PIX and ASA static, dynamic and RA VPN does not

Hello

I am facing a very interesting problem between a PIX 515 and an ASA 5510.

The PIX is in HQ and has several dynamic VPN connections (around 130) and IPsec vpn remote works very well. I had to add a PIX to ASA L2L VPN static and it does not work as it is supposed to be. The ASA 5510, at the remote end, connects and rest for a small period of time, however, all other VPN connections stop working.

The most interesting thing is that ASA is associated with the dynamic map and not the static map that I created (check by sh crypto ipsec his counterpart x.x.x.x). However, if I make any changes in the ACL 'ACL-Remote' it affects the tunnel between the PIX and ASA.

Someone saw something like that?

Here is more detailed information:

HQ - IOS 8.0 (3) - PIX 515

ASA 5510 - IOS 7.2 (3) - remote provider

Several Huawei and Cisco routers dynamically connected via ADSL

Several users remote access IPsec

A VPN site-to site static between PIX and ASA - does not.

Here is the config on the PIX:

Crypto ipsec transform-set ESP-3DES-ESP-SHA-HMAC-IPSec esp-3des esp-sha-hmac

Dyn - VPN game 100 Dynamics-card crypto transform-set ESP-3DES-ESP-SHA-HMAC-IPSec

Crypto dynamic-map Dyn - VPN 100 the value reverse-road

VPN - card 30 crypto card matches the ACL address / remote

card crypto VPN-card 30 peers set 20 x. XX. XX. XX

card crypto VPN-card 30 the transform-set ESP-3DES-ESP-SHA-HMAC-IPSec value

VPN crypto card - 100 - isakmp dynamic Dyn - VPN ipsec

interface card crypto VPN-card outside

crypto ISAKMP allow outside

crypto ISAKMP policy 10

preshared authentication

3des encryption

md5 hash

Group 2

life 86400

crypto ISAKMP policy 65535

preshared authentication

3des encryption

sha hash

Group 2

life 86400

access list ACL-remote ext ip 10.0.0.0 allow 255.255.255.0 192.168.1.0 255.255.255.0

Thank you.

Marcelo Pinheiro

The problem is that the ASA has a crypto acl defined between host and network, while the remote end has to the network.

Make sure that the acl is reversed.

Tags: Cisco Security

Similar Questions

  • VPN between a PIX and a VPN 3000

    I'm trying to set up a VPN between PIX and a VPN 3000. All configurations are complete, but the tunnel has not been established. On the PIX, to 'see the crypto engine' and ' show isakmp his ' orders, I do not see the tunnel. Of "show ipsec his ' command, I can see the mistakes"#send"continues to increase when I try to connect to the remote network. Here is the copy - paste command:

    Tag crypto map: myvpnmap, local addr. 10.70.24.2

    local ident (addr, mask, prot, port): (10.70.24.128/255.255.255.128/0/0)

    Remote ident (addr, mask, prot, port): (10.96.0.0/255.224.0.0/0/0)

    current_peer: 10.70.16.5:0

    LICENCE, flags is {origin_is_acl},

    #pkts program: encrypt 0, #pkts: 0, #pkts 0 digest

    #pkts decaps: 0, #pkts decrypt: 0, #pkts check 0

    compressed #pkts: 0, unzipped #pkts: 0

    #pkts uncompressed: 0, #pkts compr. has failed: 0, #pkts decompress failed:

    #send 12, #recv errors 0

    local crypto endpt. : 10.70.24.2, remote Start crypto. : 10.70.16.5

    Path mtu 1500, fresh ipsec generals 0, media, mtu 1500

    current outbound SPI: 0

    SAS of the esp on arrival:

    the arrival ah sas:

    SAS of the CFP on arrival:

    outgoing esp sas:

    outgoing ah sas:

    outgoing CFP sas:

    Obviously, the PIX identifies protected traffic but failed to establish the tunnel. I was wondering what could be the reason for these kind of mistakes? That means them growing '#send errors?

    Thank you very much!

    Sending error mean simply the PIX is grateful to encrypt this traffic, but there is no built tunnel and so it must drop the package.

    you will need to look at why the tunnel is not under construction however, "sending error" are just a byproduct of some other configuration issue. On the PIX, it looks like you would have something like:

    Crypto ip 10.70.24.128 access list allow 255.255.255.128 10.96.0.0 255.224.0.0

    On the 3000 under the L2L section and the Local and remote network, you need the exact opposite of the latter, then it would be:

    / Local network mask = 10.96.0.0/0.31.255.255

    / Remote network mask = 10.70.24.128/0.0.0.127

    If you have something else the tunnel will fail to come. Otherwise, we see that the Cryptography debugs the PIX and the trunk of the 3000 when the tunnel is built.

  • After the upgrade yesterday from Vista to Windows 7, now my Cisco VPN does not work and I get an error message titled: grounds 440 driver fault. Any ideas to fix this?

    After the upgrade yesterday from Vista to Windows 7, now my Cisco VPN does not work and I get an error message titled: grounds 440 driver fault.  Any ideas to fix this?

    This was the solution!  The works of vpn as $ 1 million now.  I followed the instructions above to enter the uninstall program and selecting the repair option.  I rebooted the machine, then used the troubleshooting on vpn software compatibility option.  Selected Windows windows xp (service pack 2) as the correct software and cisco vpn client started right up.

    Thanks, Nick!

    Rick

  • 13-inch early 2011 macbook pro. light green mag extremely shoddy security cordon, macbook pro stopped charging bought new magsafe. and the led does not illuminate or strings. SMC reset now mac does not recognize battery. unplugged

    13-inch early 2011 macbook pro. light green mag extremely shoddy security cordon, macbook pro stopped charging bought new magsafe. and the led does not illuminate or strings. SMC reset now mac does not recognize battery. disconnected the battery and security cordon mag, maintained hold button / stop for 5 seconds, nothing. Another SMC reset and it is the only way Mac powered on that she has no back light for the keyboard and the fan works on high all the time, please can someone HELP, thanks.

    This is the Office Mac Pro forum. I asked that your post be moved to the MacBook Pro laptop forum.

  • Just updated to IOS 10 and replace text does not work

    Just updated to IOS 10 and replace text does not work.  For example typing in omg should show oh my God. Has anyone else got this?

    I did the old thing: Disconnect to iCloud and sign back in. Unfortunately, he did not turn. The same thing happened on my iMac when upgrading to Mac OS Sierra - I lost all my text replacement. I also did Disconnect from iCloud and inback Panel . Unfortunately, it also didn't do the trick. Anyone know how to restore the replacement text. It is not has resided in the cloud?

  • Remote control does not work, and the load does not appear on Apple TV

    Hello

    I just returned from vacation and my remote seems has stopped working.   Naturally, my first assumption was that the charge was simply exhausted.

    Apparently that was the case.   He seems to have just died.

    I did pay for more than two hours and it still does not appear under devices Apple TV.

    My Apple TV 4 works very well because I use the remote control of my phone to navigate through it.

    If I understand correctly what I look at you, it seems that the remote control is same not synchronized or recognized by Apple TV more.

    Any suggestions on how to fix this?

    A reset is complete? Restart... no change.

    Thank you

    Bob

    1. Have you tried pressing the menu and the button for a few seconds while it now an inch or two away from the Apple TV, if successful, you should see a message on the screen saying the remote was paired.
    2. If you have an older remote from a previous model MacBook or Apple TV, you can use to restore the Apple TV, which, in many cases, has been sufficient to reactivate the remote Siri. You must complete all upward to undertake a restoration.
    3. If you have a USB cable - C you can try to restore by connecting it to iTunes on a computer.
    4. If you have tried all of these steps, don't have a distance sooner or a USB - C cable or their use is too inconvenient, return it to the store where purchased for a replacement, or to couple for you.
  • I can't log in to my account to Mozilla, and Password Reset does not work.

    I have an account to create themes and Mozilla Add-ons, but now it seems inactive,
    and password reset does not work. Here is one of my themes:
    https://addons.Mozilla.org/en-us/Firefox/addon/Fox-December/
    my email: [email protected]

    Support for the site Add - ons are here:
    https://discourse.Mozilla-community.org/c/Add-ons

  • My Inbox to view the sender for each message and now it does not work... How do I get it back to where it was?

    My Inbox to view the sender for each message and now it does not work... How do I get it back to where it was?

    Right-click on the header at the top of the list of messages and select from the list of options.

  • Fields on several Internet sites have been changed in another language. The browser is set to English, and this problem does not occur with Chrome.

    Fields on several Internet sites have been changed in another language. The browser is set to English, and this problem does not occur with Chrome. Specifically, a large part of Tumblr and Facebook menu has been changed in another language (Russian, I think). I tried reinstall Firefox, clear the cache and reset firefox to its default state. None of them helped. Any suggestions on how to fix this?

    Hey again,

    Sometimes a problem with Firefox can be a result of malware installed on your computer, you may not be aware of.

    You can try these free programs to search for malicious software that work with your existing anti-virus software:

    Microsoft Security Essentials is a good permanent antivirus for Windows 7/Vista/XP, if you do not already have one.

    More information can be found in the article troubleshooting Firefox problems caused by malware .

    I hope this helps!

    Curtis

  • The plus sign next to my tab stopped working: when I click on it nothing happens. I tried uninstalling and reinstalling and it still does not work.

    The sign + to add a new tab has suddenly stopped to work earlier. I tried uninstalling and reinstalling and it still does not work. What can happen and how to fix it?

    Hello

    The reset Firefox feature can solve a lot of problems in restaurant Firefox to its factory default condition while saving your vital information.
    Note: This will make you lose all the Extensions, open Web sites and preferences.

    To reset Firefox, perform the following steps:

    1. Go to Firefox > help > troubleshooting information.
    2. Click on the button 'Reset Firefox'.
    3. Firefox will close and reset. After Firefox is finished, it will display a window with the imported information. Click Finish.
    4. Firefox opens with all the default settings applied.

    Information can be found in the article Firefox Refresh - reset the settings and Add-ons .

    This solve your problems? Please report to us!

    Thank you.

  • As some Menu items: Modules, Help Menu and Pocket Extension does not work after update to 17.0

    As some Menu items: Modules, Help Menu and Pocket Extension does not work after update to 17.0

    This may be caused by the Tab Mix Plus extension

    Start Firefox in Safe Mode to check if one of the extensions (Firefox/tools > Modules > Extensions) or if hardware acceleration is the cause of the problem (switch to the DEFAULT theme: Firefox/tools > Modules > appearance).

    • Do not click on the reset button on the start safe mode window or make changes.

    You can try to install the latest Dev version of Tab Mix more if you use this extension.

    See the sticky on the forum of Tab Mix Plus:

  • The top of page 1 1/4 inch has no answer whin you click on it. As in this page, sign in or register and other app does not work. in English

    The top of page 1 1/4 inch has no response when you click it. As in this page, sign in or register and other app does not work. in English

    This problem can be caused by that extended the Yahoo! toolbar or extension of Babylon also well down and covers the top of the browser window and therefore links and buttons in this part of the screen not clickable.

    Start Firefox in Firefox to solve the issues in Safe Mode to check if one of the extensions or if hardware acceleration is the cause of the problem (switch to the DEFAULT theme: Firefox/tools > Modules > appearance/themes).

  • WiFi and apple tv does not connect for Colocation

    WiFi and apple tv does not connect for home sharing

    Please give more details about your configuration, the version of the Apple TV and software, home sharing server, etc. Others here know much more about it as I have, but they will need a clear description of the problem. You can also try to search for this site for home, sharing problems and take a look at any recent threads that you present to.

    You use the same Apple ID everywhere? ATV currently sems to have problems with Apple improved authentication protocols, so I hope they are not turned on for your Apple ID. You have enabled sharing House in configuration of the ATV?

  • Satellite M70 - 181 - slider and escape key does not

    FN with F10 keys shows no reaction.
    Check all the drivers.
    But cursor and escape keys does not.
    Need help please

    Joe

    As far as I know, FN + F10 or FN + F11 active integrated keyboard and cursor control keys.

    Satellite M70 is a fairly old machine and I do not remember which driver may be responsible for this control. Try to reinstall the Toshiba Accessibility or FN-esse utility. Maybe this will help.

    I had M70 long ago, but I've never used this option.

  • Satego P100-10F: Windows XP Lan, usb slots and the sound does not work

    Hello

    I have problems with windows vista, so I checked the forum to get information on the windows xp installation.

    I downloaded the drivers windows xp since the P100 Satellite (pspa6e), my only problem is that the LAN, usb slots and my sound does not work.

    I hope someone has a good idea for drivers or to install another driver I have sound and LAN on windows xp.

    Ty and Greetz

    See European driver of Toshiba.
    Here, you can try to install several drivers of different portable Satellite P100.
    Try all series.
    Fact is that some units of the Satellite P100 and Satego P100 series were delivered with the same features.
    Therefore, it should be possible to use the unique drivers of these series.
    Check all.

Maybe you are looking for

  • You can download additional content on a hard drive external?

    I have Logic Pro X 10.0.0 and I want to download any additional content. Unfortunately, I don't have enough space on my laptop. Is there a way to download additional content on an external hard drive?

  • Order to internal model with cRIO, synchronization of time loop

    Hello I work with control design Simulation & toolkit and I want to implement an internal model control to a real-time target. I want to implement my simulation (as an attachment) to the real target (cRIO-9024 OR cRIO-9112). I removed the transfer fu

  • What is happening with my version of Windows?

    Sometimes, when I log in, the start bar is unclickable. You must press the windows key or the ALT key to be able to click on the start bar or even no icons. In addition on photoshop, now I can't even open a document/picture unless I go to its locatio

  • Acer Aspire E3 - 112 Touchpad drivers for Windows 7

    I recently bought an Acer Aspire E3-112 which although provided with a previous installation of Windows 8.1, I am running Windows 7. The Touchpad works, but the functions of the gesture and scrolling does not. There are drivers out there for Windows

  • meaning of Windows Blue error screen

    Hello community, Please I need help in getting my pc to work properly as it should. A few days ago my pc started to turn on, and it was scary because I was reading on some secret services of the nation State. but I got an error that I could record bl