Problem of process ISAKMP Tunnel VPN

Similar Questions

• tunnel VPN ZFW problem

  Recently I tried to build a tunnel VPN of LAN LAN 2 connecting an Asa to a current zone based firewall 2911. It's a standard IPSec psk tunnel nothing complicated. I got the tunnel to establish, but I could only get traffic to encap on the side of the SAA and decap on the side of 2911. I couldn't return circulation. I followed this doc classic here for IPSec in the last example.

  http://www.Cisco.com/en/us/prod/collateral/vpndevc/ps5708/ps5710/ps1018/...

  And I don't know that the SAA is right I have built a ton of those but I am new to zfw. I don't see anything about a NAT rule exempt. But as all used real IPs instead of NAT I wasn't sure and I have found no info. I do free NAT? If If you are using a roadmap on the end you NAT overload line config as in the past?

  I also have a pair of area to "self" and I didn't know if I need something there to be able to do a ping from inside the 2911 interface when the tunnel is at the top of the remote end. Thank you

  Is the pair area yourself, outside of itself?

  And you say that you do not use only NAT, have real addresses (public routable addresses?), so why you have to make an exception for NAT you have not?

• Tunnel VPN from Site to Site dynamic

  I spent the last 2 days, try to set up a dynamic tunnel VPN site to site of a Cisco 5510 to a Cisco SA540. The 540 is a dynamic supplier that can not be changed. There a dyndns account.

  I was lucky that the other 10 sites are all static and the ADSM Assistant creates these tunnels without problems.

  What I try to do is:

  Is it possible to do it VIA ADSM?

  If this isn't the case, someone please in detail can help with orders.

  Kind regards

  PP

  Hello Paul,

  This is possible thanks to the ASDM, but you do have to use some advanced settings:

  Configuration > VPN Site to Site > advanced > Tunnel groups

  It change the group called "DefaultL2LGroup" and add the brightness button before the SA540 (Note: all of your sites with dynamic IP addresses will have the same key communicated in advance, if you have IPSec VPN clients, it will be a good idea to use a different key).

  

  Click ok and then apply.

  Then go to Configuration > VPN Site to Site > advanced > Crypto Maps and add a new entry dynamic

  

  Make sure that you match the phase 2 are on your SA540 (pictured ESP-AES-128-SHA), select a dynamic strategy and make the last sequence number (65535) then ok, apply.

  Then go to Configuration > VPN Site to Site > advanced > IKE policies and make sure you have corresponding policies of the phase 1.

  

  If no corresponding policy is found, add them.

  Through CLI:

  IKEv1 crypto policy 1

  preshared authentication

  aes encryption

  sha hash

  Group 2

  Crypto-map dynamic outside_dyn_map 65535 set transform-set ESP-AES-128-SHA ikev1

  CARD crypto ipsec-isakmp 65535 dynamic outside_dyn_map

  IPSec-attributes tunnel-group DefaultL2LGroup

  IKEv1 pre-shared-key *.

  I hope this helps.

• Tunnel VPN site to Site with 2 routers Cisco 1921

  Hi all

  So OK, I'm stumped. I create much s2s vpn tunnels before, but this one I just can't go there. It's just a tunnel VPN Site to Site simple using pre-shared keys. I would appreciate it if someone could take a look at our configs for both routers running and provide a comment. This is the configuration for both routers running. Thank you!

  Router 1

  =======

  Current configuration: 4009 bytes

  !

  ! Last configuration change at 19:01:31 UTC Wednesday, February 22, 2012 by asiuser

  !

  version 15.0

  horodateurs service debug datetime msec

  Log service timestamps datetime msec

  no password encryption service

  !

  SJWHS-RTRSJ host name

  !

  boot-start-marker

  boot-end-marker

  !

  !

  No aaa new-model

  !

  !

  !

  !

  No ipv6 cef

  IP source-route

  IP cef

  !

  !

  DHCP excluded-address 192.168.200.1 IP 192.168.200.110

  DHCP excluded-address IP 192.168.200.200 192.168.200.255

  !

  IP dhcp POOL SJWHS pool

  network 192.168.200.0 255.255.255.0

  default router 192.168.200.1

  10.10.2.1 DNS server 10.10.2.2

  !

  !

  no ip domain search

  IP-name 10.10.2.1 Server

  IP-name 10.10.2.2 Server

  !

  Authenticated MultiLink bundle-name Panel

  !

  !

  Crypto pki trustpoint TP-self-signed-236038042

  enrollment selfsigned

  name of the object cn = IOS - Self - signed - certificate - 236038042

  revocation checking no

  rsakeypair TP-self-signed-236038042

  !

  !

  TP-self-signed-236038042 crypto pki certificate chain

  certificate self-signed 01

  30820241 308201AA A0030201 02020101 300 D 0609 2A 864886 F70D0101 04050030

  8B1E638A EC

  quit smoking

  license udi pid xxxxxxxxxx sn CISCO1921/K9

  !

  !

  !

  redundancy

  !

  !

  !

  !

  crypto ISAKMP policy 10

  md5 hash

  preshared authentication

  ISAKMP crypto key presharedkey address 112.221.44.18

  !

  !

  Crypto ipsec transform-set esp-3des esp-md5-hmac IPSecTransformSet1

  !

  map CryptoMap1 10 ipsec-isakmp crypto

  defined by peer 112.221.44.18

  game of transformation-IPSecTransformSet1

  match address 100

  !

  !

  !

  !

  !

  interface GigabitEthernet0/0

  192.168.200.1 IP address 255.255.255.0

  automatic duplex

  automatic speed

  !

  !

  interface GigabitEthernet0/1

  Description wireless bridge

  IP 172.17.1.2 255.255.255.0

  automatic duplex

  automatic speed

  !

  !

  interface FastEthernet0/0/0

  Verizon DSL description for failover of VPN

  IP 171.108.63.159 255.255.255.0

  automatic duplex

  automatic speed

  card crypto CryptoMap1

  !

  !

  !

  Router eigrp 88

  network 172.17.1.0 0.0.0.255

  network 192.168.200.0

  redistribute static

  passive-interface GigabitEthernet0/0

  passive-interface FastEthernet0/0/0

  !

  IP forward-Protocol ND

  !

  no ip address of the http server

  local IP http authentication

  IP http secure server

  !

  IP route 0.0.0.0 0.0.0.0 172.17.1.1

  IP route 112.221.44.18 255.255.255.255 171.108.63.1

  !

  access-list 100 permit ip 192.168.200.0 0.0.0.255 10.10.0.0 0.0.255.255

  !

  !

  !

  !

  !

  !

  control plan

  !

  !

  !

  Line con 0

  Synchronous recording

  local connection

  line to 0

  line vty 0 4

  exec-timeout 30 0

  Synchronous recording

  local connection

  transport input telnet ssh

  !

  Scheduler allocate 20000 1000

  end

  =======

  Router 2

  =======

  Current configuration: 3719 bytes

  !

  ! Last configuration change at 18:52:54 UTC Wednesday, February 22, 2012 by asiuser

  !

  version 15.0

  horodateurs service debug datetime msec

  Log service timestamps datetime msec

  no password encryption service

  !

  SJWHS-RTRHQ host name

  !

  boot-start-marker

  boot-end-marker

  !

  logging buffered 1000000

  !

  No aaa new-model

  !

  !

  !

  !

  No ipv6 cef

  IP source-route

  IP cef

  !

  !

  !

  !

  no ip domain search

  !

  Authenticated MultiLink bundle-name Panel

  !

  !

  Crypto pki trustpoint TP-self-signed-3490164941

  enrollment selfsigned

  name of the object cn = IOS - Self - signed - certificate - 3490164941

  revocation checking no

  rsakeypair TP-self-signed-3490164941

  !

  !

  TP-self-signed-3490164941 crypto pki certificate chain

  certificate self-signed 01

  30820243 308201AC A0030201 02020101 300 D 0609 2A 864886 F70D0101 04050030

  2 060355 04031326 494F532D 53656 C 66 2 AND 536967 6E65642D 43657274 31312F30

  EA1455E2 F061AA

  quit smoking

  license udi pid xxxxxxxxxx sn CISCO1921/K9

  !

  !

  !

  redundancy

  !

  !

  !

  !

  crypto ISAKMP policy 10

  md5 hash

  preshared authentication

  ISAKMP crypto key presharedkey address 171.108.63.159

  !

  86400 seconds, duration of life crypto ipsec security association

  !

  Crypto ipsec transform-set esp-3des esp-md5-hmac IPSecTransformSet1

  !

  map CryptoMap1 10 ipsec-isakmp crypto

  defined by peer 171.108.63.159

  game of transformation-IPSecTransformSet1

  match address 100

  !

  !

  !

  !

  !

  interface GigabitEthernet0/0

  no ip address

  automatic duplex

  automatic speed

  !

  !

  interface GigabitEthernet0/0.1

  encapsulation dot1Q 1 native

  IP 10.10.1.6 255.255.0.0

  !

  interface GigabitEthernet0/1

  IP 172.17.1.1 255.255.255.0

  automatic duplex

  automatic speed

  !

  !

  interface FastEthernet0/0/0

  IP 112.221.44.18 255.255.255.248

  automatic duplex

  automatic speed

  card crypto CryptoMap1

  !

  !

  !

  Router eigrp 88

  Network 10.10.0.0 0.0.255.255

  network 172.17.1.0 0.0.0.255

  redistribute static

  passive-interface GigabitEthernet0/0

  passive-interface GigabitEthernet0/0.1

  !

  IP forward-Protocol ND

  !

  no ip address of the http server

  local IP http authentication

  IP http secure server

  !

  IP route 0.0.0.0 0.0.0.0 112.221.44.17

  !

  access-list 100 permit ip 10.10.0.0 0.0.255.255 192.168.200.0 0.0.0.255

  !

  !

  !

  !

  !

  !

  control plan

  !

  !

  !

  Line con 0

  Synchronous recording

  local connection

  line to 0

  line vty 0 4

  exec-timeout 30 0

  Synchronous recording

  local connection

  transport input telnet ssh

  !

  Scheduler allocate 20000 1000

  end

  When the GRE tunnel carries your traffic to private ip range, your ACL must contain address of the host of point to point the IPSec tunnel.

  Since then, both routers are running EIGRP in the corporate network, let the EIGRP Exchange routes via GRE tunnel, which is a good practice, rather than push the ip ranges private individual through the IPSec tunnel.

  Let me know, if that's what you want.

  Thank you

• AnyConnect vpn and a tunnel vpn Firewall even outside of the interface.

  I have a (no connection) remote access vpn and ipsec tunnel connection to return to our supplier is on the same firewall outside interface.

  The problem is when users remote vpn in they are not able to ping or join the provider above the tunnel network.

  now, I understand that this is a Bobby pin hair or u turn due to traffic but I'm still not able to understand how the remote vpn users can reach the network of the provider on the tunnel that ends on the same interface where remote access vpn is also configured.

  The firewall is asa 5510 worm 9.1

  Any suggestions please.

  Hello

  You are on the right track. Turning U will be required to allow vpn clients access to resources in the L2L VPN tunnel.

  The essence is that the split tunneling to access list must include subnets of the remote VPN to peer once the user connects they have directions pertaining to remote resources on anyconnect VPN

  Please go through this post and it will guide you how to set up the u turn on the SAA.
  https://supportforums.Cisco.com/document/52701/u-turninghairpinning-ASA

  http://www.Cisco.com/c/en/us/support/docs/security/ASA-5500-x-series-next-generation-firewalls/100918-ASA-sslvpn-00.html

  Kind regards
  Dinesh Moudgil

  PS Please rate helpful messages.

• Tunnel VPN site to Site - aggressive Mode

  I searched the community for answers to this and that you have not found quite what I was looking for (or what seems logical). I have an ASA 5510 to A site with one website VPN tunnel to a SonicWall to site B. Which works very well. I need to create a tunnel for site C to site a using a tunnel of aggressive mode. I'm not quite sure how to do this. Any suggestion would be great!

  NOTE: I have included the parts of the running configuration that seem relevant to me. If I missed something please let me know.

  ASA Version 8.2 (1)

  interface Ethernet0/0

  nameif outside

  security-level 0

  IP 1.2.3.4 255.255.255.248

  !

  10.5.2.0 IP Access-list extended site_B 255.255.255.0 allow 10.205.2.0 255.255.255.128

  access extensive list ip 10.5.2.0 site_C allow 255.255.255.0 10.205.2.128 255.255.255.128

  dynamic-access-policy-registration DfltAccessPolicy

  Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

  Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

  Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

  Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

  Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

  Crypto ipsec transform-set esp-3des esp-sha-hmac 3des-sha1

  life crypto ipsec security association seconds 28800

  Crypto ipsec kilobytes of life - safety 4608000 association

  crypto VPN 30 card matches the address site_B

  card crypto VPN 30 peer set 4.3.2.1

  crypto VPN 30 the transform-set 3des-sha1 value card

  card crypto VPN 40 corresponds to the address site_C

  card crypto VPN. 40 set peer 8.7.6.5

  crypto VPN. 40 the transform-set 3des-sha1 value card

  crypto ISAKMP allow outside

  crypto ISAKMP policy 10

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  Crypto isakmp nat-traversal 30

  crypto ISAKMP ipsec-over-tcp port 10000

  attributes of Group Policy DfltGrpPolicy

  Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn

  tunnel-group 4.3.2.1 type ipsec-l2l

  4.3.2.1 tunnel-group ipsec-attributes

  pre-shared-key *.

  tunnel-group 8.7.6.5 type ipsec-l2l

  IPSec-attributes tunnel-group 8.7.6.5

  pre-shared-key *.

  David,

  Please try this:

  clear crypto ipsec its peer site_c_IP

  clear configure VPN 40 crypto card

  card crypto VPN 10 corresponds to the address site_C

  card crypto VPN 10 set peer 8.7.6.5

  crypto VPN 10 the transform-set 3des-sha1 value card

  debug logging in buffered memory

  capture drop all circular asp type

  capture capin interface inside the match ip 10.5.2.0 255.255.255.0 10.205.2.128 255.255.255.128

  After generating the traffic and INTERNAL of the machine behind the ASA:

  view Journal | 10.205.2 Inc.

  See the fall of cap. 10.205.2 Inc.

  view Cape capin

  In case it does not work:

  (a) show the crypto classic table ASP.

  (b) details of vpn-framework for table ASP.

  (c) show cry its site_c peer ipsec

  (d) entry packet - trace within the icmp 10.5.2.15 8 0 10.205.2.130 detail

  (e) see the crypto ipsec his

  At the same time, please.

  Let me know how it goes.

  Thank you

  Portu.

  Please note all useful posts

• Impossible to access them Internert through the split tunneling VPN client.

  I divided tunnel configured on a PIX 515. The remote VPN client connects to the PIX very well and can ping hosts on the internal network, but cannot access the Internet. Am I missing something? My config as shown below.

  In addition, I don't see the routes on the VPN client via statistics (screenshot below)

  

  All opinions are appreciated.

  Rob

  --------------------------------------------------------------------------------------------------------------------------------------------------------------------------

  8.0 (3) version PIX

  !

  hostname PIX-to-250

  enable the encrypted password xxxxx

  names of

  !

  interface Ethernet0

  nameif outside

  security-level 0

  IP address x.x.x.250 255.255.255.240

  !

  interface Ethernet1

  nameif inside

  security-level 100

  IP 192.168.9.1 255.255.255.0

  !

  XXXXX encrypted passwd

  passive FTP mode

  DNS domain-lookup outside

  DNS server-group Ext_DNS

  Server name 194.72.6.57

  Server name 194.73.82.242

  the LOCAL_LAN object-group network

  object-network 192.168.9.0 255.255.255.0

  object-network 192.168.88.0 255.255.255.0

  Internet_Services tcp service object-group

  port-object eq www

  area of port-object eq

  EQ object of the https port

  port-object eq ftp

  EQ object of port 8080

  port-object eq telnet

  the WAN_Network object-group network

  object-network 192.168.200.0 255.255.255.0

  ACLOUT list extended access allowed object-group LOCAL_LAN udp any eq log field

  ACLOUT list extended access allow icmp object-group LOCAL_LAN no matter what paper

  ACLOUT list extended access permitted tcp object-group LOCAL_LAN connect to any object-group Internet_Services

  access-list extended ACLIN all permit icmp any what newspaper echo-reply

  access-list extended ACLIN all permit icmp any how inaccessible journal

  access-list extended ACLIN allowed icmp no matter what newspaper has exceeded the time

  Comment by split_tunnel_list-LAN Local access list

  split_tunnel_list list standard access allowed 192.168.9.0 255.255.255.0

  access-list extended SHEEP allowed object-group ip LOCAL_LAN 192.168.100.0 255.255.255.0

  pager lines 24

  Enable logging

  Outside 1500 MTU

  Within 1500 MTU

  IP local pool testvpn 192.168.100.1 - 192.168.100.99

  no failover

  ICMP unreachable rate-limit 1 burst-size 1

  don't allow no asdm history

  ARP timeout 14400

  Global 1 interface (outside)

  NAT (inside) 0 access-list SHEEP

  NAT (inside) 1 0.0.0.0 0.0.0.0

  Access-group ACLIN in interface outside

  ACLOUT access to the interface inside group

  Route outside 0.0.0.0 0.0.0.0 195.171.252.45 1

  Route inside 192.168.88.0 255.255.255.0 192.168.88.254 1

  Route inside 192.168.199.0 255.255.255.0 192.168.199.254 1

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout, uauth 0:05:00 absolute

  dynamic-access-policy-registration DfltAccessPolicy

  Enable http server

  No snmp server location

  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown cold start

  Crypto ipsec transform-set esp-3des esp-sha-hmac Set_1

  Crypto-map dynamic outside_dyn_map 10 game of transformation-Set_1

  life together - the association of security crypto dynamic-map outside_dyn_map 10 seconds 280000

  Crypto-map dynamic outside_dyn_map 10 the value reverse-road

  outside_map 10 card crypto ipsec-isakmp dynamic outside_dyn_map

  outside_map interface card crypto outside

  crypto ISAKMP allow outside

  crypto ISAKMP policy 1

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 43200

  crypto ISAKMP policy 65535

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  Telnet timeout 5

  SSH timeout 5

  Console timeout 0

  a basic threat threat detection

  Statistics-list of access threat detection

  internal testvpn group policy

  attributes of the strategy of group testvpn

  Protocol-tunnel-VPN IPSec

  Split-tunnel-policy tunnelspecified

  name of user testuser encrypted password xxxxxx

  type tunnel-group testvpn remote access

  tunnel-group testvpn General-attributes

  address testvpn pool

  Group Policy - by default-testvpn

  testvpn group of tunnel ipsec-attributes

  pre-shared-key *.

  !

  class-map inspection_default

  match default-inspection-traffic

  !

  !

  type of policy-card inspect dns preset_dns_map

  parameters

  message-length maximum 512

  Policy-map global_policy

  class inspection_default

  inspect the preset_dns_map dns

  inspect the ftp

  inspect h323 h225

  inspect the h323 ras

  inspect the netbios

  inspect the rsh

  inspect the rtsp

  inspect the skinny

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect the tftp

  inspect the sip

  inspect xdmcp

  inspect the icmp

  !

  global service-policy global_policy

  context of prompt hostname

  Cryptochecksum:5dcb5dcdff277e1765a9a0c366b88b9e

  : end

  # 250 A - PIX

  You have not assigned the ACL split tunnel to your strategy.

  PLS, configure the following:

  attributes of the strategy of group testvpn

  value of Split-tunnel-network-list split_tunnel_list

• Tunnel VPN and NAT

  Hello. I'm creating a tunnel VPN IPSec LAN - to - LAN of my ASA5510 to another network but met an obstacle bit. My counterpart on the other side has informed me that he already has a VPN tunnel to another company that has the same IP range as my network(10.100.16.0 /24) and can not create the tunnel.

  I was wondering is it possible to use NAT on the VPN tunnel so that traffic that goes from my network over the VPN tunnel gets translated and my counterpart on the other side sees this reflects the range of IP addresses?

  Thanks in advance for any help.

  Hello

  Yes, you can use the same address you already use for internet access.

  Just update your list of access crypto to reflect the new address and to ensure that the third party did the same.

  Jon

• Tunnel VPN RV-042 for Dual WAN Failover backup function

  We have customers with dual WAN failover scenarios with site-to-site VPN tunnels.

  In the past, the VPN tunnel backup feature has been available in the RV-082.

  One of the new RV-042 firmware versions have the function of backup Tunnel VPN available?

  The feature is supported on the RV042 V3 hardware.

• Bring up the tunnel vpn crypto without interesting traffic map

  Is it possible on ASA to bring up the tunnel vpn site to site static crypto map without generating interesting traffic? I want to reverse route injection generate road dynamic until traffic begins to flow.

  Roman,

  Unless something chnaged recently RRI inserts routes without present SAs, meaning that they are static (in contrast to current default behavior on IOS 12.4 (9) T-I_think leave).

  But to answer the question, in more recent versions, you can bring up the tunnel using packet - trace CLI.

  M.

  Edit: request for improvement that will present the same features of IPP on ASA as on IOS:

  http://Tools.Cisco.com/support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId= CSCsx67450

• Can anyone help me how I will work with tunnel VPN Failover.

  Hi Experts,

  I have two 5520 ASA one headquarters and another is disaster recovery.  So I need to build the tunnel of the Branch Office Chief at the office that I have 3g router.

  So I need to build failover to ASA of recovery after a disaster. Please can someone help me what would be the best option that makes my task complete.

  Thank you

  Mohammed

  Hello

  I guess you are looking for a relief tunnel VPN router. Here's how you set it up:

  http://www.Cisco.com/en/us/products/sw/secursw/ps5318/products_user_guide_chapter09186a0080531f28.html#wp1002246

  I hope this helps.

  Kind regards

  Anisha

  P.S.: Please mark this thread as answered if you feel that your query is resolved. Note the useful messages.

• How to secure Tunnel VPN

  Hello

  I installed a tunnel VPN between ASA and PIX. I want to implement security on the ASA or PIX so that some remote endpoint specfic IP can access resources of tunnel. is it possible to block additional IP addresses?

  Thank you

  Amardeep

  Please read this link, you can implement VPN-filter.

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00808c9a87.shtml

  Thank you

  Ajay

• I handed my number of card for your online purchases.  However, there is problem, order processing, please contact customer care on 8000-448-1642.  But unable to reach them.  Please notify

  There was problem, order processing, please contact customer care on 8000-448-1642.  But unable to reach them.  Please notify

  Please contact support:

  Contact the customer service

  I hope this helps.

  Concerning

  Megha Rawat

• Problem with Tunnel VPN L2L between 2 ASA´s

  Hi guys,.

  I have some problems with my VPN Site to site tunnel between 2 ASA (5520/5505).

  I watched a lot of videos on youtube, but I can't find out why the tunnel does not...

  Both devices can ping eachothers WAN IP address (outside interfaces), but I don't see any traffic between the 2 sites. It seems that the tunnel is not open to everyone. When i PING from the local to the Remote LAN (which should be an interesting traffic for the tunnel...), the its IKEv1 remains empty...

  Am I missing something? I can't understand it more why same phase 1 is not engaged.

  You NAT won't. In your config file traffic is NATted initially and then does not match any more crypto ACL. You must move the rule dynamic NAT/PAT until the end of the table on two ASAs NAT:

   no nat (INSIDE,OUTSIDE) source dynamic any interface nat (INSIDE,OUTSIDE) after-auto source dynamic any interface

• With tunnel VPN ASA5505 problem

  The business needs is for a VLAN again on site to go directly back to an internet service to site B.

  Site A and B are connected by a service of WES MB 100.

  A site is a site of campus with about 25 switches. Him become VLAN on the site is for the engineer access only, so they can access their companys remote access service. This VLAN must stay back so there is very little potential of a trade-off on the live network.

  The solution that I just put in place is to place an ASA5505 as the dhcp server for him VLAN become to Site A. All clients on that VLAN become get a 192.168.100.x address. The external interface on the ASA5505 to Site A is put on the live network to allow a site VPN tunnel to be put in place between the ASA5505 and the Internet - an another ASA5505 firewall

  The Site A ASA5505 was put in place with inside and outside interfaces with the same level of security. 192.168.100.x subnet is exempt from NAT. Traffic is configured to transmit via the interfaces with the same level of security and the tunnel of L2L is coming.

  But I can not all connectivity to the internet from any host on the 192.168.100.x VLAN.

  This is made more complex because the external interfaces on both of the ASA are the corporate network...

  The default route to the Site B ASA5505 is 87.xx.xx.1, the ISP router.

  The Site B ASA5505 connects directly to the ISP router.

  Site has ASA5505

  --------------------

  access-list no. - nat extended ip 192.168.100.0 allow 255.255.255.0 any

  Access access-list ON scope ip 192.168.100.0 allow 255.255.255.0 any

  NAT (inside) - access list 0 no - nat

  Access-Group No. - nat inside interface

  Route outside 0.0.0.0 0.0.0.0 10.0.99.254 1

  Crypto ipsec transform-set AES-256 aes-256-esp esp-sha-hmac

  vpn-traffic 10 crypto card matches the address OUT access

  card crypto vpn-traffic 10 peers set ##Site B IP address #.

  card crypto vpn-traffic 10 game of transformation-AES-256

  vpn-traffic outside crypto map interface

  tunnel-group ##Site B IP address # type ipsec-l2l

  tunnel-group ##Site B IP address # ipsec - attributes

  pre-shared-key *.

  Site B ASA5505

  -------------------

  permit same-security-traffic intra-interface

  access-list no. - nat extended ip 192.168.100.0 allow 255.255.255.240 all

  outside_access_in of access allowed any ip an extended list

  Global (inside) 1 interface

  NAT (inside) - access list 0 no - nat

  NAT (outside) 1 192.168.100.0 255.255.255.0

  Access-Group No. - nat inside interface

  Access-group outside_access_in in interface outside

  Crypto ipsec transform-set AES-256 aes-256-esp esp-sha-hmac

  Crypto ipsec transform-set esp-aes-256 set1, esp-sha-hmac

  card crypto vpn-traffic 10 correspondence address wootton hall

  card crypto vpn-traffic 10 peers set ##Site an IP #.

  crypto-vpn 10 transform-set set1 traffic map

  vpn-traffic outside crypto map interface

  I spent some time on it and really need some advice form experts out there!

  Can you help me to know where I have gone wrong?

  Dan

  There are some parts of the configuration that you have published to that surprise me, such as the assignment of the default route on the inside interface. But these things are not at the heart of your problem. I agree that the core of your problem is probably the sheep access list. If I understand your needs, what you need is 192.168.100.0 is not translated by going to meets B, and is translated by going to the Internet. But your translation says access list never 192.168.100.0 since your access list as another destination:

  access-list no. - nat extended ip 192.168.100.0 allow 255.255.255.0 any

  My suggestion is to rewrite this access list and change the destination of the 'all' to be addresses behind B (LAN to B).

  HTH

  Rick