Problems of IPSEC Tunnel & Port fowarding

Hello

I have a couple of 837 routers connecting two sites using an IPSEC tunnel.

In one of the sites, I'm redirected to static NAT port to an internal IP address

That is to say.

IP nat inside source static tcp 192.168.57.100 3389 3389 Dialer0 interface

transmit to RDP from the internet to internal computer.

The user can access his computer when you use the public IP address, but if it attempts to access the other site using the internal LAN IP he can't

Any suggestions

Hello

Your config NAT 192.168.57.100 over the VPN tunnel as well. Two options for access to this IP address via VPN would be.

1.) use the IP NAT itself on the VPN tunnel working currently for you.

2.) use NAT policy so that the VPN tunnel traffic is exempt from NAT. In this case your NAT statement should look like this.

IP nat inside source static tcp 192.168.57.100 3389 3389 Dialer0 interface - card route

access-list 101 deny host ip 192.168.57.100

access-list 101 permit ip 192.168.57.100 host everything

permitted route map 10

corresponds to the IP 101

HTH

Kind regards

GE.

Tags: Cisco Security

Similar Questions

Strange problem in IPSec Tunnel - 8.4 NAT (2)

Helloo all,.

This must be the strangest question I've seen since the year last on my ASA.

I have an ASA 5540, who runs the code of 8.4 (2) without any problem until I ran into this problem last week and I spent sleepless nights with no resolution! Then, take a deep breath and here is a brief description of my setup and the problem:

A Simple IPSEC tunnel between my 8.4 (2) ASA 5540 and a Juniper SSG 140 6.3.0r9.0 (road OS based VPN) screen

The tunnel rises without any problem but the ASA refused to encrypt the traffic but it decrypts with GLORY!

Here are a few outputs debug, see the output and a package tracer output that also has an explanation of my problem of NAT WEIRD:

my setup - (I won't get into the details of encryption tunnel as my tunnel negotiations are perfect and returns from the outset when the ASA is configured as response only)

CISCO ASA - IPSec network details

LAN - 10.2.4.0/28

REMOTE NETWORK - 192.168.171.8/32

JUNIPER SSG 140 - IPSec networks details

ID OF THE PROXY:

LAN - 192.168.171.8/32

REMOTE NETWORK - 10.2.4.0/28

Name host # sh cry counterpart his ipsec

peer address:

Tag crypto map: outside_map, seq num: 5, local addr:

outside_cryptomap_4 to access extended list ip 10.2.4.0 allow 255.255.255.240 host 192.168.171.8

local ident (addr, mask, prot, port): (10.2.4.0/255.255.255.240/0/0)

Remote ident (addr, mask, prot, port): (192.168.171.8/255.255.255.255/0/0)

current_peer:

#pkts program: encrypt 0, #pkts: 0, #pkts digest: 0

#pkts decaps: 72, #pkts decrypt: 72, #pkts check: 72

compressed #pkts: 0, unzipped #pkts: 0

#pkts uncompressed: 0, comp #pkts failed: 0, #pkts Dang failed: 0

success #frag before: 0, failures before #frag: 0, #fragments created: 0

Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0

#send errors: 0, #recv errors: 0

local crypto endpt. : 0, remote Start. crypto: 0

Path mtu 1500, fresh ipsec generals 58, media, mtu 1500

current outbound SPI: 5041C19F

current inbound SPI: 0EC13558

SAS of the esp on arrival:

SPI: 0x0EC13558 (247543128)

transform: esp-3des esp-sha-hmac no compression

running parameters = {L2L, Tunnel}

slot: 0, id_conn: 22040576, crypto-card: outside_map

calendar of his: service life remaining key (s): 3232

Size IV: 8 bytes

support for replay detection: Y

Anti-replay bitmap:

0xFFFFFFFF to 0xFFFFFFFF

outgoing esp sas:

SPI: 0x5041C19F (1346486687)

transform: esp-3des esp-sha-hmac no compression

running parameters = {L2L, Tunnel}

slot: 0, id_conn: 22040576, crypto-card: outside_map

calendar of his: service life remaining key (s): 3232

Size IV: 8 bytes

support for replay detection: Y

Anti-replay bitmap:

0x00000000 0x00000001

CONTEXTS for this IPSEC VPN tunnel:

# Sh asp table det vpn context host name

VPN CTX = 0x0742E6BC

By peer IP = 192.168.171.8

Pointer = 0x78C94BF8

State = upwards

Flags = BA + ESP

ITS = 0X9C28B633

SPI = 0x5041C19D

Group = 0

Pkts = 0

Pkts bad = 0

Incorrect SPI = 0

Parody = 0

Bad crypto = 0

Redial Pkt = 0

Call redial = 0

VPN = filter

VPN CTX = 0x07430D3C

By peer IP = 192.168.1.8

Pointer = 0x78F62018

State = upwards

Flags = DECR + ESP

ITS = 0X9C286E3D

SPI = 0x9B6910C5

Group = 1

Pkts = 297

Pkts bad = 0

Incorrect SPI = 0

Parody = 0

Bad crypto = 0

Redial Pkt = 0

Call redial = 0

VPN = filter

outside_cryptomap_4 to access extended list ip 10.2.4.0 allow 255.255.255.240 host 192.168.171.8

NAT (inside, outside) static source Ren - Ren - about destination static counterpart-host peer to route non-proxy-arp-search

network of the Ren - around object

subnet 10.2.4.0 255.255.255.240

network of the host object counterpart

Home 192.168.171.8

HS cry ipsec his

IKE Peer:

Type: L2L role: answering machine

Generate a new key: no State: MM_ACTIVE

output packet tracer extracted a packet transmitted by the network of 10.2.4.0/28 to 192.168.171.8 host

Phase: 7

Type: VPN

Subtype: encrypt

Result: ALLOW

Config:

Additional information:

Direct flow from returns search rule:

ID = 0x7789d788, priority = 70, domain = encrypt, deny = false

Hits = 2, user_data is0x742e6bc, cs_id = 0x7ba38680, reverse, flags = 0 x 0 = 0 protocol

IP/ID=10.2.4.0 SRC, mask is 255.255.255.240, port = 0

IP/ID=192.168.171.8 DST, mask is 255.255.255.255, port = 0, dscp = 0 x 0

input_ifc = none, output_ifc = external

VPN settings corresponding to the encrytpion + encapsulation and the hits here increment only when I run a test of tracer from my host on the remote peer inside package.

A tracer complete package out for a packet of the 10.2.4.1 255.255.255.255 network to host 192.168.171.8:

Phase: 1

Type: ACCESS-LIST

Subtype:

Result: ALLOW

Config:

Implicit rule

Additional information:

Direct flow from returns search rule:

ID = 0x77ebd1b0, priority = 1, domain = allowed, deny = false

hits = 3037156, user_data = 0 x 0, cs_id = 0 x 0, l3_type = 0 x 8

Mac SRC = 0000.0000.0000, mask is 0000.0000.0000

DST = 0000.0000.0000 Mac, mask is 0100.0000.0000

input_ifc = output_ifc = any to inside,

Phase: 2

Type:-ROUTE SEARCH

Subtype: entry

Result: ALLOW

Config:

Additional information:

in 192.168.171.0 255.255.255.0 outside

Phase: 3

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional information:

Direct flow from returns search rule:

ID = 0x77ec1030, priority = 0, sector = inspect-ip-options, deny = true

hits = 212950, user_data = 0 x 0, cs_id = 0 x 0, reverse, flags = 0 x 0 = 0 protocol

IP/ID=0.0.0.0 SRC, mask is 0.0.0.0, port = 0

IP/ID=0.0.0.0 DST, mask is 0.0.0.0, port = 0, dscp = 0 x 0

input_ifc = output_ifc = any to inside,

Phase: 4

Type:

Subtype:

Result: ALLOW

Config:

Additional information:

Direct flow from returns search rule:

ID = 0x7c12cb18, priority = 18, area = import-export flows, deny = false

hits = 172188, user_data = 0x78b1f438, cs_id = 0 x 0, use_real_addr, flags = 0 x 0,

IP/ID=0.0.0.0 SRC, mask is 0.0.0.0, port = 0

IP/ID=0.0.0.0 DST, mask is 0.0.0.0, port = 0, dscp = 0 x 0

input_ifc = output_ifc = any to inside,

Phase: 5

Type: NAT

Subtype:

Result: ALLOW

Config:

NAT (inside, outside) static source Ren - Ren - about destination static counterpart-host peer to route non-proxy-arp-search

Additional information:

Definition of static 10.2.4.1/2700 to 10.2.4.1/2700

Direct flow from returns search rule:

ID = 0x77e0a878, priority = 6, area = nat, deny = false

hits = 9, user_data is 0x7b7360a8, cs_id = 0 x 0, use_real_addr, flags = 0 x 0, proto

IP/ID=10.2.4.1 SRC, mask is 255.255.255.240, port = 0

IP/ID=192.168.171.8 DST, mask is 255.255.255.255, port = 0, dscp = 0 x 0

input_ifc = inside, outside = output_ifc

(it's the weird NAT problem I see. I see the number of hits is increment only when I run the packet tracer understands even I have pings (traffic) the 192.168.171.8 constant welcomes the 10.2.4.1/28)-s'il please see the package I pasted after the capture section)

Phase: 6

Type: VPN

Subtype: encrypt

Result: ALLOW

Config:

Additional information:

Direct flow from returns search rule:

ID = 0x7b8751f8, priority = 70, domain = encrypt, deny = false

hits = 3, user_data = 0x7432b74, cs_id = 0x7ba38680, reverse, flags = 0 x 0, proto

IP/ID=10.2.4.1 SRC, mask is 255.255.255.240, port = 0

IP/ID=192.168.171.8 DST, mask is 255.255.255.255, port = 0, dscp = 0 x 0

input_ifc = none, output_ifc = external

Phase: 7

Type: VPN

Subtype: ipsec-tunnel-flow

Result: ALLOW

Config:

Additional information:

Reverse flow from returns search rule:

ID = 0x78b0c280, priority = 69 = ipsec-tunnel-flow area, deny = false

hits = 154, user_data is 0x7435f94, cs_id = 0 x 0, reverse, flags = 0 x 0 = 0 protocol

IP/ID=192.168.171.8 SRC, mask is 255.255.255.255, port = 0

IP/ID=10.2.4.1 DST, mask is 255.255.255.240, port = 0, dscp = 0 x 0

input_ifc = out, output_ifc = any

Phase: 8

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional information:

Reverse flow from returns search rule:

ID = 0x77e7a510, priority = 0, sector = inspect-ip-options, deny = true

hits = 184556, user_data = 0 x 0, cs_id = 0 x 0, reverse, flags = 0 x 0 = 0 protocol

IP/ID=0.0.0.0 SRC, mask is 0.0.0.0, port = 0

IP/ID=0.0.0.0 DST, mask is 0.0.0.0, port = 0, dscp = 0 x 0

input_ifc = out, output_ifc = any

Phase: 9

Type: CREATING STREAMS

Subtype:

Result: ALLOW

Config:

Additional information:

New workflow created with the 119880921 id, package sent to the next module

Information module for forward flow...

snp_fp_tracer_drop

snp_fp_inspect_ip_options

snp_fp_tcp_normalizer

snp_fp_translate

snp_fp_adjacency

snp_fp_encrypt

snp_fp_fragment

snp_ifc_stat

Information for reverse flow...

snp_fp_tracer_drop

snp_fp_inspect_ip_options

snp_fp_ipsec_tunnel_flow

snp_fp_translate

snp_fp_tcp_normalizer

snp_fp_adjacency

snp_fp_fragment

snp_ifc_stat

Result:

input interface: inside

entry status: to the top

entry-line-status: to the top

output interface: outside

the status of the output: to the top

output-line-status: to the top

Action: allow

Hostname # sh Cap A1

8 packets captured

1: 12:26:53.376033 192.168.10.252 > 10.2.4.1: icmp: echo request

2: 12:26:53.376597 10.2.4.1 > 192.168.10.252: icmp: echo reply

3: 12:26:56.487905 192.168.171.8 > 10.2.4.1: icmp: echo request

4: 12:27:01.489217 192.168.171.8 > 10.2.4.1: icmp: echo request

5: 12:27:03.378245 192.168.10.252 > 10.2.4.1: icmp: echo request

6: 12:27:03.378825 10.2.4.1 > 192.168.10.252: icmp: echo reply

7: 12:27:06.491597 192.168.171.8 > 10.2.4.1: icmp: echo request

8: 12:27:11.491856 192.168.171.8 > 10.2.4.1: icmp: echo request

8 packets shown

As you can see, there is no echo response packet at all because the package may not be wrapped while he was sent to.

I'm Karen with it. In addition, he is a firewall multi-tenant live production with no problems at all outside this for a Juniper ipsec tunnel!

Also, the 192.168.10.0/24 is another remote network of IPSec tunnel to this network of 10.2.4.0/28 and this IPSEC tunnel has a similar Juniper SSG 140 screen os 6.3.0r9.0 at the remote end and this woks like a charm with no problems, but the 171 is not be encrypted by the ASA at all.

If someone could help me, that would be greatt and greatly appreciated!

Thanks heaps. !

Perfect! Now you must find something else inside for tomorrow--> forecast rain again

Please kindly marks the message as answered while others may learn from it. Thank you.

Problem with IPSEC tunnel between Cisco PIX and Cisco ASA

Hi all!

Have a strange problem with one of our tunnel ipsec for one of our customers, we can open the tunnel of the customers of the site, but not from our site, don't understand what's wrong, if it would be a configuration problem should can we not all up the tunnel.

On our side as initiator:

Jan 14 13:53:26 172.27.1.254% PIX-7-702208: ISAKMP Phase 1 Exchange started (local 1.1.1.1 (initiator), remote 2.2.2.2)

Jan 14 13:53:26 172.27.1.254% PIX-7-702210: Exchange of ISAKMP Phase 1 is complete (local 1.1.1.1 (initiator), remote 2.2.2.2)

Jan 14 13:53:26 172.27.1.254% 6-PIX-602202: ISAKMP connected session (local 1.1.1.1 (initiator), remote 2.2.2.2)

Jan 14 13:53:26 172.27.1.254% PIX-6-602201: Phase 1 ISAKMP Security Association created (local 1.1.1.1/500 (initiator), 2.2.2.2/500 remotely, authentication = pre-action, encryption = 3DES-CBC, hash = SHA, group = 2, life = 86400 s)

Jan 14 13:53:26 172.27.1.254% PIX-7-702209: ISAKMP Phase 2 Exchange started (local 1.1.1.1 (initiator), remote 2.2.2.2)

Jan 14 13:53:26 172.27.1.254% PIX-7-702201: ISAKMP Phase 1 delete received (local 1.1.1.1 (initiator), remote 2.2.2.2)

Jan 14 13:53:26 172.27.1.254% PIX-6-602203: ISAKMP disconnected session (local 1.1.1.1 (initiator), remote 2.2.2.2)

Jan 14 13:53:56 172.27.1.254% PIX-7-702303: sa_request, CBC (MSG key in English) = 1.1.1.1, dest = 2.2.2.2, src_proxy = 172.27.1.10/255.255.255.255/0/0 (type = 1), dest_proxy = 192.168.100.18/255.255.255.255/0/0 (type = 1), Protocol is ESP transform = lifedur hmac-sha-esp, esp-3des 28800 = s and 4608000 Ko, spi = 0 x 0 (0), id_conn = 0, keysize = 0, flags = 0 x 4004

The site of the customer like an answering machine:

14 jan 11:58:23 172.27.1.254% PIX-7-702208: ISAKMP Phase 1 Exchange started (local 1.1.1.1 (answering machine), 2.2.2.2 remote)

14 jan 11:58:23 172.27.1.254% PIX-7-702210: Exchange of ISAKMP Phase 1 is complete (local 1.1.1.1 (answering machine), 2.2.2.2 remote)

14 jan 11:58:23 172.27.1.254% 6-PIX-602202: ISAKMP connected session (local 1.1.1.1 (answering machine), 2.2.2.2 remote)

14 jan 11:58:23 172.27.1.254% PIX-6-602201: Phase 1 ISAKMP Security Association created (local 1.1.1.1/500 (answering machine), distance 2.2.2.2/500, authentication = pre-action, encryption = 3DES-CBC, hash = MD5, group = 1, life = 86400 s)

14 jan 11:58:23 172.27.1.254% PIX-7-702209: ISAKMP Phase 2 Exchange started (local 1.1.1.1 (answering machine), 2.2.2.2 remote)

14 jan 11:58:23 172.27.1.254% PIX-6-602301: its created, (his) sa_dest = 2.2.2.2, sa_prot = 50, sa_spi = 0x9de820bd (2649235645) sa_trans = sa_conn_id of hmac-sha-esp, esp-3des = 116

14 jan 11:58:23 172.27.1.254% PIX-7-702211: Exchange of ISAKMP Phase 2 is complete (local 1.1.1.1 (answering machine), 2.2.2.2 remote)

Jan 14 12:28:54 172.27.1.254% PIX-6-602302: SA deletion, (his) sa_dest = 2.2.2.2, sa_prot = 50, sa_spi = 0x9de820bd (2649235645), sa_trans = esp-3desesp-sha-hmac, sa_conn_id = 116

Kind regards

Johan

From my experience when a tunnel is launched on one side, but it is not on the other hand, that the problem is with an inconsistency of the isakmp and ipsec policies, mainly as ipsec policies change sets and corresponding address with ASA platform when a tunnel is not a statically defined encryption card he sometimes use the dynamic tag to allocate this vpn connection. To check if this is the case go ahead and make a "crypto ipsec to show his" when the tunnel is active on both sides, see on the SAA if the corresponding tunnel is the static encryption card set or if it presents the dynamic encryption card.

I advise you to go to the settings on both sides and ensure that they are both in the opposite direction.

NAT in the IPSec tunnel between 2 routers x IOS (877)

Hi all

We have a customer with 2 x 877 routers connected to the internet. These routers are configured with an IPSec tunnel (which works fine). The question is the inbound static NAT translation problems with the tunnel - port 25 is mapped to the address inside the mail server. The existing configuration works very well for incoming mail, but prevents users from access to the direct mail server (using the private IP address) on port 25.

Here is the Config NAT:

nat INET_POOL netmask 255.255.255.252 IP pool

IP nat inside source map route INET_NAT pool INET_POOL overload

IP nat inside source static tcp 10.10.0.8 25 25 expandable

IP nat inside source static tcp 10.10.0.8 80 80 extensible

IP nat inside source static tcp 10.10.0.8 443 443 extensible

IP nat inside source static tcp 10.10.0.7 1433 1433 extensible

IP nat inside source static tcp 10.10.0.7 extensible 3389 3389

allowed INET_NAT 1 route map

corresponds to the IP 101

access-list 101 deny ip 10.10.0.0 0.0.0.255 192.168.1.0 0.0.0.255

access-list 101 permit ip 10.10.0.0 0.0.0.255 any

On the SAA, I would setup a NAT exemption, but how do I get the same thing in the IOS?

See you soon,.

Luke

Take a look at this link:

http://www.Cisco.com/en/us/docs/iOS/12_2t/12_2t4/feature/guide/ftnatrt.html

Concerning

Farrukh

Site to Site IPSEC tunnel (5505 at 5505) blocking certain ports?

I have problems with the traffic between two connected 5505 at 5505 sites (lan to lan) ipsec tunnel. feature of 99% of the traffic on the tunnel seems good with one exception. When a pc on Site A tries to access a mangagment base tool (java embedded) web for an IP_PBX to the site B, part of the traffic does not result in an odd error. The client pc can ping and hit port 80 to prompt the web GUI, gets invited to download java and load the java web application embedded. The java application itself (a terminal CLI to replicate if you were just Telnet to) gives an error as it cannot successfully connect to the IP_PBX. We have other sites where the ipsec tunnel is between two 2800's, and there is NO problem. The provider IP_PBX suggest that we open port 2000. Personally I'm not familiar with the ASA to uderstand why he would block only certain ports on an ipsec tunnel. I'm particularly confused because there is no NAT'ing involved in trafficking through this tunnel ipsec 5505 to 5505.

Any suggestions would be greatly appreciated,

BH

I can post configs if necessary, but thought someone might be already familiar with this issue.

Thanks again.

Ok.

What is stable with the ACL I mentioned:

test2000 list access permitted tcp/udp any host x.x.x.x eq 2000

test2000 ip access list allow a whole

Access-group interface inside test2000

The idea is to check if the ASA transfers traffic x.x.x.x on port 2000 coming out to the inside network.

If you see hitcounts on the first statement, the ASA transfers the packets and the problem is maybe with the server itelf or return circulation.

Federico.

IPSEC TUNNEL... HUB & SPOKE problem

Hi all

I am facing a problem of site to site VPN HUB-and-spoke topology.

Scenario: Deficit (2811) HUB makes Ipsec tunnel with 100 spokes (851). with a common pre shared key. About 90 tunnels are up but 10 tunnels do not come to the top. Same config there spoke an IOS in each router. DPD is enabled on the HUB site.

HUB crypto config is the same for all sites and access lists are reflected in the structure in Star...

During debugging one of the rays, I got following messages...

* 09:37:59.847 Mar 2: ISAKMP: (0): found peer pre-shared key x.x.x.x corresponding

* 2 Mar 09:37:59.847: ISAKMP: (0): built of NAT - T of the seller-rfc3947 ID

* 2 Mar 09:37:59.847: ISAKMP: (0): built the seller-07 ID NAT - t

* 2 Mar 09:37:59.847: ISAKMP: (0): built of NAT - T of the seller-03 ID

* 2 Mar 09:37:59.847: ISAKMP: (0): built the seller-02 ID NAT - t

!

!

* 2 Mar 09:37:59.887: ISAKMP: (0): package to x.x.x.x my_port 500 peer_port 500 (I) sending MM_SA_SETUP

* 09:37:59.887 Mar 2: ISAKMP: (0): sending a packet IPv4 IKE.

* 09:37:59.887 Mar 2: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE

* 09:37:59.887 Mar 2: ISAKMP: (0): former State = new State IKE_I_MM2 = IKE_I_MM3

!

* 2 Mar 09:38:01.887: ISAKMP: (0): package of phase 1 is a duplicate of a previous package.

* 2 Mar 09:38:01.887: ISAKMP: (0): retransmission due to phase 1 of retransmission

* 2 Mar 09:38:04.203: ISAKMP: (0): transmit phase 1 MM_SA_SETUP...

* 09:38:04.203 Mar 2: ISAKMP (0:0): increment the count of errors on his, try 1 5: retransmit the phase 1

! (5 attempts)

* 09:38:04.887 Mar 2: ISAKMP: (0): the peer is not paranoid KeepAlive.

* 09:38:04.887 Mar 2: ISAKMP: (0): removal of reason ITS status of 'Death by retransmission P1' (I) MM_SA_SETUP (peer x.x.x.x)

* 09:38:04.887 Mar 2: ISAKMP: (0): removal of reason ITS status of 'Death by retransmission P1' (I) MM_SA_SETUP (peer x.x.x.x)

* 09:38:04.887 Mar 2: ISAKMP: Unlocking counterpart struct 0 x 82182080 for isadb_mark_sa_deleted(), count 0

* 09:38:04.887 Mar 2: ISAKMP: delete peer node by peer_reap for x.x.x.x: 82182080

* 09:38:04.887 Mar 2: ISAKMP: (0): node-653888495 error suppression FALSE reason 'IKE deleted.

* 09:38:04.887 Mar 2: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PHASE1_DEL

* 09:38:04.887 Mar 2: ISAKMP: (0): former State = new State IKE_I_MM3 = IKE_DEST_SA

It is showng NAT - T in debugging, but there is no nating passing between the two... ??

Please share your thoughts and your conclusions on that.

Concerning

SAHKI

Hello

Yes, it helped to confirm that you are limited to 100 SA IKE. The number of DH is most of the time a construction internal, so you do not have to worry too much about it. I hope this helps.

Thank you

Wen

Problem on the establishment of a GRE/IPsec tunnel between 2 cisco routers

Hello world

I am trying to establish a GRE IPsec tunnel between two cisco routers (2620XM and a 836).

I created a tunnel interfaces on both routers as follows.

2620XM

interface Tunnel0

IP 10.1.5.2 255.255.255.252

tunnel source x.x.x.x

tunnel destination y.y.y.y

end

836

interface Tunnel0

IP 10.1.5.1 255.255.255.252

tunnel source y.y.y.y

tunnel destination x.x.x.x

end

and configuration of isakmp/ipsec as follows,

2620XM

crypto ISAKMP policy 10

md5 hash

preshared authentication

ISAKMP crypto key {keys} address y.y.y.y no.-xauth

!

!

Crypto ipsec transform-set esp - esp-md5-hmac to_melissia

!

myvpn 9 ipsec-isakmp crypto map

defined peer y.y.y.y

Set transform-set to_melissia

match address 101

2620XM-router #sh ip access list 101

Expand the access IP 101 list

10 permit host x.x.x.x y.y.y.y host will

836

crypto ISAKMP policy 10

md5 hash

preshared authentication

ISAKMP crypto key {keys} address x.x.x.x No.-xauth

!

!

Crypto ipsec transform-set esp - esp-md5-hmac to_metamorfosi

!

myvpn 10 ipsec-isakmp crypto map

defined peer x.x.x.x

Set transform-set to_metamorfosi

match address 101

836-router #sh access list 101

Expand the access IP 101 list

10 licences will host host x.x.x.x y.y.y.y

Unfortunately I had no isakmp security associations at all and when I enter the debugging to this output.

CRYPTO: IPSEC (crypto_map_check_encrypt_core): CRYPTO: removed package as currently being created cryptomap.

Any ideas why I get this result? Any help will be a great help

Thank you!!!

I think it's possible. It seems to me that you are assuming that the address of the interface where goes the card encryption is peering address. While this is the default action, it is possible to configure it differently.

As you have discovered the card encryption must be on the physical output interface. If you want the peering address to have a different value of the physical interface address outgoing, then you can add this command to your crypto card:

card crypto-address

so if you put loopback0 as the id_interface then he would use loopback0 as peering address even if the card encryption may be affected on serial0/0 or another physical interface.

HTH

Rick

Problem with IPSec GRE tunnel

Hello, I have a radio link with a branch, but the link to the provider is not approved to set up a Tunnel GRE + IPSec, but I get that this log in my router.

% CRYPTO-4-PKT_REPLAY_ERR: decrypt: re-read the verification failed

The topology is:

Router 1 C3825 IOS 12.4 (25f) Fa0/2/2 - link radio - router 2 C3825 IOS 15.1 (4) M4 Gi0/1

I get the logs into the Router 1 only.

Configurations are:

Router 1:

crypto ISAKMP policy 1

BA aes

md5 hash

preshared authentication

Group 2

ISAKMP crypto key Andina12 address 172.20.127.114

invalid-spi-recovery crypto ISAKMP

!

!

Crypto ipsec transform-set TS aes - esp esp-md5-hmac

!

Profile of crypto ipsec protected-gre

86400 seconds, life of security association set

game of transformation-TS

interface Tunnel0

Description IPSec Tunnel of GRE a Víbora

bandwidth 2000

IP 172.20.127.117 255.255.255.252

IP 1400 MTU

IP tcp adjust-mss 1360

tunnel source 172.20.127.113

tunnel destination 172.20.127.114

protection ipsec profile protected-gre tunnel

interface FastEthernet0/2/2

Description RadioEnlace a Víbora

switchport access vlan 74

bandwidth 2000

No cdp enable

interface Vlan74

bandwidth 2000

IP 172.20.127.113 255.255.255.252

Router eigrp 1

network 172.20.127.116 0.0.0.3

Router 2:

crypto ISAKMP policy 1

BA aes

md5 hash

preshared authentication

Group 2

ISAKMP crypto key Andina12 address 172.20.127.113

!

!

Crypto ipsec transform-set TS aes - esp esp-md5-hmac

!

Profile of crypto ipsec protected-gre

86400 seconds, life of security association set

game of transformation-TS

interface Tunnel0

Description IPSec Tunnel of GRE a CSZ

bandwidth 2000

IP 172.20.127.118 255.255.255.252

IP 1400 MTU

IP tcp adjust-mss 1360

tunnel source 172.20.127.114

tunnel destination 172.20.127.113

protection ipsec profile protected-gre tunnel

interface GigabitEthernet0/1

Description Radio Enlace a CSZ

bandwidth 2000

IP 172.20.127.114 255.255.255.252

automatic duplex

automatic speed

media type rj45

No cdp enable

Router eigrp 1

network 172.20.127.116 0.0.0.3

Thanks for the help.

Yes, you can have just as configured:

Crypto ipsec transform-set esp - aes TS

transport mode

Be sure to change it on both routers.

DROP in flow of the IPSec tunnel

Hello

I am trying to use a VPN, who worked on one connection ASA months on ASA9.1 (2). I've updated to ASA9.1 11 (6) and it has stopped working.

This is the remote ASA5505s making an IPSEC connection-a network head 5520. I can ride preceding and following 2 and 11 9.1 9.1 (6) and while the configuration does not change, the VPN starts working on 9.1 2

Vpn connects, but there is no packets sent or received...

I get this packet tracer...

Output of the command: "packet - trace entry tcp teeessyou 192.168.190.2 5000 192.168.195.1 detail 80.

Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit rule
Additional information:
Direct flow from returns search rule:
ID = 0xae1308e8, priority = 1, domain = allowed, deny = false
hits = 622, user_data = 0 x 0, cs_id = 0 x 0, l3_type = 0 x 8
Mac SRC = 0000.0000.0000, mask is 0000.0000.0000
DST = 0000.0000.0000 Mac, mask is 0100.0000.0000
input_ifc = teeessyou, output_ifc = any

Phase: 2
Type: UN - NAT
Subtype: static
Result: ALLOW
Config:
NAT (teeessyou, outside) static source all all static destination teeessyou_ENCODERS teeessyou_ENCODERS
Additional information:
NAT divert on exit to the outside interface
Untranslate 192.168.195.1/80 to 192.168.195.1/80

Phase: 3
Type: ACCESS-LIST
Subtype: Journal
Result: ALLOW
Config:
Access-group teeessyou_access_in in the teeessyou interface
teeessyou_access_in of access allowed any ip an extended list
Additional information:
Direct flow from returns search rule:
ID = 0xae24d310, priority = 13, area = allowed, deny = false
hits = 622, user_data is 0xab6b23c0, cs_id = 0 x 0, use_real_addr, flags = 0 x 0 = 0 protocol
IP/ID=0.0.0.0 SRC, mask = 0.0.0.0, port = 0, = 0 tag
IP/ID=0.0.0.0 DST, mask is 0.0.0.0, port = 0, tag = 0, dscp = 0 x 0
input_ifc = teeessyou, output_ifc = any

Phase: 4
Type: NAT
Subtype:
Result: ALLOW
Config:
NAT (teeessyou, outside) static source all all static destination teeessyou_ENCODERS teeessyou_ENCODERS
Additional information:
Definition of static 192.168.190.2/5000 to 192.168.190.2/5000
Direct flow from returns search rule:
ID = 0xae1ea5a8, priority = 6, area = nat, deny = false
hits = 622, user_data is 0xae1e9c58, cs_id = 0 x 0, flags = 0 x 0 = 0 protocol
IP/ID=0.0.0.0 SRC, mask = 0.0.0.0, port = 0, = 0 tag
IP/ID=192.168.192.0 DST, mask is 255.255.224.0, port = 0, tag = 0, dscp = 0 x 0
input_ifc = teeessyou, output_ifc = external

Phase: 5
Type: NAT
Subtype: volatile
Result: ALLOW
Config:
Additional information:
Direct flow from returns search rule:
ID = 0xa9678858, priority = 1, domain = nat-volatile, deny = true
hits = 105, user_data = 0 x 0, cs_id = 0 x 0, reverse, use_real_addr, flags = 0 x 0, Protocol = 6
IP/ID=0.0.0.0 SRC, mask = 0.0.0.0, port = 0, = 0 tag
IP/ID=0.0.0.0 DST, mask is 0.0.0.0, port = 0, tag = 0, dscp = 0 x 0
input_ifc = none, output_ifc = any

Phase: 6
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional information:
Direct flow from returns search rule:
ID = 0xae136910, priority = 0, sector = inspect-ip-options, deny = true
hits = 622, user_data = 0 x 0, cs_id = 0 x 0, reverse, flags = 0 x 0 = 0 protocol
IP/ID=0.0.0.0 SRC, mask = 0.0.0.0, port = 0, = 0 tag
IP/ID=0.0.0.0 DST, mask is 0.0.0.0, port = 0, tag = 0, dscp = 0 x 0
input_ifc = teeessyou, output_ifc = any

Phase: 7
Type: VPN
Subtype: encrypt
Result: ALLOW
Config:
Additional information:
Direct flow from returns search rule:
ID = 0xaeec4328, priority = 70, domain = encrypt, deny = false
hits = 65, user_data is 0xb7dc, cs_id = 0 x 0, reverse, flags = 0 x 0 = 0 protocol
IP/ID=0.0.0.0 SRC, mask = 0.0.0.0, port = 0, = 0 tag
IP/ID=192.168.195.0 DST, mask is 255.255.255.0, port = 0, tag = 0, dscp = 0 x 0
input_ifc = none, output_ifc = external

Phase: 8
Type: NAT
Subtype: rpf check
Result: ALLOW
Config:
NAT (teeessyou, outside) static source all all static destination teeessyou_ENCODERS teeessyou_ENCODERS
Additional information:
Direct flow from returns search rule:
ID = 0xae1eae48, priority = 6, area = nat-reversed, deny = false
hits = 129, user_data is 0xae1e9d10, cs_id = 0 x 0, use_real_addr, flags = 0 x 0 = 0 protocol
IP/ID=0.0.0.0 SRC, mask = 0.0.0.0, port = 0, = 0 tag
IP/ID=192.168.192.0 DST, mask is 255.255.224.0, port = 0, tag = 0, dscp = 0 x 0
input_ifc = teeessyou, output_ifc = external

Phase: 9
Type: VPN
Subtype: ipsec-tunnel-flow
Result: DECLINE
Config:
Additional information:
Reverse flow from returns search rule:
ID = 0xaea9f6b0, priority = 69 = ipsec-tunnel-flow area, deny = false
hits = 129, user_data = 0 x 0, cs_id = 0xaea999c0, reverse, flags = 0 x 0 = 0 protocol
IP/ID=192.168.192.0 SRC, mask = 255.255.224.0, port = 0, = 0 tag
IP/ID=192.168.190.0 DST, mask is 255.255.255.0, port = 0, tag = 0, dscp = 0 x 0
input_ifc = out, output_ifc = any

Hello Spencerallsop,

I recommend to add the keyword "no-proxy-arp" the end of the NAT statement, so the ASA try to answer queries ARP for the traffic(VPN interesting traffic), also this last phase 9 usually shows ignored due to a filter VPN defined in sometimes group policy, make sure you have not a filter VPN in a group policy that affect this tunnel then you will need to do the following:

1. remove the NAT statement:

-no nat (teeessyou, outside) static source all all static destination teeessyou_ENCODERS teeessyou_ENCODERS

2 fix the NAT statement with the keyword "No.-proxy-arp" :

-nat (teeessyou, outside) static source any any destination static teeessyou_ENCODERS teeessyou_ENCODERS non-proxy-arp

3 disable the VPN ISA SA:

-claire crypto ikev1 his

4. run the packet tracer to check that the L2L has developed,

To be honest I wouldn't recommend move you to 9.1.7 since it has some problems with the ARP entries, and it affects AnyConnect SSL somehow, which is still under investigation.

In fact, this bug affects 9.1.7 (may affect your environment):

- https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuy28710

Please don't forget to rate and score as of this post, keep me posted!

Kind regards

David Castro,

ASA: VPN IPSEC Tunnel from 5505(ver=8.47) to 5512 (ver = 9.23)

Hi-

We have connected tunnel / VPN configuration between an ASA 5505 - worm = 8.4 (7) and 5512 - worm = 9.2 (3).
We can only ping in a sense - 5505 to the 5512, but not of vice-versa(5512 to 5505).

Networks:

Local: 192.168.1.0 (answering machine)
Distance: 192.168.54.0 (initiator)

See details below on our config:

SH run card cry

card crypto outside_map 2 match address outside_cryptomap_ibfw
card crypto outside_map 2 pfs set group5
outside_map 2 peer XX crypto card game. XX.XXX.XXX
card crypto outside_map 2 set transform-set ESP-AES-256-SHA ikev1
crypto map outside_map 2 set ikev2 AES256 ipsec-proposal

outside_map interface card crypto outside

Note:
Getting to hit numbers below on rules/ACL...

SH-access list. I have 54.0

permit for access list 6 outside_access_out line scope ip 192.168.1.0 255.255.255.0 192.168.54.0 255.255.255.0 (hitcnt = 15931) 0x01aecbcc
permit for access list 1 outside_cryptomap_ibfw line extended ip object NETWORK_OBJ_192.168.1.0_24 object NETWORK_OBJ_192.168.54.0_24 (hitcnt = 3) 0xa75f0671
access-list 1 permit line outside_cryptomap_ibfw extended ip 192.168.1.0 255.255.255.0 192.168.54.0 255.255.255.0 (hitcnt = 3) 0xa75f0671

SH run | I have access-group
Access-group outside_access_out outside interface

NOTE:
WE have another working on the 5512 - VPN tunnel we use IKE peer #2 below (in BOLD)...

HS cry his ikev1

IKEv1 SAs:

HIS active: 2
Generate a new key SA: 0 (a tunnel report Active 1 and 1 to generate a new key during the generate a new key)
Total SA IKE: 2

1 peer IKE: XX. XX.XXX.XXX
Type: L2L role: answering machine
Generate a new key: no State: MM_ACTIVE
2 IKE peers: XXX.XXX.XXX.XXX
Type: L2L role: answering machine
Generate a new key: no State: MM_ACTIVE

SH run tunnel-group XX. XX.XXX.XXX
tunnel-group XX. XX.XXX.XXX type ipsec-l2l
tunnel-group XX. XX.XXX.XXX General-attributes
Group - default policy - GroupPolicy_XX.XXX.XXX.XXX
tunnel-group XX. XX.XXX.XXX ipsec-attributes
IKEv1 pre-shared-key *.
remote control-IKEv2 pre-shared-key authentication *.

SH run | I have political ikev1

ikev1 160 crypto policy
preshared authentication
aes-256 encryption
Group 5
life 86400

SH run | I Dynamics
NAT interface dynamic obj - 0.0.0.0 source (indoor, outdoor)
NAT source auto after (indoor, outdoor) dynamic one interface

NOTE:
To from 5512 at 5505-, we can ping a host on the remote network of ASA local

# ping inside the 192.168.54.20
Type to abort escape sequence.
Send 5, echoes ICMP 100 bytes to 192.168.54.20, wait time is 2 seconds:
!!!!!
Success rate is 100 per cent (5/5), round-trip min/avg/max = 30/32/40 ms

Determination of 192.168.1.79 - local host route to 192.168.54.20 - remote host - derivation tunnel?

The IPSEC tunnel check - seems OK?

SH crypto ipsec his
Interface: outside
Tag crypto map: outside_map, seq num: 2, local addr: XX.XXX.XXX.XXX

outside_cryptomap_ibfw to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.54.0 255.255.255.0
local ident (addr, mask, prot, port): (192.168.1.0/255.255.255.0/0/0)
Remote ident (addr, mask, prot, port): (192.168.54.0/255.255.255.0/0/0)
current_peer: XX. XX.XXX.XXX

#pkts program: 4609, #pkts encrypt: 4609, #pkts digest: 4609
#pkts decaps: 3851, #pkts decrypt: 3851, #pkts check: 3851
compressed #pkts: 0, unzipped #pkts: 0
#pkts uncompressed: 4609, model of #pkts failed: 0, #pkts Dang failed: 0
success #frag before: 0, failures before #frag: 0, #fragments created: 0
Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
#TFC rcvd: 0, #TFC sent: 0
#Valid errors ICMP rcvd: 0, #Invalid ICMP errors received: 0
#send errors: 0, #recv errors: 0

local crypto endpt. : XX.XXX.XXX.XXX/0, remote Start crypto. : XX. XX.XXX.XXX/0
Path mtu 1500, ipsec 74 (44) generals, media, mtu 1500
PMTU time remaining: 0, political of DF: copy / df
Validation of ICMP error: disabled, TFC packets: disabled
current outbound SPI: CDC99C9F
current inbound SPI: 06821CBB

SAS of the esp on arrival:
SPI: 0x06821CBB (109190331)
transform: aes-256-esp esp-sha-hmac no compression
running parameters = {L2L, Tunnel, group 5 PFS, IKEv1}
slot: 0, id_conn: 339968, crypto-card: outside_map
calendar of his: service life remaining (KB/s) key: (3914789/25743)
Size IV: 16 bytes
support for replay detection: Y
Anti-replay bitmap:
0xFFFFFFFF to 0xFFFFFFFF
outgoing esp sas:
SPI: 0xCDC99C9F (3452542111)
transform: aes-256-esp esp-sha-hmac no compression
running parameters = {L2L, Tunnel, group 5 PFS, IKEv1}
slot: 0, id_conn: 339968, crypto-card: outside_map
calendar of his: service life remaining (KB/s) key: (3913553/25743)
Size IV: 16 bytes
support for replay detection: Y
Anti-replay bitmap:
0x00000000 0x00000001

--> The local ASA 5512 - where we have questions - tried Packet Tracer... seems we receive requests/responses...

SH cap CAP

34 packets captured

1: 16:41:08.120477 192.168.1.79 > 192.168.54.20: icmp: echo request
2: 16:41:08.278138 192.168.54.20 > 192.168.1.79: icmp: echo request
3: 16:41:08.278427 192.168.1.79 > 192.168.54.20: icmp: echo reply
4: 16:41:09.291992 192.168.54.20 > 192.168.1.79: icmp: echo request
5: 16:41:09.292282 192.168.1.79 > 192.168.54.20: icmp: echo reply

--> On the ASA 5505 distance - we can ping through the 5512 to the local host (192.168.1.79)

SH cap A2

42 packets captured

1: 16:56:16.136559 802. 1 q vlan P0 192.168.54.20 #1 > 192.168.1.79: icmp: echo request
2: 16:56:16.168860 802. 1 q vlan P0 192.168.1.79 #1 > 192.168.54.20: icmp: echo reply
3: 16:56:17.140434 802. 1 q vlan P0 192.168.54.20 #1 > 192.168.1.79: icmp: echo request
4: 16:56:17.171652 802. 1 q vlan P0 192.168.1.79 #1 > 192.168.54.20: icmp: echo reply
5: 16:56:18.154426 802. 1 q vlan P0 192.168.54.20 #1 > 192.168.1.79: icmp: echo request
6: 16:56:18.186178 802. 1 q vlan P0 192.168.1.79 #1 > 192.168.54.20: icmp: echo reply
7: 16:56:19.168417 802. 1 q vlan P0 192.168.54.20 #1 > 192.168.1.79: icmp: echo request

--> Package trace on 5512 does no problem... but we cannot ping from host to host?

entry Packet-trace within the icmp 192.168.1.79 8 0 detailed 192.168.54.20

Phase: 4
Type: CONN-SETTINGS
Subtype:
Result: ALLOW
Config:
class-map default class
match any
Policy-map global_policy
class class by default
Decrement-ttl connection set
global service-policy global_policy
Additional information:
Direct flow from returns search rule:
ID = 0x7fffa2d0ba90, priority = 7, area = conn-set, deny = false
hits = 4417526, user_data = 0x7fffa2d09040, cs_id = 0 x 0, use_real_addr, flags = 0 x 0 = 0 protocol
IP/ID=0.0.0.0 SRC, mask = 0.0.0.0, port = 0, = 0 tag
IP/ID=0.0.0.0 DST, mask is 0.0.0.0, port = 0, tag = 0, dscp = 0 x 0
input_ifc = output_ifc = any to inside,

Phase: 5
Type: NAT
Subtype:
Result: ALLOW
Config:
NAT interface dynamic obj - 0.0.0.0 source (indoor, outdoor)
Additional information:
Definition of dynamic 192.168.1.79/0 to XX.XXX.XXX.XXX/43904
Direct flow from returns search rule:
ID = 0x7fffa222d130, priority = 6, area = nat, deny = false
hits = 4341877, user_data = 0x7fffa222b970, cs_id = 0 x 0, flags = 0 x 0 = 0 protocol
IP/ID=0.0.0.0 SRC, mask = 0.0.0.0, port = 0, = 0 tag
IP/ID=0.0.0.0 DST, mask is 0.0.0.0, port = 0, tag = 0, dscp = 0 x 0
input_ifc = inside, outside = output_ifc

...

Phase: 14
Type: CREATING STREAMS
Subtype:
Result: ALLOW
Config:
Additional information:
New workflow created with the 7422689 id, package sent to the next module
Information module for forward flow...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_inspect_icmp
snp_fp_translate
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat

Information for reverse flow...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_translate
snp_fp_inspect_icmp
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat

Result:
input interface: inside
entry status: to the top
entry-line-status: to the top
output interface: outside
the status of the output: to the top
output-line-status: to the top
Action: allow

--> On remote ASA 5505 - Packet track is good and we can ping remote host very well... dunno why he "of Nations United-NAT?

Destination - initiator:

entry Packet-trace within the icmp 192.168.54.20 8 0 detailed 192.168.1.79

...
Phase: 4
Type: UN - NAT
Subtype: static
Result: ALLOW
Config:
NAT (inside, outside) static source NETWORK_OBJ_192.168.54.0_24 NETWORK_OBJ_192.168.54.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 non-proxy-arp-search of route static destination
Additional information:
NAT divert on exit to the outside interface
Untranslate 192.168.1.79/0 to 192.168.1.79/0
...

Summary:
We "don't" ping from a host (192,168.1.79) on 5512 - within the network of the 5505 - inside the network host (192.168.54.20).
But we can ping the 5505 - inside the network host (192.168.54.20) 5512 - inside the network host (192.168.1.79).

Please let us know what other details we can provide to help solve, thanks for any help in advance.

-SP

Well, I think it is a NAT ordering the issue.

Basically as static and this NAT rule-

NAT interface dynamic obj - 0.0.0.0 source (indoor, outdoor)

are both in article 1 and in this article, it is done on the order of the rules so it does match the dynamic NAT rule rather than static because that seems to be higher in the order.

To check just run a 'sh nat"and this will show you what order everthing is in.

The ASA is working its way through the sections.

You also have this-

NAT source auto after (indoor, outdoor) dynamic one interface

which does the same thing as first statement but is in section 3, it is never used.

If you do one of two things-

(1) configure the static NAT statement is above the dynamic NAT in section 1 that is to say. You can specify the command line

or

(2) remove the dynamic NAT of section 1 and then your ASA will use the entry in section 3.

There is a very good document on this site for NAT and it is recommended to use section 3 for your general purpose NAT dynamic due precisely these questions.

It is interesting on your ASA 5505 you duplicated your instructions of dynamic NAT again but this time with article 2 and the instructions in section 3 that is why your static NAT works because he's put in correspondence before all your dynamic rules.

The only thing I'm not sure of is you remove the dynamic NAT statement in article 1 and rely on the statement in section 3, if she tears the current connections (sorry can't remember).

Then you can simply try to rearrange so your static NAT is above it just to see if it works.

Just in case you want to see the document here is the link-

https://supportforums.Cisco.com/document/132066/ASA-NAT-83-NAT-operation-and-configuration-format-CLI

Jon

Unable to Ping hosts through IPSec Tunnel

I have a configuration of lab home with a PIX 515 running code 8.03. I've made several changes over the last week and now when I finish a VPN connection to the external interface, I'm unable to hit all internal resources. My VPN connection comes from a 10.22.254.0/24 trying to knock the internal nodes to 10.22.1.0/24, see below. When I finish a VPN connection with the inside interface works, so I guess that I'm dealing with a NAT problem? I have not idea why Phase 9 is a failure:-------. Any help would be great!

-------

IP 10.22.254.0 allow Access-list extended sheep 255.255.255.0 10.22.1.0 255.255.255.0

NAT (inside) 0 access-list sheep

-------

Global 1 interface (outside)

-------

access-list extended split allow ip 10.22.1.0 255.255.255.0 10.22.254.0 255.255.255.0

-------

Packet-trace entry inside tcp 10.22.1.15 1025 10.22.254.15 3389 detailed

Phase: 1

Type: FLOW-SEARCH

Subtype:

Result: ALLOW

Config:

Additional information:

Not found no corresponding stream, creating a new stream

Phase: 2

Type:-ROUTE SEARCH

Subtype: entry

Result: ALLOW

Config:

Additional information:

in 0.0.0.0 0.0.0.0 outdoors

Phase: 3

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional information:

Direct flow from returns search rule:

ID = 0x2bb3450, priority = 0, sector = option-ip-enabled, deny = true

hits = 17005, user_data = 0 x 0, cs_id = 0 x 0, reverse, flags = 0 x 0 = 0 protocol

SRC ip = 0.0.0.0 mask 0.0.0.0, port = 0 =

DST ip = 0.0.0.0 mask 0.0.0.0, port = 0 =

Phase: 4

Type: VPN

Subtype: ipsec-tunnel-flow

Result: ALLOW

Config:

Additional information:

Direct flow from returns search rule:

ID = 0x304ae48, priority = 12, area = ipsec-tunnel-flow, deny = true

hits = 17005, user_data = 0 x 0, cs_id = 0 x 0, flags = 0 x 0 = 0 protocol

SRC ip = 0.0.0.0 mask 0.0.0.0, port = 0 =

DST ip = 0.0.0.0 mask 0.0.0.0, port = 0 =

Phase: 5

Type: NAT-FREE

Subtype:

Result: ALLOW

Config:

NAT (inside) 0 access-list sheep

NAT-control

is the intellectual property inside 10.22.1.0 outside 10.22.254.0 255.255.255.0 255.255.255.0

Exempt from NAT

translate_hits = 6, untranslate_hits = 5

Additional information:

Direct flow from returns search rule:

ID = 0x2be2a00, priority = 6, free = area of nat, deny = false

Hits = 5, user_data is 0x2be2960, cs_id = 0 x 0, use_real_addr, flags = 0 x 0 = 0 protocol

SRC ip = 10.22.1.0, mask is 255.255.255.0, port = 0

DST ip = 10.22.254.0, mask is 255.255.255.0, port = 0

Phase: 6

Type: NAT

Subtype: host-limits

Result: ALLOW

Config:

static (inside, DMZ) 10.22.1.0 10.22.1.0 netmask 255.255.255.0

NAT-control

is the intellectual property inside 10.22.1.0 255.255.255.0 DMZ all

static translation at 10.22.1.0

translate_hits = 10, untranslate_hits = 0

Additional information:

Direct flow from returns search rule:

ID = 0x2d52800, priority = 5, area = host, deny = false

hits = 21654, user_data = 0x2d51dc8, cs_id = 0 x 0, reverse, flags = 0 x 0 = 0 protocol

SRC ip = 10.22.1.0, mask is 255.255.255.0, port = 0

DST ip = 0.0.0.0 mask 0.0.0.0, port = 0 =

Phase: 7

Type: NAT

Subtype:

Result: ALLOW

Config:

NAT (inside) 1 0.0.0.0 0.0.0.0

NAT-control

is the intellectual property inside everything outside of any

dynamic translation of hen 1 (192.168.20.20 [Interface PAT])

translate_hits = 2909, untranslate_hits = 9

Additional information:

Direct flow from returns search rule:

ID = 0x2d4a7d0, priority = 1, sector = nat, deny = false

hits = 16973, user_data = 0x2d4a730, cs_id = 0 x 0, flags = 0 x 0 = 0 protocol

SRC ip = 0.0.0.0 mask 0.0.0.0, port = 0 =

DST ip = 0.0.0.0 mask 0.0.0.0, port = 0 =

Phase: 8

Type: VPN

Subtype: encrypt

Result: ALLOW

Config:

Additional information:

Direct flow from returns search rule:

ID = 0 x 3328000, priority = 70, domain = encrypt, deny = false

hits = 0, user_data is 0x1efa0cc, cs_id = 0 x 0, reverse, flags = 0 x 0 = 0 protocol

SRC ip = 10.22.1.0, mask is 255.255.255.0, port = 0

DST ip = 10.0.0.0, mask is 255.0.0.0, port = 0

Phase: 9

Type: ACCESS-LIST

Subtype: ipsec-user

Result: DECLINE

Config:

Additional information:

Direct flow from returns search rule:

ID = 0x3329a48, priority = 69, domain = ipsec - user, deny = true

Hits = 37, user_data = 0 x 0, cs_id = 0 x 0, flags = 0 x 0 = 0 protocol

SRC ip = 0.0.0.0 mask 0.0.0.0, port = 0 =

DST ip = 10.0.0.0, mask is 255.0.0.0, port = 0

Result:

input interface: inside

entry status: to the top

entry-line-status: to the top

output interface: outside

the status of the output: to the top

output-line-status: to the top

Action: drop

Drop-reason: flow (acl-drop) is denied by the configured rule

No, the sheep ACL requires that defining the internal network traffic to the

Pool VPN. You must remove the other entries.

Delete:

allowed to Access-list sheep line 8 extended ip 10.22.254.0 255.255.255.0 DM_INLINE_NETWORK_18 object-group
allowed to Access-list sheep line 8 extended ip 10.22.254.0 255.255.255.0 10.22.1.0 255.255.255.0

Cisco's ASA IPsec tunnel disconnects after a while

Hi all

I've set up an IPsec tunnel between sonicwall pro road and cisco ASA 5510. The well established tunnel and two subnets can access each other.

I then added a static route to a public ip address on the sonicwall ipsec policy, so that all traffic to this ip address will go through the IPsec tunnel. It also works very well.

But the problem is aftre tunnel Ipsec sometimes breaks down, and then I need to renegotiate the ipsec on sonicwall to restore the tunnel.

This happens twice a day. I'm whther fear that this behavior is because of problems with config. I'm pasting my ASA running Setup here. Plese give some advice.

SonicWALL publicip 1.1.1.2 192.168.10.0 subnet

Cisco ASA publicip 1.1.1.1 subnet 192.168.5.0

ciscoasa # sh run
: Saved
:
ASA Version 8.2 (1)
!
ciscoasa hostname
domain default.domain.invalid
activate 8Ry2YjIyt7RRXU24 encrypted password
2KFQnbNIdI.2KYOU encrypted passwd
names of
!
interface Ethernet0/0
Speed 100
full duplex
nameif outside
security-level 0
IP 1.1.1.1 255.255.255.248
!
interface Ethernet0/1
nameif inside
security-level 100
192.168.5.1 IP address 255.255.255.0
!
interface Ethernet0/2
Shutdown
No nameif
no level of security
no ip address
!
interface Ethernet0/3
Shutdown
No nameif
no level of security
no ip address
!
interface Management0/0
nameif management
security-level 100
IP 192.168.1.1 255.255.255.0
management only
!
passive FTP mode
DNS domain-lookup outside
DNS lookup field inside
DNS server-group DefaultDNS
Server name 66.28.0.45
Server name 66.28.0.61
domain default.domain.invalid
permit same-security-traffic inter-interface
permit same-security-traffic intra-interface
object-group service rdp tcp
EQ port 3389 object
object-group service tcp OpenVPN
port-object eq 1194
access list outside extended permit icmp any any echo response
access list outside extended permit tcp any host # eq pptp
outside allowed extended access will list any host #.
list of extended outside access permit udp any any eq 1701
extended outdoor access allowed icmp a whole list
access list outside extended permit tcp any host # eq ftp
access list outside extended permit tcp any host # eq ssh
list of extended outside access permit tcp any host # object - group rdp
turn off journal
access list outside extended permit tcp any host 1.1.1.1 object - group Open
VPN
access-list sheep extended ip 192.168.5.0 allow 255.255.255.0 192.168.5.0 255
. 255.255.0
access-list sheep extended ip 192.168.5.0 allow 255.255.255.0 192.168.10.0 255
. 255.255.0
L2L 192.168.5.0 ip extended access-list allow 255.255.255.0 192.168.10.0 255.2
55.255.0
pager lines 24
Enable logging
asdm of logging of information
Outside 1500 MTU
Within 1500 MTU
management of MTU 1500
IP local pool ippool 192.168.5.131 - 192.168.5.151 mask 255.255.255.0
IP local pool l2tppool 192.168.5.155 - 192.168.5.200 mask 255.255.255.0
ICMP unreachable rate-limit 1 burst-size 1
ASDM image disk0: / asdm - 621.bin
don't allow no asdm history
ARP timeout 14400
Global 1 interface (outside)
NAT (outside) 1 192.168.10.0 255.255.255.0
NAT (outside) 1 192.168.5.0 255.255.255.0
NAT (inside) 0 access-list sheep
NAT (inside) 1 192.168.5.0 255.255.255.0
outside access-group in external interface
Route outside 0.0.0.0 0.0.0.0 38.106.51.121 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-registration DfltAccessPolicy
the ssh LOCAL console AAA authentication
AAA authentication LOCAL telnet console
Enable http server
http 192.168.1.0 255.255.255.0 management
http 192.168.5.0 255.255.255.0 inside
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set esp-3des esp-sha-hmac RIGHT
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
Crypto-map dynamic dynmap 5 the value reverse-road
Crypto easyvpn dynamic-map 10 transform-set RIGHT
Crypto-map dynamic easyvpn 10 reverse-drive value
card crypto mymap 10 correspondence address l2l
card crypto mymap 10 set peer 1.1.1.2
card crypto mymap 10 transform-set RIGHT
map mymap 30000-isakmp ipsec crypto dynamic easyvpn
mymap outside crypto map interface
crypto isakmp identity address
crypto ISAKMP allow outside
crypto ISAKMP policy 10
preshared authentication
3des encryption
md5 hash
Group 2
life 86400
crypto ISAKMP policy 20
preshared authentication
3des encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 65535
preshared authentication
3des encryption
sha hash
Group 2
life 86400
Crypto isakmp nat-traversal 3600
Telnet 192.168.5.0 255.255.255.0 inside
Telnet timeout 5
SSH 0.0.0.0 0.0.0.0 outdoors
SSH timeout 5
Console timeout 0
Hello to tunnel L2TP 10
management of 192.168.1.2 - dhcpd address 192.168.1.254
enable dhcpd management
!
a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
WebVPN
internal DefaultRAGroup group strategy
attributes of Group Policy DefaultRAGroup
value of 66.28.0.45 DNS server 66.28.0.61
Protocol-tunnel-VPN IPSec l2tp ipsec
field default value cisco.com
attributes of Group Policy DfltGrpPolicy
internal band easyvpn strategy
attributes of the strategy of band easyvpn
value of 66.28.0.45 DNS server 66.28.0.61
Protocol-tunnel-VPN IPSec
enable IPSec-udp
Split-tunnel-policy tunnelall
the address value ippool pools
VPN-group-policy DefaultRAGroup
attributes global-tunnel-group DefaultRAGroup
address l2tppool pool
Group Policy - by default-DefaultRAGroup
IPSec-attributes tunnel-group DefaultRAGroup
pre-shared-key *.
tunnel-group DefaultRAGroup ppp-attributes
No chap authentication
ms-chap-v2 authentication
tunnel-group 1.1.1.2 type ipsec-l2l
1.1.1.2 tunnel-group ipsec-attributes
pre-shared-key *.
tunnel-group easyvpn type remote access
tunnel-group easyvpn General attributes
Group Policy - by default-easyvpn
easyvpn group tunnel ipsec-attributes
pre-shared-key *.
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the rsh
inspect esmtp
inspect sqlnet
inspect the skinny
inspect sunrpc
inspect xdmcp
inspect the netbios
inspect the tftp
inspect the pptp
!
global service-policy global_policy
context of prompt hostname
Cryptochecksum:5542615c178d2803f764c9b8f104732b
: end

I guess you have typo in the configuration of the ASA?

L2L 192.168.5.0 ip extended access-list allow 255.255.255.0 192.168.10.0 255.255.255.0
list access extended extended permitted host ip voip pubic ip 192.168.10.0 255.255.255.0

Can you confirm that you have configured instead the following:

access-list l2l extended permitted host ip voip pubic ip 192.168.10.0 255.255.255.0

Moreover, even if the crypto map tag says easyvpn; peer address is correct to point 1.1.1.2

In addition, don't know why you have the following configuration (but if it is not necessary I suggest to be removed and 'clear xlate' after the withdrawal):

NAT (outside) 1 192.168.10.0 255.255.255.0

Finally, pls turn off keepalive to SonicWall.

If the foregoing still don't resolve the issue, can you try to remove the card dynamic encryption of the ASA (no map mymap 30000-isakmp ipsec crypto dynamic easyvpn), release the tunnel and try to open the tunnel between the ASA and SonicWall and take the exit of "show the isa cry his ' and ' show cry ipsec his» I'm curious to see why he is always referred to the easyvpn crypto map. When you remove the dynamic encryption card, dynamic vpn lan-to-lan of remote access client does not work.

How to configure ASA5520 of Checkpoint IPsec tunnel configuration

Hi guys and under tension, a lot of it!

I have a problem, I set up an IPsec tunnel between my ASA5520 at a Checkpoint Firewall (PE) CONFIG below (not true FT)

network of the ASA_MAPPED object

4.4.4.0 subnet 255.255.255.0

network of the CHECKPOINT_MAPPED object

5.5.5.5.0 SUBNET 255.255.255.0

OUT_CRYPTO extended access list permit ip object ASA_MAPPED object CHECKPOINT_MAPPED

Crypto ipsec transform-set ikev1 CHECKPOINT_SET aes - esp esp-sha-hmac

destination NAT (INSIDE, OUTSIDE) static source ALLNETWORKS(10.0.0.0/16) ASA_MAPPED CHECKPOINT_MAPPED of CHECKPOINT_MAPPED static

NAT (INSIDE, OUTSIDE) source of destination ALLNETWORKS(10.0.0.0/16) static ASA_MAPPED static 4.4.4.11 5.5.5.11

card crypto OUTSIDE_MAP 5 corresponds to the address OUT_CRYPTO

OUTSIDE_MAP 5 set crypto map peer X.X.X.X

card crypto OUTSIDE_MAP 5 set transform-set CHECKPOINT_SET ikev1

card crypto OUTSIDE_MAP 5 defined security-association life seconds 3600

CHECKPOINT_MAP interface card crypto OUTSIDE

tunnel-group X.X.X.X type ipsec-l2l

tunnel-group ipsec-attributes X.X.X.X

IKEv1 pre-shared-key 1234

ISAKMP crypto 10 nat-traversal

Crypto ikev1 allow outside

IKEv1 crypto policy 10

preshared authentication

aes encryption

sha hash

Group 5

life 86400

IPsec Tunnel is in place and I can access the server on the other side via the beach of NATTED, for example a server behind the checkpoint with the IP 10.90.55.11 is accessible behind the ASA as 4.4.4.11, the problem is that I have never worked on a Checkpoint Firewall and servers/Server 4.4.4.11 that I can't connect to my environment to that checkpoint is configured with a Tunnel interface that is also supposed to to make NAT because of the superimposition of networks, at one point, I added an access to an entire list and bidirectional routing has been reached, but I encountered a new problem, I could not overlook from my servers public became unaccessecable, since all traffic was encrypted and get dropped to VPN: ipsec-tunnel-flow... for now the Tunnel is up and I can access the server via NAT 4.4.4.11, but can't access my internal servers. What did I DO WRONG (also, I don't have access to the Checkpoint Firewall (PE)) how their installation would be or how it should be to allow bidirectional routing?

========================================================

Tag crypto map: CHECKPOINT_MAP, seq num: 5, local addr: X.X.X.X

Access extensive list ip 4.4.4.0 OUT_5_CRYPTO allow 255.255.255.0 5.5.5.0 255.255.255.0

local ident (addr, mask, prot, port): (4.4.4.0/255.255.255.0/0/0)

Remote ident (addr, mask, prot, port): (5.5.5.0/255.255.255.0/0/0)

current_peer: X.X.X.X

#pkts program: 3207, #pkts encrypt: 3207, #pkts digest: 3207

#pkts decaps: 3417, #pkts decrypt: 3417, #pkts check: 3417

compressed #pkts: 0, unzipped #pkts: 0

#pkts uncompressed: 3207, model of #pkts failed: 0, #pkts Dang failed: 0

success #frag before: 0, failures before #frag: 0, #fragments created: 0

Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0

#send errors: 0, #recv errors: 0

local crypto endpt. : X.X.X.X/0, remote Start crypto. : X.X.X.X/0

Path mtu 1500, fresh ipsec generals 74, media, mtu 1500

current outbound SPI: 5254EDC6

current inbound SPI: 36DAB960

SAS of the esp on arrival:

SPI: 0x36DAB960 (920303968)

transform: aes - esp esp-sha-hmac no compression

running parameters = {L2L, Tunnel}

slot: 0, id_conn: 19099648, crypto-card: CHECKPOINT_MAP

calendar of his: service life remaining (KB/s) key: (3914999/3537)

Size IV: 16 bytes

support for replay detection: Y

Anti-replay bitmap:

0 x 00000000 0x0000000F

outgoing esp sas:

SPI: 0x5254EDC6 (1381297606)

transform: aes - esp esp-sha-hmac no compression

running parameters = {L2L, Tunnel}

slot: 0, id_conn: 19099648, crypto-card: CHECKPOINT_MAP

calendar of his: service life remaining (KB/s) key: (3914999/3537)

Size IV: 16 bytes

support for replay detection: Y

Anti-replay bitmap:

0x00000000 0x00000001
```
unless I include any any on my access-list and the problem with that is  that my Public servers then get encrypted from the OUTSIDE interface  unless you know of a way to bypass the VPN
```
No, u certainly shouldn't allow 0.0.0.0 for proxy ACL. Again, your config is very good. In addition, package account, this show that traffic is going throug the tunnel in two ways:

#pkts program: 3207

#pkts decaps: 3417

Also, looking at the meter, I can guess that some of the traffic comes from the other site, but does not return back (maybe that's where you can not connect from behing Checkpoint). If you say that 0.0.0.0 solved the problem, are there no other NAT rules for subnet behind ASA, so the server IP, for which you are trying to connect behind the checkpoint, translates into something else (not the beach, included in proxy ACL), when to come back?

Cisco 1841 ipsec tunnel protocol down after a minute

I have a strange problem where im manages to get a tha cisco ipsec tunnel 1841 to a RV016 linksys/cisco for about a minute and ping/encrypt the packets through the linen for about a minute before it breaks down. I tried different configuration and it all results in the tunnel for a minute then descend to come. I don't know if im hitting a bug and decide to if im doing something wrong.

any help is appreciated paul

RV016 firmware 2.0.18

Cisco 1841: C1841-ADVENTERPRISEK9-M), Version 12.4 (24) T

my config

no default isakmp crypto policy

!

crypto ISAKMP policy 1

BA 3des

md5 hash

preshared authentication

Group 2

lifetime 28800

ISAKMP crypto key address 0.0.0.0 eaton1234 0.0.0.0

!

!

Crypto ipsec transform-set esp-3des esp-sha-hmac ESSTS

transport mode

no default crypto ipsec transform-set

!

Crypto ipsec profile ipsec_profile1

Description in the location main site to site VPN tunnel

game of transformation-ESSTS

PFS group2 Set

!

!

!

!

!

!

!

Tunnel1 interface

Description of the location of the hand

IP unnumbered Serial0/0/0

source of tunnel Serial0/0/0

destination 209.213.x.x tunnel

ipv4 ipsec tunnel mode

tunnel path-mtu-discovery

protection of ipsec profile ipsec_profile1 tunnel

!

a debug output

Apr 24 16:42:07: IPSEC (validate_proposal_request): part #1 the proposal

Apr 24 16:42:07: IPSEC (validate_proposal_request): part #1 of the proposal

(Eng. msg key.) Local INCOMING = 209.213.xx.46, distance = 209.213.xx.164,.

local_proxy = 10.20.86.0/255.255.255.0/0/0 (type = 4),

remote_proxy = 10.0.0.0/255.255.255.0/0/0 (type = 4),

Protocol = ESP, transform = NONE (Tunnel),

lifedur = 0 and 0kb in

SPI = 0 x 0 (0), id_conn = 0, keysize = 0, flags = 0 x 0

Apr 24 16:42:07: mapdb Crypto: proxy_match

ADR SRC: 10.20.86.0

ADR DST: 10.0.0.0

Protocol: 0

SRC port: 0

DST port: 0

Apr 24 16:42:07: IPSEC (key_engine): had an event of the queue with 1 KMI message (s)

Apr 24 16:42:07: mapdb Crypto: proxy_match

ADR SRC: 10.20.86.0

ADR DST: 10.0.0.0

Protocol: 0

SRC port: 0

DST port: 0

Apr 24 16:42:07: IPSEC (policy_db_add_ident): src dest 10.0.0.0, 10.20.86.0, dest_port

0

Apr 24 16:42:07: IPSEC (create_sa): its created.

(his) sa_dest = 209.213.xx.46, sa_proto = 50,.

sa_spi = 0x4CF51011 (1291128849).

sa_trans = sa_conn_id of hmac-sha-esp, esp-3des = 2045

sa_lifetime(k/sec) = (4463729/3600)

Apr 24 16:42:07: IPSEC (create_sa): its created.

(his) sa_dest = 209.213.xx.164, sa_proto = 50,.

sa_spi = 0x1EB77DAF (515341743).

sa_trans = sa_conn_id of hmac-sha-esp, esp-3des = 2046

sa_lifetime(k/sec) = (4463729/3600)

Apr 24 16:42:07: % LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, sta changed

you to

Apr 24 16:42:07: IPSEC (key_engine): had an event of the queue with 1 KMI message (s)

Apr 24 16:42:07: IPSEC (key_engine_enable_outbound): rec would notify of ISAKMP

Apr 24 16:42:07: IPSEC (key_engine_enable_outbound): select SA with spinnaker 515341743/50

Apr 24 16:42:07: IPSEC (update_current_outbound_sa): update peer 209.213.xx.164 curre

NT his outgoing to SPI 1EB77DAF

Apr 24 16:42:12: IPSEC (key_engine): request timer shot: count = 1,.

local (identity) = 209.213.xx.46, distance = 209.213.xx.164,

local_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4),

remote_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4)

Apr 24 16:42:12: IPSEC (sa_request):,.

(Eng. msg key.) Local OUTGOING = 209.213.xx.46, distance = 209.213.xx.164,.

local_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4),

remote_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4),

Protocol = ESP, transform = esp-3des esp-sha-hmac (Tunnel),

lifedur = 3600 s and KB 4608000,

SPI = 0 x 0 (0), id_conn = 0, keysize = 0, flags = 0 x 0

Apr 24 16:42:42: IPSEC (key_engine): request timer shot: count = 2,.

local (identity) = 209.213.xx.46, distance = 209.213.xx.164,

local_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4),

remote_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4)

Apr 24 16:42:42: % LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, sta changed

you all the downu

All possible debugging has been disabled

I would try to set up a VPN Interface virtual Tunnel on the IOS router base and the value of defined transformation in tunnel mode no transport.

In history, I have had several issues with VPN between a router IOS and the series RV.

Cannot reach the destination of an IPSec tunnel through another IPSec tunnel

Hi all

I have a PIX 515E version 8.0 (2).

I have two remote sites connected to this PIX via IPSec tunnels.

Each remote site can reach local networks behind the PIX, but I can't reach remoteSiteB remoteSiteA.

Thus,.

SiteA <----- ipsec="" -----="">PIX1 SiteX <---------------->10.0.8.1 10.30.8.254

SiteB <----- ipsec="" -----="">PIX1 SiteX <---------------->10.0.8.1 10.138.34.21

SiteA can ping SiteX

SiteB can ping SiteX

SiteA cannot ping SiteB

SiteB cannot ping SiteA

If I do not show crypto isakmp ipsec his I see appropriate subnets:

Tag crypto map: CRYPTO-MAP, seq num: 4, local addr: 203.166.1.1

permit access-list ACLVPN-TO_SITEA ip 10.138.34.16 255.255.255.240 host 10.30.8.254

local ident (addr, mask, prot, port): (10.138.34.16/255.255.255.240/0/0)

Remote ident (addr, mask, prot, port): (10.30.8.254/255.255.255.255/0/0)

current_peer: 104.86.2.4

Tag crypto map: CRYPTO-MAP, seq num: 5, local addr: 203.166.1.1

access-list ACLVPN-TO_SITEB allowed host ip 10.30.8.254 10.138.34.16 255.255.255.240

local ident (addr, mask, prot, port): (10.30.8.254/255.255.255.255/0/0)

Remote ident (addr, mask, prot, port): (10.138.34.16/255.255.255.240/0/0)

current_peer: 216.178.200.200

Journal messages that seem to point to the problem...

April 18, 2013 13:27:35: % PIX-4-402116: IPSEC: received a package of ESP (SPI = 0xD51BB13A, sequence number = 0x21A) 104.86.2.4 (user = 104.86.2.4) at 203.166.1.1. Inside the package décapsulés does not match policy negotiated in the SA. The package indicates its destination as 10.138.34.21, its source as 10.30.8.254 and its Protocol 6. SA specifies its local proxy like 10.0.8.0/255.255.255.0/0/0 and his remote_proxy as 10.30.8.254/255.255.255.255/0/0

My question is really what I have to do something funky to allow traffic to pass between the two tunnels?

Hello

This could be much easier if we have seen the real configurations.

But here are some things to be confirmed in the configurations (some of them you mentioned above, but I still quote once again)
- Make sure that each firewall, you set the appropriate VPN L2L ACL
- Make sure that you have configured NAT0 on the central PIX "outside" interface for the Site A and Site B
- Make sure the Central PIX has "same-security-traffic permit intra-interface" configured. This will allow the Site traffic to enter the Central PIX 'outside' interface and head back on the same interface to Site B. And vice versa.
To view some actual configurations that may be required provided everything else is ok. (I assume that all devices are Cisco)

Central PIX

permit same-security-traffic intra-interface

A connection to the site

SITE-A-CRYPTOMAP of the 10.0.8.0 ip access list allow 255.255.255.0 host 10.30.8.254

SITE-A-CRYPTOMAP of the 10.138.34.16 ip access list allow 255.255.255.240 host 10.30.8.254

Site B connection

SITE-B-CRYPTOMAP of the 10.0.8.0 ip access list allow 255.255.255.0 10.138.34.16 255.255.255.240

SITE-B-CRYPTOMAP to the list of allowed access host ip 10.30.8.254 10.138.34.16 255.255.255.240

NAT0

access list for the INTERIOR-NAT0 allowed ip 10.0.8.0 255.255.255.0 host 10.30.8.254

access list for the INTERIOR-NAT0 allowed ip 10.0.8.0 255.255.255.0 10.138.34.16 255.255.255.240

NAT (inside) 0-list of access to the INTERIOR-NAT0

OUTSIDE-NAT0 allowed host ip 10.30.8.254 access list 10.138.34.16 255.255.255.240

OUTSIDE-NAT0 allowed ip 10.138.34.16 access list 255.255.255.240 host 10.30.8.254

NAT (outside) 0-list of access OUTSIDE-NAT0

Site has

CENTRAL-SITE-CRYPTOMAP to the list of allowed access host ip 10.30.8.254 10.0.8.0 255.255.255.0

CENTRAL-SITE-CRYPTOMAP to the list of allowed access host ip 10.30.8.254 10.138.34.16 255.255.255.240

the INTERIOR-NAT0 allowed host ip 10.30.8.254 access list 10.0.8.0 255.255.255.0

the INTERIOR-NAT0 allowed host ip 10.30.8.254 access list 10.138.34.16 255.255.255.240

NAT (inside) 0-list of access to the INTERIOR-NAT0

Site B

CENTRAL-SITE-CRYPTOMAP of the 10.138.34.16 ip access list allow 255.255.255.240 10.0.8.0 255.255.255.0

CENTRAL-SITE-CRYPTOMAP of the 10.138.34.16 ip access list allow 255.255.255.240 host 10.30.8.254

the INTERIOR-NAT0 allowed host ip 10.138.34.16 access list 255.255.255.240 10.0.8.0 255.255.255.0

the INTERIOR-NAT0 allowed host ip 10.138.34.16 access list 255.255.255.240 host 10.30.8.254

NAT (inside) 0-list of access to the INTERIOR-NAT0

Hope this helps

-Jouni

Problems of IPSEC Tunnel &amp; Port fowarding

Similar Questions

Maybe you are looking for

Problems of IPSEC Tunnel & Port fowarding