S2S tunnel

Hello

I have a question about a tunnel I created.

The tunnel works well, but one of the sites wants to add more internal addresses.

Current NAT is

access-list extended sheep allowed ip 192.168.0.0 255.255.255.0 192.168.1.0 255.255.255.0

Extensive list of allowed ip 192.168.0.0 access tunnel 255.255.255.0 192.168.1.0 255.255.255.0

And that the crypto-

card crypto TEST 1 corresponds to the Tunnel address

crypto map set peer xxx.xxx.xxx.x TEST 1

The other site now wants the tunnel to add 192.168.3.0 and 172.3.1.0 on the same peer address.

Is this possible?

Kind regards

Ash

Hello

You can do it.

You just need to add (ace) access control entries in your present ACL Tunnel.

allowed for access list lengthened 2 ip 192.168.0.0 Tunnel line 255.255.255.0 192.168.3.0 255.255.255.0

permit for access list 3 Tunnel line scope 192.168.0.0 ip 255.255.255.0 172.3.1.0 255.255.255.0

You will also need to exempt this NAT traffic also as you did for your previous ace.

Also on remote site you must add the exact reflection of these ace in your acl already configured.

HTH

Tags: Cisco Security

Similar Questions

ASA: S2S Tunnel stops with higher traffic

Hello

I have no idea where I have to start solving our problem:

Site A: ASA 5520/9.2 (4) 5 ~ 20 IPsec tunnels

Site b: ASA 5505/9.2 (4) 5

When I do a SSH (or HTTP or any other TCP) session from Site A to any Linux on Site B server, I can connect, but when I do something as a "dmesg" or long "ls - al", the session hooked after 10 to 20 lines. Also HTTP sessions (as a site to set up a printer), smaller Web sites are okay (but slow), more big sites stops with a browser timeout.

This only happens on one site, all other sites work very well (which have the same config, same OS ASA).

Just to test, I opened the ssh port to the external IP address on the external interface and it works very well, as well as with the traffic through the tunnel going something wrong.

Any idea, where do I start debugging?

Gruss ivo

PS: How is stupid cloudflare, they check this text and do not allow to write the ls command linux less al, but ls space space space less al works!

You can twist on the SAA mss using this doc and empty the outside df bit as well. Follow the steps described in the section "VPN encryption error."

Crypto ipsec df - bit clear-df outdoors

Let us know how it rates.

Kind regards
Dinesh Moudgil

PS Please rate helpful messages.

Command to check the tunnel VPN S2S awhile in the cisco router

Dear all,

Please share the command check S2S tunnel of time that is configured on the router.

There are commands that define the lifetimes of (his) IPSec Security Associations, ISAKMP.

For example:

crypto ISAKMP policy 1
BA 3des
preshared authentication
Group 2
life 3600

life 3599 seconds crypto ipsec security association

... and you can determine the remaining lifetime for these SAs with the following commands:

SH detail session crypto

SH in detail its crypto isakmp

SH crypto ipsec his

The delta between the lifetime (s) configured and remaining life will tell you how much time has passed since the last regeneration, but that is as close you are likely to have to determine when the tunnel came first.

You could use other means as States of syslog for you say when a Tunnel is a transitioning upwards or downwards.

Best regards

Mike

Tunnel VPN ASA 5520 (DMZ + INSIDE) destined for OUTSIDE

I can't find any reference to anywhere else.

We have an ASA 5520 to our site HQ (inside the network) with several regional subnets on the DMZ interface.

We need connectivity VPN Site to Site between the INSIDE and a remote control on the OUTSIDE of the site, as well as between the DMZ subnets and even outside the site. The interface from the OUTSIDE of the SAA must be local VPN endpoint for all tunnels.

I created a S2S VPN between the INSIDE and the OUTSIDE site and it works great.

When I create a VPN S2S tunnel between a site of DMZ and even outside the site (using the same settings the and remote, but with a cryptomap different because the local subnet (DMZ) is different from the other inside the subnet, the traffic gets the mapping (show crypto isakmp his) to the same cryptomap that was created for the access to the tunnel from the OUTSIDE) , instead of to the new cryptomap, so remote endpoint deletes it, and traffic also causes SPI incorrect of for the remote endpoint, which makes the original INTERIOR outside OF THE VPN tunnel to fall from time to time.

Is this a bug?

I also did a local S2S VPN tunnel configuration test of networks as everything INSIDE and the DMZ. With the help of the wizard VPN S2S leads ASA only to create a NAT rule exempted for the subnet on the INSIDE interface. Can I manually create another tax-exempt NAT rule to the side of the DMZ and use this a S2S tunnel to connect sites inside and DMZ to the remote OFF-SITE in a connection profile?

I'm building a Rube Goldberg?

Thank you

George

Hi George,.

It seems you have a situation overlapping it, are you sure that subnets inside did not overlap with the networks from the DMZ? A package tracer could clarify wha that the ASA is actually sending.

In addition, you can merge the two interfaces on the same card encryption if you wish, just make sure that the NAT is configured correctly. For example; Source NAT (all, outside) static...

It may be useful

-Randy-

IPsec client for s2s NAT problem

Hello

We have a remote site (Paris) with a 5512 with some s2s and RA light customer vpn (anyconnect IPsec) tunnels. AnyConnect has no problem, but the ipsec client can not pass traffic on the LAN. The subnet behind the fw is 10.176.0.0/16 and the RA 10.172.28.0/24 customer pool. However, we have a s2s than nat 10.0.0.0/8 tunnel and it appears that customers vpn IPSEC RA being bound traffic matches this rule and prevents connectivity to local resources via vpn ipsec client.

......

hits = 485017, user_data = 0x7fffa5d1aa10, cs_id = 0 x 0, use_real_addr, flags = 0 x 0 = 0 protocol

IP/ID=10.176.0.0 SRC, mask is 255.255.0.0, port = 0

IP/ID=10.0.0.0 DST, mask is 255.0.0.0, port = 0, dscp = 0 x 0

input_ifc = inside, outside = output_ifc

...

Manual NAT policies (Section 1)

1 (outdoor) static source Paris_Network Paris_Network static destination Remote2_LAN_Networks Remote2_LAN_Networks non-proxy-arp-search to itinerary (inside)

translate_hits = 58987, untranslate_hits = 807600

2 (inside) (outside) static source Paris_Network Paris_Network static destination DM_INLINE_NETWORK_2 DM_INLINE_NETWORK_2-route search

translate_hits = 465384, untranslate_hits = 405850

3 (inside) (outside) static source Paris_Network Paris_Network static destination Remote1_Networks Remote1_Networks-route search

translate_hits = 3102307, untranslate_hits = 3380754

4 (outside) (inside) static source Paris_RA_VPN Paris_RA_VPN static destination Paris_Network Paris_Network-route search

translate_hits = 0, untranslate_hits = 3

This method works on other sites with almost identical configuration, but for some reason, it doesn't work here. I can't specify different subnets for the s2s tunnel because there is too much of. Can someone help me and tell me why I can't get this to work?

Hello

So you're saying that the AnyConnect is working but not IPsec? What is the the AnyConnect VPN? It is outside the 10.0.0.0/8 network?

You should be able to substitute the NAT VPN L2L configuration by simply configuring a separate NAT for the local network for VPN pool traffic at the top of your NAT configurations

For example

being PARIS-LAN network

10.176.0.0 subnet 255.255.0.0

object netwok PARIS-VPN-POOL

10.172.28.0 subnet 255.255.255.0

NAT (inside, outside) 1 static source PARIS PARIS - LAN LAN destination PARIS-VPN-POOL PARIS-VPN-POOL static

This should ensure that the first rule on the SAA is the NAT rule that matches the VPN Client for LAN traffic. Other aircraft in the L2L VPN should still hit the original NAT rule to the VPN L2L

If this does not work then we must look closer, the configuration.

Hope this helps

Remember to mark a reply as the answer if it answered your question.

Feel free to ask more if necessary

-Jouni

ASA of asymmetric routing

Hi all

Having an ASA anyconnect and s2s tunnels running.

Goal: enable anyconnect to users access to resources on ipsec tunnel.

Problem: anyconnect users and s2s tunnels using the same outside the interface.

Applied configuration:

1. permit same-security-traffic intra-interface

2 strategy map configured to bypass tcp on the external interface connections

But these measures did not help. RA users may not join s2s subnet.

Please tell us how to achieve this goal.

Thanks in advance

Alex

You shouldn't have political map of workaround.

You will need a NAT exemption for the pool VPN for remote subnets. Ethan Banks has a nice article on exactly this Setup here:

http://packetpushers.NET/Cisco-ASA-8-38-4-Hairpinning-NAT-configuration/

EZvpn + site to site

Hi all

I hope you can give me a little help here. I have a 857W router which I've set up a site to site, so an EasyVPN.

Both work perfectly independtly, but I can't run them together.

Can I have both work for about 5 minutes, but then all of a sudden the site to site VPN will fail, and even if the VPN client still works, I can not the s2s tunnel back until I go into config and remove a specific line:

card crypto client VPNmap of authentication default list

Of course my authentication attempts to intervene on the S2S as well, even though I thought that I had set up only to the EasyVPN.

Any help would be appreciated!

AAA new-model

!

AAA authentication login default local

AAA authorization exec default local

AAA authorization network default local

!

AAA - the id of the joint session

!

No dhcp use connected vrf ip

IP dhcp 60 link cleanup interval

!

IP dhcp pool dpool1

import all

network 192.168.1.240 255.255.255.240

by default-router 192.168.1.254

Server DNS 8.8.8.8

update of arp

!

crypto ISAKMP policy 1

BA aes 256

preshared authentication

Group 5

!

crypto ISAKMP policy 2

BA 3des

preshared authentication

Group 2

ISAKMP crypto key t34534:5 address 15.81.30.50

ISAKMP crypto keepalive 300

the local address VPNpool pool-crypto isakmp client configuration

ISAKMP xauth timeout 60 crypto

!

Configuration group customer isakmp crypto ClientVPN

key Hx36LdhguKjQ! Rai

pool VPNpool

ACL-VPN-Client

!

!

Crypto ipsec transform-set transform-1 esp - aes esp-sha-hmac

Crypto ipsec transform-2 transform-set esp-3des esp-sha-hmac

!

crypto dynamic-map VPNmap 2

the transform-set transform-2 value

market arriere-route

!

!

* card crypto client VPNmap of authentication default list *.

crypto map VPNmap default isakmp authorization list

client configuration address card crypto VPNmap answer

map VPNmap 1 ipsec-isakmp crypto

defined by peer 15.81.30.50

the transform-set transform-1 value

match address VPN-Site2Site

card crypto VPNmap 2-isakmp dynamic ipsec VPNmap

!

!

ATM0 interface

no ip address

no ip mroute-cache

ATM vc-per-vp 64

No atm ilmi-keepalive

PVC 8/32

PPPoE-client dial-pool-number 1

!

DSL-automatic operation mode

!

interface FastEthernet0

spanning tree portfast

!

interface FastEthernet1

spanning tree portfast

!

interface FastEthernet2

spanning tree portfast

!

interface FastEthernet3

spanning tree portfast

!

interface Dot11Radio0

no ip address

!

encryption ciphers aes - ccm mode

!

SSID wifi

!

base speed - 1.0 2.0 basic basic-5, 5 6.0 9.0 basic-11, 0 12.0 18.0 24.0 36.0 48.0 54.0

channel 2432

root of station-role

Bridge-Group 1

Bridge-group subscriber-loop-control 1

Bridge-Group 1 covering-disabled people

Bridge-Group 1 block-unknown-source

No source of bridge-Group 1-learning

unicast bridge-Group 1-floods

!

interface Vlan1

Description network internal

no ip address

Bridge-Group 1

Bridge-Group 1 covering-disabled people

!

interface Dialer1

the negotiated IP address

IP access-group Internet-Inbound-ACL in

IP mtu 1492

NAT outside IP

IP virtual-reassembly

encapsulation ppp

IP tcp adjust-mss 1452

Dialer pool 1

Dialer name remote redback

Dialer-Group 1

No cdp enable

PPP chap for pap authentication callin

PPP chap hostname [email protected] / * /

PPP chap password 7 011289k757h61F

PPP pap sent-username [email protected] / * / 011289k757h61F password 7

PPP ipcp dns request

PPP ipcp wins request

failure to track PPP ipcp

card crypto VPNmap

waiting-224 in

!

interface BVI1

Description the network bridge internal

IP 192.168.1.254 255.255.255.240

IP VPN-restrict access-group the

IP nat inside

IP virtual-reassembly

!

IP pool local VPNpool 172.16.1.1 172.16.1.2

no ip forward-Protocol nd

IP route 0.0.0.0 0.0.0.0 Dialer1

!

no ip address of the http server

no ip http secure server

The dns server IP

overload of IP nat inside source list 101 interface Dialer1

!

IP Internet-Inbound-ACL extended access list

allow tcp any a Workbench

allow icmp a whole

permit udp host 8.8.8.8 eq field all

allow udp any any eq isakmp

permit any any eq non500-isakmp udp

allow udp any any eq ntp

deny ip any any newspaper

scope of access to IP-VPN-Client list

permit ip 172.16.1.0 0.0.0.3 all

192.168.1.240 IP allow 0.0.0.15 all

extended IP VPN-restrict access list

permit udp 10.0.94.0 0.0.0.255 host 192.168.1.249

permit udp 10.0.94.0 0.0.0.255 host 192.168.1.248

permit udp 10.0.92.22 host 192.168.1.249

permit udp host 10.0.92.22 192.168.1.248

allow the host ip 10.0.93.93 one

deny ip 10.0.92.0 0.0.3.255 no matter what newspaper

allow an ip

scope of IP-VPN-Site2Site access list

192.168.1.240 IP allow the host 0.0.0.15 10.0.93.93

host ip 192.168.1.249 permit 10.0.94.0 0.0.0.255

host ip 192.168.1.248 permit 10.0.94.0 0.0.0.255

permit ip host 192.168.1.249 10.0.92.22

permit ip host 192.168.1.248 10.0.92.22

!

access-list 101 deny ip 192.168.1.240 0.0.0.15 10.0.92.0 0.0.3.255

access-list 101 deny ip 192.168.1.240 0.0.0.15 172.16.1.0 0.0.0.3

access-list 101 permit ip 192.168.1.240 0.0.0.15 all

Dialer-list 1 ip protocol allow

Hi Rick,

Try adding the No.-xauth keyword for

ISAKMP crypto key t34534:5 address 15.81.30.50 no.-xauth

Please evaluate the useful messages

Best regards

Eugene

S2S VPN - cannot get the tunnel upward

I couldn't lift a VPN site-to site because of a configuration error that I can't fix

The topology is Server1 > Hub > ASA - 1 ASA-2<><>

When I launch a ping server 1 Server 2 to try to get out of the tunnel to the top, I get the following error:

% ASA-6-110002: unable to locate the output for ICMP inside:192.168.100.2/2655 to 192.168.200.2/0 interface

No matter which side I am ping, I get the error on both of the ASA. Here is the config for the two ASA, thanks for any help.

!
ASA-1 hostname
!
interface GigabitEthernet0
nameif outside
security-level 0
IP 80.1.1.1 255.255.255.252
!
interface GigabitEthernet1
nameif inside
security-level 100
IP 192.168.100.1 address 255.255.255.0
!
passive FTP mode
network of the PC_LAN object
255.255.255.0 subnet 192.168.100.0
network of the REMOTE_LAN object
192.168.200.0 subnet 255.255.255.0
extended access list ACL-OUTSIDE-PING icmp permitted any one
LAB_S2S_VPN to access extended list ip 192.168.100.0 allow 255.255.255.0 192.168.200.0 255.255.255.0 connect
LAB_S2S_VPN list extended access allow icmp 192.168.100.0 255.255.255.0 192.168.200.0 255.255.255.0 connect
pager lines 24
Enable logging
exploitation forest-size of the buffer of 6000
debug logging in buffered memory
Outside 1500 MTU
Within 1500 MTU
ICMP unreachable rate-limit 1 burst-size 1
ICMP allow any inside
ARP timeout 14400
NAT static PC_LAN PC_LAN destination (indoor, outdoor) static source REMOTE_LAN REMOTE_LAN
Access-Group ACL-OUTSIDE-PING to the interface inside
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
Floating conn timeout 0:00:00
dynamic-access-policy-registration DfltAccessPolicy
identity of the user by default-domain LOCAL
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start
Crypto ipsec transform-set ikev1 aes-esp - SHA-AES-ESP esp-sha-hmac
card crypto VPN_CRYPTO_MAP 1 corresponds to the address LAB_S2S_VPN
card crypto VPN_CRYPTO_MAP 1 set peer 80.1.1.2
card crypto VPN_CRYPTO_MAP 1 set transform-set ESP-AES-SHA ikev1
VPN_CRYPTO_MAP interface card crypto outside
Crypto ikev1 allow outside
IKEv1 crypto policy 10
preshared authentication
aes encryption
sha hash
Group 2
life 86400
management-access inside
a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
tunnel-group 80.1.1.2 type ipsec-l2l
IPSec-attributes tunnel-group 80.1.1.2
IKEv1 pre-shared-key *.

ASA-2 host name
!
interface GigabitEthernet0
nameif outside
security-level 0
IP 80.1.1.2 255.255.255.252
!
interface GigabitEthernet1
nameif inside
security-level 100
192.168.200.1 IP address 255.255.255.0
!
interface GigabitEthernet2
Shutdown
No nameif
no level of security
no ip address
!
passive FTP mode
network of the PC_LAN object
192.168.200.0 subnet 255.255.255.0
network of the REMOTE_LAN object
255.255.255.0 subnet 192.168.100.0
extended access list ACL-OUTSIDE-PING icmp permitted any one
LAB_S2S_VPN to access extended list ip 192.168.200.0 allow 255.255.255.0 192.168.100.0 255.255.255.0 connect
LAB_S2S_VPN list extended access allow icmp 192.168.200.0 255.255.255.0 192.168.100.0 255.255.255.0 connect
pager lines 24
Outside 1500 MTU
Within 1500 MTU
no failover
ICMP unreachable rate-limit 1 burst-size 1
don't allow no asdm history
ARP timeout 14400
NAT static REMOTE_LAN REMOTE_LAN destination (indoor, outdoor) static source PC_LAN PC_LAN
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
Floating conn timeout 0:00:00
dynamic-access-policy-registration DfltAccessPolicy
identity of the user by default-domain LOCAL
Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start
Crypto ipsec transform-set ikev1 aes-esp - SHA-AES-ESP esp-sha-hmac
card crypto VPN_CRYPTO_MAP 1 corresponds to the address LAB_S2S_VPN
card crypto VPN_CRYPTO_MAP 1 set peer 80.1.1.1
card crypto VPN_CRYPTO_MAP 1 set transform-set ESP-AES-SHA ikev1
VPN_CRYPTO_MAP interface card crypto outside
Crypto ikev1 allow outside
IKEv1 crypto policy 10
preshared authentication
aes encryption
sha hash
Group 2
life 86400
Telnet timeout 5
SSH timeout 5
Console timeout 0
a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
tunnel-group 80.1.1.1 type ipsec-l2l
IPSec-attributes tunnel-group 80.1.1.1
IKEv1 pre-shared-key *.
!

You won't have a road to 192.168.200.2 so he was not able to locate the next hop for the traffic of the tunnel.

These static routes adding causes all traffic to be sent to the default gateway of the internet, including VPN and VPN traffic not.
So adding a route for 192.168.200.0 pointing to 80.1.1.X gave the same results.

Kind regards
Dinesh Moudgil

PS Please rate helpful messages.

ASA base S2S VPN, Tunnel establishes only when interesting traffic hits to end distance

Dear all,

I need your help to solve the problem mentioned below.

VPN tunnel established between the unit two ASA. A DEVICE and device B

(1) if interesting traffic initiates a LAN device. traffic ACL hits. TUNEL is not coming

(2) if interesting traffic initiates B LAN device. Tunnel will establish all the works of serivces

(3) after the Tunnel device establishmnet B. We forced to tunnel down at both ends. Interesting again traffic initiates device a surpringly tunnel

will go up. After 2 or 3 days (after life expire 86400 seconds) initiated traffic of device A, tunnel will not esatblish.

(it comes to rescue link: interesting won't be there all the time.)

checked all parametrs, everthing seems fine. Here are the logs of attached but not more informative debugging on the balls. Please suggest.

February 2, 2010 13:23:17: % ASA-7-713236: IP = 81.145.x.x, IKE_DECODE new SEND Message (msgid = 0) with payloads: HDR + HER (1), SELLER (13) + (0) NONE total length: 496

February 2, 2010 13:23:18: % ASA-6-713219: IP = 81.x.x.x, KEY-ACQUIRE Queuing messages are treated when SA P1 is finished.

February 2, 2010 13:23:18: % ASA-6-713219: IP = 81.x.x.x, KEY-ACQUIRE Queuing messages are treated when SA P1 is finished.

February 2, 2010 13:23:23: % ASA-6-713219: IP = 81.x.x.x, KEY-ACQUIRE Queuing messages are treated when SA P1 is finished.

February 2, 2010 13:23:25: % ASA-7-715065: IP = 81.x.x.x, history of mistake IKE MM Initiator WSF (struct & 0x1abb1e10) , : MM_DONE, EV_ERROR--> MM_WAIT_MSG2, EV_RETRY--> MM_WAIT_MSG2, EV_TIMEOUT--> MM_WAIT_MSG2 NullEvent--> MM_SND_MSG1, EV_SND_MSG--> MM_SND_MSG1, EV_START_TMR--> MM_SND_MSG1, EV_RESEND_MSG--> MM_WAIT_MSG2, EV_RETRY

February 2, 2010 13:23:25: % ASA-7-713906: IP = 81.x.x.x, IKE SA MM:56f95c85 ending: flags 0 x 01000022, refcnt 0, tuncnt 0

February 2, 2010 13:23:25: % ASA-7-713906: IP = 81.x.x.x, sending clear/delete with the message of reason

February 2, 2010 13:23:25: % ASA-3-713902: IP = 81.x.x.x, counterpart of drop table counterpart, didn't match!

February 2, 2010 13:23:25: % ASA-4-713903: IP = 81.x.x.x, error: cannot delete PeerTblEntry

Hi, I have a similar problem a long time ago. You can choose which set up the tunnel in your crypto card:

card crypto bidirectional IPsec_map 1 set-type of connection

I hope that it might help to solve your problem. Kind regards.

Tunnel VPN S2S when there is no firewall remote site

We have a situation where one of our sites (site A) has no firewall. All site a goes on MPLS network to access internet to site B. Site B connects to the rest of our MPLS private including the C Site.

The MPLS network and routers are all managed provider. This site needs to access a website which is another private company accessible only via a tunnel.

I know that we can create a tunnel from Site C to site D, but would be possible around site to use this tunnel to get to the site D?
```
ccess-list outside_20_cryptomap extended permit ip 10.51.22.224 255.255.255.224 10.22.43.0 255.255.255.0
access-list outside_20_cryptomap extended permit ip 10.92.0.0 255.255.0.0 10.22.43.0 255.255.255.0
```
For the second line, everything is OK, assuming 10.92.0.0/16 is the subnet of the site has traffic where should go throug the tunel.

For the first line, you said that 10.51.22.224/27's wan interface. This interface, I guess that will be used as a tunnel endpoint, so you do not have to include in your ACL crypto (but if you really the intent/need to do, you can do it).

Just decide what which subnets traffic/traffic should pass through the tunnel for you and include it in your proxy ACL.
```
What networks will site D need to config as interesting subnets so that 10.92 at site A can actually access 10.22.43 at site D?
```
Access between site D and site A, proxy-ID on the website should be the reflection of the second ACE you provided in the ACL on the site c. i.e.:
```
access-list outside_20_cryptomap extended permit ip  10.22.43.0 255.255.255.0 10.92.0.0 255.255.0.0 
```

ASA - s2s vpn with dynamic ip - Dungeon tunnel upward

Hi guys,.

We want to set up a vpn between our central asa5520, and a new branch office asa5505 with dynamic public ip address.

This type of configuration is supported, but the tunnel can only be initiated from the asa distance (the asa central do not know how to reach the asa remote).

prove that on this vpn also transit traffic voice, we must always maintain the tunnel.

A solution would be to have a kind of continuous ping from the remote office to the central office... is more 'professional' wat to reach our goal?

Thank you.

Try, 'management-access to the inside' of the asa and ping

Disaster recovery and Tunnels S2S

I have a lot of remote sites running 800 routers series multiservice that connect to the main office of via IPSec (no GRE) tunnels. What is the best way to switch these guys on a recovery site without completely reconfigure the whole scenario to use GRE and dynamic failover?

In addition, I would shift immediately, only after an extended shutdown. Is this possible?

I was planning to put a customer VPN on all PCs, but even once the VPN tunnel complicates things. When it is low there is no internet (all internet traffic is lifted back to the main site for filtering purposes). Can you return to send all traffic directly to the internet regardless of the encryption card? All suggestions are welcome!

Each remotesite can have two IPsec peers for the same tunnel.
800 routers will attempt to always connect to the first pair (first site).
If the first site is unresponsive, 800 routers tries to connect to the second peer second site).

Now... This happens immediately because it's normally the behavior of desire (the least downtime).

To do this, for example:

Main site1: 1.1.1.1

Main site2: 2.2.2.2

card crypto peer 1.1.1.1 MYMAP 2.2.2.2

The foregoing statement card crypto on a 800 router will try to connect to 1.1.1.1 and only if received no response to 2.2.2.2

Federico.

S2S VPN with multiple context

Hello

I intend to combine two ASA 5510 (used for the separate VPN S2S requirements) in a single Cisco ASA 5512 - X using contexts. I would like to know if someone has deployed VPN S2S in multi mode context, known problems and how the distribution of resources is made (for example)?

Thanks in advance

Krishna

Hello Krishna,

Implementation of VPN in multiple mode requires the division of total available VPN licenses between the configured settings. ASA administrator can configure how many licenses each context is allocated.

By default, no license of VPN tunnel is attributed to the contexts and the award of the license type must be done manually by the administrator.

Here is a document for your reference:-
http://www.Cisco.com/c/en/us/support/docs/security/ASA-5500-x-series-next-generation-firewalls/116639-TechNote-ASA-00.html

Concerning
Dinesh Moudgil

PS Please rate helpful messages.

A Site with IPsec without restoring a new tunnel

Hello, I have a question about IPSec S2S.

Network.PNG

In this topoloy, I would like to that IPSec S2S between 172.21.0.0/24 and 172.22.0.0/24.

The serial line is the first priority and route on ISP is the second priority for routing.

The question is how can I create the IPsec Site to Site connection without restore when the routing path changes?

The AR configuration:

!
version 15.1
no service the timestamps don't log datetime msec
no service timestamps debug datetime msec
no password encryption service
!
hostname AR
!
!
!
!
!
!
!
!
no ip cef
No ipv6 cef
!
!
!
username cisco password 0 BR
!
!
license udi pid CISCO2901/K9 sn FTX1524YO05
licence start-up module c2900 technology-package securityk9
!
!
!
crypto ISAKMP policy 10
BA 3des
md5 hash
preshared authentication
Group 2
!
cisco key crypto isakmp 10.0.0.2 address
address of cisco crypto isakmp 200.200.200.2 keys
!
!
!
Crypto ipsec transform-set esp-3des esp-sha-hmac TS
!
CMAP 10 ipsec-isakmp crypto card
defined peer 10.0.0.2
defined by peer 200.200.200.2
game of transformation-TS
match the vpn address
!
!
!
!
!
!
pvst spanning-tree mode
!
!
!
!
!
!
interface GigabitEthernet0/0
IP 100.100.100.2 255.255.255.252
automatic duplex
automatic speed
card crypto WCPA
!
interface GigabitEthernet0/1
IP 172.21.0.254 255.255.255.0
automatic duplex
automatic speed
!
interface Serial0/0/0
the IP 10.0.0.1 255.255.255.252
encapsulation ppp
Chap PPP authentication protocol
2000000 clock frequency
card crypto WCPA
!
interface Serial0/0/1
no ip address
2000000 clock frequency
Shutdown
!
interface Vlan1
no ip address
Shutdown
!
router ospf 1
Log-adjacency-changes
Network 10.0.0.0 0.0.0.3 area 0
network 172.21.0.0 0.0.0.255 area 0
!
router RIP
version 2
network 100.0.0.0
network 172.21.0.0
No Auto-resume
!
IP classless
!
IP flow-export version 9
!
!
list of IP - vpn access scope
IP 172.21.0.0 allow 0.0.0.255 172.22.0.0 0.0.0.255
!
!
!
!
!
Line con 0
!
line to 0
!
line vty 0 4
opening of session
!
!
!
end

Configuration of BR:

!
version 15.1
no service the timestamps don't log datetime msec
no service timestamps debug datetime msec
no password encryption service
!
hostname BR
!
!
!
!
!
!
!
!
no ip cef
No ipv6 cef
!
!
!
Cisco spends 0 username AR
!
!
license udi pid CISCO2901/K9 sn FTX1524L63A
licence start-up module c2900 technology-package securityk9
!
!
!
crypto ISAKMP policy 10
BA 3des
md5 hash
preshared authentication
Group 2
!
cisco key crypto isakmp 10.0.0.1 address
address of cisco crypto isakmp 100.100.100.2 keys
!
!
!
Crypto ipsec transform-set esp-3des esp-sha-hmac TS
!
CMAP 10 ipsec-isakmp crypto card
defined peer 10.0.0.1
defined by peer 100.100.100.2
game of transformation-TS
match the vpn address
!
!
!
!
!
!
pvst spanning-tree mode
!
!
!
!
!
!
interface GigabitEthernet0/0
IP 200.200.200.2 255.255.255.252
automatic duplex
automatic speed
card crypto WCPA
!
interface GigabitEthernet0/1
IP 172.22.0.254 255.255.255.0
automatic duplex
automatic speed
!
interface Serial0/0/0
the IP 10.0.0.2 255.255.255.252
encapsulation ppp
Chap PPP authentication protocol
card crypto WCPA
!
interface Serial0/0/1
no ip address
2000000 clock frequency
Shutdown
!
interface Vlan1
no ip address
Shutdown
!
router ospf 1
Log-adjacency-changes
Network 10.0.0.0 0.0.0.3 area 0
network 172.22.0.0 0.0.0.255 area 0
!
router RIP
version 2
network 172.22.0.0
network 200.200.200.0
No Auto-resume
!
IP classless
!
IP flow-export version 9
!
!
list of IP - vpn access scope
IP 172.22.0.0 allow 0.0.0.255 172.21.0.0 0.0.0.255
!
!
!
!
!
Line con 0
!
line to 0
!
line vty 0 4
opening of session
!
!
!
end

Thank you very much!

Although you might go this route, I wouldn't.

I would use VTI (GRE tunnels that run over IPSec) interfaces. One on the series circuit and the other on the circuit of the ISP.

You can then either use GRE KeepAlive to detect which tunnels are in place and use static routes or dynamic routing as EIGRP Protocol (put a higher value of the 'bandwidth' with the 'bandwidth' command on the favorite tunnel).

Tunnel VPN site to Site with 2 routers Cisco 1921

Hi all

So OK, I'm stumped. I create much s2s vpn tunnels before, but this one I just can't go there. It's just a tunnel VPN Site to Site simple using pre-shared keys. I would appreciate it if someone could take a look at our configs for both routers running and provide a comment. This is the configuration for both routers running. Thank you!

Router 1

=======

Current configuration: 4009 bytes

!

! Last configuration change at 19:01:31 UTC Wednesday, February 22, 2012 by asiuser

!

version 15.0

horodateurs service debug datetime msec

Log service timestamps datetime msec

no password encryption service

!

SJWHS-RTRSJ host name

!

boot-start-marker

boot-end-marker

!

!

No aaa new-model

!

!

!

!

No ipv6 cef

IP source-route

IP cef

!

!

DHCP excluded-address 192.168.200.1 IP 192.168.200.110

DHCP excluded-address IP 192.168.200.200 192.168.200.255

!

IP dhcp POOL SJWHS pool

network 192.168.200.0 255.255.255.0

default router 192.168.200.1

10.10.2.1 DNS server 10.10.2.2

!

!

no ip domain search

IP-name 10.10.2.1 Server

IP-name 10.10.2.2 Server

!

Authenticated MultiLink bundle-name Panel

!

!

Crypto pki trustpoint TP-self-signed-236038042

enrollment selfsigned

name of the object cn = IOS - Self - signed - certificate - 236038042

revocation checking no

rsakeypair TP-self-signed-236038042

!

!

TP-self-signed-236038042 crypto pki certificate chain

certificate self-signed 01

30820241 308201AA A0030201 02020101 300 D 0609 2A 864886 F70D0101 04050030

8B1E638A EC

quit smoking

license udi pid xxxxxxxxxx sn CISCO1921/K9

!

!

!

redundancy

!

!

!

!

crypto ISAKMP policy 10

md5 hash

preshared authentication

ISAKMP crypto key presharedkey address 112.221.44.18

!

!

Crypto ipsec transform-set esp-3des esp-md5-hmac IPSecTransformSet1

!

map CryptoMap1 10 ipsec-isakmp crypto

defined by peer 112.221.44.18

game of transformation-IPSecTransformSet1

match address 100

!

!

!

!

!

interface GigabitEthernet0/0

192.168.200.1 IP address 255.255.255.0

automatic duplex

automatic speed

!

!

interface GigabitEthernet0/1

Description wireless bridge

IP 172.17.1.2 255.255.255.0

automatic duplex

automatic speed

!

!

interface FastEthernet0/0/0

Verizon DSL description for failover of VPN

IP 171.108.63.159 255.255.255.0

automatic duplex

automatic speed

card crypto CryptoMap1

!

!

!

Router eigrp 88

network 172.17.1.0 0.0.0.255

network 192.168.200.0

redistribute static

passive-interface GigabitEthernet0/0

passive-interface FastEthernet0/0/0

!

IP forward-Protocol ND

!

no ip address of the http server

local IP http authentication

IP http secure server

!

IP route 0.0.0.0 0.0.0.0 172.17.1.1

IP route 112.221.44.18 255.255.255.255 171.108.63.1

!

access-list 100 permit ip 192.168.200.0 0.0.0.255 10.10.0.0 0.0.255.255

!

!

!

!

!

!

control plan

!

!

!

Line con 0

Synchronous recording

local connection

line to 0

line vty 0 4

exec-timeout 30 0

Synchronous recording

local connection

transport input telnet ssh

!

Scheduler allocate 20000 1000

end

=======

Router 2

=======

Current configuration: 3719 bytes

!

! Last configuration change at 18:52:54 UTC Wednesday, February 22, 2012 by asiuser

!

version 15.0

horodateurs service debug datetime msec

Log service timestamps datetime msec

no password encryption service

!

SJWHS-RTRHQ host name

!

boot-start-marker

boot-end-marker

!

logging buffered 1000000

!

No aaa new-model

!

!

!

!

No ipv6 cef

IP source-route

IP cef

!

!

!

!

no ip domain search

!

Authenticated MultiLink bundle-name Panel

!

!

Crypto pki trustpoint TP-self-signed-3490164941

enrollment selfsigned

name of the object cn = IOS - Self - signed - certificate - 3490164941

revocation checking no

rsakeypair TP-self-signed-3490164941

!

!

TP-self-signed-3490164941 crypto pki certificate chain

certificate self-signed 01

30820243 308201AC A0030201 02020101 300 D 0609 2A 864886 F70D0101 04050030

2 060355 04031326 494F532D 53656 C 66 2 AND 536967 6E65642D 43657274 31312F30

EA1455E2 F061AA

quit smoking

license udi pid xxxxxxxxxx sn CISCO1921/K9

!

!

!

redundancy

!

!

!

!

crypto ISAKMP policy 10

md5 hash

preshared authentication

ISAKMP crypto key presharedkey address 171.108.63.159

!

86400 seconds, duration of life crypto ipsec security association

!

Crypto ipsec transform-set esp-3des esp-md5-hmac IPSecTransformSet1

!

map CryptoMap1 10 ipsec-isakmp crypto

defined by peer 171.108.63.159

game of transformation-IPSecTransformSet1

match address 100

!

!

!

!

!

interface GigabitEthernet0/0

no ip address

automatic duplex

automatic speed

!

!

interface GigabitEthernet0/0.1

encapsulation dot1Q 1 native

IP 10.10.1.6 255.255.0.0

!

interface GigabitEthernet0/1

IP 172.17.1.1 255.255.255.0

automatic duplex

automatic speed

!

!

interface FastEthernet0/0/0

IP 112.221.44.18 255.255.255.248

automatic duplex

automatic speed

card crypto CryptoMap1

!

!

!

Router eigrp 88

Network 10.10.0.0 0.0.255.255

network 172.17.1.0 0.0.0.255

redistribute static

passive-interface GigabitEthernet0/0

passive-interface GigabitEthernet0/0.1

!

IP forward-Protocol ND

!

no ip address of the http server

local IP http authentication

IP http secure server

!

IP route 0.0.0.0 0.0.0.0 112.221.44.17

!

access-list 100 permit ip 10.10.0.0 0.0.255.255 192.168.200.0 0.0.0.255

!

!

!

!

!

!

control plan

!

!

!

Line con 0

Synchronous recording

local connection

line to 0

line vty 0 4

exec-timeout 30 0

Synchronous recording

local connection

transport input telnet ssh

!

Scheduler allocate 20000 1000

end

When the GRE tunnel carries your traffic to private ip range, your ACL must contain address of the host of point to point the IPSec tunnel.

Since then, both routers are running EIGRP in the corporate network, let the EIGRP Exchange routes via GRE tunnel, which is a good practice, rather than push the ip ranges private individual through the IPSec tunnel.

Let me know, if that's what you want.

Thank you

S2S tunnel

Similar Questions

Network.PNG

Maybe you are looking for