Lost comunication in VPn tunnel after session claire encryption

Similar Questions

• Problems with VPN tunnels after the upgrade to PIX 7.0

  It seems that Cisco has revamped the VPN process on the new Version of PIX 7.0.

  After I've upgraded, I noticed that AH (i.e. ah-sha-hmac, ah-md5-hmac) was no longer supported and all my container transformation games OH no were not converted.

  Another question, if you have enabled on Versieon 6.3, names when you upgrade, tunnel groups will be created (formerly "identity isakmp crypto, crypto key isakmp peer ') which will include a hostname (hostname of identity) instead of IP as it was to the point 6.3. Guess what... Nothing works! Having to delete and recreate it using the IP address.

  See an example...

  tunnel-group OTHER_END type ipsec-l2l

  IPSec-attributes tunnel-group OTHER_END

  pre-shared-key *.

  The above does not work... Having to recreate using the IP address mapped to OTHER_END...

  tunnel-group 2.2.2.2 type ipsec-l2l

  2.2.2.2 tunnel-group ipsec-attributes

  pre-shared-key *.

  Furthermore, I have problems with my racoon and freeswan extranet... Did someone recently updated with success and other gateways VPN provider (i.e. checkpoint, Freeswan and Racoon) work?

  We found the solution for this problem. It appeared that the perfect forward secrecy is enabled at the other side. If a 'card crypto outside_map 10 set pfs' is necessary. With the pix 6.3 version that appears not to make the difference, the vpn works even with pfs disabled on the side of pix.

• After the VPN Tunnel access problem is in place.

  Could someone please take a look at this config and tell me why, once I have the VPN tunnel to the top, I can't access all hosts on the 192.168.41.0 network? (The x are inserted for privacy). Thank you.

  Try...

  ISAKMP nat-traversal

• Lost the VPN tunnel between 2 site when internal client using client vpn

  We currently have VPN tunnel connected to the remote desktop using router VPN Hotbrick 2.

  When 1 of the internal computer try to connect to another server VPN customer using Cisco VPN Client v4.8, she will appear in drop/disable/loss of the tunnel between us VPN and remote offices. The tunnel is still established but no traffice between site 2. (cannot all ping)

  What are the causes of the problem? Hotbrik problem? Customer Cisco VPN setting or something else?

  I don't know what causes the problem. Help, please. Thanks in advance.

  Hello

  The problem is that your NAT device will not translating properly, and when the 2nd customer triggers (ISAKMP packets-UDP 500) connections port isn't transalated, so for the SAA is as the first user tries to connect again, then it rejects the initial connection.

  The trick is, as you have discovered, use global UDP.

  The problem is that UDP 10000 is not a standard, so you need to check if multiple users can be connected at the same time behind the same NAT device.

  If this is not the case, use the NAT transparency standard industry (UDP 4500). This should be configured only on the SAA.

  Please rate if this helped.

  Kind regards

  Daniel

• Site-to-Site VPN breaks after reset of the router

  Hi all

  I have a very difficult problem.  I have a CallManager server on one site (Site A) configuration and IP phones which connect you via tunneling IPSec VPN site-to site to Site B.  WAN link to Site B (cable ISP with IP static) can be a tad bit reliable at times.  Everything worked perfectly, except when the router resets or loses connection at site B, smashing everything.  I have the option tftp 150 defined on the server CUCM on Site (192.168.10.250).  The tunnel is NOT upward automatically after a router loses connection, and once this is the case, it seems that I can't help that can restore full connectivity.  I know I must be missing something, but have no idea what.  The nbar-Discovery Protocol on the external interface of the router on the Site B shows TFTP and Skinny packets go out, but nothing back in.  I can't ping all internal resources on the Site A of Site B.  I'm doing a "isakmp crypto to show his" on each router and it shows the tunnel as being upward.  In order to back up the tunnel, I need to access the router on the Site A with the SDM tool and do a 'test' of the VPN tunnel.  It shows it as inactive, and when I have SDM generate traffic, using the source IP address as 192.168.10.1 (inside the interface of the router on the Site A) and destination IP of 192.168.11.1 (inside the interface of the router on the Site B), the tunnel back to the top.  Yet, even if the tunnel is restored, nothing works as much as to be able to ping site starting tftp from Site A to Site B and Site B.  Any help on this is GREATLY appreciated.  Any suggestions on how to configure a VPN site-to-site-reliable so that if cnnection is lost on one end, the tunnel back upward and devices on Site B can access resources such as on Site A CallManager server.  Thanks in advance!

  Hello

  One way you can have the tunnel come back automatically even if it breaks down is configure SLA monitoring on one of the routers of the site so that it sends periodic pings inside the IP address of the router on the other site. For example, on the Siite to configure it for SLA monitoring of IP than his inside source 192.168.10.1 and making ping inside the interface of Site B interface regularly, 192.168.11.1. Configuration guide, please see the below page:

  http://www.Cisco.com/en/us/docs/iOS/12_4/ip_sla/configuration/guide/hsicmp.html#wp1027188

  About traffic has not managed, pouvez you please paste the result of ' show cry isa his ', ' cry ipsec to show his ' and the configuration of the two routers if possible?

  Kind regards

  Assia

• routing of traffic between vpn tunnels

  Hello

  I have a scenario like that.

  There are two branch office vpn tunnels to the headquarters. I want to load balance the traffic on this two links using EIGRP.

  in this way, another branch offic is also connected to the head office. now, I want to ensure the communication between two branch of the office through seat over these vpn tunnels.

  Concerning

  skrao

  Hello

  Here is a great link that describes a similar setup to yours:

  http://www.Cisco.com/en/us/Tech/tk583/TK372/technologies_configuration_example09186a008009438e.shtml

  Good reading and after return if there is anything that you are not clear.

  PLS, don't forget to rate messages.

  Paresh

• Possible to assign security levels in the VPN tunnel?

  Currently I have a PIX-2-ASA VPN tunnel works without any problem.

  Here's my problem, I want to know if there is a way to configure one side of the tunnel as an interface "drop safety" of sorts. I want only one side to be able to open traffic.

  ACLs are not useful on one side at least as return traffic generated on the random ports. I want only one side to answer Insider sessions, but not be able to start a session on its own.

  Since the terminiates of VPN tunnel on the external interface, the security level of each side is '0 '. If all traffic behind on part and on the other the tunnel can innitate sessions.

  Any ideas?

  Thank you

  Edit: One side is a v6.3 (5) of PIX515E, another ASA5510 v7.2 (1)

  Hello

  On your ASA, you can specify the following 3 connection types in your crypto card:

  1 crypto map set type of connection are created only

  2 crypto map set connection type response only

  3 crypto map set-type of two-way connection

  This should allow you to control what end can initiate the tunnel.

  Concerning

  Pradeep

• An easy - how bounce a VPN tunnel from the command line?

  I think I know the answer, but must ensure. Is - what the command to bounce a VPN?

  his clear crypto ipsec peer

  Just to check - this command does not delete the config, but simply bounces, right?

  For customers of IOS VPN...

  your order will only cause me to generate a new key when I send more traffic... just tried...

  For the ASA VPN Clients we have

  ASA - fw # vpn - sessiondb logoff?

  all the all sessions

  proxy email Email-Proxy sessions

  specific session to Index the index

  specific sessions address IP IPAddress

  IPsec LAN-to-LAN l2l sessions

  name user name specific sessions

  sessions specific Protocol

  remote access remote IPsec sessions

  sessions of customer VPN SSL SVC

  Group-Tunnel tunnel-group sessions

  Mgmt of VPN VPN - lb load balancing sessions

  WebVPN WebVPN sessions

• NAT VPN tunnel and still access Internet traffic

  Hello

  Thank you in advance for any help you can provide.

  I have a server with the IP 192.168.1.9 that needs to access a subnet remote from 192.168.50.0/24, through the Internet.  However, before the server can access the remote subnet, the server IP must be NAT'ed to 10.1.0.1 because the VPN gateway remote (which is not under my control) allows access to other customers who have the same subnet address that we do on our local network.

  We have a 2801 Cisco (running c2801-advsecurityk9 - mz.124 - 15.T9.bin) set up to make the NAT.  It is the only gateway on our network.

  I have configured the Cisco 2801 with the following statements of NAT and the relevant access lists:

  access-list 106 allow host ip 192.168.1.9 192.168.50.0 0.0.0.255

  NAT extended IP access list
  refuse the host ip 192.168.1.9 192.168.50.0 0.0.0.255
  deny ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255
  ip permit 192.168.1.0 0.0.0.255 any

  route allowed ISP 10 map
  corresponds to the IP NAT

  IP nat EMDVPN 10.1.0.1 pool 10.1.0.1 netmask 255.255.255.0
  IP nat inside source list 106 pool EMDVPN
  IP nat inside source map route ISP interface FastEthernet0/1 overload

  When the server (192.168.1.9) attempts to ping on the subnet of 192.168.50.0/24 devices, the VPN tunnel is established successfully.  However, after that, the server is no longer able to access the Internet because the NAT translation for 192.168.1.9 has changed since the external IP address of the router (FastEthernet0/1) at 10.1.0.1.

  The documentation I've seen on the site of Cisco says that this type of Setup allows only host subnet communication.  Internet access is not possible.  However, maybe I missed something, or one of you experts can help me.  Is it possible to configure the NAT router traffic destined to the VPN tunnel and still access the Internet by using the dynamic NAT on FastEthernet0/1?

  Once again, thank you for any help you can give.

  Alex

  Hello

  Rather than use a pool for NAT

  192.168.1.9 - 10.1.0.1 > 192.168.50.x

  ACL 102 permit ip 192.168.1.9 host 192.168.50.0 0.0.0.255

  RM-STATIC-NAT route map permit 10
  corresponds to the IP 102

  IP nat inside source static 192.168.1.9 10.1.0.1 card expandable RM-STATIC-NAT route

  ACL 101 deny host ip 192.168.1.9 192.168.50.0 0.0.0.255
  ACL 101 by ip 192.168.1.0 0.0.0.255 any
  overload of IP nat inside source list 101 interface FastEthernet0/1

  VPN access list will use the source as 10.1.0.1... *.

  Let me know if it works.

  Concerning

  M

• VPN tunnel for initiation of the static method to the dynamic side

  Hello

  In the case of site to site VPN between static IP (ASA) and dynamic IP (Linksys AG241), would it be possible to open the VPN tunnel by the static side? How can I configure it? Could you please advice?

  Thank you very much

  Nitass

  Nitass, I'm sure that you can not start session with ASA, which is on the side of the VPN server.

• ASA base S2S VPN, Tunnel establishes only when interesting traffic hits to end distance

  Dear all,

  I need your help to solve the problem mentioned below.

  VPN tunnel established between the unit two ASA.   A DEVICE and device B

  (1) if interesting traffic initiates a LAN device. traffic ACL hits. TUNEL is not coming

  (2) if interesting traffic initiates B LAN device. Tunnel will establish all the works of serivces

  (3) after the Tunnel device establishmnet B. We forced to tunnel down at both ends. Interesting again traffic initiates device a surpringly tunnel

  will go up.   After 2 or 3 days (after life expire 86400 seconds) initiated traffic of device A, tunnel will not esatblish.

  (it comes to rescue link: interesting won't be there all the time.)

  checked all parametrs, everthing seems fine. Here are the logs of attached but not more informative debugging on the balls. Please suggest.

  February 2, 2010 13:23:17: % ASA-7-713236: IP = 81.145.x.x, IKE_DECODE new SEND Message (msgid = 0) with payloads: HDR + HER (1), SELLER (13) + (0) NONE total length: 496

  February 2, 2010 13:23:18: % ASA-6-713219: IP = 81.x.x.x, KEY-ACQUIRE Queuing messages are treated when SA P1 is finished.

  February 2, 2010 13:23:18: % ASA-6-713219: IP = 81.x.x.x, KEY-ACQUIRE Queuing messages are treated when SA P1 is finished.

  February 2, 2010 13:23:23: % ASA-6-713219: IP = 81.x.x.x, KEY-ACQUIRE Queuing messages are treated when SA P1 is finished.

  February 2, 2010 13:23:25: % ASA-7-715065: IP = 81.x.x.x, history of mistake IKE MM Initiator WSF (struct & 0x1abb1e10) , : MM_DONE, EV_ERROR--> MM_WAIT_MSG2, EV_RETRY--> MM_WAIT_MSG2, EV_TIMEOUT--> MM_WAIT_MSG2 NullEvent--> MM_SND_MSG1, EV_SND_MSG--> MM_SND_MSG1, EV_START_TMR--> MM_SND_MSG1, EV_RESEND_MSG--> MM_WAIT_MSG2, EV_RETRY

  February 2, 2010 13:23:25: % ASA-7-713906: IP = 81.x.x.x, IKE SA MM:56f95c85 ending: flags 0 x 01000022, refcnt 0, tuncnt 0

  February 2, 2010 13:23:25: % ASA-7-713906: IP = 81.x.x.x, sending clear/delete with the message of reason

  February 2, 2010 13:23:25: % ASA-3-713902: IP = 81.x.x.x, counterpart of drop table counterpart, didn't match!

  February 2, 2010 13:23:25: % ASA-4-713903: IP = 81.x.x.x, error: cannot delete PeerTblEntry

  Hi, I have a similar problem a long time ago. You can choose which set up the tunnel in your crypto card:

  card crypto bidirectional IPsec_map 1 set-type of connection

  I hope that it might help to solve your problem. Kind regards.

• FAILURE OF VPN TUNNEL

  Hello guys,.

  I have an ASA 5505 firewall tries to create a VPN tunnel from site to site with a router of 2621 running Advanced IP services. The tunnel keeps do not and I don't know why. Below is the config.

  !
  hostname SeCuReWaLL
  domain default.domain.invalid
  activate 2KFQnbNIdI.2KYOU encrypted password
  2KFQnbNIdI.2KYOU encrypted passwd
  names of
  name 192.168.2.0 outside
  name 192.168.3.0 inside
  !
  interface Vlan1
  Description of network links extended to outside of the
  nameif outside
  security-level 0
  192.168.2.101 IP address 255.255.255.0
  !
  interface Vlan2
  Description within a private network
  nameif inside
  security-level 100
  address 192.168.3.1 IP 255.255.255.0
  !
  interface Ethernet0/0
  !
  interface Ethernet0/1
  switchport access vlan 2
  !
  interface Ethernet0/2
  Shutdown
  !
  interface Ethernet0/3
  Shutdown
  !
  interface Ethernet0/4
  Shutdown
  !
  interface Ethernet0/5
  Shutdown
  !
  interface Ethernet0/6
  Shutdown
  !
  interface Ethernet0/7
  Shutdown
  !
  boot system Disk0: / asa822 - k8.bin
  passive FTP mode
  DNS server-group DefaultDNS
  domain default.domain.invalid
  allow inside_access_in to access extended list ip inside outside 255.255.255.0 255.255.255.0
  outside_access_in list extended access permit icmp any any echo response
  site_router to access extended list ip inside 255.255.255.0 allow 192.168.5.0 255.255.255.0
  pager lines 24
  Outside 1500 MTU
  Within 1500 MTU
  ICMP unreachable rate-limit 1 burst-size 1
  ASDM image disk0: / asdm - 625.bin
  don't allow no asdm history
  ARP timeout 14400
  Global 1 interface (outside)
  NAT (inside) 0-list of access site_router
  NAT (inside) 1 inside 255.255.255.0
  Access-group outside_access_in in interface outside
  Route outside 0.0.0.0 0.0.0.0 192.168.2.1 1
  Outdoor 192.168.5.0 255.255.255.0 192.168.2.107 1
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  dynamic-access-policy-registration DfltAccessPolicy
  Enable http server
  HTTP inside 255.255.255.0 inside
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown cold start
  Crypto ipsec transform-set esp-3des esp-sha-hmac secure_set
  life crypto ipsec security association seconds 28800
  Crypto ipsec kilobytes of life - safety 4608000 association
  peer set card crypto ipsec_map 10 192.168.2.107
  card crypto ipsec_map 10 transform-set secure_set
  ipsec_map interface card crypto outside
  crypto ISAKMP allow outside
  crypto ISAKMP policy 10
  preshared authentication
  3des encryption
  md5 hash
  Group 5
  lifetime 28800
  Telnet timeout 5
  SSH timeout 5
  Console timeout 0
  dhcpd dns 192.168.2.1
  !
  dhcpd address 192.168.3.10 - 192.168.3.40 inside
  dhcpd allow inside
  !

  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  WebVPN
  username admin privilege 15 encrypted password f3UhLvUj1QsXsuK7
  tunnel-group 192.168.2.107 type ipsec-l2l
  IPSec-attributes tunnel-group 192.168.2.107
  pre-shared key *.
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  maximum message length automatic of customer
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the netbios
  inspect the rsh
  inspect the rtsp
  inspect the skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect the tftp
  inspect the sip
  inspect xdmcp
  Review the ip options
  !
  global service-policy global_policy
  context of prompt hostname
  call-home
  Profile of CiscoTAC-1
  no active account
  http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address
  email address of destination [email protected] / * /
  destination-mode http transport
  Subscribe to alert-group diagnosis
  Subscribe to alert-group environment
  Subscribe to alert-group monthly periodic inventory
  monthly periodicals to subscribe to alert-group configuration
  daily periodic subscribe to alert-group telemetry
  Cryptochecksum:a6ffc4e9572dbee8e526c3013a96a510
  : end

  !
  InternetRouter hostname
  !
  boot-start-marker
  boot-end-marker
  !
  !
  No aaa new-model
  no location network-clock-participate 1
  No network-clock-participate wic 0
  IP cef
  !
  !
  !
  !
  no ip domain search
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  crypto ISAKMP policy 10
  BA 3des
  md5 hash
  preshared authentication
  Group 5
  lifetime 28800
  key cisco address 192.168.2.101 crypto ISAKMP xauth No.
  !
  !
  Crypto ipsec transform-set esp-3des secure_set
  !
  ipsec_map 10 ipsec-isakmp crypto map
  defined peer 192.168.2.101
  Set transform-set secure_set
  match the address router_site
  !
  !
  !
  !
  interface Loopback0
  192.168.5.1 IP address 255.255.255.0
  !
  interface FastEthernet0/0
  IP 192.168.2.107 255.255.255.0
  automatic duplex
  automatic speed
  ipsec_map card crypto
  !
  interface Serial0/0
  no ip address
  Shutdown
  !
  interface FastEthernet0/1
  no ip address
  Shutdown
  automatic duplex
  automatic speed
  !
  interface Serial0/1
  no ip address
  Shutdown
  !
  IP route 192.168.3.0 255.255.255.0 192.168.2.101
  !
  !
  IP http server
  no ip http secure server
  !
  router_site extended IP access list
  ip licensing 192.168.5.0 0.0.0.255 192.168.3.0 0.0.0.255
  !
  !
  !
  !
  control plan
  !
  !
  !
  Voice-port 1/0/0
  !
  Voice-port 1/0/1
  !
  Voice-port 1/1/0
  !
  Voice-port 1/1/1
  !
  !
  !
  !
  !
  !
  !
  !
  Line con 0
  exec-timeout 0 0
  Synchronous recording
  line to 0
  line vty 0 4
  opening of session
  !
  !
  end

  InternetRouter #debug isakmp crypto
  Crypto ISAKMP debug is on
  InternetRouter #ping
  Protocol [ip]:
  Target IP address: 192.168.3.10
  Number of repetitions [5]:
  Size of datagram [100]:
  Timeout in seconds [2]:
  Extended commands [n]: y
  Address source or interface: 192.168.5.1
  Type of service [0]:
  Set the DF bit in the IP header? [None]:
  Validate the response data? [None]:
  Data model [0xABCD]:
  In bulk, Strict, Record, Timestamp, Verbose [no]:
  Scan the range of sizes [n]:
  Type to abort escape sequence.
  Send 5, echoes ICMP 100 bytes to 192.168.3.10, time-out is 2 seconds:
  Packet sent with the address source 192.168.5.1

  * 01:49:47.699 Mar 1: ISAKMP: ke received message (1/1)
  * 01:49:47.699 Mar 1: ISAKMP: (0:0:N / A:0): THE application profile is (NULL)
  * 01:49:47.699 Mar 1: ISAKMP: created a struct peer 192.168.2.101, peer port 500
  * 01:49:47.699 Mar 1: ISAKMP: new created position = 0x8553C778 peer_handle = 0 x 80000013
  * 01:49:47.699 Mar 1: ISAKMP: lock struct 0x8553C778, refcount IKE peer 1 for isakmp_initiator
  * 01:49:47.699 Mar 1: ISAKMP: 500 local port, remote port 500
  * 01:49:47.699 Mar 1: ISAKMP: set new node 0 to QM_IDLE
  * 01:49:47.703 Mar 1: insert his with his 84074CC8 = success
  * 01:49:47.703 Mar 1: ISAKMP: (0:0:N / A:0): cannot start aggressive mode, try the main mode.
  * 01:49:47.703 Mar 1: ISAKMP: (0:0:N / A:0): found peer pre-shared key matching 192.168.2.101
  * 01:49:47.703 Mar 1: ISAKMP: (0:0:N / A:0): built the seller-07 ID NAT - t
  * 01:49:47.703 Mar 1: ISAKMP: (0:0:N / A:0): built of NAT - T of the seller-03 ID
  * 01:49:47.703 Mar 1: ISAKMP: (0:0:N / A:0): built the seller-02 ID NAT - t
  * 01:49:47.703 Mar 1: ISAKMP: (0:0:N / A:0): entry = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
  * 01:49:47.707 Mar 1: ISAKMP: (0:0:N / A:0): former State = new State IKE_READY = IKE_I_MM1

  * 01:49:47.707 Mar 1: ISAKMP: (0:0:N / A:0): early changes of Main Mode
  * 01:49:47.707 Mar 1: ISAKMP: (0:0:N / A:0): send package to 192.168.2.101 my_port 500 peer_port 500 (I) MM_NO_STATE
  * 01:49:47.711 Mar 1: ISAKMP (0:0): packet received 192.168.2.101 dport 500 sport Global 500 (I) MM_NO_STATE
  * 01:49:47.711 Mar 1: ISAKMP: (0:0:N / A:0): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
  * 01:49:47.711 Mar 1: ISAKMP: (0:0:N / A:0): former State = new State IKE_I_MM1 = IKE_I_MM2

  * 01:49:47.715 Mar 1: ISAKMP: (0:0:N / A:0): treatment ITS payload. Message ID = 0
  * 01:49:47.715 Mar 1: ISAKMP: (0:0:N / A:0): load useful vendor id of treatment
  * 01:49:47.715 Mar 1: ISAKMP: (0:0:N / A:0): supplier code seems the unit/DPD but major incompatibilite.123
  * 01:49:47.715 Mar 1: ISAKMP: (0:0:N / A:0): provider ID is NAT - T v2
  * 01:49:47.719 Mar 1: ISAKMP: (0:0:N / A:0): load useful vendor id of treatment
  * 01:49:47.719 Mar 1: ISAKMP: (0:0:N / A:0): supplier code seems the unit/DPD but major incompatibility of 194
  * 01:49:47.719 Mar 1: ISAKMP: (0:0:N / A:0): found peer pre-shared key matching 192.168.2.101
  * 01:49:47.719 Mar 1: ISAKMP: (0:0:N / A:0): pre-shared key local found
  * 01:49:47.719 Mar 1: ISAKMP: analysis of the profiles for xauth...
  * 01:49:47.719 Mar 1: ISAKMP: (0:0:N / A:0): audit ISAKMP transform 1 against the policy of priority 10
  * 01:49:47.719 Mar 1: ISAKMP: 3DES-CBC encryption
  * 01:49:47.719 Mar 1: ISAKMP: MD5 hash
  * 01:49:47.719 Mar 1: ISAKMP: group by default 5
  * 01:49:47.719 Mar 1: ISAKMP: pre-shared key auth
  * 01:49:47.723 Mar 1: ISAKMP: type of life in seconds
  * 01:49:47.723 Mar 1: ISAKMP: life (basic) of 28800
  * 01:49:47.723 Mar 1: ISAKMP: (0:0:N / A:0): atts are acceptable. Next payload is 0
  * 1 Mar 01:49:48.119: ISAKMP:(0:1:SW:1): load useful vendor id of treatment
  * 1 Mar 01:49:48.119: ISAKMP:(0:1:SW:1): vendor ID seems the unit/DPD but major incompatibility of 123
  * 1 Mar 01:49:48.123: ISAKMP:(0:1:SW:1): vendor ID is NAT - T v2
  * 1 Mar 01:49:48.123: ISAKMP:(0:1:SW:1): load useful vendor id of treatment
  * 1 Mar 01:49:48.123: ISAKMP:(0:1:SW:1): vendor ID seems the unit/DPD but major incompatibility of 194
  * 01:49:48.123 Mar 1: ISAKMP: (0:1:SW:1): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
  * 01:49:48.123 Mar 1: ISAKMP: (0:1:SW:1): former State = new State IKE_I_MM2 = IKE_I_MM2

  * 1 Mar 01:49:48.127: ISAKMP:(0:1:SW:1): sending package to 192.168.2.101 my_port 500 peer_port 500 (I) MM_SA_SETUP
  * 01:49:48.127 Mar 1: ISAKMP: (0:1:SW:1): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
  * 01:49:.48.131 Mar 1: ISAKMP: (0:1:SW:1): former State = new State IKE_I_MM2 = IKE_I_MM3

  * 01:49:48.383 Mar 1: ISAKMP (0:134217729): packet received 192.168.2.101 dport 500 sport Global 500 (I) MM_SA_SETUP
  * 01:49:48.383 Mar 1: ISAKMP: (0:1:SW:1): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
  * 01:49:48.383 Mar 1: ISAKMP: (0:1:SW:1): former State = new State IKE_I_MM3 = IKE_I_MM4

  * 1 Mar 01:49:48.387: ISAKMP:(0:1:SW:1): processing KE payload. Message ID = 0
  * 1 Mar 01:49:48.887: ISAKMP:(0:1:SW:1): processing NONCE payload. Message ID = 0
  * 01:49:48.887 Mar 1: ISAKMP: (0:1:SW:1): found peer pre-shared key matching 192.168.2.101
  * 01:49:48.891 Mar 1: ISAKMP: (0:1:SW:1): SKEYID generated State
  * 1 Mar 01:49:48.891: ISAKMP:(0:1:SW:1): load useful vendor id of treatment
  * 1 Mar 01:49:48.891: ISAKMP:(0:1:SW:1): vendor ID is the unit
  * 1 Mar 01:49:48.891: ISAKMP:(0:1:SW:1): load useful vendor id of treatment
  * 1 Mar 01:49:48.891: ISAKMP:(0:1:SW:1): vendor ID seems the unit/DPD but major incompatibility of 145
  * 1 Mar 01:49:48.891: ISAKMP:(0:1:SW:1): vendor ID is XAUTH
  * 1 Mar 01:49:48.895: ISAKMP:(0:1:SW:1): load useful vendor id of treatment
  * 1 Mar 01:49:48.895: ISAKMP:(0:1:SW:1): speaking to another box of IOS!
  * 1 Mar 01:49:48.895: ISAKMP:(0:1:SW:1): load useful vendor id of treatment
  * 01:49:48.895 Mar 1: ISAKMP: (0:1:SW:1): supplier code seems the unit/DPD but hash mismatch
  * 01:49:48.895 Mar 1: ISAKMP: receives the payload type 20
  * 01:49:48.895 Mar 1: ISAKMP: receives the payload type 20
  * 01:49:48.895 Mar 1: ISAKMP: (0:1:SW:1): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
  * 01:49:48.899 Mar 1: ISAKMP: (0:1:SW:1): former State = new State IKE_I_MM4 = IKE_I_MM4

  * 01:49:48.899 Mar 1: ISAKMP: (0:1:SW:1): send initial contact
  * 01:49:48.899 Mar 1: ISAKMP: (0:1:SW:1): ITS been pr.e using id ID_IPV4_ADDR type shared-key authentication
  * 01:49:48.899 Mar 1: ISAKMP (0:134217729): payload ID
  next payload: 8
  type: 1
  address: 192.168.2.107
  Protocol: 17
  Port: 500
  Length: 12
  * 01:49:48.903 Mar 1: ISAKMP: (0:1:SW:1): the total payload length: 12
  * 1 Mar 01:49:48.903: ISAKMP:(0:1:SW:1): sending package to 192.168.2.101 my_port 500 peer_port 500 (I) MM_KEY_EXCH
  * 01:49:48.907 Mar 1: ISAKMP: (0:1:SW:1): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
  * 01:49:48.907 Mar 1: ISAKMP: (0:1:SW:1): former State = new State IKE_I_MM4 = IKE_I_MM5

  * 01:49:48.907 Mar 1: ISAKMP (0:134217729): packet received 192.168.2.101 dport 500 sport Global 500 (I) MM_KEY_EXCH
  * 1 Mar 01:49:48.911: ISAKMP:(0:1:SW:1): payload ID for treatment. Message ID = 0
  * 01:49:48.911 Mar 1: ISAKMP (0:134217729): payload ID
  next payload: 8
  type: 1
  address: 192.168.2.101
  Protocol: 17
  Port: 0
  Length: 12
  * 1 Mar 01:49:48.911: ISAKMP:(0:1:SW:1): peer games * no * profiles
  * 1 Mar 01:49:48.911: ISAKMP:(0:1:SW:1): HASH payload processing. Message ID = 0
  * 01:49:48.915 Mar 1: ISAKMP: received payload type 17
  * 1 Mar 01:49:48.915: ISAKMP:(0:1:SW:1): load useful vendor id of treatment
  * 1 Mar 01:49:48.915: ISAKMP:(0:1:SW:1): vendor ID is DPD
  * 01:49:48.915 Mar 1: ISAKMP: (0:1:SW:1): SA authentication status:
  authenticated
  * 01:49:48.915 Mar 1: ISAKMP: (0:1:SW:1): SA has been authenticated with 192.168.2.101
  * 01:49:48.915 Mar 1: ISAKMP: attempts to insert a 192.168.2.107/192.168.2.101/500/ peer and inserted 8553 778 successfully.
  * 01:49:48.919 Mar 1: ISAKMP: (0:1:SW:1): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
  * 01:49:48.919 Mar 1: ISAKMP: (0:1:SW:1.): O State of LD = new State IKE_I_MM5 = IKE_I_MM6

  * 01:49:48.919 Mar 1: ISAKMP: (0:1:SW:1): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
  * 01:49:48.919 Mar 1: ISAKMP: (0:1:SW:1): former State = new State IKE_I_MM6 = IKE_I_MM6

  * 01:49:48.923 Mar 1: ISAKMP: (0:1:SW:1): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
  * 01:49:48.923 Mar 1: ISAKMP: (0:1:SW:1): former State = new State IKE_I_MM6 = IKE_P1_COMPLETE

  * 01:49:48.927 Mar 1: ISAKMP: (0:1:SW:1): start Quick Mode Exchange, M - ID of 590019425
  * 1 Mar 01:49:48.931: ISAKMP:(0:1:SW:1): sending package to 192.168.2.101 my_port 500 peer_port 500 (I) QM_IDLE
  * 01:49:48.931 Mar 1: ISAKMP: (0:1:SW:1): entrance, node-590019425 = IKE_MESG_INTERNAL, IKE_INIT_QM
  * 01:49:48.931 Mar 1: ISAKMP: (0:1:SW:1): former State = new State IKE_QM_READY = IKE_QM_I_QM1
  * 01:49:48.931 Mar 1: ISAKMP: (0:1:SW:1): entry = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
  * 01:49:48.935 Mar 1: ISAKMP: (0:1:SW:1): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE

  * 01:49:48.939 Mar 1: ISAKMP (0:134217729): packet received 192.168.2.101 dport 500 sport Global 500 (I) QM_IDLE
  * 01:49:48.939 Mar 1: ISAKMP: node set 330122531 to QM_IDLE
  * 1 Mar 01:49:48.943: ISAKMP:(0:1:SW:1): HASH payload processing. Message ID = 330122531
  * 1 Mar 01:49:48.943: ISAKMP:(0:1:SW:1): treatment protocol NOTIFIER INVALID_ID_INFO 1
  0, message ID SPI = 330122531, a = 84074CC8
  * 01:49:48.943 Mar 1: ISAKMP: (0:1:SW:1): the peer is not paranoid KeepAlive.

  * 01:49:48.943 Mar 1: ISAKMP: (0:1:SW:1): remove the reason for HIS "fatal Recevied of information' State (I) QM_IDLE (ext. 192.168.2.101)
  * 01:49:48.943 Mar 1: ISAKMP: (0:1:SW:1): remove error node 330122531 FALSE reason 'informational (en) st.
  Success rate is 0% (0/5)
  InternetRouter #ate 1 "
  * 01:49:48.943 Mar 1: ISAKMP: (0:1:SW:1): entry = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY
  * 01:49:48.947 Mar 1: ISAKMP: (0:1:SW:1): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE

  * 01:49:48.947 Mar 1: ISAKMP (0:134217729): packet received 192.168.2.101 dport 500 sport Global 500 (I) QM_IDLE
  * 01:49:48.951 Mar 1: ISAKMP: node set-412204705 to QM_IDLE
  * 1 Mar 01:49:48.951: ISAKMP:(0:1:SW:1): sending package to 192.168.2.101 my_port 500 peer_port 500 (I) QM_IDLE
  * 01:49:48.951 Mar 1: ISAKMP: (0:1:SW:1): purge the node-412204705
  * 01:49:48.955 Mar 1: ISAKMP: (0:1:SW:1): entry = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
  * 01:49:48.955 Mar 1: ISAKMP: (0:1:SW:1): former State = new State IKE_P1_COMPLETE = IKE_DEST_SA

  * 01:49:48.955 Mar 1: ISAKMP: (0:1:SW:1): removal of HIS State "No reason" why (I) QM_IDLE (ext. 192.168.2.101)
  * 01:49:48.955 Mar 1: ISAKMP: Unlocking IKE struct 0x8553C778 for isadb_mark_sa_deleted(), count 0
  * 01:49:48.959 Mar 1: ISAKMP: delete peer node by peer_reap for 192.168.2.101: 8553 778
  * 01:49:48.959 Mar 1: ISAKMP: (0:1:SW:1): error in node-590019425 FALSE reason for deletion "deleted IKE."
  * 01:49:48.959 Mar 1: ISAKMP: (0:1:SW:1): node error 330122531 FALSE reason for deletion "removed IKE."
  * 01:49:48.959 Mar 1: ISAKMP: (0:1:SW:1): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
  * 01:49:48.959 Mar 1: ISAKMP: (0:1:SW:1): former State = new State IKE_DEST_SA = IKE_DEST_SA

  Hello

  I gave a quick scan here for the configuration on both devices, found two or three commands are missing from the configuration of the ASA

  ASA
  ---

  card crypto ipsec_map 10 correspondence address site_router

  outside_access_in list extended access udp allowed any any eq 500
  outside_access_in list extended access udp allowed any any eq 4500
  outside_access_in list extended access allow esp a whole

  I'm assuming pre shared key defined on ASA cisco is the same on router

  On router
  ---------

  Try running the following commands: -.

  No crypto ipsec transform-set esp-3des secure_set
  Crypto ipsec transform-set esp-3des esp-sha-hmac secure_set

  At the time of the opening of the tunnel, please gather at the debug crypto isa 127 output and debug crypto ipsec 127 of ASA

  You can also check the configuration below document link

  http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a00805e8c80.shtml

  Ignore the map route on router configuration contained in the above document *.

  HTH...

  Kind regards
  Mohit

• Connectivity on the VPN tunnel problem.

  Hello

  I have a site to tunnel between the PIX506 and Cisco VPN 3000 Concentrator. I'll be spending it again ASA5510, so the tunnel will be established between the ASA and PIX. After inistial tests, I found only one box of remote network (time clock lol) is down by connectivity while tunnel between Pix and ASA (works fine with the hub). All traffic is allowed through the VPN tunnel built on SAA is? I understand it should be as long as the tunnel is running, correct? (Note: the remote clock uses ports TCP 8888 and 8889 to communicate with the server)

  Thank you

  If there is no filter, again all traffic should be allowed.

  You need not choose L2TP connection is pure IPsec.

  If you wish, you can post your configurations to check them out (you can remove sensitive information)

  Federico.

• Help with a VPN tunnel between ASA 5510 and Juniper SSG20

  Hello

  We have a customer wanting to configure a VPN Site to Site tunnel between a new purchased 5510 of ASA located in his direction with its Juniper SSG20 Office, located in the main office. We contacted HP and they send us a Cisco professional to do the job.

  After 2 days from 16:00 to 22:00 and error and countless hours of research online and nunerous calls, we are still unable to get traffic from the network of agencies to enter the tunnel.

  Main branch
  1.1.1.2                                 1.1.1.1
  -----                                               -----------
  192.168.8.0/24 | ASA|-----------------------------------| Juniper |    192.168.1.0/24
  -----                                               -----------
  192.168.8.254 192.168.1.254

  According to Cisco professionals, the tunnel is now in place but no traffic through. We are unable to ping anything on the network on the other side (192.168.1.0/24). We receive timeout ping all the time. The Cisco professional told us it's a routing or NAT problem and he's working on a solution!

  Through research, I came across a post on Experts-Exchange (here) [the 1st comment on the original post] which States "...". that both sides of the VPN must have a different class of LAN for the VPN to work... " Would that be our problem?

  It has become a critical issue to the point that he had to replace the Cisco ASA with a temporary Juniper SSG5 on another subnet (192.168.7.0/24) to get the tunnel upward and through traffic until the ASA VPN issue is resolved and I didn't need to say that the client is killing us!

  Help is very appreciated.

  Thank you

  1. Yes, ping package from the interface of the ASA is considered valuable traffic to the LAN of Juniper.

  SAA, need you traffic from the interface source ASA's private, because interesting to determine by crypto ACL MYLIST traffic between 192.168.8.0/24 and 192.168.1.0/24.

  You will also need to add the following configuration to be able to get the ping of the interface of the ASA:

  management-private access

  To initiate the ping of the private interface ASA:

  ping 192.168.1.254 private

  2. the default time before the next generation of new key is normally 28800 seconds, and if there is no interesting traffic flowing between 2 subnets, he'll tear the VPN tunnel down. As soon as there is interesting traffic, the VPN tunnel will be built automatically into the next generation of new key. However, if there is traffic before generating a new key, the new tunnel will be established, and VPN tunnel will remain standing and continue encrypt and decrypt traffic.

  Currently, your configuration has been defined with ITS lifetime of 3600 seconds GOLD / 4608000 kilobytes of traffic before the next generate a new key (it will be either 3600 seconds, or 4608000 kilobytes period expires first). You can certainly change it by default to 28800 seconds without configuring kilobytes. SA life is negotiated between the ASA and Juniper, and whatever is the lowest value will be used.

  Hope that helps.

• ASA to 1841 VPN Tunnel

  Hello

  I am trying to establish a VPN tunnel from site to site between 2 offices. An agency has a Cisco 1841 and the other a pair of ASA 5510. I get the tunnel to establish without problem. The problem is that traffic will the intended to the ASA 1841 will not encrypt to this particular tunnel. I get decaps on the session, but no program. I've reconfigured the tunnel several times but keep getting the same result:

  Interface: FastEthernet0/1
  The session state: UP-ACTIVE
  Peer: 202.41.148.5 port fvrf 500: (none) ivrf: (none)
  Phase1_id: 202.41.148.5
  DESC: (none)
  IKE SA: local 81.218.42.130/500 remote 202.41.148.5/500 Active
  Capabilities: (None) connid:98 life time: 23:45:02
  FLOW IPSEC: allowed ip 192.168.5.0/255.255.255.0 10.0.96.0/255.255.240.0
  Active sAs: 2, origin: card crypto
  On arrival: dec #pkts'ed 17 drop 0 life (KB/s) 4569995/2704
  Outbound: #pkts enc'ed drop 0 0 life (KB/s) 4569996/2704

  Any suggestions would be greatly appreciated.

  Andy

  Your ACL 100 is not exempt traffic 192.168.5.0-> 10.0.96.0 of the NAT process.  Please add the line below above the permit statement and test again.

  access-list 100 deny ip 192.168.5.0 0.0.0.255 10.0.96.0 0.0.15.255