 3038 06035504

  0b 133128 63292032 30303620 56657269 5369676e 2c20496e 632e202d 20466f72

  20617574 7a 656420 75736520 6f6e6c79 31453043 06035504 03133c 56 686f7269

  65726953 69676e20 436c 6173 73203320 5075626c 69632050 72696 72792043 61 d

  65727469 66696361 74696f6e 20417574 686f7269 7479202d 20473530 1e170d31

  30303230 38303030 3030305a 170d 3230 30323037 32333539 35395a 30 81b5310b

  30090603 55040613 02555331 17301506 0355040a 130e5665 72695369 676e2c20

  496e632e 311f301d 06035504 0b 131656 65726953 69676e20 54727573 74204e65

  74776f72 6b313b30 5465726d 20757365 20617420 73206f66 39060355 040b 1332

  68747470 7777772e 733a2f2f 76657269 7369676e 2e636f6d 2f727061 20286329

  302d 0603 55040313 26566572 69536967 61737320 33205365 6e20436c 3130312f

  63757265 20536572 76657220 20473330 82012230 0d06092a 864886f7 4341202d

  010101 05000382 010f0030 82010 0d has 02 b187841f 82010100 c20c45f5 bcab2597

  a7ada23e 9cbaf6c1 39b88bca c2ac56c6 e5bb658e 444f4dce 6fed094a d4af4e10

  9c688b2e 957b899b 13cae234 34c1f35b f3497b62 d188786c 83488174 0253f9bc

  7f432657 5833833b 330a17b0 d04e9124 ad867d64 12dc744a 34a11d0a ea961d0b

  15fca34b 3bce6388 d0f82d0c 948610ca b69a3dca eb379c00 48358629 5078e845

  1941 4ff595ec 7b98d4c4 71b350be 28b38fa0 b9539cf5 ca2c23a9 fd1406e8 63cd

  18b49ae8 3c6e81fd e4cd3536 b351d369 ec12ba56 6e6f9b57 c58b14e7 0ec79ced

  4a546ac9 4dc5bf11 b1ae1c67 81cb4455 33997f24 9b3f5345 7f861af3 3cfa6d7f

  81f5b84a d3f58537 1cb5a6d0 09e4187b 384efa0f 01 has 38201 02030100 df308201

  082b 0601 05050701 01042830 26302406 082 b 0601 db303406 05050730 01861868

  7474703a 2f2f6f63 73702e76 65726973 69676e2e 636f6d30 12060355 1 d 130101

  ff040830 02010030 70060355 b 200469 30673065 060, 6086 480186f8 1 d 060101ff

  45010717 03305630 2806082b 06010505 07020116 1 c 687474 70733a2f 2f777777

  2e766572 69736967 6e2e636f 6d2f6370 73302 has 06 082 b 0601 05050702 02301e1a

  1 c 687474 70733a2f 2f777777 2e766572 69736967 6e2e636f 6d2f7270 61303406

  03551d1f 042d302b 3029 has 027 a0258623 68747470 3a2f2f63 726c2e76 65726973

  69676e2e 636f6d2f 2d67352e 70636133 63726c 30 0e060355 1d0f0101 ff040403

  02010630 6d06082b 06010505 07010c 59305730 55160969 5da05b30 04 61305fa1

  6 d 616765 2f676966 3021301f 2b0e0302 30070605 1a04148f e5d31a86 ac8d8e6b

  c3cf806a d448182c 7b192e30 25162368 7474703a 2f2f6c6f 676f2e76 65726973

  69676e2e 636f6d2f 76736c6f 676f2e67 69663028 0603551d 11042130 1fa41d30

  1 b 311930 17060355 04031310 56657269 5369676e 4d504b49 2d322d36 301D 0603

  445 1653 44c1827e 1d20ab25 f40163d8 be79a530 1f060355 c 1604140d 551d0e04

  1 230418 30168014 7fd365a7 c2ddecbb f03009f3 4339fa02 af333133 300 d 0609 d

  2a 864886 05050003 82010100 0c8324ef ddc30cd9 589cfe36 b6eb8a80 f70d0101

  4bd1a3f7 9df3cc53 ef829ea3 a1e697c1 589d756c e01d1b4c fad1c12d 05c0ea6e

  b2227055 d9203340 3307c 265 83fa8f43 379bea0e 9a6c70ee f69c803b d937f47a

  99 c 71928 8705 404167d 1 273aeddc 866d 24f78526 a2bed877 7d494aca 6decd018

  481d22cd 0b0b8bbc f4b17bfd b499a8e9 762ae11a 2d876e74 d388dd1e 22c6df16

  b62b8214 0a945cf2 50ecafce ff62370d ad65d306 4153ed02 14c8b558 28a1ace0

  5becb37f 954afb03 c8ad26db e6667812 4ad99f42 fbe198e6 42839b8f 8f6724e8

  6119b5dd cdb50b26 058ec36e c4c875b8 46cfe218 065ea9ae a8819a47 16de0c28

  6c2527b9 deb78458 c61f381e a4c4cb66

  quit smoking

  crypto ISAKMP allow outside

  crypto ISAKMP policy 10

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  crypto ISAKMP policy 20

  preshared authentication

  3des encryption

  md5 hash

  Group 2

  life 86400

  crypto ISAKMP policy 30

  preshared authentication

  3des encryption

  md5 hash

  Group 1

  life 86400

  No encryption isakmp nat-traversal

  Telnet 192.168.1.0 255.255.255.0 inside

  Telnet timeout 60

  SSH 192.168.1.0 255.255.255.0 inside

  SSH timeout 5

  Console timeout 0

  dhcpd outside auto_config

  !

  a basic threat threat detection

  Statistics-list of access threat detection

  no statistical threat detection tcp-interception

  WebVPN

  attributes of Group Policy DfltGrpPolicy

  Group internal water policy

  attributes of group water policy

  value of 192.168.1.1 DNS server

  VPN-idle-timeout no

  VPN-session-timeout no

  Protocol-tunnel-VPN IPSec

  attributes of Registrar username

  VPN-group-policy DfltGrpPolicy

  type water tunnel-group remote access

  water General attributes tunnel-group

  water of the pool address

  Group Policy - by default-water

  DHCP server 192.168.1.1

  water ipsec-attributes tunnel-group

  pre-shared key *.

  tunnel-group 24.x.x.97 type ipsec-l2l

  24.x.x.97 group of tunnel ipsec-attributes

  pre-shared key *.

  !

  class-map inspection_default

  match default-inspection-traffic

  !

  !

  type of policy-card inspect dns preset_dns_map

  parameters

  maximum message length automatic of customer

  message-length maximum 512

  Policy-map global_policy

  class inspection_default

  inspect the preset_dns_map dns

  inspect the ftp

  inspect h323 h225

  inspect the h323 ras

  inspect the rsh

  inspect the rtsp

  inspect esmtp

  inspect sqlnet

  inspect the skinny

  inspect sunrpc

  inspect xdmcp

  inspect the sip

  inspect the netbios

  inspect the tftp

  Review the ip options

  !

  global service-policy global_policy

  context of prompt hostname

  anonymous reporting remote call

  Cryptochecksum:06bda38461d2419b3e5c4904333b62e7

  : end

  # sh crypto isa water his

  ITS enabled: 1

  Generate a new key SA: 0 (a tunnel report Active 1 and 1 to generate a new key during the generate a new key)

  Total SA IKE: 1

  1 peer IKE: 24.x.x.97

  Type: L2L role: answering machine

  Generate a new key: no State: MM_ACTIVE

  water # sh crypto ipsec his

  Interface: outside

  Tag crypto map: outside_map, seq num: 1, local addr: 24.x.x.54

  outside_1_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.100.0 255.255.255.0

  local ident (addr, mask, prot, port): (192.168.1.0/255.255.255.0/0/0)

  Remote ident (addr, mask, prot, port): (Town/255.255.255.0/0/0)

  current_peer: 24.x.x.97

  #pkts program: encrypt 0, #pkts: 0, #pkts digest: 0

  #pkts decaps: 78, #pkts decrypt: 78, #pkts check: 78

  compressed #pkts: 0, unzipped #pkts: 0

  #pkts uncompressed: 0, comp #pkts failed: 0, #pkts Dang failed: 0

  success #frag before: 0, failures before #frag: 0, #fragments created: 0

  Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0

  #send errors: 0, #recv errors: 0

  local crypto endpt. : 24.x.x.54, remote Start crypto. : 24.x.x.97

  Path mtu 1500, fresh ipsec generals 58, media, mtu 1500

  current outbound SPI: FC3F0652

  current inbound SPI: 16409623

  SAS of the esp on arrival:

  SPI: 0 x 16409623 (373331491)

  transform: esp-3des esp-md5-hmac no compression

  running parameters = {L2L, Tunnel, PFS 2 group}

  slot: 0, id_conn: 126976, crypto-card: outside_map

  calendar of his: service life remaining (KB/s) key: (3914995/28408)

  Size IV: 8 bytes

  support for replay detection: Y

  Anti-replay bitmap:

  0xFFFFFFFF to 0xFFFFFFFF

  outgoing esp sas:

  SPI: 0xFC3F0652 (4231988818)

  transform: esp-3des esp-md5-hmac no compression

  running parameters = {L2L, Tunnel, PFS 2 group}

  slot: 0, id_conn: 126976, crypto-card: outside_map

  calendar of his: service life remaining (KB/s) key: (3915000/28408)

  Size IV: 8 bytes

  support for replay detection: Y

  Anti-replay bitmap:

  0x00000000 0x00000001

  Thanks again!

  In addition,

  Now that I actually think...

  The original ICMP you did would go as follows

  • 192.168.100.x send ICMP messages to echo
  • Happens on ASA local
  • Gets sent through the VPN L2L connection
  • Arrives on the ASA remote
  • ASA forwards traffic on the LAN Host 192.168.1.x
  • LAN forward host to respond to its default gateway 192.168.1.1 (NOT ASA)
  • ICMP Echo traffic gets lost because of no real route for the return traffic
    • Therefore, you see no encapsulated traffic to destination, ASA, decapsules only traffic that origin of the host that sends the ICMP messages to echo through the VPN L2L

  -Jouni

• VPN-> ASA1 < - l2l Tunnel - > client-> Service ASA2 will not work?

  Hello

  I have spent a lot of time with this problem, but I have not found a working configuration. I sound so simple, but nothing seems to work.

  We have a Site 2 Site tunnel established between two ASA 5505, in the network 'ASA2, 192.168.33.0/24' a terminal server server is located.

  A warrior of the road the VPN user connects to the network 'ASA1, 192.168.0.0/24' using the Cisco VPN Client. It is able to connect to its network services, but not the services that are found in the ASA2 network. The log file is clean, without drops.

  The client shows stats both networks secure routes.

  I'm blind for the solution, or is this not possible?

  Someone has an int for me?

  Best regards

  Markus

  Looks like you need to configure 192.168.0.0/24 within the field of encryption for the tunnel between ASA 1 with the ASA2 L2L.

  You must configure the user of warrior to also encrypt the traffic to the ASA2 network.

  You must activate the same communication intra-interface security, so that traffic can enter ASA 1, then let ASA 1 ASA 2 on the same outside the interface.

  HTH >

• L2l tunnel and show connection addess

  Hello world

  ASA 5505 L2L 5520 tunnel a.

  The tunnel is running.

  5505 # sh crypto isakmp his

  IKEv1 SAs:

  ITS enabled: 1
  Generate a new key SA: 0 (a tunnel report Active 1 and 1 to generate a new key during the generate a new key)
  Total SA IKE: 1

  1 IKE Peer: 10.31.2.30
  Type: L2L role: initiator
  Generate a new key: no State: MM_ACTIVE

  There are no SAs IKEv2

  SH crypto ipsec his
  Interface: Visitor_Edge
  Tag crypto map: D_Traffic_Crypto, seq num: 1, local addr: 10.31.2.20

  When I sh conn address 10.31.2.20 all the
  5 in use, most used 9316
  ESP visitor identity Ifc 10.31.2.20 NP 10.31.2.30, idle 0:00:00, 9912 bytes, flags - 1
  UDP 10.31.2.30:500 NP identity Ifc 10.31.2.20:500 visitor, slowed down to 0:00:09, 3365216, flags - 2 bytes
  ESP visitor identity Ifc 10.31.2.20 NP 10.31.2.30, idle 0:00:00, 3816 bytes, flags - 3

  Must understand the connections 1 and 3 are used for what purpose and why they have no port information?

  As 2 is tunnel connection using port 500. but the connections 1 and 3 have no port number, why?

  Concerning

  Mahesh

  Connection 1 and 3 represent the traffic going in and out, ESP that sit directly on the IP header, so there is no port information.

  Connection 2 represent IKE messages that are exchanging messages on port UDP 500.

• How to set up a one-way IPSec-L2L tunnel

  This may be a silly question, since VPN for communications between the parties of confidence and that most people would try to correct a unidirectional tunnel.

  But I'm interested to transform a regular one-way only, tunnel that traffic to my side can initiate the tunnel.

  Recently, we built this tunnel between our ASA5510 and ASA5510 of our biz partner to run critical applications on their web servers not connected to the Internet. I want to tie down so that they cannot launch the VPN. I have the crypto ACL set to limit to a port address, so they can only come from this port once the tunnel is established. We also have a personal firewall installed on each host.

  Any idea on how to make the one-way tunnel and protect also us better once the tunnel is mounted?

  Hello

  You can use the following command:

  defined card crypto seq - num connection-type name {only answer | only | two-way}

  This command defines whether the tunnel is come only or single answer. If you set the tunnel on your side to come alone, the asa will never accept the installation of tunnel from your business partner. However, you can still start the configuration of the vpn tunnel.

  Check:

  http://www.Cisco.com/en/us/partner/docs/security/ASA/asa80/command/reference/C5.html#wp2152576

  Even if the reference is to ASA8.0 I know it works for 7.2.x so

  Hope this helps

  Kind regards

  Pieter-Jan

• L2l IPsec question: 0 packages decrypted!

  Hello

  We have implemented a solution for IPSec-l2l between HQ and remote sites. The last being a ship, we opted for the dynamic Ipsec l2l solution to static using two ASAs. However, the solution fails to certain ports. In fact, the tunnel is established and the packets are encrypted on the ASA remote. However, no packet is decrypted. HQ sees not all encrypted packets. It looks like something between the two does not prevent IPSec packets to reach the HQ...

  How could ensure us that the solution works always regardless of any ACL or NAT between the two?

  Excerpts of the "sh crypto ipsec his" cmd for a positive and result negative as well as the configuration of the remote control - ASA IPsec.

  Distance - ASA # sh crypto isakmp his

  Interface: outside
  Tag crypto map: CMAP, seq num: 10, local addr: 172.16.1.215

  extended vpn ip 10.240.192.0 access list allow 255.255.255.0 10.0.0.0 255.0.0.0
  local ident (addr, mask, prot, port): (10.240.192.0/255.255.255.0/0/0)
  Remote ident (addr, mask, prot, port): (10.0.0.0/255.0.0.0/0/0)
  current_peer: 146.40.75.33

  #pkts program: 28, encrypt #pkts: 28, #pkts digest: 28
  decaps #pkts: 15, #pkts decrypt: 15, #pkts check: 15
  compressed #pkts: 0, unzipped #pkts: 0
  #pkts uncompressed: 28, comp #pkts failed: 0, #pkts Dang failed: 0
  success #frag before: 0, failures before #frag: 0, #fragments created: 0
  Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
  #send errors: 0, #recv errors: 0

  local crypto endpt. : 172.16.1.215, remote Start crypto. : 146.40.75.33

  Distance - ASA # sh crypto isakmp his

  Interface: outside
  Tag crypto map: CMAP, seq num: 10, local addr: 168.240.6.11

  extended vpn ip 10.240.192.0 access list allow 255.255.255.0 10.0.0.0 255.0.0.0
  local ident (addr, mask, prot, port): (10.240.192.0/255.255.255.0/0/0)
  Remote ident (addr, mask, prot, port): (10.0.0.0/255.0.0.0/0/0)
  current_peer: 146.40.75.33

  #pkts program: 45, #pkts encrypt: 45, #pkts digest: 45
  #pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0
  compressed #pkts: 0, unzipped #pkts: 0
  #pkts uncompressed: 28, comp #pkts failed: 0, #pkts Dang failed: 0
  success #frag before: 0, failures before #frag: 0, #fragments created: 0
  Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
  #send errors: 0, #recv errors: 0

  local crypto endpt. : 168.240.6.11, remote Start crypto. : 146.40.75.33

  Remote control - ASA config

  extended vpn ip 10.240.192.0 access list allow 255.255.255.0 10.0.0.0 255.0.0.0

  10.240.192.0 IP Access-list extended sheep 255.255.255.0 allow 10.0.0.0 255.0.0.0

  Global 1 interface (outside)
  NAT (inside) 0 access-list sheep
  NAT (inside) 1 0.0.0.0 0.0.0.0

  Crypto ipsec transform-set esp-sha-3des esp-3des esp-sha-hmac
  life crypto ipsec security association seconds 28800
  Crypto ipsec kilobytes of life - safety 4608000 association
  card crypto CMAP 10 corresponds to the vpn address
  card crypto CMAP 10 set pfs Group1
  card crypto CMAP 10 set peer 146.40.75.33

  card crypto CMAP 10 value transform-set esp-3des-sha
  card crypto CMAP 10 set phase 1-mode aggressive Group1
  card crypto CMAP 10 set reverse-road
  CMAP outside crypto map interface
  ISAKMP crypto identity hostname
  crypto ISAKMP allow outside
  crypto ISAKMP policy 65535
  preshared authentication
  3des encryption
  sha hash
  Group 1
  life 86400
  No encryption isakmp nat-traversal

  tunnel-group 146.40.75.33 type ipsec-l2l
  IPSec-attributes tunnel-group 146.40.75.33
  pre-shared key *.

  Thanks for your help!

  Franc

  Hello

  The first output shows two packets encrypted/decrypted on the ASA remote.

  At this point, the VPN worked very well? What was different?

  The second output shows encrypted packets on the ASA remote but no decrypted.

  You mentioned that the HQ site does not show decrypted packets either.

  It seems that the ASA remote sends the traffic in the tunnel, but they never reached the HQ site.

  This can happen when there is a problem of route, NAT problem or some sort of VPN filter.

  To understand this better explain what the difference was between the first and the second scenario.

  Federico.

• Static L2L Tunnel - will not come to the top

  Hi all

  Currently have a very big problem with a site that I can't go there for the moment.

  We have one HUB ASA5505 SEC + a few other ASA connected via VPN L2L. We have static L2L 1 active, 1 dynamic L2L Active, and I am currently trying to add a second static Tunnel L2L.

  I checked that each WAN Interface can ping each other, and both devices have full internet connectivity. There is no double nat or being content filtering. I noticed that my Client remote access VPN Cisco will not properly connect through the ASA despite full internet connectivity, but when I connect directly to a modem, I was able to connect properly. So apparently the ISP isn't blocking IPSEC traffic as far as I KNOW.

  Static2 uses currently a temporary license of TAC since our license is currently waiting for arrival, but a release of version see the watch all VPN/3des features are enabled.

  Here are the configs:

  ASA5505-HUB hostname
  domain xxxxxxx.local
  activate the password xxxxxxxxxxx
  names of
  name 192.168.9.50 xxxxxxxxx
  name 192.168.9.51 xxxxxxxxx xxxxxxxxxx description
  !
  interface Vlan1
  nameif inside
  security-level 100
  IP 192.168.9.1 255.255.255.0
  !
  interface Vlan2
  nameif outside
  security-level 0
  IP address xxxxxxxxxxxxx 255.255.255.248
  !
  interface Vlan3
  nameif dmz
  security-level 50
  IP 10.10.9.1 255.255.255.0
  !
  interface Ethernet0/0
  switchport access vlan 2
  !
  interface Ethernet0/1
  !
  interface Ethernet0/2
  !
  interface Ethernet0/3
  !
  interface Ethernet0/4
  switchport access vlan 3
  !
  interface Ethernet0/5
  switchport access vlan 3
  !
  interface Ethernet0/6
  !
  interface Ethernet0/7
  !
  passwd xxxxxxxxxxxx
  passive FTP mode
  clock timezone CST - 6
  clock to summer time recurring CDT
  DNS lookup field inside
  DNS server-group DefaultDNS
  Server name xxxxxxxxxx
  Server name xxxxxxxxxxxxxxx
  domain xxxxxxxxxxxx.local
  permit same-security-traffic intra-interface
  permit inside_nat0_outbound to access extended list ip 192.168.0.0 255.255.0.0 192.168.0.0 255.255.0.0
  access-list 101 extended allow icmp a whole
  access-list standard split allow 192.168.0.0 255.255.0.0
  permit to_static1 to access extended list ip 192.168.0.0 255.255.0.0 192.168.14.0 255.255.255.0
  permit to_static2 to access extended list ip 192.168.0.0 255.255.0.0 192.168.16.0 255.255.255.0< this="" is="" the="" problem="">
  RTP list extended access udp any permitted any 10000 20000 Beach
  RTP list extended access permitted tcp everything any 10000 20000 Beach
  pager lines 24
  monitor debug logging
  asdm of logging of information
  Within 1500 MTU
  Outside 1500 MTU
  MTU 1500 dmz
  mask IP local RA-pool 192.168.99.1 - 192.168.99.126 255.255.255.128
  no failover
  ICMP unreachable rate-limit 1 burst-size 1
  don't allow no asdm history
  ARP timeout 14400
  Global 1 interface (outside)
  NAT (inside) 0-list of access inside_nat0_outbound
  NAT (inside) 1 0.0.0.0 0.0.0.0
  Route outside 0.0.0.0 0.0.0.0 75.146.188.94 1
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout, uauth 0:05:00 absolute
  dynamic-access-policy-registration DfltAccessPolicy
  Enable http server
  http 192.168.0.0 255.255.0.0 inside
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown cold start
  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
  set of 20 SYSTEM_DEFAULT_CRYPTO_MAP crypto dynamic-map transform-set ESP-3DES-SHA
  card crypto outside_map 10 correspondence address to_static1
  card crypto outside_map 10 peers set xxxxxxxxxx
  outside_map crypto 10 card value transform-set ESP-3DES-SHA
  card crypto outside_map 11 match address to_static2
  card crypto outside_map 11 counterpart set xxxxxxxxxxxxx< problem="">
  card crypto outside_map 11 game of transformation-ESP-3DES-SHA
  outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
  outside_map interface card crypto outside
  crypto ISAKMP allow outside
  crypto ISAKMP policy 10
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  Telnet 192.168.0.0 255.255.0.0 inside
  Telnet timeout 5
  SSH timeout 5
  Console timeout 0
  management-access inside
  dhcpd outside auto_config
  !
  dhcpd address 192.168.9.101 - 192.168.9.199 inside
  dhcpd dns 192.168.9.2 xxxxxxxxxxx interface inside
  dhcpd xxxxxxxxx.local area inside interface
  xxxxxxxx dhcpd option 66 ip inside interface
  dhcpd allow inside
  !

  a basic threat threat detection
  Statistics-list of access threat detection
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  message-length maximum 512
  type of policy-card inspect sip default_sip
  parameters
  Journal of decline in the shares of Max-forwards-validation
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the netbios
  inspect the rtsp
  inspect the default_sip sip
  !
  global service-policy global_policy
  Group xxxxx-RA internal policy
  xxxxx-RA group policy attributes
  Server DNS value 192.168.9.2 xxxxxxxxxxxxx
  Protocol-tunnel-VPN IPSec l2tp ipsec
  Split-tunnel-policy tunnelspecified
  Split-tunnel-network-list value split
  xxxxxxxxx.local value by default-field
  allow to NEM
  IPSec-attributes tunnel-group DefaultL2LGroup
  pre-shared-key *.
  type tunnel-group xxxxx-RA remote access
  Tunnel-Group global xxxxxx-RA-attributes
  address-RA-pool
  Group Policy - by default-xxxxx-RA
  tunnel-group xxxxxx-ipsec-attributes
  pre-shared-key *.
  tunnel-group STATIC2_WANIP type ipsec-l2l< problem="">
  IPSec-attributes tunnel-group STATIC2_WANIP
  pre-shared-key *.
  tunnel-group STATIC1_WANIP type ipsec-l2l
  IPSec-attributes tunnel-group STATIC1_WANIP
  pre-shared-key *.
  context of prompt hostname

  and...

  ASA5505-STATIC2 host name
  domain xxxxxxxx.local
  activate the password XXXXXX
  passwd xxxxxxxxxxx
  names of
  !
  interface Ethernet0/0
  switchport access vlan 3
  !
  interface Ethernet0/1
  switchport access vlan 2
  !
  interface Ethernet0/2
  switchport access vlan 2
  !
  interface Ethernet0/3
  switchport access vlan 2
  !
  interface Ethernet0/4
  switchport access vlan 2
  !
  interface Ethernet0/5
  switchport access vlan 2
  !
  interface Ethernet0/6
  switchport access vlan 2
  !
  interface Ethernet0/7
  switchport trunk allowed vlan 1-2
  switchport trunk vlan 1 native
  switchport mode trunk
  !
  interface Vlan1
  nameif dmz
  security-level 50
  IP 10.10.0.1 address 255.255.255.0
  !
  interface Vlan2
  nameif inside
  security-level 100
  192.168.16.1 IP address 255.255.255.0
  !
  interface Vlan3
  nameif outside
  security-level 0
  IP address xxxxxxxxxxx 255.255.254.0
  !
  passive FTP mode
  clock timezone CST - 6
  clock to summer time recurring CDT
  DNS lookup field inside
  DNS server-group DefaultDNS
  Server name xxxxxxxxxx
  Server name xxxxxxxxxx
  domain xxxxxxxxxx.local
  access extensive list ip 192.168.16.0 to_hq allow 255.255.255.0 192.168.0.0 255.
  255.0.0
  192.168.16.0 IP Access-list extended sheep 255.255.255.0 allow 192.168.0.0 255.
  255.0.0
  pager lines 24
  MTU 1500 dmz
  Within 1500 MTU
  Outside 1500 MTU
  no failover
  ICMP unreachable rate-limit 1 burst-size 1
  don't allow no asdm history
  ARP timeout 14400

  Route outside 0.0.0.0 0.0.0.0 xxxxxxxxxxx
  Global 1 interface (outside)
  NAT (dmz) 1 0.0.0.0 0.0.0.0
  NAT (inside) 0 access-list sheep
  NAT (inside) 1 0.0.0.0 0.0.0.0
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy
  Enable http server
  http 192.168.0.0 255.255.0.0 inside
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown cold start
  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
  life crypto ipsec security association seconds 28800
  Crypto ipsec kilobytes of life - safety 4608000 association
  card crypto cmap1 match 10 address to_hq
  card crypto cmap1 10 peers set xxxxxxxxxxxxxx
  cmap1 crypto 10 card value transform-set ESP-3DES-SHA
  crypto ISAKMP policy 10
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  crypto ISAKMP policy 65535
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  No encryption isakmp nat-traversal
  Telnet 192.168.0.0 255.255.0.0 inside
  Telnet timeout 5
  SSH timeout 5
  Console timeout 0
  management-access inside
  dhcpd dns 192.168.9.2 xxxxxxxxxxxx
  !
  dhcpd address dmz 10.10.0.100 - 10.10.0.199
  dhcpd lease 10800 dmz interface
  dhcpd enable dmz
  !
  dhcpd address 192.168.16.101 - 192.168.16.131 inside
  lease interface 10800 dhcpd inside
  dhcpd xxxxxxxxxx.local area inside interface
  dhcpd ip interface 192.168.9.50 option 66 inside
  dhcpd allow inside
  !

  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  WebVPN
  tunnel-group HUB_WANIP type ipsec-l2l
  IPSec-attributes tunnel-group HUB_WANIP
  pre-shared-key *.
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  maximum message length automatic of customer
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  Review the ip options
  inspect the netbios
  inspect the rsh
  inspect the rtsp
  inspect the skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect the tftp
  inspect the sip
  inspect xdmcp
  inspect the icmp
  !
  global service-policy global_policy
  context of prompt hostname

  Any help is appreciated

  Hello

  Seems to me that the ASA named STATIC2-ASA5505 lack some essential associated VPN configurations.

  The encryption card is not attached to any interface

  Configure this

  cmap1 interface card crypto outside

  The Crypto ISAKMP is not enabled on any interface

  Configure this

  crypto ISAKMP allow outside

  Hope this helps

  -Jouni

• Design of VPN L2L ASA question

  We expect to have more than 10,000 remote VPN L2L clients.

  I see that each crypto card needs a statement of 'same game' and the IP address is the address of the remote peer VPN L2L.

  :

  EX:

  card encryption UNI-POP 3 set peer 172.23.0.3

  : . . .

  card crypto UNI-POP 10000 set peer 172.26.0.250

  :

  I already feel that this will be a VERY long config, maybe too big to save/read/from memory.

  :

  Anyone would be a better approach?

  Thank you

  Frank

  Frank,

  If the remote end will run only from time to time, you should not have set peer statements and normally it would suffice to have a dynamic encryption card.

  If the remote ends do not support certificates, it is possible to land on defaultl2l tunnel-group.

  bsns-asa5505-19# sh run all tunnel-group
  tunnel-group DefaultL2LGroup type ipsec-l2l
  tunnel-group DefaultL2LGroup general-attributes
  (...)
  

  You need to test yourself to see if it will work.

  I also agree in terms of more than one firewall. With devices for two in the load balancing or if possible 2pairs of devices in the failover cluster could be great way to have a decent charge by machine and equipment redundancy (ideal circumstances]);. I suggest you ping your system engineer for sure any deployment involving 5585, guys can usually give good advice (and discounts;]).

  Marcin

• Move on to a different physical interface same ASA L2L tunnel

  Some may describe the process to move a tunnel L2L existing since one physical interface to another?

  Thank you!

  Sent by Cisco Support technique iPhone App

  Add the map encryption to the new interface

  card crypto IPSEC interface new_outside

  You will also need to add isakmp to the new interface

  ISAKMP crypto enable new_outside

  If you have a new public IP address, then you will need to create a new VPN Group also.

• Allowing ports through a VPN tunnel question

  I have a VPN tunnel established and I can ping above but my application fails and I think its because I encouraged not 2 ports (ports TCP 19813 and 19814) through. I'm not clear how should I do for allowing these ports through. I need to add a statement to permit to access my list 'sheep' or what I need to add a statement of license to my list of access interface "external"?

  Remote users have an IP address of 172.16.5.x 24 and they're trying to connect to users on the 192.168.200.x 24 192.168.201.x 24. I can't do a ping of the 24 192.168.200.x to the 172.16.5.0/24.

  The commands below are what I currently have in my PIX.

  My current sheep-access list:

  IP 192.168.201.0 allow Access-list sheep 255.255.255.0 172.16.5.0 255.255.255.0

  IP 192.168.200.0 allow Access-list sheep 255.255.255.0 172.16.5.0 255.255.255.0

  My current outside of the access-list interface:

  acl_inbound list access permit tcp any host xx.xx.xx.xx eq smtp

  acl_inbound list access permit tcp any host xx.xx.xx.xx eq - ica citrix

  acl_inbound list access permit tcp any host xx.xx.xx.xx eq www

  acl_inbound list access permit tcp any host xx.xx.xx.xx eq www

  acl_inbound list access permit tcp any host xx.xx.xx.xx eq www

  acl_inbound list access permit tcp any host xx.xx.xx.xx eq 500

  acl_inbound esp allowed access list any host xx.xx.xx.xx

  acl_inbound list access permit icmp any any echo response

  access-list acl_inbound allow icmp all once exceed

  acl_inbound list all permitted access all unreachable icmp

  acl_inbound list access permit tcp any host xx.xx.xx.xx eq www

  acl_inbound list access permit tcp any host xx.xx.xx.xx eq https

  first of all, you disable the commnad "sysopt connection permit-ipsec" on the pix? with this enabled command, which is enabled by default, the pix will ignore any ACLs for encrypted traffic. so if you have Hell no this command, then the acl that you applied on the outside int won't make a difference.

  However, if "sysopt connection permit-ipsec" is always on, and then all the port/protocol should be allowed.

  you said you could do a ping of 192.168.200.0 to 172.16.5.0. How about you 172.16.5.0 to 192.168.200.0 and 192.168.201.0?

  also, just wondering if the vpn lan-to-lan or access remote vpn (i.e. using the cisco vpn client).

• (Between Cisco and Fortigate) IPsec tunnel question

  Hi all

  Im trying to install an IPsec site-to-site between 2 different routers (Cisco 3750 and Fortigate 100a) (R1 & Fortigate100A)

  IPsec, the whole scenario works with the installation.

  But unfortunately the tunnel (between R1 & Fortigate100A) IPsec does not work.

  (Pls look at the attached jpg file)

  The message is received in routers are shown below:

  Cisco: R1:

  % CRYPTO-6-IKMP_MODE_FAILURE: fast mode processing failed with the peer to 192.168.43.75

  FortiGate 100A:

  IKE 0: none established HIS IKE for informational type of d18e1af773e658b9/192.168.43.195:500->192.168.43.75 Exchange 3 cookie d3695c6cea17475a, don't drop

  IKE 0:Cisco - P1:6899: authentication OK

  IKE 0: none established HIS IKE for informational type of d18e1af78ed17bf9/192.168.43.195:500->192.168.43.75 Exchange 3 cookie 414bd35ab92bc4ef, don't drop

  IKE 0:Cisco - P1:6899:Cisco - P2:14802: failure of negotiating quick mode due to the delay of new attempt IKE 0:Cisco - P1:6900: authentication OK

  I configured both routers as follows:

  Cisco:

  HostName:R1

  ISAKMP policy 1

  Hash: sha

  Authentication: pre-shared

  Encryption: AES128

  DH group: 2

  Life 86400

  ISAKMP Key: cisco1 address 192.168.43.75

  Crypto IPsec transform-set esp - aes and hmac-sha-esp RIGHT

  Access-list: 101 permit ip 10.0.0.0 0.0.0.255 10.10.10.0 0.0.0.255

  Map R1_to_Fortigate100A 10 IPsec-Isakmp crypto

  defined by peers: 192.168.43.75

  Mailing address 101

  The value transformset: RIGHT

  int fa # 0 / 0 Crypto map R1_to_Fortigate100A

  FortiGate:

  HostName: Fortigate100A

  Phase 1:

  Preshared key: cisco1

  The remote gateway ip address: 192.168.43.195

  mode: aggressive

  Accept any pair

  Proposal P1:

  AES 128 / SHA1

  AES 192 / SHA1

  AES192/SHA 256

  DH: 2

  Keylife: 86400

  Phase2:

  AES 128 / SHA1

  AES 192 / SHA1

  AES192/SHA 256

  Keylife:86400

  Quick mode selector:

  Source address: 10.10.10.0/24

  Destination address: 192.168.43.0/24

  I will be very very very grateful if you informed of my faults possible a solution

  Happy new year

  Ministry of education

  For some time I messed with a fortigate, but I would try first to change the remote address of the phase 2 to 10.0.0,0/24. If this is the statement "interesting traffic", it does not match what you have on the Cisco. After that, try to change the phase 1 Ike mode to something else than "aggressive."

  Sent by Cisco Support technique iPad App