Redirect peer tunnel VPN L2L ina

Question of curiosity... I have 2 new ASA5515 which I put up for an improvement of the equipment. In the time before I swap them I am using them as a sort of laboratory of fortune to get him going to setup VPN L2L. I didn't use current IP addresses for the test environment, so I used false numbers.

My question is: can I go back and change the IP address peer and address local/remote without having to tear them up to specifications plant again?

-Do I have reprint just the type of Tunnel-Group IPsec-l2l X.X.X.X command with the IP address?

I know that there are a few other of the region that I have to change the IP of both peers, but just of my question is, I can do or do I have to start over?

-Jon

Jon

You should not reconfigure from scratch if that's what you're asking.

You just need to change the peer IPs everywhere where they appear in your configuration.

Jon

Tags: Cisco Security

Similar Questions

Tunnel VPN L2L with NATTing will not allow traffic which will be initiated by spoke to the hub.

Traffic from internal hosts will NAT address works ok, but what speaks tests it traffic never connects.

get the 10.1.12.232 NAT host would be 172.27.63.133 and past through the VPN tunnel to 10.24.4.65 without problem. However when 10.24.4.65 tries to ping or connect to 172.27.63.133 traffic does not make inside host 10.1.12.232

ASA-1 #.
!
network object obj - 172.27.73.0
172.27.73.0 subnet 255.255.255.0
network object obj - 172.27.63.0
172.27.63.0 subnet 255.255.255.0
network object obj - 10.1.0.0
10.1.0.0 subnet 255.255.0.0
network object obj - 10.24.4.64
subnet 10.24.4.64 255.255.255.224
network object obj - 172.27.73.0 - 172.27.73.255
range 172.27.73.0 172.27.73.255
the object of the 10.0.0.0 network
subnet 10.0.0.0 255.0.0.0
network object obj - 24.173.237.212
Home 24.173.237.212
network object obj - 10.1.12.232
Home 10.1.12.232
network object obj - 172.27.63.133
Home 172.27.63.133
the DM_INLINE_NETWORK_9 object-group network
object-network 10.0.0.0 255.255.255.0
object-network 10.0.11.0 255.255.255.0
object-network 10.0.100.0 255.255.255.0
object-network 10.0.101.0 255.255.255.0
object-network 10.0.102.0 255.255.255.0
object-network 10.0.103.0 255.255.255.0
the DM_INLINE_NETWORK_16 object-group network
object-network 10.1.11.0 255.255.255.0
object-network 10.1.12.0 255.255.255.0
object-network 10.1.13.0 255.255.255.0
object-network 10.1.3.0 255.255.255.0
!
outside_1_cryptomap list extended access permitted ip object-group DM_INLINE_NETWORK_16-group of objects DM_INLINE_NETWORK_9
access extensive list ip 172.27.73.0 outside_8_cryptomap allow 255.255.255.0 10.24.4.64 255.255.255.224
access extensive list ip 172.27.63.0 outside_8_cryptomap allow 255.255.255.0 10.24.4.64 255.255.255.224
!
list of allowed outside access extended ip 10.24.4.64 255.255.255.224 172.27.63.0 255.255.255.0
list of allowed outside access extended ip 10.24.4.64 255.255.255.224 10.1.0.0 255.255.0.0
list of allowed outside access extended ip 172.27.63.0 255.255.255.0 10.1.0.0 255.255.0.0
!
NAT (inside, all) source static obj - 172.27.73.0 obj - 172.27.73.0 destination static obj - 10.24.4.64 obj - 10.24.4.64 no-proxy-arp-search to itinerary
NAT (inside, all) source static obj - 172.27.63.0 obj - 172.27.63.0 destination static obj - 10.24.4.64 obj - 10.24.4.64 no-proxy-arp-search to itinerary
NAT (inside, outside) source dynamic obj - 10.66.0.0 obj - 172.27.73.0 - 172.27.73.255 destination static obj - 10.24.4.64 obj - 10.24.4.64
NAT (inside, outside) source dynamic obj - 10.70.0.0 obj - 172.27.73.0 - 172.27.73.255 destination static obj - 10.24.4.64 obj - 10.24.4.64
NAT (inside, outside) source dynamic obj - 10.96.228.0 obj - 172.27.73.0 - 172.27.73.255 destination static obj - 10.24.4.64 obj - 10.24.4.64
NAT (inside, outside) source dynamic obj - 10.96.229.0 obj - 172.27.73.0 - 172.27.73.255 destination static obj - 10.24.4.64 obj - 10.24.4.64
NAT (inside, outside) source dynamic obj - 192.168.5.0 obj - 172.27.73.0 - 172.27.73.255 destination static obj - 10.24.4.64 obj - 10.24.4.64
NAT (inside, outside) source dynamic obj - 10.75.0.0 obj - 172.27.73.0 - 172.27.73.255 destination static obj - 10.24.4.64 obj - 10.24.4.64
NAT (inside, outside) source dynamic obj - 10.11.0.0 obj - 172.27.73.0 - 172.27.73.255 destination static obj - 10.24.4.64 obj - 10.24.4.64
NAT (inside, outside) source static obj - 10.1.3.37 obj - 10.71.0.37 destination static obj - 50.84.209.140 obj - 50.84.209.140
NAT (inside, outside) source static obj - 10.1.3.38 obj - 10.71.0.38 destination static obj - 50.84.209.140 obj - 50.84.209.140
NAT (inside, outside) source static obj - 10.1.12.232 obj - 172.27.63.133 destination static obj - 10.24.4.64 obj - 10.24.4.64
NAT (inside, outside) source dynamic obj - 10.1.0.0 obj - 172.27.73.0 - 172.27.73.255 destination static obj - 10.24.4.64 obj - 10.24.4.64
!
NAT (exterior, Interior) source static obj - 10.24.4.64 obj - 10.24.4.64 destination static obj - 172.27.63.133 obj - 10.1.12.232
NAT (outside, outside) source static obj - 10.24.4.64 obj - 10.24.4.64 destination static obj - 172.27.63.133 obj - 10.1.12.232

the object of the 10.0.0.0 network
NAT (inside, outside) dynamic obj - 24.173.237.212
!
NAT (VendorDMZ, outside) the after-service automatic source dynamic obj - 192.168.13.0 obj - 24.173.237.212
outside access-group in external interface
Route outside 0.0.0.0 0.0.0.0 24.173.237.209 1
Route inside 10.1.0.0 255.255.0.0 10.1.10.1 1
Route inside 10.2.1.0 255.255.255.248 10.1.10.1 1
!
Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
Crypto ipsec transform-set ikev1 ESP-3DES-SHA-DH2-esp-3des esp-sha-hmac
Crypto ipsec pmtu aging infinite - the security association
!
card crypto GEMed 8 corresponds to the address outside_8_cryptomap
card crypto GEMed 8 set peer 64.245.57.4
card crypto GEMed 8 set ikev1 transform-set ESP-AES-256-SHA ESP-AES-256-MD5
GEMed outside crypto map interface
!
: end
ASA-1 #.

Hello

First of all, I would like to remove these two lines because they do nothing productive
```
nat (outside,inside) source static obj-10.24.4.64 obj-10.24.4.64 destination static obj-172.27.63.133 obj-10.1.12.232nat (outside,outside) source static obj-10.24.4.64 obj-10.24.4.64 destination static obj-172.27.63.133 obj-10.1.12.232
```
Then, I was running packet - trace to see what NAT rule actually hit you.
```
packet-tracer input inside 10.1.12.232 12345 10.24.4.65 12345
```

Problem with Tunnel VPN L2L between 2 ASA´s

Hi guys,.

I have some problems with my VPN Site to site tunnel between 2 ASA (5520/5505).

I watched a lot of videos on youtube, but I can't find out why the tunnel does not...

Both devices can ping eachothers WAN IP address (outside interfaces), but I don't see any traffic between the 2 sites. It seems that the tunnel is not open to everyone. When i PING from the local to the Remote LAN (which should be an interesting traffic for the tunnel...), the its IKEv1 remains empty...

Am I missing something? I can't understand it more why same phase 1 is not engaged.

You NAT won't. In your config file traffic is NATted initially and then does not match any more crypto ACL. You must move the rule dynamic NAT/PAT until the end of the table on two ASAs NAT:
```
 no nat (INSIDE,OUTSIDE) source dynamic any interface nat (INSIDE,OUTSIDE) after-auto source dynamic any interface
```

ASA IPP on VPN L2L w/NAT

I have a tunnel VPN L2L on a Cisco ASA 5520 I am trying to get IPPS, to work on. On my ACL cryptomap I defined a local group object and a remote object-group, and I'm the one-to-one NAT scene on the local group. I also have a configured route map that will take the static routes and redistribute in my ACE. EIGRP two things - 1, I noticed, I don't see on my ASA static routes that point to remote subnets and 2, the ACL that I used in my definition of route map is not getting any hits on it.

Any thoughts on where I can go wrong?

Thank you

Darren

You have configured the following:

crypto set reverse-road map

If you do, can you remove and Add again and see if that fixes the problem?

Router w / Tunnel dynamic L2L and Clients VPN

I have a 7200 router currently configured w / vpn clients. I'm looking to add a tunnel dynamic l2l. When I do, I am more able to connect using the vpn client. I following the configuration the following URL.

http://Cisco.com/en/us/Tech/tk583/TK372/technologies_configuration_example09186a00801dddbb.shtml

As soon as I add...

Crypto-map dynamic dynmap 5

Define VPNclient isakmp-profile

the vpn client no longer works. Have not access to the config right now as I took it. Someone at - it it works correctly?

Okay, mhhh I think that this is a problem with the configuration, give a shot at one of the L2L bouncing, set it to the profile and the keychain, which is the result.

Using VPN L2L static and dynamic dedicated tunnels

We have an ASA 5510 running 8.0 at our company headquarters. We have remote sites who need to create VPN L2L at the HQ ASA tunnels. Some remote sites have static IP addresses and others have dynamic IP addresses.

I found documentation Cisco L2L static IP VPN tunnels and make them work. I found another Cisco documentation for static IP dynamic L2L VPN tunnels using the tunnel-group "DefaultL2LGroup".

My question is, can you have two types of tunnels on the same ASA L2L? If so, simply by using the definitions of "DefaultL2LGroup" tunnel-group and of tunnel-group work? Is there a reason to not do? Is better technology (ASA HQ and a combination of ASA 5505 and 1861 at remote sites) available?

Yes, you can have both types of tunnels L2L. If you use a PSK - remember that the IP address of the remote site is used to 'validate' to connect to Headquarters. As long as you use a sure PSK = 64 characters and all with upper/lower case alpha numeric - you should be OK.

A better way to do it - is to get the static IP addresses for the site that currently have DHCP from ISP.

HTH >

Question of redundancy VPN l2l using 2811 as endpoint devices

I have a new implementation of VPN L2L passes using two 2811 s than VPN terminal devices. I'll try to use the HSRP address between the public interfaces of both routers as VPN peer address. The problem that I found during the test is that the tunnel will become active and debugs watch the HSRP address as an invalid address to form the tunnel. Have a work-around, or a better plan for redundancy on peering address using similar devices? Thanks in advance.

Take a look at this doc about IOS IPSec HA.

http://www.Cisco.com/en/us/docs/iOS/security/configuration/guide/sec_vpn_ha_enhance_ps6922_TSD_Products_Configuration_Guide_Chapter.html#wp1039849

Do not do a ping ASA inside IP port of the remote site VPN L2L with her

The established VPN L2L OK between ASA-1/ASA-2:

ASA-2# see the crypto isakmp his

KEv1 SAs:

ITS enabled: 1

Generate a new key SA: 0 (a tunnel report Active 1 and 1 to generate a new key during the generate a new key)

Total SA IKE: 1

1 peer IKE: 207.140.28.102

Type: L2L role: answering machine

Generate a new key: no State: MM_ACTIVE

There are no SAs IKEv2

QUESTION: 3750-2, we ping 3750-1 (10.10.2.253) are OK, but not ASA-1 inside port (10.10.2.254).

Debug icmp ASA-1 data:

ASA-1 debug icmp trace #.

trace of icmp debug enabled at level 1

Echo ICMP Internet request: 10.100.2.252 server: 10.10.2.253 ID = 400 seq = 0 len = 72

ICMP echo response from the server: 10.10.2.253 Internet: 10.100.2.252 ID = 400 seq = 0 len = 72

Echo ICMP Internet request: 10.100.2.252 server: 10.10.2.253 ID = 400 seq = 1 len = 72

ICMP echo response from the server: 10.10.2.253 Internet: 10.100.2.252 ID = 400 seq = 1 len = 72

Echo request ICMP 10.100.2.252 to 10.10.2.254 ID = 401 seq = 0 len = 72

Echo request ICMP 10.100.2.252 to 10.10.2.254 ID = 401 seq = 1 len = 72

Echo request ICMP 10.100.2.252 to 10.10.2.254 ID = 401 seq = 2 len = 72

Make sure you have access to the administration # inside

lt me know f This allows.

VPN l2l failed inside on ASA 5520 (8.02)

VPN l2l is dropping packets to Phase 5 because of a rule configured. I have an isakmp his but the client cannot connect to the destination here in my network. I'll post my config to access list at the bottom of the Packet-trace output.

vpnASA01 # entry packet - trace within the icmp [10.0.0.243] 0 8 10.97.29.73 det

Phase: 1

Type: CAPTURE

Subtype:

Result: ALLOW

Config:

Additional information:

Direct flow from returns search rule:

ID = 0xc92087c8, priority = 12, area = capture, deny = false

hits = 85188209121, user_data = 0xc916a478, cs_id = 0 x 0, l3_type = 0 x 0

Mac SRC = 0000.0000.0000, mask is 0000.0000.0000

DST = 0000.0000.0000 Mac, mask is 0000.0000.0000

Phase: 2

Type: ACCESS-LIST

Subtype:

Result: ALLOW

Config:

Implicit rule

Additional information:

Direct flow from returns search rule:

ID = 0xc87f1f98, priority = 1, domain = allowed, deny = false

hits = 85193048387, user_data = 0 x 0, cs_id = 0 x 0, l3_type = 0 x 8

Mac SRC = 0000.0000.0000, mask is 0000.0000.0000

DST = 0000.0000.0000 Mac, mask is 0000.0000.0000

Phase: 3

Type: FLOW-SEARCH

Subtype:

Result: ALLOW

Config:

Additional information:

Not found no corresponding stream, creating a new stream

Phase: 4

Type:-ROUTE SEARCH

Subtype: entry

Result: ALLOW

Config:

Additional information:

in 10.0.0.0 255.0.0.0 inside

Phase: 5

Type: ACCESS-LIST

Subtype:

Result: DECLINE

Config:

Implicit rule

Additional information:

Direct flow from returns search rule:

ID = 0xc87f3670, priority = 111, domain = allowed, deny = true

hits = 67416, user_data = 0 x 0, cs_id = 0 x 0, flags = 0 x 4000, protocol = 0

SRC ip = 0.0.0.0 mask 0.0.0.0, port = 0 =

DST ip = 0.0.0.0 mask 0.0.0.0, port = 0 =

Result:

input interface: inside

entry status: to the top

entry-line-status: to the top

the output interface: inside

the status of the output: to the top

output-line-status: to the top

Action: drop

Drop-reason: flow (acl-drop) is denied by the configured rule

= ACCESS-LIST + Config =.

the object-group L2LVPN-blah_local network
network-object 10.97.29.73 255.255.255.255
the object-group L2LVPN-blah_remote network
network-object [10.0.0.240] 255.255.255.240

INBOUND_OUTSIDE list of allowed ip extended access object-L2LVPN-blah_remote L2LVPN-blah_local group object

L2LVPN-blah_obj allowed extended ip access-list object-L2LVPN-blah_local group L2LVPN-blah_remote

access-list SHEEP extended permits all ip [10.0.0.243] 255.255.255.240

Route outside [10.0.0.240] [10.97.29.1] 255.255.255.240 1

address for correspondence card crypto outside-VPN 46 L2LVPN - blah_obj
peer set card crypto VPN-exterior 46 [10.0.0.243]
outside-VPN 46 transform-set esp-sha-aes-256 crypto card
outside-VPN interface card crypto outside

IPSec-l2l type tunnel-group [10.0.0.243]
IPSec-attributes of tunnel-group [10.0.0.243]
pre-shared-key *.

[10.0.0.1] is to protect the global addresses of clients. Assume that these are still used in place of the current range of intellectual property. 10.0.0.240/28

===========================================

Thanks in advance.

Michael Garcia

Profit Systems, Inc..

Hi Michael,

-Is the IP peer really part of the network that make up the field of encryption?

-Is the ACL INBOUND_OUTSIDE applied (incoming) inside or outside interface (inbound)? It is the current form, it would need to be on the external interface.

-You specify the peer IP only in the ACL SHEEP, so all other traffic is NAT would and eventually denied because it does not match the field of encryption

Someone else may have a few ideas, but these are questions I have for the moment.

James

Policy NAT for VPN L2L

Summary:

We strive to establish a two-way VPN L2L tunnel with a partner. VPN traffic is one-to-many towards our partner, and our partner they need of a many-to-one to us (they need to access a host on our network). In addition, our partner has many VPN, so they force us to use a separate NAT with two private hosts addresses, one for each direction of the tunnel.

My initial configuration of the tunnel on my grown up side of Phase 1, but not IPSec. Partner ran debug that revealed that my host did not address NAT'd in the NAT policy. We use an ASA5520, ver 7.0.

Here is the config:

# #List of OUR guests

the OURHosts object-group network

network-host 192.168.x.y object

# Hosts PARTNER #List

the PARTNERHosts object-group network

network-host 10.2.a.b object

###ACL for NAT

# Many - to - many outgoing

access-list extended NAT2 allowed ip object-group OURHosts-group of objects PARTNERHosts

# One - to - many incoming

VIH3 list extended access permit ip host 192.168.c.d PARTNERHosts object-group

# #NAT

NAT (INSIDE) 2-list of access NAT2

NAT (OUTSIDE) 2 172.20.n.0

NAT (INSIDE) 3 access-list VIH3

NAT (OUTSIDE) 3 172.20.n.1

# #ACL for VPN

access list permits extended VPN ip object-group objects PARTNERHosts OURHosts-group

access allowed extended VPN ip host 192.168.c.d PARTNERHosts object-group list

# #Tunnel

tunnel-group type ipsec-l2l

card <#>crypto is the VPN address

card crypto <#>the value transform-set VPN

card <#>crypto defined peer

I realize that the ACL for the VPN should read:

access allowed extended VPN ip host 172.20.n.0 PARTNERHosts object-group list

access allowed extended VPN ip host 172.20.n.1 PARTNERHosts object-group list

.. . If the NAT was working properly, but when this ACL is used, Phase 1 is not even negotiating, so I know the NAT is never translated.

What am I missing to NAT guests for 172.20 addresses host trying to access their internal addresses via the VPN?

Thanks in advance.

Patrick

Here is the order of operations for NAT on the firewall:

1 nat 0-list of access (free from nat)

2. match the existing xlates

3. match the static controls

a. static NAT with no access list

b. static PAT with no access list

4. match orders nat

a. nat [id] access-list (first match)

b. nat [id] [address] [mask] (best match)

i. If the ID is 0, create an xlate identity

II. use global pool for dynamic NAT

III. use global dynamic pool for PAT

If you can try

(1) a static NAT with an access list that will have priority on instruction of dynamic NAT

(2) as you can see on 4A it uses first match with NAT and access list so theoretically Exchange autour should do the trick.

I don't see any negative consequences? -Well Yes, you could lose all connectivity. I don't think that will happen, but I can't promise if you do absolutely not this after-hours.

Jon

Tunnel VPN site to Site - aggressive Mode

I searched the community for answers to this and that you have not found quite what I was looking for (or what seems logical). I have an ASA 5510 to A site with one website VPN tunnel to a SonicWall to site B. Which works very well. I need to create a tunnel for site C to site a using a tunnel of aggressive mode. I'm not quite sure how to do this. Any suggestion would be great!

NOTE: I have included the parts of the running configuration that seem relevant to me. If I missed something please let me know.

ASA Version 8.2 (1)

interface Ethernet0/0

nameif outside

security-level 0

IP 1.2.3.4 255.255.255.248

!

10.5.2.0 IP Access-list extended site_B 255.255.255.0 allow 10.205.2.0 255.255.255.128

access extensive list ip 10.5.2.0 site_C allow 255.255.255.0 10.205.2.128 255.255.255.128

dynamic-access-policy-registration DfltAccessPolicy

Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

Crypto ipsec transform-set esp-3des esp-sha-hmac 3des-sha1

life crypto ipsec security association seconds 28800

Crypto ipsec kilobytes of life - safety 4608000 association

crypto VPN 30 card matches the address site_B

card crypto VPN 30 peer set 4.3.2.1

crypto VPN 30 the transform-set 3des-sha1 value card

card crypto VPN 40 corresponds to the address site_C

card crypto VPN. 40 set peer 8.7.6.5

crypto VPN. 40 the transform-set 3des-sha1 value card

crypto ISAKMP allow outside

crypto ISAKMP policy 10

preshared authentication

3des encryption

sha hash

Group 2

life 86400

Crypto isakmp nat-traversal 30

crypto ISAKMP ipsec-over-tcp port 10000

attributes of Group Policy DfltGrpPolicy

Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn

tunnel-group 4.3.2.1 type ipsec-l2l

4.3.2.1 tunnel-group ipsec-attributes

pre-shared-key *.

tunnel-group 8.7.6.5 type ipsec-l2l

IPSec-attributes tunnel-group 8.7.6.5

pre-shared-key *.

David,

Please try this:

clear crypto ipsec its peer site_c_IP

clear configure VPN 40 crypto card

card crypto VPN 10 corresponds to the address site_C

card crypto VPN 10 set peer 8.7.6.5

crypto VPN 10 the transform-set 3des-sha1 value card

debug logging in buffered memory

capture drop all circular asp type

capture capin interface inside the match ip 10.5.2.0 255.255.255.0 10.205.2.128 255.255.255.128

After generating the traffic and INTERNAL of the machine behind the ASA:

view Journal | 10.205.2 Inc.

See the fall of cap. 10.205.2 Inc.

view Cape capin

In case it does not work:

(a) show the crypto classic table ASP.

(b) details of vpn-framework for table ASP.

(c) show cry its site_c peer ipsec

(d) entry packet - trace within the icmp 10.5.2.15 8 0 10.205.2.130 detail

(e) see the crypto ipsec his

At the same time, please.

Let me know how it goes.

Thank you

Portu.

Please note all useful posts

Design of VPN L2L ASA question

We expect to have more than 10,000 remote VPN L2L clients.

I see that each crypto card needs a statement of 'same game' and the IP address is the address of the remote peer VPN L2L.

:

EX:

card encryption UNI-POP 3 set peer 172.23.0.3

: . . .

card crypto UNI-POP 10000 set peer 172.26.0.250

:

I already feel that this will be a VERY long config, maybe too big to save/read/from memory.

:

Anyone would be a better approach?

Thank you

Frank

Frank,

If the remote end will run only from time to time, you should not have set peer statements and normally it would suffice to have a dynamic encryption card.

If the remote ends do not support certificates, it is possible to land on defaultl2l tunnel-group.
```
bsns-asa5505-19# sh run all tunnel-group
tunnel-group DefaultL2LGroup type ipsec-l2l
tunnel-group DefaultL2LGroup general-attributes
(...)
```
You need to test yourself to see if it will work.

I also agree in terms of more than one firewall. With devices for two in the load balancing or if possible 2pairs of devices in the failover cluster could be great way to have a decent charge by machine and equipment redundancy (ideal circumstances]);. I suggest you ping your system engineer for sure any deployment involving 5585, guys can usually give good advice (and discounts;]).

Marcin

VPN L2L dynamic to static w/o DefaultL2LGroup

I was looking for a method to have a VPN L2L static dyn without using DefaultL2LGroup but to set in place several groups of tunnel for each router with a dynamic IP address. Many people say it is not possible, but I found this guide: http://inetpro.org/wiki/LAN-to-LAN_IPSec_VPN_between_PIX/ASA_7.2_hub_and_IOS_spokes_with_dynamic_IP_addresses

Now the problem: the vpn rises, but I can't reach any device with a ping.

Side static: ASA 5505 - 8.22

Side Dynamics: Zyxel P-661HW-D3

Here is the config for the SAA:
```
access-list outside extended permit icmp any any

    access-list outside extended deny ip any any

    access-list inside extended permit ip 10.1.0.0 255.255.248.0 10.51.10.0 255.255.255.0

    access-list inside extended deny ip any any

    access-list VPN extended permit ip 10.1.0.0 255.255.248.0 10.51.10.0 255.255.255.0

    access-list ST_3710 extended permit ip 10.1.0.0 255.255.248.0 10.51.10.0 255.255.255.0
nat (inside) 0 access-list VPN

    nat (inside) 1 10.1.0.0 255.255.248.0
access-group inside in interface inside

    access-group outside in interface outside
crypto ipsec transform-set myset esp-3des esp-md5-hmac

    crypto ipsec security-association lifetime seconds 28800

    crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map DN3710 1 match address ST_3710

    crypto dynamic-map DN3710 1 set transform-set myset
crypto map dyn-map 2 ipsec-isakmp dynamic DN3710

    crypto map dyn-map interface outside
crypto isakmp enable outside
crypto isakmp policy 10

    authentication pre-share

    encryption 3des

    hash md5

    group 2

    lifetime 86400
crypto isakmp policy 20

    authentication pre-share

    encryption des

    hash md5

    group 2

    lifetime 86400

    no crypto isakmp nat-traversal
group-policy GP3710 internal

    group-policy GP3710 attributes

    vpn-filter value ST_3710

    vpn-tunnel-protocol IPSec
tunnel-group TG3710 type ipsec-l2l

    tunnel-group TG3710 general-attributes

    default-group-policy GP3710

    tunnel-group TG3710 ipsec-attributes

    pre-shared-key *********
```
As you can see it the vpn is in place:
```
2   IKE Peer: ***.***.***.***

        Type    : L2L             Role    : responder

        Rekey   : no              State   : AM_ACTIVE
```
Thanks in advance if anyone can help me with this problem.

Kind regards

Luca

Hello Luca,

You have reason for it, you can have the spokes of landing on a separate tunnel-groups, not only for the DefaultL2LGroup, the ASA follows this sequence when making a tunnel-group looup for L2L tunnels with pre-shared keys:

- ike-id verified first and could be (full fqdn) host name or IP address

-If ike-id search fails ASA tent peer IP address

-DefaultRAGroup/DefaultL2LGroup is used as a last resort

The output of your "sh cry isa his" I can see that at least Phase 1 is in place for your tunnel, please make sure that it landed on the correct tunnel-group.

The problem I see clearly here is the VPN filter that you have applied Group Policy, keep in mind that we must apply filters on incoming management vpn.

When a vpn-filter is applied to a political group that governs a LAN to LAN VPN connection, the ACL must be configured with the
remote network in the position of the ACL src_ip and LAN in the position of dest_ip of the ACL. Be careful during the construction of the
ACL for use with the vpn-filter feature. The ACL are built with traffic after decrypted in mind, however, they are also applied to the traffic
in the direction opposite.

In your case, the remote network is 10.51.10.0 255.255.255.0 and the local network 10.1.0.0 255.255.248.0. so let's say you want to allow just telnet:

The following ACE will allow remote Telnet network for LAN:

permit access-list vpnfilt-l2l 10.51.10.0 255.255.255.0 10.1.0.0 255.255.248.0 eq 23

The following ACE will allow LAN to Telnet to the remote network:
permit access-list vpnfilt-l2l 10.0.0.0 255.255.255.0 eq 23 10.1.0.0 255.255.248.0

Note: The ACE access-list vpnfilt-l2l allowed 10.51.10.0 255.255.255.0 10.1.0.0 255.255.248.0 eq 23 will allow the local network establish a connection to the remote on any TCP port network if he uses a port source from 23.

The access-list vpnfilt-l2l allowed 10.0.0.0 ACE 255.255.255.0 eq 23 10.1.0.0 255.255.248.0 will allow the network to remote connect to the LAN on any TCP port if he uses a port source from 23.

Kind regards

Tunnel VPN IPSEC Gre of the router in the branch office by Pix to the router HQ

Hi all

I tried to get this scenario to work before I put implement but am getting the error on router B.

01:05:38: % CRYPTO-6-IKMP_MODE_FAILURE: fast processing mode failed with the peer to 83.1.16.1

Here are the following details for networks

Router B

Address series 82.12.45.1/30

fast ethernet 192.168.20.1/24 address

PIX

outside the 83.1.16.1/30 interface eth0

inside 192.168.50.1/30 eth1 interface

Router

Fast ethernet (with Pix) 192.168.50.2/30 address

Loopback (A network) 192.168.100.1/24 address

Loopback (Network B) 192.168.200.1/24 address

Loopback (Network C) 192.168.300.1/24 address

Is could someone please tell me where im going wrong as I read the explanation of the error and it points to political unmaching. This has confused me like the two counterparts seem to have the same settings.

Config router B

======================

name of host B
!
Select the 5 secret goat.
!
username 7 privilege 15 password badger badger
iomem 15 memory size
IP subnet zero
!
!
no ip domain-lookup
IP - test.local domain name
!
property intellectual ssh delay 30
property intellectual ssh authentication-2 retries
!
crypto ISAKMP policy 5
md5 hash
preshared authentication
Group 2
ISAKMP crypto key VPN2VPN address 83.1.16.1
!
86400 seconds, duration of life crypto ipsec security association
!
Crypto ipsec transform-set esp - esp-md5-hmac VPN
!
crypto map 5 VPN ipsec-isakmp
defined by peer 83.1.16.1
PFS group2 Set
match address VPN
!
call the rsvp-sync
!
interface Loopback10
20.0.2.2 the IP 255.255.255.255
!
interface Tunnel0
bandwidth 1544000
20.0.0.1 IP address 255.255.255.0
source of Loopback10 tunnel
tunnel destination 20.0.2.1
!
interface FastEthernet0/0
Description * inside the LAN CONNECTION *.
address 192.168.20.1 255.255.255.0
IP nat inside
automatic duplex
automatic speed
!
interface Serial0/0
Description * INTERNET ACCESS *.
IP 88.12.45.1 255.255.255.252
NAT outside IP
VPN crypto card
!
interface FastEthernet0/1
no ip address
Shutdown
automatic duplex
automatic speed
!
Router eigrp 1
network 20.0.0.0
No Auto-resume
!
overload of IP nat inside source list NAT interface Serial0/0
IP classless
IP route 0.0.0.0 0.0.0.0 Serial0/0
no ip address of the http server
!
!
NAT extended IP access list
deny ip 192.168.20.0 0.0.0.255 192.168.200.0 0.0.0.255
deny ip 192.168.20.0 0.0.0.255 192.168.300.0 0.0.0.255
deny ip 192.168.20.0 0.0.0.255 192.168.100.0 0.0.0.255
ip licensing 192.168.20.0 0.0.0.255 any
list of IP - VPN access scope
permit ip host 20.0.2.2 20.0.2.1
!

Config PIX

====================

PIX Version 7.2 (4)
!
pixfirewall hostname
names of
name 20.0.2.2 B_LOOP
name 88.12.45.1 B_WANIP
!
interface Ethernet0
Description * LINK to ISP *.
nameif outside
security-level 0
IP 83.1.16.1 255.255.255.252
!
interface Ethernet1
Description * LINK TO LAN *.
nameif inside
security-level 100
IP 192.168.50.1 255.255.255.252
!
passive FTP mode
the ROUTER_LOOPS object-group network
network-object 20.0.2.0 255.255.255.252
access allowed extended VPN ip host 20.0.2.1 B_LOOP list
access-list extended SHEEP permit ip host 20.0.2.1 ROUTER_LOOPS object-group
Access ip allowed any one extended list ACL_OUT
pager lines 24
Outside 1500 MTU
Within 1500 MTU
no failover
ICMP unreachable rate-limit 1 burst-size 1
don't allow no asdm history
ARP timeout 14400
Global (1 interface external)
NAT (inside) 0 access-list SHEEP
NAT (inside) 1 192.168.50.0 255.255.255.252
NAT (inside) 1 192.168.50.0 255.255.255.0
Access to the interface inside group ACL_OUT
Route outside 0.0.0.0 0.0.0.0 83.1.16.2 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set esp - esp-md5-hmac VPN
86400 seconds, duration of life crypto ipsec security association
VPN 5 crypto card matches the VPN address
card crypto VPN 5 set pfs
card crypto VPN 5 set peer B_WANIP
VPN 5 value transform-set VPN crypto card
card crypto VPN 5 defined security-association life seconds 28800
card crypto VPN outside interface
crypto isakmp identity address
crypto ISAKMP allow outside
crypto ISAKMP policy 5
preshared authentication
the Encryption
md5 hash
Group 2
life 86400
Telnet timeout 5
SSH timeout 5
Console timeout 0
tunnel-group 88.12.45.1 type ipsec-l2l
IPSec-attributes tunnel-group 88.12.45.1
pre-shared-key *.
!
class-map inspection_default
match default-inspection-traffic
!

When you create a GRE tunnel between two routers, there should be a routing decision to reach the Remote LAN through local (rather than exit directly the physical interface) tunnel interface.

This could be accomplished by EIGRP, but you can check if the adjacency is built.

As a test, what happens if you add a static route saying (reach remote LAN, sending traffic to the tunnel interface).

Check if the GRE tunnel comes up with sh interface tunnel

Federico.

Tunnel VPN site to Site with 2 routers Cisco 1921

Hi all

So OK, I'm stumped. I create much s2s vpn tunnels before, but this one I just can't go there. It's just a tunnel VPN Site to Site simple using pre-shared keys. I would appreciate it if someone could take a look at our configs for both routers running and provide a comment. This is the configuration for both routers running. Thank you!

Router 1

=======

Current configuration: 4009 bytes

!

! Last configuration change at 19:01:31 UTC Wednesday, February 22, 2012 by asiuser

!

version 15.0

horodateurs service debug datetime msec

Log service timestamps datetime msec

no password encryption service

!

SJWHS-RTRSJ host name

!

boot-start-marker

boot-end-marker

!

!

No aaa new-model

!

!

!

!

No ipv6 cef

IP source-route

IP cef

!

!

DHCP excluded-address 192.168.200.1 IP 192.168.200.110

DHCP excluded-address IP 192.168.200.200 192.168.200.255

!

IP dhcp POOL SJWHS pool

network 192.168.200.0 255.255.255.0

default router 192.168.200.1

10.10.2.1 DNS server 10.10.2.2

!

!

no ip domain search

IP-name 10.10.2.1 Server

IP-name 10.10.2.2 Server

!

Authenticated MultiLink bundle-name Panel

!

!

Crypto pki trustpoint TP-self-signed-236038042

enrollment selfsigned

name of the object cn = IOS - Self - signed - certificate - 236038042

revocation checking no

rsakeypair TP-self-signed-236038042

!

!

TP-self-signed-236038042 crypto pki certificate chain

certificate self-signed 01

30820241 308201AA A0030201 02020101 300 D 0609 2A 864886 F70D0101 04050030

8B1E638A EC

quit smoking

license udi pid xxxxxxxxxx sn CISCO1921/K9

!

!

!

redundancy

!

!

!

!

crypto ISAKMP policy 10

md5 hash

preshared authentication

ISAKMP crypto key presharedkey address 112.221.44.18

!

!

Crypto ipsec transform-set esp-3des esp-md5-hmac IPSecTransformSet1

!

map CryptoMap1 10 ipsec-isakmp crypto

defined by peer 112.221.44.18

game of transformation-IPSecTransformSet1

match address 100

!

!

!

!

!

interface GigabitEthernet0/0

192.168.200.1 IP address 255.255.255.0

automatic duplex

automatic speed

!

!

interface GigabitEthernet0/1

Description wireless bridge

IP 172.17.1.2 255.255.255.0

automatic duplex

automatic speed

!

!

interface FastEthernet0/0/0

Verizon DSL description for failover of VPN

IP 171.108.63.159 255.255.255.0

automatic duplex

automatic speed

card crypto CryptoMap1

!

!

!

Router eigrp 88

network 172.17.1.0 0.0.0.255

network 192.168.200.0

redistribute static

passive-interface GigabitEthernet0/0

passive-interface FastEthernet0/0/0

!

IP forward-Protocol ND

!

no ip address of the http server

local IP http authentication

IP http secure server

!

IP route 0.0.0.0 0.0.0.0 172.17.1.1

IP route 112.221.44.18 255.255.255.255 171.108.63.1

!

access-list 100 permit ip 192.168.200.0 0.0.0.255 10.10.0.0 0.0.255.255

!

!

!

!

!

!

control plan

!

!

!

Line con 0

Synchronous recording

local connection

line to 0

line vty 0 4

exec-timeout 30 0

Synchronous recording

local connection

transport input telnet ssh

!

Scheduler allocate 20000 1000

end

=======

Router 2

=======

Current configuration: 3719 bytes

!

! Last configuration change at 18:52:54 UTC Wednesday, February 22, 2012 by asiuser

!

version 15.0

horodateurs service debug datetime msec

Log service timestamps datetime msec

no password encryption service

!

SJWHS-RTRHQ host name

!

boot-start-marker

boot-end-marker

!

logging buffered 1000000

!

No aaa new-model

!

!

!

!

No ipv6 cef

IP source-route

IP cef

!

!

!

!

no ip domain search

!

Authenticated MultiLink bundle-name Panel

!

!

Crypto pki trustpoint TP-self-signed-3490164941

enrollment selfsigned

name of the object cn = IOS - Self - signed - certificate - 3490164941

revocation checking no

rsakeypair TP-self-signed-3490164941

!

!

TP-self-signed-3490164941 crypto pki certificate chain

certificate self-signed 01

30820243 308201AC A0030201 02020101 300 D 0609 2A 864886 F70D0101 04050030

2 060355 04031326 494F532D 53656 C 66 2 AND 536967 6E65642D 43657274 31312F30

EA1455E2 F061AA

quit smoking

license udi pid xxxxxxxxxx sn CISCO1921/K9

!

!

!

redundancy

!

!

!

!

crypto ISAKMP policy 10

md5 hash

preshared authentication

ISAKMP crypto key presharedkey address 171.108.63.159

!

86400 seconds, duration of life crypto ipsec security association

!

Crypto ipsec transform-set esp-3des esp-md5-hmac IPSecTransformSet1

!

map CryptoMap1 10 ipsec-isakmp crypto

defined by peer 171.108.63.159

game of transformation-IPSecTransformSet1

match address 100

!

!

!

!

!

interface GigabitEthernet0/0

no ip address

automatic duplex

automatic speed

!

!

interface GigabitEthernet0/0.1

encapsulation dot1Q 1 native

IP 10.10.1.6 255.255.0.0

!

interface GigabitEthernet0/1

IP 172.17.1.1 255.255.255.0

automatic duplex

automatic speed

!

!

interface FastEthernet0/0/0

IP 112.221.44.18 255.255.255.248

automatic duplex

automatic speed

card crypto CryptoMap1

!

!

!

Router eigrp 88

Network 10.10.0.0 0.0.255.255

network 172.17.1.0 0.0.0.255

redistribute static

passive-interface GigabitEthernet0/0

passive-interface GigabitEthernet0/0.1

!

IP forward-Protocol ND

!

no ip address of the http server

local IP http authentication

IP http secure server

!

IP route 0.0.0.0 0.0.0.0 112.221.44.17

!

access-list 100 permit ip 10.10.0.0 0.0.255.255 192.168.200.0 0.0.0.255

!

!

!

!

!

!

control plan

!

!

!

Line con 0

Synchronous recording

local connection

line to 0

line vty 0 4

exec-timeout 30 0

Synchronous recording

local connection

transport input telnet ssh

!

Scheduler allocate 20000 1000

end

When the GRE tunnel carries your traffic to private ip range, your ACL must contain address of the host of point to point the IPSec tunnel.

Since then, both routers are running EIGRP in the corporate network, let the EIGRP Exchange routes via GRE tunnel, which is a good practice, rather than push the ip ranges private individual through the IPSec tunnel.

Let me know, if that's what you want.

Thank you

Redirect peer tunnel VPN L2L ina

Similar Questions

Maybe you are looking for