Site to Site VPN IPsec IPv6 on issue of routers-Tunnel

Hi, I am experiencing a problem can any one address the question below and let me know the solution. I have two routers and try to build "Site to Site VPN IPsec IPv6". I followed orders from Cisco and community document but when I apply my profile of ipsec for tunnel interfaces, that the tunnel is down.

https://supportforums.Cisco.com/docs/doc-27009

Ali,

VTI tunnels are meant to be broken when there is no active negotiated spinnakers.

The tunnel will go towards up/face upwards when there is a means of transport of packages - i.e. the SPIs are present.

You can control the order spinnakers 'show peer's crypto ipsec '.

For debugging:

Debug crypto isa

Debug crypto ipsec

M.

Tags: Cisco Security

Similar Questions

  • Site-to-Site VPN IPSEC falls intermittently

    Site-to-Site VPN IPSEC falls intermittently

    I am currently having a problem with a VPN from Site to Site traffic not only not intermittently. When the problem occurs, I can't Ping the remote site to the AC Site. But I can solve the problem by Pinging from HQ at the Remote Site. My network is currently configured as follows

    -------HQ------

    7.0 (4) version of pix 515 with card Ethernet 4 ports.

    Outside of the interface connected to the Broadband DSL link.

    Outside2 Interface connected to the second link DSL broadband

    -Distance-

    I have 4 Remote Sites. 2 sites connect you to each connection to wide band at HQ to spread the load to HQ

    6.3 (5) pix 501 version

    # The problem #.

    All VPN establishes successfully to the HQ Pix

    Intermittently, a remote site will report that they cannot connect to servers/services in the HQ. When I do a show crypto ipsec's and see the crypto isakmp his headquarters there is no entry for the remote site. However when I do the same on the remote site there is an entry for the HQ. With debugging on the remote site pix I try to ping from a pc to the HQ server and I get the following (see below). If I do a "ipsec Isakmp security association claire crypto ' and ' clear crypto ipsec his ' on the pix of remote site, then I can successfully ping all servers in headquarters.

    This problem seems to have taken place only when I upgraded the pix of a 501 to 515 and added another 2 remote sites and a second broadband, as described above. I'm afraid that there is a problem with software version 7 Pix. Any advice would be greatly appreciated.

    Console record Carrick-PIX01 (config) # 7

    Carrick-PIX01 (config) # ter Lun

    Output Carrick-PIX01 (config) #.

    Carrick-PIX01 # debug crypto ipsec

    Carrick-PIX01 # debug crypto isakmp

    Carrick-PIX01 #.

    ISAKMP (0:0): sending of NAT - T vendor ID - rev 2 & 3

    ISAKMP (0): early changes of Main Mode

    ISAKMP (0): retransmission of the phase 1 (0)...

    ISAKMP (0): retransmission of the phase 1 (1)...

    ISAKMP (0): retransmission of the phase 1 (2)...

    Carrick-PIX01 #.

    Carrick-PIX01 #.

    ISAKMP (0): retransmission of the phase 1 (3)...

    Carrick-PIX01 #.

    Carrick-PIX01 #.

    ISAKMP (0): retransmission of the phase 1 (4)... IPSec (key_engine): request timer shot: count = 1,.

    (identity) local = OUTER-IP, distance = 86.43.74.16,.

    local_proxy = LAN-OFFICE/255.255.255.0/0/0 (type = 4),

    remote_proxy = 194.x.x.x.x.255.0/0/0 (type = 4)

    ISAKMP (0): delete SA: CBC EXTERNAL IP, dst 86.43.74.16

    ISADB: Reaper checking HIS 0x10c167c, id_conn = 0 DELETE IT!

    Peer VPN: ISAKMP: Peer Info for 86.43.74.16/500 not found - peer: 1

    ISADB: Reaper checking HIS 0x10ca914, id_conn = 0

    Can force you the ISAKMP Keepalive, value from IPSec Security Association idle time and on the other. The problem should be solved

    ISAKMP crypto keepalive 30

    Crypto ipsec security association temps_inactivite 60

    Let me know if it helps

  • Cisco ASA Site to Site VPN IPSEC and NAT question

    Hi people,

    I have a question about the two Site to Site VPN IPSEC and NAT. basically what I want to achieve is to do the following:

    ASA2 is at HQ and ASA1 is a remote site. I have no problem setting a static static is a Site to IPSEC VPN between sites. Guests residing in 10.1.0.0/16 are able to communicate with hosts in 192.168.1.0/24, but what I want is to configure the NAT with IPSEC VPN for this host to 10.1.0.0/16 will communicate with hosts in 192.168.1.0/24 with translated addresses

    Just an example:

    N2 host (10.1.0.1/16) contacted N1 192.168.1.5 with destination host say 10.23.1.5 No 192.168.1.5 (notice the last byte is the same in the present case,.5)

    The translation still for the rest of the communication (host pings ip destination host 10.23.1.6 N3 N2 not 192.168.1.6 new last byte is the same)

    It sounds a bit confusing to me, but I've seen this type of configuration before when I worked for the supplier of managed services where we have given our customers (Ipsec Site to Site VPN with NAT, don't know how it was setup)

    Basically we contact the customer via site-to-site VPN hosts but their real address were hidden and we used as translated address more high 10.23.1.0/24 instead of (real) 192.168.1.0/24, last byte must be the same.

    Grateful if someone can shed some light on this subject.

    Hello

    OK so went with the old format of NAT configuration

    It seems to me that you could do the following:

    • Configure the ASA1 with static NAT strategy

      • access-list L2LVPN-POLICYNAT allowed ip 192.168.1.0 255.255.255.0 10.1.0.0 255.255.0.0
      • public static 10.23.1.0 (inside, outside) access-list L2LVPN-POLICYNAT
    • Because the above is a static NAT of the policy, this means that the translation will be made only when the destination network is 10.1.0.0/16
    • If you have for example a PAT basic configuration to inside-> external traffic, the above NAT configuration and the custom of the actual configuration of PAT interfere with eachother
    • ASA2 side, you can normally configure NAT0 / NAT Exemption for the 10.1.0.0/16 network
      • Note of the INTERIOR-SHEEP access-list SHEEP L2LVPN
      • the permitted INSIDE SHEEP 10.1.0.0 ip access list 255.255.0.0 10.23.1.0 255.255.255.0
      • NAT (inside) 0-list of access to the INTERIOR-SHEEP
    • You will need to consider that your access-list defining the VPN encrypted L2L traffic must reflect the new NAT network
      • ASA1: allowed to access-list L2LVPN-ENCRYPTIONDOMAIN ip 10.23.1.0 255.255.255.0 10.1.0.0 255.255.0.0
      • ASA2: list L2LVPN-ENCRYPTIONDOMAIN allowed ip 10.1.0.0 access 255.255.0.0 10.23.1.0 255.255.255.0

    I could test this configuration to work tomorrow but I would like to know if it works.

    Please rate if this was helpful

    -Jouni

  • ASA ASA from Site to Site VPN IPSec Tunnel

    Any help would be greatly appreciated...

    I have two devices Cisco ASA with a Site for the configuration of the tunnel VPN IPSec Site as follows: -.

    Site #1 - Cisco ASA running version 8.2 (1) with an internal range of 10.0.0.x/24

    Site #2 - Cisco ASA running version 8.2 (1) with an internal range of 10.1.1.x/24

    Site #1 is simple and has a dynamic NAT rule which translates all of the inside and the outside (public IP) of the SAA.

    Internet access works very well in all workstations of this site.  A static route is configured to redirect all traffic to a public router upstream.

    Site #2 is slightly more complicated; the Cisco ASA is configured with 10.1.1.254/24 as its interior IP address and 10.1.2.254/24 as its external IP address.  A dynamic NAT rule is configured to translate everything inside as the 10.1.2.254 (outside) address of the ASA.  A default static route is then configured to redirect all traffic to a Draytek device on 10.1.2.253.  This device then performs its own private Public NAT.  Again the Internet works fine all hosts inside the Cisco ASA (10.1.1.x)

    The IPSec tunnel is created with the networks local and remote endpoint as above (10.0.0.x/24) and (10.1.1.x/24).  The Draytek at the Site #2 device is configured with a form of DMZ that allows essentially ALL traffic toward the front directly on the external interface of the ASA (10.1.2.254).  The Phase 1 and Phase 2 negotiation of the tunnel ends correctly, and the tunnel is formed without any problem.  However, all traffic passing on networks ICMP does not end and the Syslog reports the following-

    Site #1-

    6 January 19, 2011 15:27:21 302020 ZEFF-SB-01_LAN 1 10.1.1.51 0 Built of outbound ICMP connection for faddr 10.1.1.51/0 gaddr ZEFF-SB-01_LAN/1 laddr ZEFF-SB-01_LAN/1
    6 January 19, 2011 15:27:23 302021 10.1.1.51 0 ZEFF-SB-01_LAN 1 Connection of ICMP disassembly for faddr 10.1.1.51/0 gaddr ZEFF-SB-01_LAN/1 laddr ZEFF-SB-01_LAN/1

    Site #2-

    6 January 19, 2011 15:24:47 302020 10.1.1.51 0 10.0.0.30 1 Built of outbound ICMP connection for faddr gaddr laddr 10.1.1.51/0 10.1.1.51/0 10.0.0.30/1
    6 January 19, 2011 15:24:49 302021 10.0.0.30 1 10.1.1.51 0 Connection of disassembly for faddr gaddr laddr 10.1.1.51/0 10.1.1.51/0 10.0.0.30/1 ICMP

    It's the same for any form of traffic passing over the tunnel.  The ACL is configured to allow segments of LAN out to any destination.  At this point, I left scratching my head, as my original theory was to blame the Draytek, but after reading the documentation given to the DMZ host configuration, it appears this parameter is configured all traffic is simply forwarded to the IP address (in this case, the Cisco ASA interface outside).

    Anyone can shed light on a possible cause of this problem?

    Thank you

    Nick

    did you bypass the vpn traffic between 10.0.0 and 10.1.1 to be NAT - ed on the two ASA?

    Please provide the following information

    -set up the tunnel

    -show the isa cry his

    -show the ipsec cry his

    -ping of the site 1 site 2 via tunnel

    -capture "crypto ipsec to show his" once again

    -ping from site 2 to 1 by the tunnel of the site

    -capture "crypto ipsec to show his" once again

    -two ASA configuration.

  • Site to Site VPN IPSEC for multisite with dual ISP failover

    Hello world

    I have total 6 ASA 5505, I already built failover with double tis. Now, I want to configure site 2 site VPN for all 3 sites. Each site has 2 firewall.

    I just built a config for 2 a site WHAT VPN here is the config for a single site.

    local ip address: 172.16.100.0

    IP of the pubis: 10.5.1.101, 10.6.1.101

    Remote local ip: 172.16.101.0

    Remote public ip: 10.3.1.101, 10.4.1.101

    Remote local ip: 192.168.0.0

    Remote public ip: 10.1.1.101, 10.2.1.101

    the tunnel on the first 2 firewall configuration:

    IP 172.16.100.0 allow Access-list vpn1 255.255.255.0 172.16.101.0 255.255.255.0

    backupvpn1 ip 172.16.100.0 access list allow 255.255.255.0 172.16.101.0 255.255.255.0

    ip 172.16.100.0 access VPN2 list allow 255.255.255.0 192.168.0.0 255.255.255.0

    backupvpn2 ip 172.16.100.0 access list allow 255.255.255.0 192.168.0.0 255.255.255.0

    IP 172.16.100.0 allow Access-list sheep 255.255.255.0 172.16.101.0 255.255.255.0

    172.16.100.0 IP Access-list sheep 255.255.255.0 allow 192.168.0.0 255.255.255.0

    !

    !

    NAT (inside) 0 access-list sheep

    NAT (inside) 1 0.0.0.0 0.0.0.0

    !

    !

    !

    crypto ISAKMP allow outside

    ISAKMP crypto enable backup

    crypto ISAKMP policy 10

    preshared authentication

    3des encryption

    sha hash

    !

    !

    !

    Crypto ipsec transform-set esp-3des esp-sha-hmac my-set1

    card crypto outside_map 1 match for vpn1

    peer set card crypto outside_map 1 10.3.1.101

    My outside_map 1 transform-set-set1 crypto card

    outside_map interface card crypto outside

    !

    !

    card crypto outside_map 2 match address backupvpn1

    peer set card crypto outside_map 2 10.4.1.101

    My outside_map 2 transform-set-set1 crypto card

    backup of crypto outside_map interface card

    !

    !

    !

    Crypto ipsec transform-set esp-3des esp-sha-hmac my-set2

    crypto outside_map 3 game card address vpn2

    peer set card crypto outside_map 3 10.1.1.101

    My outside_map 3 transform-set-set2 crypto card

    outside_map interface card crypto outside

    !

    !

    card crypto 4 correspondence address backupvpn2 outside_map

    peer set card crypto outside_map 4 10.2.1.101

    My outside_map 4 transform-set-set2 crypto card

    backup of crypto outside_map interface card

    !

    !

    !

    tunnel-group 10.3.1.101 type ipsec-l2l

    IPSec-attribute Tunnel-Group 10.3.1.101

    pre-shared key cisco

    ISAKMP keepalive retry 20 3 threshold

    !

    !

    tunnel-group 10.4.1.101 type ipsec-l2l

    IPSec-attribute Tunnel-Group 10.4.1.101

    pre-shared key cisco

    ISAKMP keepalive retry 20 3 threshold

    !

    !

    tunnel-group 10.1.1.101 type ipsec-l2l

    IPSec-attribute Tunnel-Group 10.1.1.101

    pre-shared key cisco

    ISAKMP keepalive retry 20 3 threshold

    !

    !

    tunnel-group 10.2.1.101 type ipsec-l2l

    IPSec-attribute Tunnel-Group 10.2.1.101

    pre-shared key cisco

    ISAKMP keepalive retry 20 3 threshold

    !

    !

    backup of MTU 1500

    If this correct what should I configure other side that I want to finish in front of it. Is my address name vpn1 crypto card must match on the other side or not?

    any suggestion is good...

    Thank you...

    What I mean with the routing is a routing protocol or static routes the SAA can choose between interfaces to establish the tunnel.

    If the ASA has the card encryption applied to two interfaces, then one should be used as primary and the other as backup.

    How will be the ASA choose which is better? Via the routing.

    If you use a routing protocol, the ASA will be known which interface to send packets every time, but if using static routes, you need to change the metric and configuring IP SLA.

    Federico.

  • Design site to Site VPN w/NAT traversal issue

    Hi, I have a number of site to site VPN that end on a PIX. I intend to migrate these VPN to a router that sits on a demilitarized zone connected to the PIX. Before doing that I'm going to set up a private network new virtual to end on the router but I also need than VPNS that end on the PIX to be not affected.

    If I configure NAT traversal on the PIX, affected my other VPN?

    Thanks in advance

    DOM

    Hi Dom,

    Why do you want to configure NAT-Traversal on PIX, if you wish to terminate your VPN router (which is on the DMZ).

    Do you do any NAT on PIX thru the router?

    If you want to configure NAT-Traversal, it must be configured on the end (on the router in your case) devices.

    Example:

    When a user with Cisco client or Cisco router behind NAT wants to connect to another device (such as PIX, ASA, or router) NAT - T must be configured on the machine (which will be the PIX or ASA)

    Hope that helps.

    * Please indicate the post

  • Site to site VPN - need help to set up several tunnels

    I currently have tunnels VPN site-to-site of two remote sites with 1720s to connect to an ASA5510 on my site TOWN_HALL. (see attached diagram)

    It works well, but I want to add connectivity between the 1720-A LAN (172.20.3.0/24) and LAN 1720 - B (172.22.3.0/24). What is the best way to do it? The years 1720 can be configured with direct VPN L2L tunnels or that will affect the existing tunnels is the ASA5510? If so, I'm guessing that each 1720 will have to go through the ASA first.

    Thank you.

    Configs below:

    ASA5510

    ASA Version 7.2 (2)

    !

    names of

    name 172.18.3.19 Postal Mail Server description

    name 172.18.3.33 description Helpdesk Server helpdesk

    DNS-guard

    !

    interface Ethernet0/0

    Description link Comcast

    nameif ComCast_Out

    security-level 0

    IP 29.92.14.73 255.255.255.248

    !

    interface Ethernet0/1

    nameif inside

    security-level 100

    address 192.168.10.2 255.255.255.252

    !

    interface Ethernet0/2

    security-level 0

    !

    interface Ethernet0/3

    Shutdown

    No nameif

    no level of security

    no ip address

    !

    interface Management0/0

    nameif management

    security-level 100

    IP 10.10.10.1 255.255.255.0

    management only

    !

    boot system Disk0: / asa722 - k8.bin

    boot system Disk0: / asa706 - k8.bin

    passive FTP mode

    clock timezone IS - 5

    clock to summer time EDT recurring

    list of allowed incoming access extended ip any host 29.92.14.74

    list of extended all inbound icmp permitted access all inaccessible

    list of inbound icmp permitted access extended throughout entire echo response

    list of allowed inbound tcp extended access any host 29.92.14.73 eq 3000

    list of allowed inbound tcp extended access any newspaper SMTP host 29.92.14.73 eq

    list of allowed inbound tcp extended access any host 29.92.14.73 eq www

    list of allowed inbound tcp extended access any host 29.92.14.73 eq 3389

    list of allowed inbound tcp extended access any host 29.92.14.73 eq pptp

    list of allowed inbound tcp extended access any host 116.204.226.42 eq 3000

    list of allowed inbound tcp extended access any host 116.204.226.42 eq smtp

    list of allowed inbound tcp extended access any host 116.204.226.42 eq www

    list of allowed inbound tcp extended access any host 116.204.226.42 eq 3389

    list of allowed inbound tcp extended access any host 116.204.226.42 eq pptp

    list of inbound note FTP Server access

    list of allowed inbound tcp extended access any host 29.92.14.73 eq ftp

    acl_out list extended access permit tcp host 29.92.14.73 any eq smtp

    acl_out list extended access permit tcp host 192.168.1.4 any eq smtp

    tcp extended access list acl_out deny any any eq smtp

    access ip allowed any one extended list acl_out

    121 extended access-list permit ip 192.168.10.0 255.255.255.0 192.168.20.0 255.255.255.0

    IP 172.18.3.0 allow Access-list extended sheep 255.255.255.0 172.22.3.0 255.255.255.0

    IP 172.18.3.0 allow Access-list extended sheep 255.255.255.0 172.20.3.0 255.255.255.0

    access-list extended sheep allowed ip 192.168.1.0 255.255.255.0 172.22.3.0 255.255.255.0

    access-list sheep extended ip 172.30.1.0 allow 255.255.255.0 172.31.255.0 255.255.255.0

    access-list sheep extended ip 192.168.10.0 allow 255.255.255.252 172.31.255.0 255.255.255.0

    IP 172.17.1.0 allow Access-list extended sheep 255.255.255.0 172.31.255.0 255.255.255.0

    172.18.0.0 IP Access-list extended sheep 255.255.0.0 allow 172.31.255.0 255.255.255.0

    IP 172.31.3.0 allow Access-list extended sheep 255.255.255.0 172.31.255.0 255.255.255.0

    access-list sheep extended ip 192.168.0.0 allow 255.255.0.0 172.31.255.0 255.255.255.0

    backup_access_out of access allowed any ip an extended list

    outside_access_out of access allowed any ip an extended list

    Note to access list outside_access_out Barracuda

    outside_access_out list extended access permit tcp host 172.18.3.8 any eq smtp inactive

    Comment from outside_access_out-access SMTP Block list

    outside_access_out tcp extended access list deny any any eq smtp inactive

    Note to access list schools SMTP inside_access_in

    inside_access_in list extended access permit tcp host postal eq smtp no matter what eq smtp

    inside_access_in list extended access permit tcp host 172.18.3.8 any eq smtp

    inside_access_in list extended access permit tcp host 172.18.3.30 any eq smtp

    inside_access_in tcp extended access list deny any any eq smtp

    inside_access_in of access allowed any ip an extended list

    Access extensive list ip 172.18.3.0 ComCast_Out_20_cryptomap allow 255.255.255.0 172.22.3.0 255.255.255.0

    ComCast_Out_20_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 172.22.3.0 255.255.255.0

    Access extensive list ip 172.18.3.0 ComCast_Out_25_cryptomap allow 255.255.255.0 172.20.3.0 255.255.255.0

    vpn_access list standard access allowed 192.168.10.0 255.255.255.252

    standard access list vpn_access allow 172.17.1.0 255.255.255.0

    standard access list vpn_access allow 172.18.0.0 255.255.0.0

    standard access list vpn_access allow 172.31.3.0 255.255.255.0

    vpn_access list standard access allowed 172.30.1.0 255.255.255.0

    vpn_access list standard access allowed 192.168.0.0 255.255.0.0

    pager lines 24

    Enable logging

    emergency logging monitor

    logging warnings put in buffered memory

    asdm of logging of information

    MTU 1500 ComCast_Out

    Within 1500 MTU

    MTU 1500 NOT_IN_USE

    management of MTU 1500

    IP local pool vpnpool 192.168.20.2 - 192.168.20.254

    172.31.255.1 mask - local 172.31.255.250 pool POOL VPN IP 255.255.255.0

    ICMP unreachable rate-limit 1 burst-size 1

    ASDM image disk0: / asdm - 522.bin

    don't allow no asdm history

    ARP timeout 14400

    NAT-control

    Global interface (ComCast_Out) 1

    Global (NOT_IN_USE) 1 interface

    NAT (inside) 0 access-list sheep

    NAT (inside) 1 192.0.0.0 255.0.0.0

    NAT (inside) 1 0.0.0.0 0.0.0.0

    TCP static (inside ComCast_Out) interface 3000 172.18.3.22 3000 netmask 255.255.255.255

    TCP static (inside ComCast_Out) interface smtp 172.18.3.8 smtp netmask 255.255.255.255

    TCP static (inside ComCast_Out) interface www 172.18.3.30 www netmask 255.255.255.255

    TCP static (inside ComCast_Out) interface 3389 172.18.3.22 3389 netmask 255.255.255.255

    TCP static (inside ComCast_Out) interface 172.18.3.22 pptp pptp netmask 255.255.255.255

    TCP static (inside NOT_IN_USE) interface 3000 172.18.3.22 3000 netmask 255.255.255.255

    TCP static (inside NOT_IN_USE) interface smtp 172.18.3.8 smtp netmask 255.255.255.255

    TCP static (inside NOT_IN_USE) interface www 172.18.3.30 www netmask 255.255.255.255

    TCP static (inside NOT_IN_USE) interface 3389 172.18.3.23 3389 netmask 255.255.255.255

    TCP static (inside NOT_IN_USE) interface 172.18.3.22 pptp pptp netmask 255.255.255.255

    TCP static (inside ComCast_Out) interface 3101 172.18.3.8 3101 netmask 255.255.255.255

    TCP static (inside ComCast_Out) ftp ftp netmask 255.255.255.255 helpdesk interface

    static TCP (inside ComCast_Out) interface ftp - data helpdesk ftp - data netmask 255.255.255.255

    static (inside, ComCast_Out) 29.92.14.74 172.18.3.16 netmask 255.255.255.255

    Access-group entering interface ComCast_Out

    Access-group interface ComCast_Out outside_access_out

    inside_access_in access to the interface inside group

    Access-group entering interface NOT_IN_USE

    Access-group interface NOT_IN_USE backup_access_out

    Route 0.0.0.0 ComCast_Out 0.0.0.0 29.92.14.78 1 track 1

    Route inside 192.168.0.0 255.255.0.0 192.168.10.1 1

    Route inside 172.17.1.0 255.255.255.0 192.168.10.1 1

    Route inside 172.18.0.0 255.255.0.0 192.168.10.1 1

    Route inside 172.31.3.0 255.255.255.0 192.168.10.1 1

    Route inside 172.30.1.0 255.255.255.0 192.168.10.1 1

    Timeout xlate 03:00

    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

    Timeout, uauth 0:05:00 absolute

    internal group vpnclient strategy

    vpnclient group policy attributes

    Protocol-tunnel-VPN IPSec

    Split-tunnel-policy tunnelspecified

    value of Split-tunnel-network-list vpn_access

    internal remote group strategy

    Group remote attributes policy

    Split-tunnel-policy tunnelspecified

    Split-tunnel-network-list value 121

    Enable http server

    http 172.0.0.0 255.0.0.0 inside

    http 192.0.0.0 255.0.0.0 inside

    http 10.10.10.0 255.255.255.0 management

    No snmp server location

    No snmp Server contact

    Server enable SNMP traps snmp authentication linkup, linkdown cold start

    monitor SLA 123

    interface type echo protocol ipIcmpEcho 168.87.71.226 ComCast_Out

    NUM-package of 3

    frequency 10

    Annex ALS life monitor 123 to always start-time now

    Crypto ipsec transform-set esp-3des esp-md5-hmac 3des

    Crypto ipsec transform-set esp - esp-sha-hmac SHA3DES

    Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

    3DES encryption dynamic-map dynmap 10 transform-set

    Crypto-map dynamic outside_dyn_map 10 the value transform-set ESP-3DES-SHA

    address for correspondence card crypto vpnremote 20 ComCast_Out_20_cryptomap

    peer set card crypto vpnremote 20 202.13.116.209

    vpnremote card crypto 20 the transform-set ESP-DES-MD5 value

    address for correspondence card crypto vpnremote 25 ComCast_Out_25_cryptomap

    peer set card crypto vpnremote 25 207.147.31.97

    card crypto vpnremote 25 game of transformation-ESP-DES-MD5

    vpnremote 30 card crypto ipsec-isakmp dynamic dynmap

    map vpnremote 65535-isakmp ipsec crypto dynamic outside_dyn_map

    vpnremote ComCast_Out crypto map interface

    card crypto VN1530600A 663 matches the address ACL663

    card crypto VN1530600A 663 set pfs

    card crypto VN1530600A 663 set peer 29.92.14.73

    crypto VN1530600A 663 the transform-set SHA3DES value card

    card crypto VN1530600A 663 defined security-association life seconds 1800

    crypto isakmp identity address

    ISAKMP crypto enable ComCast_Out

    crypto ISAKMP policy 10

    preshared authentication

    3des encryption

    md5 hash

    Group 2

    life 86400

    crypto ISAKMP policy 20

    preshared authentication

    3des encryption

    sha hash

    Group 2

    life 86400

    crypto ISAKMP policy 30

    preshared authentication

    the Encryption

    md5 hash

    Group 2

    life 86400

    Crypto isakmp nat-traversal 20

    !

    track 1 rtr 123 accessibility

    tunnel-group type remote ipsec-ra

    tunnel-group remote General attributes

    address vpnpool pool

    Group Policy - by default-remote control

    tunnel-group remote ipsec-attributes

    pre-shared-key *.

    tunnel-group 29.92.14.73 type ipsec-l2l

    IPSec-attributes tunnel-group 29.92.14.73

    pre-shared-key *.

    tunnel-group 202.13.116.209 type ipsec-l2l

    IPSec-attributes tunnel-group 202.13.116.209

    pre-shared-key *.

    tunnel-group 207.147.31.97 type ipsec-l2l

    IPSec-attributes tunnel-group 207.147.31.97

    pre-shared-key *.

    Telnet 192.168.0.0 255.255.0.0 inside

    Telnet 172.0.0.0 255.0.0.0 inside

    Telnet timeout 120

    SSH timeout 5

    Console timeout 0

    management-access inside

    management of 10.10.10.11 - dhcpd addresses 10.10.10.20

    !

    !

    class-map inspection_default

    match default-inspection-traffic

    !

    !

    Policy-map global_policy

    class inspection_default

    inspect the pptp

    !

    global service-policy global_policy

    context of prompt hostname

    Cryptochecksum:82155434d3cfa69cd7217f20aaacabb7

    : end

    1720-A

    version 12.2

    horodateurs service debug datetime

    Services log timestamps datetime

    encryption password service

    !

    1720-A host name

    !

    logging buffered debugging 4096

    !

    iomem 20 memory size

    clock timezone IS - 5

    clock to summer time EDT recurring 2 Sun Mar 2:00 1 Sun Nov 02:00

    IP subnet zero

    !

    !

    no ip domain-lookup

    name of the IP-server 172.18.3.24

    DHCP excluded-address IP 172.20.3.1 172.20.3.20

    !

    IP dhcp pool dhcppool

    network 172.20.3.0 255.255.255.0

    router by default - 172.20.3.1

    DNS-server 172.18.3.24 172.18.3.26

    !

    audit of IP notify Journal

    Max-events of po verification IP 100

    property intellectual ssh timeout of 120

    property intellectual ssh authentication-3 retries

    !

    crypto ISAKMP policy 10

    md5 hash

    preshared authentication

    Group 2

    address of Cisco key crypto isakmp 29.92.14.73

    !

    !

    Crypto ipsec transform-set esp - esp-md5-hmac TOWN_HALL

    Crypto ipsec transform-set esp - esp-md5-hmac DES-MD5

    Dimensions of tunnel mib crypto ipsec flowmib history 200

    MIB crypto ipsec flowmib size of 200 historical failure

    !

    map VPNmap 10 ipsec-isakmp crypto

    defined by peer 29.92.14.73

    game of transformation-TOWN_HALL

    match address TOWN_HALL

    !

    !

    !

    !

    interface Ethernet0

    IP 207.147.31.97 255.255.255.252

    IP-group access to the PERIMETER of

    NAT outside IP

    Half duplex

    card crypto VPNmap

    !

    interface FastEthernet0

    LAN description

    IP 172.20.3.1 255.255.255.0

    IP nat inside

    automatic speed

    !

    interface Serial0

    no ip address

    Shutdown

    !

    IP nat inside source list NAT_ADDRESSES interface Ethernet0 overload

    IP classless

    IP route 0.0.0.0 0.0.0.0 207.147.31.98

    no ip address of the http server

    enable IP pim Bennett

    !

    !

    NAT_ADDRESSES extended IP access list

    deny ip 172.20.3.0 0.0.0.255 172.18.3.0 0.0.0.255

    IP 172.20.3.0 allow 0.0.0.255 any

    PERIMETER extended IP access list

    permit udp host 29.92.14.73 host 207.147.31.97 eq isakmp

    esp permits 29.92.14.73 host 207.147.31.97

    IP 172.18.3.0 allow 0.0.0.255 172.20.3.0 0.0.0.255

    allow all all unreachable icmp

    permit any any icmp echo response

    allow any host 207.147.31.97 eq telnet tcp

    allow any host 192.168.20.1 eq telnet tcp

    permit tcp any eq www everything

    permit tcp any eq 443 all

    permit udp host 173.13.116.209 host 207.147.31.97 eq isakmp

    esp permits 173.13.116.209 host 207.147.31.97

    IP 172.22.3.0 allow 0.0.0.255 172.20.3.0 0.0.0.255

    refuse an entire ip

    TOWN_HALL extended IP access list

    IP 172.20.3.0 allow 0.0.0.255 172.18.3.0 0.0.0.255

    !

    alias exec sr show run

    alias exec s sh ip int br

    alias exec srt show ip route

    !

    Line con 0

    exec-timeout 0 0

    Synchronous recording

    line to 0

    line vty 0 4

    exec-timeout 60 0

    Synchronous recording

    local connection

    transport telnet entry

    !

    No Scheduler allocate

    NTP-period clock 17180009

    end

    1720-B
    version 12.1
    no single-slot-reload-enable service
    horodateurs service debug datetime
    Services log timestamps datetime
    encryption password service
    !
    1720-B host name
    !
    logging buffered debugging 4096
    no set record in buffered memory
    Console rate-limit logging 10 except errors
    !
    iomem 25 memory size
    clock AND time zone - 5
    clock to summer time EDT recurring 2 Sun Mar 2:00 1 Sun Nov 02:00
    IP subnet zero
    no ip finger
    no ip domain-lookup
    name of the IP-server 172.18.3.24
    DHCP excluded-address IP 172.22.3.1 172.22.3.20
    !
    IP dhcp pool dhcppool
    network 172.22.3.0 255.255.255.0
    router by default - 172.22.3.1
    DNS-server 172.18.3.24 172.18.3.26
    !
    audit of IP notify Journal
    Max-events of po verification IP 100
    !
    !
    crypto ISAKMP policy 10
    md5 hash
    preshared authentication
    Group 2
    address of Cisco key crypto isakmp 29.92.14.73
    !
    !
    Crypto ipsec transform-set esp - esp-md5-hmac TOWN_HALL
    !
    map VPNmap 10 ipsec-isakmp crypto
    defined by peer 29.92.14.73
    game of transformation-TOWN_HALL
    match address TOWN_HALL
    !
    !
    !
    !
    interface Ethernet0
    IP 202.13.116.209 255.255.255.252
    IP-group access to the PERIMETER of
    NAT outside IP
    Half duplex
    card crypto VPNmap
    !
    interface FastEthernet0
    LAN description
    IP 172.22.3.1 255.255.255.0
    IP nat inside
    automatic speed
    !
    IP nat inside source list NAT_ADDRESSES interface Ethernet0 overload
    source-interface IP kerberos any
    IP classless
    IP route 0.0.0.0 0.0.0.0 202.13.116.210
    no ip address of the http server
    !
    !
    NAT_ADDRESSES extended IP access list
    deny ip 172.22.3.0 0.0.0.255 172.18.3.0 0.0.0.255
    deny ip 172.22.3.0 0.0.0.255 192.168.1.0 0.0.0.255
    IP 172.22.3.0 allow 0.0.0.255 any
    PERIMETER extended IP access list
    permit udp host 29.92.14.73 host 202.13.116.209 eq isakmp
    esp permits 29.92.14.73 host 202.13.116.209
    IP 172.18.3.0 allow 0.0.0.255 172.22.3.0 0.0.0.255
    allow all all unreachable icmp
    permit any any icmp echo response
    permit tcp any eq www everything
    permit tcp any eq 443 all
    ip permit 192.168.1.0 0.0.0.255 172.22.3.0 0.0.0.255
    refuse an entire ip
    TOWN_HALL extended IP access list
    IP 172.22.3.0 allow 0.0.0.255 172.18.3.0 0.0.0.255
    IP 172.22.3.0 allow 0.0.0.255 192.168.1.0 0.0.0.255
    alias exec sr show run
    alias exec s sh ip int br
    alias exec srt show ip route
    alias exec sri see the race | I have
    alias exec srb see the race | b
    !
    Line con 0
    Synchronous recording
    transport of entry no
    line to 0
    line vty 0 4
    exec-timeout 0 0
    Synchronous recording
    local connection
    !
    No Scheduler allocate
    NTP-period clock 17180266
    end

    Make sure you have the following sets of transformations in used through the tunnel:
    Crypto ipsec transform-set esp - esp-md5-hmac TOWN_HALL

    The tunnel seems to be failing on the negotiations of the phase 2 due to incompatibility, but depending on the configuration
    It seems very well.

    Are you sure that these debugs are not only a part of the negotiations and finally the established tunnel?

    Check the condition of the tunnel with the commands:
    HS cry isa his
    HS cry ips its
    In trying to establish the tunnel again and we will see the results.

    Federico.

  • Installation of site to site VPN IPSec using PIX and ASA

    / * Style definitions * / table. MsoNormalTable {mso-style-name : « Table Normal » ; mso-tstyle-rowband-taille : 0 ; mso-tstyle-colband-taille : 0 ; mso-style-noshow:yes ; mso-style-priorité : 99 ; mso-style-qformat:yes ; mso-style-parent : » « ;" mso-rembourrage-alt : 0 à 5.4pt 0 à 5.4pt ; mso-para-margin : 0 ; mso-para-marge-bottom : .0001pt ; mso-pagination : widow-orphelin ; police-taille : 11.0pt ; famille de police : « Calibri », « sans-serif » ; mso-ascii-font-family : Calibri ; mso-ascii-theme-font : minor-latin ; mso-fareast-font-family : « Times New Roman » ; mso-fareast-theme-font : minor-fareast ; mso-hansi-font-family : Calibri ; mso-hansi-theme-font : minor-latin ; mso-bidi-font-family : « Times New Roman » ; mso-bidi-theme-font : minor-bidi ;}

    I am a site configuration to site IPSec VPN using a PIX515E to site A and ASA5520 to Site B.

    I have attached the lab diagram. Consider PIX and ASA are in default configuration, which means that nothing is configured on both devices.

    According to the scheme

    ASA5520

    External interface is the level of security 11.11.10.1/248 0

    The inside interface is 172.16.9.2/24 security level 100

    Default route is 0.0.0.0 0.0.0.0 11.11.10.2 1

    PIX515E

    External interface is the level of security 123.123.10.2/248 0

    The inside interface is 172.16.10.1/24 security level 100

    Default route is 0.0.0.0 0.0.0.0 123.123.10.1 1

    / * Style definitions * / table. MsoNormalTable {mso-style-name : « Table Normal » ; mso-tstyle-rowband-taille : 0 ; mso-tstyle-colband-taille : 0 ; mso-style-noshow:yes ; mso-style-priorité : 99 ; mso-style-qformat:yes ; mso-style-parent : » « ;" mso-rembourrage-alt : 0 à 5.4pt 0 à 5.4pt ; mso-para-margin : 0 ; mso-para-marge-bottom : .0001pt ; mso-pagination : widow-orphelin ; police-taille : 11.0pt ; famille de police : « Calibri », « sans-serif » ; mso-ascii-font-family : Calibri ; mso-ascii-theme-font : minor-latin ; mso-fareast-font-family : « Times New Roman » ; mso-fareast-theme-font : minor-fareast ; mso-hansi-font-family : Calibri ; mso-hansi-theme-font : minor-latin ; mso-bidi-font-family : « Times New Roman » ; mso-bidi-theme-font : minor-bidi ;}

    Could someone tell me how to set up this configuration? I tried but didn't workout. Here is the IKE protocol I have used.

    IKE information:

    IKE Encrytion OF

    MD5 authentication method

    Diffie Helman Group 2

    Failure to life

    IPSEC information:

    IPsec encryption OF

    MD5 authentication method

    Failure to life

    Please enter the following command

    on asa

    Sysopt connection permit VPN

    on pix not sure of the syntax, I think it is

    Permitted connection ipsec sysopt

    What we are trying to do here is basically allowing vpn opening ports

    Alternatively you can open udp 500 and esp (or port ip 50) out to in on the two firewalls

  • Site to site VPN IPSec

    Hi all,

    Could someone tell me please if on the IPSec VPN (not GRE over IPSec) site to supported routing protocols?

    Thank you.

    Hello

    Well, a Site does not support multicast traffic.

    http://www.ietf.org/RFC/rfc2401.txt

    4.1 Definition and Scope    A Security Association (SA) is a simplex "connection" that affords    security services to the traffic carried by it.  Security services    are afforded to an SA by the use of AH, or ESP, but not both.  If    both AH and ESP protection is applied to a traffic stream, then two    (or more) SAs are created to afford protection to the traffic stream.    To secure typical, bi-directional communication between two hosts, or    between two security gateways, two Security Associations (one in each    direction) are required.    A security association is uniquely identified by a triple consisting    of a Security Parameter Index (SPI), an IP Destination Address, and a    security protocol (AH or ESP) identifier.  In principle, the    Destination Address may be a unicast address, an IP broadcast    address, or a multicast group address.  However, IPsec SA management    mechanisms currently are defined only for unicast SAs.

    The only possible mechanism is to use the GRE over IPSec.

    I hope this helps.

    Kind regards
    Abhishek Purohit
    CCIE-S-35269

  • IPsec site to Site VPN on Wi - Fi router

    Hello!

    Can someone tell me if there is a router Netgear Wi - Fi that can form IPsec Site to Site VPN connection between 2 Wi - Fi routers via the WAN connection?

    I know that this feature exists on the Netgear firewall, but can you have the same function on any Wi - Fi router?

    See you soon!

    Michael

    I suspect that.

    Thank you very much for the reply.

    See you soon!

  • EIGRP via IPSec site to site VPN

    having trouble getting to work through an IOS EIGRP (2ea. 2811 s) connection of the site to site VPN IPSec peer.  IPSec VPN works with route directions static tunnel.  By using the IPSec policy basis and VTI interface:

    crypto ISAKMP policy 1

    preshared authentication

    Group 2

    ISAKMP crypto key "" address 192.168.x.66

    !

    Crypto ipsec transform-set esp-3des esp-sha-hmac vpn

    Crypto ipsec df - game

    !

    static-crypt 6 map ipsec-isakmp crypto

    the value of 192.168.x.66 peer

    Set transform-set vpn

    match address 101

    !

    tunnel1 interface

    IP address 1xx.33.20.226 255.255.255.252

    no ip redirection

    IP 1400 MTU

    IP tcp adjust-mss 1360

    QoS before filing

    source of tunnel FastEthernet 0/0

    destination 192.168.x.66 tunnel

    crypto static crypto map

    !

    interface FastEthernet 0/0

    Add an IP...

    crypto static crypto map

    !

    Router eigrp 10

    passive-interface default

    no passive-interface FastEthernet 0/1

    no passive-interface Tunnel1

    network...

    network...

    No Auto-resume

    !

    IP route 0.0.0.0 0.0.0.0 Tunnel1

    IP route 0.0.0.0 0.0.0.0 146.33.20.225<-- peer's="" default-gateway="" is="" vpn="" peer="" router="" on="" other="" side="" of="" satelite="">

    must be something simple, but I can't.

    Thank you, kevin

    Unfamiliar with the VTI, but I think you are missing:

    ipv4 ipsec tunnel mode

    Profile of tunnel ipsec protection

    Also don't think that you need crypto card in the tunnel because it is already on fa0/0.  What looks like the access-list 101? Take a look at this doc:

    http://www.ciscosystems.com/en/us/docs/iOS/12_3t/12_3t14/feature/guide/gtIPSctm.html

  • Site to Site VPN - cannot ping remote subnet

    Hi all.

    I have a site to site VPN IPSEC between a 5510 (HQ) and 5505 (Remote). Everything works on the tunnel. Crypto cards and ACL is symmetrical. I see that the tunnel is in place for the required subnets. However, I can not ping of internal subnets inside 5510 to Remote LAN inside 5505 and vice versa. I have other rays VPN 5510 where I can ping within remote LAN successfully x.x.x.x. Can figure out what I'm missing. I can ping internet points, but cannot ping HQ.

    Any suggestions?

    I'm also an instant learn the ASAs, so I'm not an expert.  I know that I encouraged outside ICMP. My statement SHEEP and crypto are running off of the same group of objects that lists subnets of HQ.

    Thanks in advance.

    5505 lack the command:

    management-access inside

    Federico.

  • Connectivity between two site to site VPN

    I have two remote sites that each connect to our main office using a site to site VPN. Remote offices have 831 routers. The main office has a PIX 515.

    A remote office is 192.168.15.X and the other is 192.168.100.X. The main office is on a 10.X.X.X network.

    Each remote office can contact the office with no problems. However, they cannot communicate with each other at all and I need this to work. I just want to be able to access the network 192.168.100.X network 192.168.15.X through the VPN tunnel that is already set up between each remote desktop.

    I tried to add the other network to the ACL for the tunnel, but that did not work. I feel I'm missing something simple.

    For example, the following ACL initially.

    Note access-list 103 IPSec rule

    access-list 103 allow ip 192.168.15.0 0.0.0.255 10.0.0.0 0.255.255.255

    I added this line to this LIST.

    access-list 103 allow ip 192.168.15.0 0.0.0.255 192.168.100.0 0.0.0.255

    But that did not help.

    Thanks in advance.

    Hello

    What code are you running on the Pix. Talk to talk IPSEC connectivity is supported only in version 7.0 and higher.

    Enhanced support has spoke-to-Spoke VPN

    Version 7.0 (1) improving support communications a spoke-to-spoke (customer-to-customer) VPN, providing the ability to traffic to enter and exit the same interface. In addition, remote access to splitting tunnel connections can be completed on the external interface of the security apparatus, enabling traffic destined to the Internet for remote user VPN tunnels to leave on the same interface as it happened (after that the firewall rules have been applied).

    The same-security-traffic command permits traffic to enter and exit the same interface when it is used with the keyword a spoke-to-spoke VPN using intra-interface. For more information, see the section "Allows Intra-Interface traffic" in the in the command line Configuration Guide Cisco Security Appliance.

    http://www.Cisco.com/univercd/CC/TD/doc/product/iaabu/PIX/pix_sw/v_70/70_rn/pix_70rn.htm#wp162358

    Example of Configuration:

    http://www.Cisco.com/en/us/partner/products/HW/vpndevc/ps2030/products_configuration_example09186a00804675ac.shtml

    Let me know if it helps.

    Kind regards

    Arul

    * Please note all useful messages *.

  • Troubleshooting IPSec Site to Site VPN between ASA and 1841

    Hi all

    in the past I've implemented several VPN connections between the devices of the SAA. So I thought a site link between an ASA site and 1841 would be easier... But it seems I was mistaken.

    I configured a VPN Site to Site, as it has been described in the Document ID: SDM 110198: IPsec Site to Site VPN between ASA/PIX and an example of IOS Router Configuration (I have not used SDM but CCP).

    I have run the wizards on the ASA with ASDM and the current IOS version 15.1 1841, with CCP.

    It seems to Phase 1 and 2 are coming although my ASA in ADSM reports (monitoring > VPN > VPN statistics > Sessions) a tunnel established with some of the Tx traffic but 0 Rx traffic),

    On the ASA:

    Output of the command: "sh crypto ipsec its peer 217.xx.yy.zz.

    address of the peers: 217.86.154.120
    Crypto map tag: VPN-OUTSIDE, seq num: 2, local addr: 62.aa.bb.cc

    access extensive list ip 192.168.37.0 outside_2_cryptomap_1 allow 255.255.255.0 172.20.2.0 255.255.255.0
    local ident (addr, mask, prot, port): (LAN-A/255.255.255.0/0/0)
    Remote ident (addr, mask, prot, port): (LAN-G/255.255.255.0/0/0)
    current_peer: 217.xx.yy.zz

    #pkts program: 400, #pkts encrypt: 400, #pkts digest: 400
    #pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0
    compressed #pkts: 0, unzipped #pkts: 0
    #pkts uncompressed: 400, comp #pkts failed: 0, #pkts Dang failed: 0
    success #frag before: 0, failures before #frag: 0, #fragments created: 0
    Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
    #send errors: 0, #recv errors: 0

    local crypto endpt. : 62.aa.bb.cc, remote Start crypto. : 217.xx.yy.zz

    Path mtu 1500, fresh ipsec generals 58, media, mtu 1500
    current outbound SPI: 39135054
    current inbound SPI: B2E9E500

    SAS of the esp on arrival:
    SPI: 0xB2E9E500 (3001672960)
    transform: esp-3des esp-sha-hmac no compression
    running parameters = {L2L, Tunnel, PFS 2 group}
    slot: 0, id_conn: 100327424, crypto-map: VPN-OUTSIDE
    calendar of his: service life remaining (KB/s) key: (4374000/1598)
    Size IV: 8 bytes
    support for replay detection: Y
    Anti-replay bitmap:
    0x00000000 0x00000001
    outgoing esp sas:
    SPI: 0 x 39135054 (957567060)
    transform: esp-3des esp-sha-hmac no compression
    running parameters = {L2L, Tunnel, PFS 2 group}
    slot: 0, id_conn: 100327424, crypto-map: VPN-OUTSIDE
    calendar of his: service life remaining (KB/s) key: (4373976/1598)
    Size IV: 8 bytes
    support for replay detection: Y
    Anti-replay bitmap:
    0x00000000 0x00000001

    Output of the command: "sh crypto isakmp his."

    HIS active: 4
    Generate a new key SA: 0 (a tunnel report Active 1 and 1 to generate a new key during the generate a new key)
    Total SA IKE: 4

    IKE Peer: 217.xx.yy.zz
    Type: L2L role: initiator
    Generate a new key: no State: MM_ACTIVE

    On the 1841

    1841 crypto isakmp #sh its
    IPv4 Crypto ISAKMP Security Association
    DST CBC conn-State id
    217.86.154.120 62.153.156.163 QM_IDLE 1002 ACTIVE

    1841 crypto ipsec #sh its

    Interface: Dialer1
    Tag crypto map: SDM_CMAP_1, local addr 217.86.154.120

    protégé of the vrf: (none)
    local ident (addr, mask, prot, port): (172.20.2.0/255.255.255.0/0/0)
    Remote ident (addr, mask, prot, port): (192.168.37.0/255.255.255.0/0/0)
    current_peer 62.153.156.163 port 500
    LICENCE, flags is {origin_is_acl},
    #pkts program: encrypt 0, #pkts: 0, #pkts digest: 0
    #pkts decaps: 585, #pkts decrypt: 585, #pkts check: 585
    compressed #pkts: 0, unzipped #pkts: 0
    #pkts uncompressed: 0, #pkts compr. has failed: 0
    #pkts not unpacked: 0, #pkts decompress failed: 0
    Errors #send 0, #recv 0 errors

    local crypto endpt. : 217.86.154.120, remote Start crypto. : 62.153.156.163
    Path mtu 1452, ip mtu 1452, ip mtu BID Dialer1
    current outbound SPI: 0xB2E9E500 (3001672960)
    PFS (Y/N): Y, Diffie-Hellman group: group2

    SAS of the esp on arrival:
    SPI: 0 x 39135054 (957567060)
    transform: esp-3des esp-sha-hmac.
    running parameters = {Tunnel}
    Conn ID: 2003, flow_id: FPGA:3, sibling_flags 80000046, card crypto: SDM_CMAP_1
    calendar of his: service life remaining (k/s) key: (4505068/1306)
    Size IV: 8 bytes
    support for replay detection: Y
    Status: ACTIVE

    the arrival ah sas:

    SAS of the CFP on arrival:

    outgoing esp sas:
    SPI: 0xB2E9E500 (3001672960)
    transform: esp-3des esp-sha-hmac.
    running parameters = {Tunnel}
    Conn ID: 2004, flow_id: FPGA:4, sibling_flags 80000046, card crypto: SDM_CMAP_1
    calendar of his: service life remaining (k/s) key: (4505118/1306)
    Size IV: 8 bytes
    support for replay detection: Y
    Status: ACTIVE

    outgoing ah sas:

    outgoing CFP sas:

    Interface: virtual Network1
    Tag crypto map: SDM_CMAP_1, local addr 217.86.154.120

    protégé of the vrf: (none)
    local ident (addr, mask, prot, port): (172.20.2.0/255.255.255.0/0/0)
    Remote ident (addr, mask, prot, port): (192.168.37.0/255.255.255.0/0/0)
    current_peer 62.153.156.163 port 500
    LICENCE, flags is {origin_is_acl},
    #pkts program: encrypt 0, #pkts: 0, #pkts digest: 0
    #pkts decaps: 585, #pkts decrypt: 585, #pkts check: 585
    compressed #pkts: 0, unzipped #pkts: 0
    #pkts uncompressed: 0, #pkts compr. has failed: 0
    #pkts not unpacked: 0, #pkts decompress failed: 0
    Errors #send 0, #recv 0 errors

    local crypto endpt. : 217.86.154.120, remote Start crypto. : 62.153.156.163
    Path mtu 1452, ip mtu 1452, ip mtu BID Dialer1
    current outbound SPI: 0xB2E9E500 (3001672960)
    PFS (Y/N): Y, Diffie-Hellman group: group2

    SAS of the esp on arrival:
    SPI: 0 x 39135054 (957567060)
    transform: esp-3des esp-sha-hmac.
    running parameters = {Tunnel}
    Conn ID: 2003, flow_id: FPGA:3, sibling_flags 80000046, card crypto: SDM_CMAP_1
    calendar of his: service life remaining (k/s) key: (4505068/1306)
    Size IV: 8 bytes
    support for replay detection: Y
    Status: ACTIVE

    the arrival ah sas:

    SAS of the CFP on arrival:

    outgoing esp sas:
    SPI: 0xB2E9E500 (3001672960)
    transform: esp-3des esp-sha-hmac.
    running parameters = {Tunnel}
    Conn ID: 2004, flow_id: FPGA:4, sibling_flags 80000046, card crypto: SDM_CMAP_1
    calendar of his: service life remaining (k/s) key: (4505118/1306)
    Size IV: 8 bytes
    support for replay detection: Y
    Status: ACTIVE

    outgoing ah sas:

    outgoing CFP sas:

    It seems that the routing on the 1841 is working properly as I can tear down the tunnel and relaunch in scathing a host on the network of 1841, but not vice versa.

    Trounleshoot VPN of the 1841 report shows a message like "the following sources are forwarded through the interface card crypto.      (172.20.2.0 1) go to "Configure-> routing" and correct the routing table.

    I have not found an error on the 1841 config so if one of the guys reading this thread has an idea I appreciate highly suspicion!

    It's the running of the 1841 configuration

    !
    version 15.1
    horodateurs service debug datetime msec
    Log service timestamps datetime msec
    encryption password service
    !
    host name 1841
    !
    boot-start-marker
    start the system flash c1841-adventerprisek9 - mz.151 - 1.T.bin
    boot-end-marker
    !
    logging buffered 51200 notifications
    !
    AAA new-model
    !
    !
    AAA authentication login default local
    !
    AAA - the id of the joint session
    !
    iomem 20 memory size
    clock timezone PCTime 1
    PCTime of summer time clock day March 30, 2003 02:00 October 26, 2003 03:00
    dot11 syslog
    IP source-route
    !
    No dhcp use connected vrf ip
    !
    IP cef
    no ip bootp Server
    IP domain name test
    name of the IP-server 194.25.2.129
    name of the IP-server 194.25.2.130
    name of the IP-server 194.25.2.131
    name of the IP-server 194.25.2.132
    name of the IP-server 194.25.2.133
    No ipv6 cef
    !
    Authenticated MultiLink bundle-name Panel
    !
    !
    object-group network phone
    VoIP phone description
    Home 172.20.2.50
    Home 172.20.2.51
    !
    redundancy
    !
    !
    controller LAN 0/0/0
    atm mode
    Annex symmetrical shdsl DSL-mode B
    !
    !
    crypto ISAKMP policy 1
    BA 3des
    preshared authentication
    Group 2
    isakmp encryption key * address 62.aa.bb.cc
    !
    !
    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
    !
    map SDM_CMAP_1 1 ipsec-isakmp crypto
    Description Tunnel to62.aa.bb.cc
    the value of 62.aa.bb.cc peer
    game of transformation-ESP-3DES-SHA
    PFS group2 Set
    match address 100
    !
    !
    !
    interface FastEthernet0/0
    DMZ description $ FW_OUTSIDE$
    10.10.10.254 IP address 255.255.255.0
    IP nat inside
    IP virtual-reassembly
    automatic duplex
    automatic speed
    !
    interface FastEthernet0/1
    Description $ETH - LAN$ $FW_INSIDE$
    IP 172.20.2.254 255.255.255.0
    IP access-group 100 to
    IP nat inside
    IP virtual-reassembly
    IP tcp adjust-mss 1412
    automatic duplex
    automatic speed
    !
    ATM0/0/0 interface
    no ip address
    No atm ilmi-keepalive
    !
    point-to-point interface ATM0/0/0.1
    PVC 1/32
    PPPoE-client dial-pool-number 1
    !
    !
    interface Dialer1
    Description $FW_OUTSIDE$
    the negotiated IP address
    IP mtu 1452
    NAT outside IP
    IP virtual-reassembly
    encapsulation ppp
    Dialer pool 1
    Dialer-Group 2
    PPP authentication chap callin pap
    PPP chap hostname xxxxxxx
    PPP chap password 7 xxxxxxx8
    PPP pap sent-name of user password xxxxxxx xxxxxxx 7
    map SDM_CMAP_1 crypto
    !
    IP forward-Protocol ND
    IP http server
    local IP http authentication
    IP http secure server
    !
    !
    The dns server IP
    IP nat inside source static tcp 10.10.10.1 808 interface Dialer1 80
    IP nat inside source static tcp 10.10.10.1 25 25 Dialer1 interface
    IP nat inside source overload map route SDM_RMAP_1 interface Dialer1
    IP nat inside source overload map route SDM_RMAP_2 interface Dialer1
    IP route 0.0.0.0 0.0.0.0 Dialer1 permanent
    !
    logging trap notifications
    Note category of access list 1 = 2 CCP_ACL
    access-list 1 permit 172.20.2.0 0.0.0.255
    Note access-list category 2 CCP_ACL = 2
    access-list 2 allow 10.10.10.0 0.0.0.255
    Note access-list 100 category CCP_ACL = 4
    Note access-list 100 IPSec rule
    access-list 100 permit ip 172.20.2.0 0.0.0.255 192.168.37.0 0.0.0.255
    Note CCP_ACL the access list 101 = 2 category
    Note access-list 101 IPSec rule
    access-list 101 deny ip 172.20.2.0 0.0.0.255 192.168.37.0 0.0.0.255
    access-list 101 permit ip 172.20.2.0 0.0.0.255 any
    Note access-list 102 CCP_ACL category = 2
    Note access-list 102 IPSec rule
    access-list 102 deny ip 172.20.2.0 0.0.0.255 192.168.37.0 0.0.0.255
    access-list 102 permit ip 10.10.10.0 0.0.0.255 any
    !

    !
    allowed SDM_RMAP_1 1 route map
    corresponds to the IP 101
    !
    allowed SDM_RMAP_2 1 route map
    corresponds to the IP 102
    !
    !
    control plan
    !
    !
    Line con 0
    line to 0
    line vty 0 4
    length 0
    transport input telnet ssh
    !
    Scheduler allocate 20000 1000
    NTP-Calendar Update
    NTP 172.20.2.250 Server prefer
    end

    As I mentioned previously: suspicion is much appreciated!

    Best regards

    Joerg

    Joerg,

    ASA receives not all VPN packages because IOS does not send anything.

    Try to send packets to the 1841 LAN to LAN of the ASA and see is the "sh cry ips its" on the 1841 increments the encrypted packets (there not)

    The problem seems so on the side of the router.

    I think that is a routing problem, but you only have one default gateway (no other channels on the router).

    The ACL 100 is set to encrypt the traffic between the two subnets.

    It seems that the ACL 101 is also bypassing NAT for VPN traffic.

    Follow these steps:

    Try running traffic of LAN router inside IP (source of ping 192.168.37.x 172.20.2.254) and see if the packages are not through the translation and obtaining encrypted.

    I would also like to delete 100 ACL from the inside interface on the router because it is used for the VPN. You can create an another ACL to apply to the interface.

    Federico.

  • IPSec Site to Site VPN Solution needed?

    Hi all

    I need a solution to provide full connectivity to one of my clients. I created two IPSEC Site to Site VPN, one between the INFO and RITA and second between NIDA and RITA. I can access RITA machine that is 172.16.36.101 at the INFO and 10.0.0.5 to NIDA.

    Now, I need to give access to my customer INFORMATION to direct NIDA 10.0.0.5 without established VPN machine to NIDA 10.0.0.5 of 172.16.36.101 access.

    Could you please give me the solution how is that possible?

    Concerning

    Uzair Hussain

    Hi uzair.infotech,

    Looks like you need to set up a grouping between the 3 sites, at the end of that your topology will look like this:

    INFO - RITA - NIDA

    You can check this guide that explains step by step how to configure grouping:

    https://supportforums.Cisco.com/document/12752536/how-configure-site-sit...

    Hope this info helps!

    Note If you help!

    -JP-

Maybe you are looking for