Public static IPsec tunnel between two routers cisco [VRF aware]

Similar Questions

• IPSec tunnel between 2 routers

  Hello

  I am trying to configure an IPSec VPN tunnel between 2 routers Cisco, connected to the internet via the ATM interface, my router is a 1841 with the network 10.200.36.0 address the remote router is a Cisco network 192.168.9.0 address with 877.

  I have tryied to follow some tutorials, unsuccessfully, because I can't always ping all IP addresses on the remote network and also the VPN tunnel is not up!

  Can help you please give me a configuration model, or maybe let me know how to configure step by step on mine and remote router?

  Thank you very much!

  Concerning

  Riccardo

  Here is an example. x.x.x.x and y.y.y.y are the public IPs of routers:

  ROUTER1 hostname

  !

  crypto ISAKMP policy 10

  BA aes 256

  AUTH pre

  Group 5

  !

  ISAKMP crypto key cisco1234 address y.y.y.y

  !

  Crypto ipsec transform-set ESP-AES256-SHA1 esp - aes 256 esp-sha-hmac

  !

  Profile of crypto ipsec TunnelProfile

  the transform ESP-AES256-SHA1 value

  !

  interface Tunnel0

  IP 10.255.255.0 255.255.255.254

  tunnel Dialer source 0

  tunnel destination y.y.y.y

  ipv4 ipsec tunnel mode

  Tunnel TunnelProfile ipsec protection profile

  !

  interface Dialer0

  IP x.x.x.x

  !

  IP route 192.168.9.0 255.255.255.0 Tunnel0

  hostname ROUTER2

  !

  crypto ISAKMP policy 10

  BA aes 256

  AUTH pre

  Group 5

  !

  ISAKMP crypto cisco1234 key address x.x.x.x

  !

  Crypto ipsec ESP-AES256-SHA1 transform-set esp - aes 256 esp-sha-hmac

  !

  Profile of crypto ipsec TunnelProfile

  the transform ESP-AES256-SHA1 value

  !

  interface Tunnel0

  IP 10.255.255.1 255.255.255.254

  tunnel Dialer source 0

  tunnel destination x.x.x.x

  ipv4 ipsec tunnel mode

  Tunnel TunnelProfile ipsec protection profile

  !

  interface Dialer0

  IP address y.y.y.y

  !

  IP route 10.200.36.0 255.255.255.0 Tunnel0

  --
  Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
  http://www.Kiva.org/invitedBy/karsteni

• Traffic is failed on plain IPSec tunnel between two 892 s

  Have a weird case and you are looking for some suggestions/thougs where to dig because I have exhausted the options.

  Note: I replaced the Networkid real to a mentined below.

  Topology: a classic IPSec VPN tunnel between two 892 s of Cisco, with pre-shared key and no GRE. A 892 (branch_892) has access to the Internet using PPPoE and has three network / VLAN behind it. A VLAN is coordinated to the PPPoE internet access. Access to the other two VLAN - VL92 (100.100.200.0/24) and VL93 (100.100.100.0/24) is performed via the VPN tunnel.

  Second 892 (892_DC) has just one interface - WAN on Gigabit enabled/connected and a static route to the default GW. It doesn't have any defined interal network. If the router is strictly used to send traffic to VL92/VL93 to the domestic 892 via IPSec tunnel.

  Here's the problem: access to VL93 (100.100.100.0/24) works, however for VL92 (100.100.100.0/24) - does not work.

  Devices in VL92 I ping IP address of 892_DC through the VPN tunnel. The 892_DC router I can ping devices in VL92. However, I can't VL92 ping any device beyond the 892_DC and at the same time the packets arriving on 892_DC for VL92 are not sent through the VPN tunnel.

  I took the package trace on 892_DC using capture point/buffer to nathalie caron to VL92 packages and saw that the traffic coming to the 892_DC. I run the nathalie caron even on Branch_892, and there was not a single package.

  So... What's the problem? More interesting, I modified the way left on VL92 access list and still - no packets are sent through the tunnel.

  Any idea? Two routers config are below

  -------

  892_DC #show ru

  !

  crypto ISAKMP policy 10

  BA aes 256

  hash sha256

  preshared authentication

  Group 2

  isakmp encryption key * address 1.2.3.4

  ISAKMP crypto keepalive 10 periodicals

  !

  address of 1.2.3.4 crypto isakmp peers

  Description of-COIL-892

  !

  !

  Crypto ipsec transform-set IT-IPSec-Transform-Set esp - aes 256 sha256-esp-hmac

  Crypto ipsec df - bit clear

  !

  map IT ipsec - IPSec crypto - Crypto - map 10-isakmp

  defined peer 1.2.3.4

  disable the kilobytes of life together - the security association

  86400 seconds, life of security association set

  the transform-set IT-IPSec-Transform-Set value

  match a lists 101

  market arriere-route

  QoS before filing

  !

  interface GigabitEthernet0

  IP 10,20,30,40 255.255.255.240

  IP 1400 MTU

  IP tcp adjust-mss 1360

  automatic duplex

  automatic speed

  card crypto IT-IPSec-Crypto-map

  !

  IP route 0.0.0.0 0.0.0.0 10.20.30.41

  !

  access list 101 ip allow any 100.100.100.0 0.0.0.255 connect

  access list 101 ip allow any 100.100.200.0 0.0.0.255 connect

  -------------------------------------------------------------------------------------

  Branch_892 #sh run

  !

  crypto ISAKMP policy 10

  BA aes 256

  hash sha256

  preshared authentication

  Group 2

  isakmp encryption key * address 10,20,30,40

  ISAKMP crypto keepalive 10 periodicals

  !

  address peer isakmp crypto 10,20,30,40

  !

  !

  Crypto ipsec transform-set IT-IPSec-Transform-Set esp - aes 256 sha256-esp-hmac

  Crypto ipsec df - bit clear

  !

  map IT ipsec - IPSec crypto - Crypto - map 10-isakmp

  defined peer 10,20,30,40

  disable the kilobytes of life together - the security association

  86400 seconds, life of security association set

  the transform-set IT-IPSec-Transform-Set value

  match address 101

  market arriere-route

  QoS before filing

  !

  FastEthernet6 interface

  Description VL92

  switchport access vlan 92

  !

  interface FastEthernet7

  Description VL93

  switchport access vlan 93

  !

  interface GigabitEthernet0

  Description # to WAN #.

  no ip address

  automatic duplex

  automatic speed

  PPPoE-client dial-pool-number 1

  !

  interface Vlan1

  Description # local to #.

  IP 192.168.1.254 255.255.255.0

  IP nat inside

  IP virtual-reassembly in

  !

  interface Vlan92

  Description fa6-nexus e100/0/40

  IP 100.100.200.1 255.255.255.0

  !

  interface Vlan93

  Description fa7-nexus e100/0/38

  IP 100.100.100.1 255.255.255.0

  !

  interface Dialer0

  no ip address

  No cdp enable

  !

  interface Dialer1

  IP 1.2.3.4 255.255.255.248

  IP mtu 1454

  NAT outside IP

  IP virtual-reassembly in max-pumping 256

  encapsulation ppp

  IP tcp adjust-mss 1414

  Dialer pool 1

  Dialer-Group 1

  Authentication callin PPP chap Protocol

  PPP chap hostname ~ ~ ~

  PPP chap password =.

  No cdp enable

  card crypto IT-IPSec-Crypto-map

  !

  Dialer-list 1 ip protocol allow

  !

  access-list 101 permit ip 100.100.100.0 0.0.0.255 any

  access-list 101 permit ip 100.100.200.0 0.0.0.255 any

  !

  IP route 0.0.0.0 0.0.0.0 Dialer1

  Yes correct sounds - so another possible problem is the routing is routing 100% correct on both sides? Can you put the two sides config for review?

• IPsec VPN between two routers - mode ESP Transport and Tunnel mode

  Hi experts,

  I have this question about the Transport mode and Tunnel mode for awhile.

  Based on my understanding of 'Transport' mode is not possible because you always original "internal" private in the IP headers or IP addresses. They are always different as public IP on interfaces enabled with Crypto Card addresses. When encapsulated in the VPN tunnel, the internal IP addresses must be included or the remote VPN router won't know where to forward the packet.

  To test, I built a simple GNS3 with three routers laboratory. R1 and R3 are configured as VPN routers and the R2 must simulate Internet.

  My configs are also very basic. The R2 is routing between 1.1.1.0/24 and 2.2.2.0/24. It is defined as the gateway of R1 and R3.

  R1:

  crypto ISAKMP policy 100
  BA aes
  preshared authentication
  Group 2
  ISAKMP crypto key 123456 address 2.2.2.2
  !
  Crypto ipsec transform-set ESP_null null esp esp-sha-hmac
  !
  10 map ipsec-isakmp crypto map
  defined peer 2.2.2.2
  transformation-ESP_null game
  match address VPN

  !

  list of IP - VPN access scope
  ip permit 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255
  !

  R3:

  crypto ISAKMP policy 100
  BA aes
  preshared authentication
  Group 2
  ISAKMP crypto key 123456 address 1.1.1.2
  !
  !
  Crypto ipsec transform-set ESP_null null esp esp-sha-hmac
  !
  10 map ipsec-isakmp crypto map
  defined peer 1.1.1.2
  transformation-ESP_null game
  match address VPN

  !

  list of IP - VPN access scope
  Licensing ip 10.0.0.0 0.0.0.255 192.168.1.0 0.0.0.255

  I configured transform-"null" value, while it will not encrypt the traffic.

  Then I tried the two 'transport' mode and mode "tunnel". I ping a host in the internal network of the R1 to another host in the internal network of the R3. I also tried 'telnet'. I also captured packets and carefully compared in both modes.

  Packets encapsulated in exactly the same way!

  It's just SPI + sequence No. + + padding

  I will attach my screenshots here for you guys to analyze it. I would be grateful for any explanation. I confused maybe just when it comes to the NAT...

  I guess my next step is to check if the two modes to make the difference when the GRE is used.

  Thank you

  Difan

  Hi Difan,

  As you point out the mode of transport is not always applicable (i.e. applicable if IP source and destination is equal to corresnpoding proxy IDs).

  A typical scenario in this mode of transport is used:

  -Encryption between two hosts

  -GRE tunnels

  -L2TP over IPsec

  Even if you set "transport mode" this does not mean that it will be used. IOS routers and I blieve also ASA will perform backup even if the mode of transport is configured but does not apply in tunnel mode.

  I can take a look at your traces to sniff, but all first can you please check if you transport mode on your ipsec security associations? "See the crypto ipsec his" exit you will show the tunnel or transport mode.

  HTH,

  Marcin

• NAT in the IPSec tunnel between 2 routers x IOS (877)

  Hi all

  We have a customer with 2 x 877 routers connected to the internet. These routers are configured with an IPSec tunnel (which works fine). The question is the inbound static NAT translation problems with the tunnel - port 25 is mapped to the address inside the mail server. The existing configuration works very well for incoming mail, but prevents users from access to the direct mail server (using the private IP address) on port 25.

  Here is the Config NAT:

  nat INET_POOL netmask 255.255.255.252 IP pool

  IP nat inside source map route INET_NAT pool INET_POOL overload

  IP nat inside source static tcp 10.10.0.8 25 25 expandable

  IP nat inside source static tcp 10.10.0.8 80 80 extensible

  IP nat inside source static tcp 10.10.0.8 443 443 extensible

  IP nat inside source static tcp 10.10.0.7 1433 1433 extensible

  IP nat inside source static tcp 10.10.0.7 extensible 3389 3389

  allowed INET_NAT 1 route map

  corresponds to the IP 101

  access-list 101 deny ip 10.10.0.0 0.0.0.255 192.168.1.0 0.0.0.255

  access-list 101 permit ip 10.10.0.0 0.0.0.255 any

  On the SAA, I would setup a NAT exemption, but how do I get the same thing in the IOS?

  See you soon,.

  Luke

  Take a look at this link:

  http://www.Cisco.com/en/us/docs/iOS/12_2t/12_2t4/feature/guide/ftnatrt.html

  Concerning

  Farrukh

• Multiple IPSec tunnels between two international research reports

  Hello, I have a no. 2851 to HQ and 2821 2nd site. Using IPSec VPN to connect two LANs and it works very well. Now, I want to connect another local network on each site through the same VPN. I want to separate the traffic between the LANs. Is this possible?

  You cannot use another crypto card if you must use the same IP for the peers you.

  If you have other addresses ip at each end to close the tunnel, you can use another crypto card.

  If the answer is no, then you can manipulate you acl of the traffic of interest to decide which lan can reach for witch lan.

• Problem on the establishment of a GRE/IPsec tunnel between 2 cisco routers

  Hello world

  I am trying to establish a GRE IPsec tunnel between two cisco routers (2620XM and a 836).

  I created a tunnel interfaces on both routers as follows.

  2620XM

  interface Tunnel0

  IP 10.1.5.2 255.255.255.252

  tunnel source x.x.x.x

  tunnel destination y.y.y.y

  end

  836

  interface Tunnel0

  IP 10.1.5.1 255.255.255.252

  tunnel source y.y.y.y

  tunnel destination x.x.x.x

  end

  and configuration of isakmp/ipsec as follows,

  2620XM

  crypto ISAKMP policy 10

  md5 hash

  preshared authentication

  ISAKMP crypto key {keys} address y.y.y.y no.-xauth

  !

  !

  Crypto ipsec transform-set esp - esp-md5-hmac to_melissia

  !

  myvpn 9 ipsec-isakmp crypto map

  defined peer y.y.y.y

  Set transform-set to_melissia

  match address 101

  2620XM-router #sh ip access list 101

  Expand the access IP 101 list

  10 permit host x.x.x.x y.y.y.y host will

  836

  crypto ISAKMP policy 10

  md5 hash

  preshared authentication

  ISAKMP crypto key {keys} address x.x.x.x No.-xauth

  !

  !

  Crypto ipsec transform-set esp - esp-md5-hmac to_metamorfosi

  !

  myvpn 10 ipsec-isakmp crypto map

  defined peer x.x.x.x

  Set transform-set to_metamorfosi

  match address 101

  836-router #sh access list 101

  Expand the access IP 101 list

  10 licences will host host x.x.x.x y.y.y.y

  Unfortunately I had no isakmp security associations at all and when I enter the debugging to this output.

  CRYPTO: IPSEC (crypto_map_check_encrypt_core): CRYPTO: removed package as currently being created cryptomap.

  Any ideas why I get this result? Any help will be a great help

  Thank you!!!

  I think it's possible. It seems to me that you are assuming that the address of the interface where goes the card encryption is peering address. While this is the default action, it is possible to configure it differently.

  As you have discovered the card encryption must be on the physical output interface. If you want the peering address to have a different value of the physical interface address outgoing, then you can add this command to your crypto card:

  card crypto-address

  so if you put loopback0 as the id_interface then he would use loopback0 as peering address even if the card encryption may be affected on serial0/0 or another physical interface.

  HTH

  Rick

• IPSEC tunnel between 2 7606 PE

  I am creating an IPSec tunnel between two 7606 PE routers... get this error when I ping everywhere and if I start using the path descends LDP.

  12 Nov 16:32:22.801 IS: IPSEC (key_engine): request timer shot: count = 1,.

  local (identity) = 10.10.135.1, distance = 10.10.135.2.

  local_proxy = 10.10.0.0/255.255.0.0/0/0 (type = 4),

  remote_proxy = 10.10.0.0/255.255.0.0/0/0 (type = 4)

  12 Nov 16:32:22.801 IS: IPSEC (sa_request):,.

  (Eng. msg key.) Local OUTGOING = 10.10.135.1, distance = 10.10.135.2.

  local_proxy = 10.10.0.0/255.255.0.0/0/0 (type = 4),

  remote_proxy = 10.10.0.0/255.255.0.0/0/0 (type = 4),

  Protocol = ESP, transform = NONE (Tunnel),

  lifedur = 190 s and 4608000 Ko,.

  SPI = 0 x 0 (0), id_conn = 0, keysize = 256, flags = 0 x 0

  12 Nov 16:32:22.801 IS: ISAKMP: (0): profile of ITS application is test

  12 Nov 16:32:22.801 IS: ISAKMP: created a struct peer 10.10.135.2, peer port 500

  12 Nov 16:32:22.801 IS: ISAKMP: new position created post = 0x5326A08C peer_handle = 0x8000001A

  12 Nov 16:32:22.801 IS: ISAKMP: lock struct 0x5326A08C, refcount 1 to peer isakmp_initiator

  12 Nov 16:32:22.801 IS: ISAKMP: 500 local port, remote port 500

  12 Nov 16:32:22.801 IS: ISAKMP: impossible to allocate IKE SA

  12 Nov 16:32:22.801 IS: ISAKMP: Unlocking counterpart struct 0x5326A08C for isadb_unlock_peer_delete_sa(), count 0

  12 Nov 16:32:22.801 IS: ISAKMP: delete peer node by peer_reap for 10.10.135.2: 5326A08C

  12 Nov 16:32:22.801 IS: ISAKMP: (0): purge SA., his = 0, delme = 532E8364

  PE2 #.

  12 Nov 16:32:22.801 IS: ISAKMP: error during the processing of HIS application: failed to initialize SA

  12 Nov 16:32:22.801 IS: ISAKMP: error while processing message KMI 0, error 2.

  12 Nov 16:32:22.801 IS: IPSEC (key_engine): had an event of the queue with 1 KMI message (s)

  PE2 #.

  12 Nov 16:32:52.801 IS: IPSEC (key_engine): request timer shot: count = 2,.

  local (identity) = 10.10.135.1, distance = 10.10.135.2.

  local_proxy = 10.10.0.0/255.255.0.0/0/0 (type = 4),

  remote_proxy = 10.10.0.0/255.255.0.0/0/0 (type = 4)

  IPsec only is not supported on the 6500 and 7600 without module series IPsec (IPsec-SPA or VPNSM), sorry.

• IPSec Tunnel between Cisco 2801 and Netscren 50 with NAT and static

  Hello

  My problem isn't really the IPSec connection between two devices (it is already done...) But my problem is that I have a mail server on the site of Cisco, who have a static NAT from inside to outside. Due to the static NAT, I do not see the server in the VPN tunnel. I found a document that almost describes the problem:

  "Configuration of a router IPSEC Tunnel private-to-private network with NAT and static" (Document ID 14144)

  NAT takes place before the encryption verification!

  In this document, the solution is 'routing policy' using the loopback interface. But, how can I handle this with the Netscreen firewall. Someone has an idea?

  Thanks for any help

  Best regards

  Heiko

  Hello

  Try to change your static NAT with static NAT based policy.

  That is to say the static NAT should not be applicable for VPN traffic

  permissible static route map 1

  corresponds to the IP 104

  access-list 104 refuse host ip 10.1.110.10 10.1.0.0 255.255.0.0

  access-list 104 allow the host ip 10.1.110.10 all

  IP nat inside source static 10.1.110.10 81.222.33.90 map of static route

  HTH

  Kind regards

  GE.

• IPSec tunnels between duplicate LAN subnets

  Hi all

  Please help to connect three sites with our Central site has all the resources for users, including internet access.

  The three sites will be the ASA 5505 like their WAN device.

  We need to know is - it possible, allowing to configure an IPsec Tunnel between the three ASA with duplicate LAN subnets.

  Central site two networks 192.168.1.x 24, 192.168.100.x 24

  Distance a 24 192.168.1.x subnet

  Two remote a subnet 192.168.100.x 24

  If it is possible we also do hair distance one ping, above two remote to the Central Site to access internet, what sites need are on the Central Site, including e-mail, network, other resource also records.

  We have no other way to make this network, as all security is on our Central Site, website filtering, Application filtering, filtering of network traffic all.

  We understand that we can change two remote sites to a different subnet from the Central Site, but we have so many host devices, it will take weeks or months, so to change the MS AD domain for all users, servers too.

  We really need your expertise to do this in a laboratory and then in production.

  Thank you

  Hello Stephen,

  You can check the following links for the subnets overlap talk to each other:-

  1 LAN-to-LAN IPsec VPN with overlapping networks

  http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a0080b37d0b.shtml

  2 IPsec between two IOS routers with overlapping of private networks

  http://www.Cisco.com/en/us/products/ps5855/products_configuration_example09186a0080a0ece4.shtml

  Important point is local network must connect to the remote network via the translated addresses.

  for example, you won't be ablt to use real IP of the communication.

  For haripinning or turning U:

  http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a00805734ae.shtml

  Hope that helps.

  Kind regards

  Dinesh Moudgil

• VPN between 2 routers Cisco 1841 (LAN to LAN)

  Hello

  I need to connect two offices (two different LAN) using routers cisco 1841 at both ends.

  Currently the two cisco router are in working condition and refer the internet LAN clients. (making the NAT).

  Can someone please tell us what is the easiest way to set up a VPN between two sites, so that LAN users to an office to access mail servers electronic/request to the office LAN.

  I understand that I need IPSec Site to Site VPN (I think).

  Anyonce can you please advise.

  Kind regards.

  s.nasheet wrote:
  Hi ,
  I need to connect two offices ( two different LAN's) together using cisco 1841 routers at both end.
  Currently both cisco router are in working order and  acting as a internet gateway to the LAN clients. ( doing NAT).
  Can anybody please advise what is the easiest method to configure VPN between two sites so that  LAN users at one office be able to access  the  email/application servers at the other LAN office.
  I understand I need IPSec Site to Site VPN  ( i think).
  Can anyonce please advise.
  Regards.
  

  Yes, you need a VPN site-to site. Start with this link which gives a number of examples to set up a VPN S2S between 2 routers Cisco.

  http://www.Cisco.com/en/us/Tech/tk583/TK372/tech_configuration_examples_list.html#anchor16

  Jon

• IPSec tunnel between a client connection mobility and WRV200

  Someone has set up an IPSec tunnel between a client connection mobility and WRV200? I can't get the right configuration.

  Agitation, these products are treated by the Cisco Small Business support community. Please refer to the URL: https://supportforums.cisco.com/community/netpro/small-business

• Tunnel of sIte establishing btn two routers cisco 1721

  Hello

  I need to establish IPSec site to site tunnel between cisco 1721 (version supports for IPSec). U can help me to set up the basic configuration.

  The network diagram is standard. The objective of the implementation is to establsih a communication between two end counterparts.

  IE LAN---> router---> Internet--->---> LAN router

  Thanks in advance

  Concerning

  RAMU

  Of course, here is an example configuration for VPN Site to Site tunnel between 2 IOS routers:

  http://www.Cisco.com/en/us/Tech/tk583/TK372/technologies_configuration_example09186a0080194650.shtml

  Hope that helps.

• Double IPSec tunnel between routers

  I am facing the following challenge:

  I have two routers and want to build two IPSec encapsulated between them, with the help of ASIT tunnel interfaces.

  The interaces two tunnel would in that case the same source and destination ip addresses.

  With a single tunnel interface defined, it works well, however, as soon as the second tunnel interface is defined, the first breaks down.

  Here is an example configuration:

  interface Tunnel0
  IP 192.168.1.1 255.255.255.252
  source of tunnel Serial1/0
  tunnel destination 10.1.1.6
  ipv4 ipsec tunnel mode
  protection of ipsec profile ipsecprofile tunnel
  !
  Tunnel1 interface
  IP 192.168.1.5 255.255.255.252
  source of tunnel Serial1/0
  tunnel destination 10.1.1.6
  ipv4 ipsec tunnel mode
  protection of ipsec profile ipsecprofile tunnel
  !

  In fact, the matter is rather a conceptual issue than a direct. What is the root cause, this type of configuration does not work?

  ESP protocol is the distinction between endponits ESP SAs based on SPI identifier as well, isn't? If so, what is wrong here?

  Thanks in advance...

  Hi Frank,.

  As a general rule, you cannot have two interfaces of tunnel with the same tunnel source (series 1/0) and destinations (10.1.1.6) tunnel; with the same method (ipv4) tunel.

  The work around that would be to bounce one of the tunnels on a loopback interface.

  This tunnel 1: tunnel_interface_1 - series 1/0---internet---10.1.1.6

  and tunnel 2: tunnel_interface_2---loopback---serial1/0---internet---10.1.1.6

  In this way the two tunnels can be up at the same time.

  I hope this helps.

  -Shrikant

  P.S.: Please check question one answer, if it has been resolved. Note the useful messages. Thank you.

• ASA 5505 - I can't create an IPSEC VPN between two ASA 5505

  Hello

  I have two ASA 5505 with basic license and I'm trying to create a VPN IPSEC using the CLI. Here are the steps I did:

  1 Configure ASA-1 (host name, vlan 1 and vlan 2).

  2. configure a static route

  3. create object network (local and remote)

  4. create the access list

  5. create ikev1 crypto

  6. create tunnel-group

  7 Configure nat

  and I repeat the steps above with the ASA but another change IP.

  Are to correct the above steps?

  Why can I not create an IPSEC VPN between devices?.

  No, you needn't. The ASA configuration is ok. Packet trace proved it. I think it can be a problem on the hosts. Please, check the firewall on the PC and try to put out of service, if it is running.