Site to site vpn problem

Similar Questions

• Site to Site VPN problem ASA 5505

  Hello

  I have a strange problem with a site to site VPN. I configured it completely and I added 3 of my internal networks to be encrypted and access the remote network across the tunnel.

  For some reason, I can access the remote network of only two of the three internal networkls that I've specified.

  Here is a copy of my config - if anyone has any info I would be happy of course.

  Thank you

  Kevin

  FK - U host name. S. - Raleigh - ASA
  domain appdrugs.com
  activate 08PI8zPL2UE41XdH encrypted password
  2KFQnbNIdI.2KYOU encrypted passwd
  names of
  name Maridian-primary-Net 192.168.237.0
  Meridian-backup-Net 192.168.237.128 name
  name 10.239.192.141 AccessSwitch1IDFB
  name 10.239.192.143 AccessSwitch1IDFC
  name 10.239.192.140 AccessSwitch1MDFA
  name 10.239.192.142 AccessSwitch2IDFB
  name CiscoCallManager 10.195.64.206
  name 10.239.192.2 CoreSwitch1
  name 10.239.192.3 CoreSwitch2
  name 10.195.64.17 UnityVM
  name 140.239.116.162 Outside_Interface
  name 65.118.69.251 Meridian-primary-VPN
  name 65.123.23.194 Meridian_Backup_VPN
  DNS-guard
  !
  interface Ethernet0/0
  Shutdown
  No nameif
  security-level 100
  no ip address
  !
  interface Ethernet0/1
  nameif outside
  security-level 60
  address IP Outside_Interface 255.255.255.224
  !
  interface Ethernet0/2
  nameif Inside1
  security-level 100
  IP 10.239.192.7 255.255.255.128
  !
  interface Ethernet0/3
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface Management0/0
  nameif management
  security-level 50
  IP 192.168.1.1 255.255.255.0
  management only
  !
  boot system Disk0: / asa804 - k8.bin
  Disk0: / asa804.bin starting system
  passive FTP mode
  DNS domain-lookup outside
  DNS domain-lookup Inside1
  management of the DNS domain-lookup service
  DNS server-group DefaultDNS
  Server name 10.239.192.10
  domain appdrugs.com
  permit same-security-traffic inter-interface
  permit same-security-traffic intra-interface
  the DM_INLINE_NETWORK_1 object-group network
  object-network 10.195.64.0 255.255.255.0
  object-network 10.239.192.0 255.255.255.0
  object-network 10.239.192.128 255.255.255.128
  object-group service DM_INLINE_SERVICE_1
  the purpose of the ip service
  ICMP service object
  the purpose of the echo icmp message service
  response to echo icmp service object
  the DM_INLINE_NETWORK_2 object-group network
  object-network 10.195.64.0 255.255.255.0
  object-network 10.239.192.0 255.255.255.128
  object-network 10.239.192.128 255.255.255.128
  the DM_INLINE_NETWORK_3 object-group network
  network-object 10.195.64.0 255.255.255.192
  object-network 10.239.192.0 255.255.255.128
  object-network 10.239.192.128 255.255.255.128
  the DM_INLINE_NETWORK_5 object-group network
  Maridian-primary-Net network object 255.255.255.128
  Meridian-backup-Net network object 255.255.255.128
  the DM_INLINE_NETWORK_6 object-group network
  Maridian-primary-Net network object 255.255.255.128
  Meridian-backup-Net network object 255.255.255.128
  object-group network Vital-network-hardware-access
  host of the object-Network UnityVM
  host of the CiscoCallManager object-Network
  host of the object-Network AccessSwitch1MDFA
  host of the object-Network AccessSwitch1IDFB
  host of the object-Network AccessSwitch2IDFB
  host of the object-Network AccessSwitch1IDFC
  host of the object-Network CoreSwitch1
  host of the object-Network CoreSwitch2
  object-group service RDP - tcp
  EQ port 3389 object
  the DM_INLINE_NETWORK_7 object-group network
  Maridian-primary-Net network object 255.255.255.128
  Meridian-backup-Net network object 255.255.255.128
  host of network-object Meridian-primary-VPN
  host of the object-Network Meridian_Backup_VPN
  the DM_INLINE_NETWORK_9 object-group network
  host of the object-Network Outside_Interface
  Group-object Vital-equipment-access to the network
  object-group service DM_INLINE_SERVICE_2
  will the service object
  ESP service object
  the purpose of the service ah
  the eq isakmp udp service object
  object-group service DM_INLINE_SERVICE_3
  ICMP service object
  the purpose of the echo icmp message service
  response to echo icmp service object
  the DM_INLINE_NETWORK_4 object-group network
  object-network 10.195.64.0 255.255.255.0
  object-network 10.239.192.0 255.255.255.128
  object-network 10.239.192.128 255.255.255.128
  the DM_INLINE_NETWORK_8 object-group network
  object-network 10.195.64.0 255.255.255.0
  object-network 10.239.192.0 255.255.255.128
  object-network 10.239.192.128 255.255.255.128
  Outside_access_in list extended access permit icmp any any echo response
  Access extensive list Maridian-primary-Net ip Outside_access_in 255.255.255.128 DM_INLINE_NETWORK_8 object-group enable
  Access extensive list Meridian-backup-Net ip Outside_access_in 255.255.255.128 DM_INLINE_NETWORK_3 object-group enable
  Inside_nat0_outbound to access ip 10.0.0.0 scope list allow 255.0.0.0 10.0.0.0 255.0.0.0
  Access extensive list ip 10.239.192.0 Inside_nat0_outbound allow Maridian-primary-Net 255.255.255.0 255.255.255.128
  Inside_access_in to access ip 10.0.0.0 scope list allow 255.0.0.0 all
  Inside1_nat0_outbound to access ip 10.0.0.0 scope list allow 255.0.0.0 10.0.0.0 255.0.0.0
  Inside1_nat0_outbound list extended access allowed object-group DM_INLINE_NETWORK_1 Maridian-primary-Net 255.255.255.128 ip
  Inside1_nat0_outbound list extended access permitted ip object-group Meridian-backup-Net DM_INLINE_NETWORK_2 255.255.255.128
  Access extensive list ip 10.239.192.0 Inside1_nat0_outbound allow 255.255.255.0 10.239.199.0 255.255.255.192
  Access extensive list ip 10.195.64.0 Inside1_nat0_outbound allow 255.255.255.192 10.239.199.0 255.255.255.192
  Inside1_access_in to access ip 10.0.0.0 scope list allow 255.0.0.0 all
  Outside_1_cryptomap list extended access allowed object-group DM_INLINE_SERVICE_1-DM_INLINE_NETWORK_1 Maridian-primary-Net 255.255.255.128 objects
  Outside_2_cryptomap list extended access permitted ip object-group Meridian-backup-Net DM_INLINE_NETWORK_2 255.255.255.128
  permitted access Vital-network-Access_splitTunnelAcl-list standard 10.239.192.0 255.255.255.128
  permitted access Vital-network-Access_splitTunnelAcl-list standard 10.195.64.0 255.255.255.0
  permitted access Vital-network-Access_splitTunnelAcl-list standard 10.239.192.128 255.255.255.128
  Access extensive list ip 10.239.199.0 Vital_VPN allow 255.255.255.192 object-group Vital-equipment-access to the network
  Vital_VPN list extended access allow icmp 10.239.199.0 255.255.255.192 object-group Vital-equipment-access to the network
  Vital_VPN of access allowed any ip an extended list
  Outside_cryptomap_1 list extended access allowed object-group DM_INLINE_NETWORK_4 Maridian-primary-Net 255.255.255.128 ip
  access list Vital-Site-to-site access extended allow ip object-DM_INLINE_NETWORK_5 group Vital-network-hardware-access object
  Vital-Site-to-Site-access extended access list permits object-group DM_INLINE_SERVICE_3-group of objects DM_INLINE_NETWORK_6 object-group Vital-equipment-access to the network
  Vital-Site-to-Site-access extended access list permits object-group objects object-group DM_INLINE_NETWORK_9 DM_INLINE_NETWORK_7 DM_INLINE_SERVICE_2-group
  pager lines 24
  Enable logging
  exploitation forest asdm warnings
  Outside 1500 MTU
  MTU 1500 Inside1
  management of MTU 1500
  mask IP local pool access remote 10.239.199.11 - 10.239.199.62 255.255.255.192
  ICMP unreachable rate-limit 1 burst-size 1
  ASDM image disk0: / asdm - 621.bin
  don't allow no asdm history
  ARP timeout 14400
  Global (1 interface external)
  NAT (Inside1) 0-list of access Inside1_nat0_outbound
  NAT (Inside1) 1 10.0.0.0 255.0.0.0
  Access-group Outside_access_in in interface outside
  Access-group Inside1_access_in in interface Inside1
  Route outside 0.0.0.0 0.0.0.0 140.239.116.161 1
  Route Inside1 10.192.52.0 255.255.255.0 10.239.192.1 1
  Route Inside1 10.195.64.0 255.255.240.0 10.239.192.1 1
  Route Inside1 10.239.0.0 255.255.0.0 10.239.192.1 1
  Route Inside1 10.239.192.0 255.255.248.0 10.239.192.1 1
  Route out of the Maridian-primary-Net 255.255.255.0 Outside_Interface 1
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  dynamic-access-policy-registration DfltAccessPolicy
  Enable http server
  http 66.104.209.192 255.255.255.224 outside
  http 192.168.1.0 255.255.255.0 management
  http 10.239.172.0 255.255.252.0 Inside1
  SNMP-server host Inside1 10.239.132.225 community appfirestarter * #*.
  location of Server SNMP Raleigh
  contact Server SNMP Kevin mcdonald
  Server SNMP community appfirestarter * #*.
  Server enable SNMP traps snmp authentication linkup, linkdown cold start
  Server SNMP traps enable entity config change
  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
  Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
  Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
  Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
  Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
  Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
  Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
  Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
  Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac
  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
  life crypto ipsec security association seconds 28800
  Crypto ipsec kilobytes of life - safety 4608000 association
  Dynamic crypto map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
  Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
  Dynamic crypto map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define security association lifetime 28800 seconds
  cryptographic kilobytes 4608000 life of the set - the association of security of the 65535 SYSTEM_DEFAULT_CRYPTO_MAP of the dynamic-map
  card crypto Outside_map 1 corresponds to the address Outside_cryptomap_1
  card crypto Outside_map 1 peer set VPN-primary-Meridian
  Outside_map 1 transform-set ESP-3DES-MD5 crypto card game
  card crypto Outside_map 1 defined security-association life seconds 28800
  card crypto Outside_map 1 set security-association kilobytes of life 4608000
  card crypto Outside_map 2 corresponds to the address Outside_2_cryptomap
  card crypto Outside_map 2 set peer Meridian_Backup_VPN
  map Outside_map 2 game of transformation-ESP-3DES-MD5 crypto
  card crypto Outside_map 2 defined security-association life seconds 28800
  card crypto Outside_map 2 set security-association kilobytes of life 4608000
  card crypto Outside_map 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
  Outside_map interface card crypto outside
  crypto ISAKMP allow outside
  crypto ISAKMP policy 5
  preshared authentication
  3des encryption
  md5 hash
  Group 2
  life 86400
  crypto ISAKMP policy 30
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  Telnet timeout 5
  SSH timeout 5
  Console timeout 0
  outside access management
  management of 192.168.1.2 - dhcpd address 192.168.1.254
  enable dhcpd management
  !
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  WebVPN
  allow outside
  tunnel-group-list activate
  internal strategy of State civil-access to the network group
  Group Policy attributes Vital access to the network
  value of server DNS 10.239.192.10
  value of VPN-filter Vital_VPN
  Protocol-tunnel-VPN IPSec webvpn
  Split-tunnel-policy tunnelspecified
  Split-tunnel-network-list value vital-network-Access_splitTunnelAcl
  value of remote access address pools
  internal state civil-Site-to-Site-GroupPolicy group strategy
  Civil-site-a-site-grouppolicy-strategie status of group attributes
  value of VPN-filter Vital-Site-to-Site-access
  Protocol-tunnel-VPN IPSec l2tp ipsec webvpn
  username APPRaleigh encrypted password m40Ls2r9N918trxp
  username APPRaleigh attributes
  VPN-group-policy Vital-network access
  type of remote access service
  username, password kmadmin u8urNz44/I.ugcF. encrypted privilege 15
  tunnel-group 65.118.69.251 type ipsec-l2l
  tunnel-group 65.118.69.251 General-attributes
  Group Policy - by Defaut-vital-site-a-site-grouppolicy
  IPSec-attributes tunnel-group 65.118.69.251
  pre-shared-key *.
  tunnel-group 65.123.23.194 type ipsec-l2l
  tunnel-group 65.123.23.194 General-attributes
  Group Policy - by Defaut-vital-site-a-site-grouppolicy
  IPSec-attributes tunnel-group 65.123.23.194
  pre-shared-key *.
  remote access of type tunnel-group Vital access to the network
  tunnel-group Vital access to the network general-attributes
  Access to distance-address pool
  Group Policy - by default-state civilian access to the network
  tunnel-group Vital access to the network ipsec-attributes
  pre-shared-key *.
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns migrated_dns_map_1
  parameters
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the migrated_dns_map_1 dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  !
  global service-policy global_policy
  context of prompt hostname
  Cryptochecksum:a080b1759b57190ba65d932785ad4967
  : end

  can you confirm if we have the exact reflection of crypto acl at the other end

  I feel may be you have a 24 10.239.192.0 255.255.255.0 on the other end in the remote network

  can you please confirm that

  also a reason, why you use 10.239.192.0 255.255.255.128 and 10.239.192.128 255.255.255.128 instead of 10.239.192.0 255.255.255.0

• Multi-site VPN problem

  Greetings,

  I practice implementation of VPN and it seems to have fallen on a small issue that solution eludes me.  Everything works in my current topology with the exception of a multi-site vpn.  I have 3 ASA, which is outside the interface is connected via a switch.  The inside interface is connected to a local area network that contains a workstation on each subnet.  I'm trying to set up a solution where I can have all 3 ASA related between them via a VPN.  The question I have is when I raise a single tunnel, scathing from a workstation behind the ASA, I can't set up a second tunnel scathing from a different network.  To explain that better, here is an explanation:

  ASA #1

  outdoors: 10.0.1.1/24

  inside: 192.168.0.1/24

  workstation: 192.168.0.100

  ASA #2

  outside: 10.0.1.2/24

  inside: 192.168.1.1/24

  workstation: 192.168.1.100

  ASA #3

  outside: 10.0.1.3/24

  inside: 192.168.2.1/24

  workstation: 192.168.2.100

  If I ping 192.168.0.100 192.168.1.100, the tunnel opens very well and I get answers.  If I can try and ping 192.168.0.100 192.168.2.100, does not open the tunnel to 192.168.2.0.  If I clear all its on ASA #1 and then ping 192.168.0.100 192.168.2.100, the tunnel opens very well and I get a response.  Then I try and ping 192.168.0.100 192.168.1.100 and the same thing happens, no tunnel and no response.  When I enabled logging on ASA #1 seems that it sends the ping for the different network on the tunnel open instead of opening a new tunnel to the correct network.  Can someone tell me what is happening here and if I just missed something simple with routing?  Or is it maybe a problem with VPN?

  Craig,

  You have default route badly configured on all the ASA. Here's what you have configured

  ASA1

  Route outside 0.0.0.0 0.0.0.0 192.168.0.1 1

  It's sendning the package for outside inside IP address. Here's what you need to do on the ASA

  ASA1

  No route outside 0.0.0.0 0.0.0.0 192.168.0.1 1

  Route outside 0.0.0.0 0.0.0.0 10.0.1.2

  ASA2

  No route outside 0.0.0.0 0.0.0.0 192.168.1.1 1

  Route outside 0.0.0.0 0.0.0.0 10.0.1.1

  ASA3

  No route outside 0.0.0.0 0.0.0.0 192.168.2.1 1

  Route outside 0.0.0.0 0.0.0.0 10.0.1.1

  Also delete icmp access list crypto that you allowed to what IP is the same access list. IP covers both the ICMP.

  Kindly let me know change default allows traffic.

  Kind regards

  Bad Boy

  P.S. Please mark this message as 'Responded' If you find this information useful so that it brings goodness to other users of the community

• Site to site VPN problems

  Hello, I'm having a problem with my VPN configuration. I have two locations each with she is has a subnett. I have a VPN site-to site between the two locations. The site to site VPN is up and fully functional without any problem. Now if I'm away from work and to connect with the site A VPN client, I cannot ping or connect what either on site B. Or if I am connected to site B by a VPN I can't ping or connect what to site A.

  I hope that makes sense, but I'll be happy to give more details on Setup if necessary.

  I think that the command you need is:

  same-security-traffic permit Intra-interface (not inter-interface)

  The remote VPN and VPN site - to use the same outside interface, so this command allows VPN traffic out this interface pin

  Sent by Cisco Support technique iPad App

• Site-2-Site VPn problem

  Guys,

  I'm new in the world of IP VPN. I am setting up a site 2 site between 2 routers Cisco 1841 vpn. I have SDSL connection on both ends and I am able to ping outside intellectual property both ok but with vpn configuration problems. The VPN tunnel is not come and show crypto isakmp its shows me nothing. I enabled debugging on isakmp and ipsec but no display of the trace. Attached is my router config, I have a similar config on the other end.

  Help, please!

  See you soon,.

  K

  This ping will never work, ping now you will from the dialer interface, go ahead and do

  source of ping 192.168.1.1 192.168.0.254

• SBS 2008 - Server 2008 site to site vpn problem.

  Hi all

  I have a box of SBS 2008 I want to add another server to the remote site (standard 2008). Currently, VPN works great on SBS and I can compose anywhere via the pptp network and join.

  I added the RRAS branch again 2008 server role. Connection to the configured application, since VPN was already running on SBS, I just added to the request and the road. Both servers have user names Eric their numbering interfaces to, when I connect branch to SBS, he just connects in seconds, get IP address and routes are added, when I check the SBS it appears as inaccessible, when try to connect manually I either get error RRAS 0 or a pop up says the modem is already in use or not properly configured.

  Grateful if someone can the advice that I've spent 2 days on this.

  Thanx

  If you can repost this thread under http://blogs.technet.com/b/windowsserver/, you can get a lot of fruitful discussions, solutions...

• Site to Site PIX VPN problems

  Hi, I currently have a site to site vpn upward and running and it works fine. I try to put the other two online and just cannot make them work. I used the same configuration of one operation but I cannot get the next tunnel. I saw several errors when debugging isakmp and ipsec and they are at the end of my configs. Anyone have any ideas? Thank you

  Main site - a vpn clients connecting too it and pt to pt vpn to 3 endpoints

  Cisco PIX Firewall Version 6.3 (3)

  * Main Site Config *.

  client_vpn 10.10.0.0 ip access list allow 255.255.0.0 192.168.0.0 255.255.255.0

  VPN_to_Site2 10.10.0.0 ip access list allow 255.255.0.0 192.168.0.0 255.255.255.0

  NAT (inside) 0-list of access client_vpn

  Permitted connection ipsec sysopt

  Crypto ipsec transform-set esp-3des esp-md5-hmac fws_encry_set

  outside_map 60 ipsec-isakmp crypto map

  address for correspondence card crypto outside_map 60 VPN_to_Site2

  crypto outside_map 60 peer 64.X.X.19 card game

  card crypto outside_map 60 transform-set fws_encry_set

  outside_map interface card crypto outside

  ISAKMP allows outside

  ISAKMP key * address 64.X.X.19 netmask 255.255.255.255 No.-xauth-no-config-mode

  ISAKMP identity address

  ISAKMP nat-traversal 20

  part of pre authentication ISAKMP policy 10

  ISAKMP policy 10 3des encryption

  ISAKMP policy 10 md5 hash

  10 2 ISAKMP policy group

  ISAKMP life duration strategy 10 86400

  Site 2 config

  * only because the pt to pt does not work I have it set up to allow vpn clients to cross to connect to the main site.

  Cisco PIX Firewall Version 6.3 (5) *.

  permit access ip 192.168.0.0 list VPN_to_Main 255.255.255.0 10.10.0.0 255.255.0.0

  NAT (inside) 0-list of access VPN_to_Main

  Permitted connection ipsec sysopt

  Crypto ipsec transform-set esp-3des esp-md5-hmac fws_encry_set

  outside_map 10 ipsec-isakmp crypto map

  outside_map card crypto 10 corresponds to the address VPN_to_Main

  crypto outside_map 10 peer 207.X.X.13 card game

  card crypto outside_map 10 transform-set fws_encry_set

  outside_map interface card crypto outside

  ISAKMP allows outside

  ISAKMP key * address 207.X.X.13 netmask 255.255.255.255 No.-xauth-no-config-mode

  ISAKMP identity address

  ISAKMP nat-traversal 20

  part of pre authentication ISAKMP policy 10

  ISAKMP policy 10 3des encryption

  ISAKMP policy 10 md5 hash

  10 2 ISAKMP policy group

  ISAKMP life duration strategy 10 86400

  Errors

  PIX (config) # IPSEC (sa_initiate): ACL = deny; No its created

  authenticator is HMAC-MD5IPSEC (validate_proposal): invalid local address

  I have a link that works very well. I have copied the config from there, changed the ip info and it does not work. The only differences in the configs are no sysopt route dnat and it's on Version 6.2 (2)

  IPSec (sa_initiate): ACL = deny; No its created

  I think that you have configured a VPN tunnel without removing the cryptographic card of the external interface. The message above is the error we get in such situation.

  I suggest the following solution:

  -remove the external interface (the two pix) cryptographic card

  -Cree claire isa his and trendy clear ipsec his (the two pix)

  -Reapply the card encryption on external interfaces.

  If this doesn't solve the problem, restart the equipment.

  Kind regards

  Ajit

• problem of site 2 site vpn

  Greetings. We have a site 2 site vpn 2 asa5510-based work. The two sites are accessible internel network hosts, but we are unable to access all the services (such as the TFTP or CA)? or even ping hosts in the remote site of our local asa5510 network. It seems that ASA attempts to send packets directly through the default gw, bypasing the vpn tunnel. Any help would be very appreciate.

  PS We checked the ACLs on both devices, so more than likely, this is not the problem.

  Hello

  Since you did not include public ip address of the external interface in the Crypto ACL, it's why he's not going in the tunnel.

  Add Crypto ACL a statement where qualify you this statement outside the public ip address of the interface source and mirror image in the remote device.

  HTH

  Sangaré

  Pls rate helpful messages

• IPSec site to site VPN cisco VPN client routing problem and

  Hello

  I'm really stuck with the configuration of ipsec site to site vpn (hub to spoke, multiple rays) with cisco vpn remote client access to this vpn.

  The problem is with remote access - cisco vpn client access - I can communicate with hub lan - but I need also communication of all lans speaks of the cisco vpn client.

  There are on the shelves, there is no material used cisco - routers DLINK.

  Someone told me that it is possible to use NAT to translate remote access IP-lan-HUB customers and thus allow communication - but I'm unable to set up and operate.

  Can someone help me please?

  Thank you

  Peter

  RAYS - not cisco devices / another provider

  Cisco 1841 HSEC HUB:

  crypto ISAKMP policy 1

  BA 3des

  preshared authentication

  Group 2

  ISAKMP crypto key x xx address no.-xauth

  !

  the group x crypto isakmp client configuration

  x key

  pool vpnclientpool

  ACL 190

  include-local-lan

  !

  86400 seconds, duration of life crypto ipsec security association

  Crypto ipsec transform-set esp-3des esp-sha-hmac 1cisco

  !

  Crypto-map dynamic dynmap 10

  Set transform-set 1cisco

  !

  card crypto ETH0 client authentication list userauthen

  card crypto isakmp authorization list groupauthor ETH0

  client configuration address card crypto ETH0 answer

  ETH0 1 ipsec-isakmp crypto map

  set peer x

  Set transform-set 1cisco

  PFS group2 Set

  match address 180

  card ETH0 10-isakmp ipsec crypto dynamic dynmap

  !

  !

  interface FastEthernet0/1

  Description $ES_WAN$

  card crypto ETH0

  !

  IP local pool vpnclientpool 192.168.200.100 192.168.200.150

  !

  !

  overload of IP nat inside source list LOCAL interface FastEthernet0/1

  !

  IP access-list extended LOCAL

  deny ip 192.168.7.0 0.0.0.255 192.168.1.0 0.0.0.255

  deny ip 192.168.7.0 0.0.0.255 192.168.200.0 0.0.0.255

  IP 192.168.7.0 allow 0.0.0.255 any

  !

  access-list 180 allow ip 192.168.7.0 0.0.0.255 192.168.1.0 0.0.0.255

  access-list 190 allow ip 192.168.7.0 0.0.0.255 192.168.200.0 0.0.0.255

  !

  How the DLINK has been configured for traffic between the site to site VPN subnets? You are able to add multiple remote subnets on DLINK? If you can, then you must add the pool of Client VPN subnet.

  Alternatively, if you cannot add multiple subnet on DLINK router, you can change the pool of Client VPN 192.168.6.0/24, and on the crypto ACL between the site to site VPN, you must edit the 180 existing ACL

  DE:

  access-list 180 allow ip 192.168.7.0 0.0.0.255 192.168.1.0 0.0.0.255

  access-list 180 allow ip 192.168.200.0 0.0.0.255 192.168.1.0 0.0.0.255

  TO:

  access-list 180 allow ip 192.168.6.0 0.0.1.255 192.168.1.0 0.0.0.255

  Also change the ACL 190 split tunnel:

  DE:

  access-list 190 allow ip 192.168.7.0 0.0.0.255 192.168.200.0 0.0.0.255

  access-list 190 allow ip 192.168.1.0 0.0.0.255 192.168.200.0 0.0.0.255

  TO:

  access-list 190 allow ip 192.168.7.0 0.0.0.255 192.168.6.0 0.0.0.255

  access-list 190 allow ip 192.168.1.0 0.0.0.255 192.168.6.0 0.0.0.255

  Finally, replace the remote subnet 192.168.7.0/255.255.255.0 192.168.6.0/255.255.254.0 DLINK.

  Hope that helps.

• Problems with site-to-site vpn

  Hello world

  I recently received the mission assigned to the site to site vpn configuration and this is my first time. I'm trying to set up a vpn with pix 501 but short questions site. I managed to get that below, but I'm stuck now and do not know what could be the problem. Here's the debug output.

  Any help is greatly appreciated on what could be the potential problem.

  -AK

  ISAKMP (0:0): sending of NAT - T vendor ID - rev 2 & 3
  ISAKMP (0): early changes of Main Mode
  crypto_isakmp_process_block:src:208.249.117.203, dest:70.91.20.245 spt:500 dpt:500
  Exchange OAK_MM
  ISAKMP (0): treatment ITS payload. Message ID = 0

  ISAKMP (0): audit ISAKMP transform 1 against 20 priority policy
  ISAKMP: 3DES-CBC encryption
  ISAKMP: hash SHA
  ISAKMP: default group 2
  ISAKMP: preshared auth
  ISAKMP: type of life in seconds
  ISAKMP: duration of life (basic) of 28800
  ISAKMP (0): atts are acceptable. Next payload is 0
  ISAKMP (0): load useful treatment vendor id

  ISAKMP (0): ITS been pre-shared key, using id ID_IPV4_ADDR type authentication

  to return to the State is IKMP_NO_ERROR
  crypto_isakmp_process_block:src:208.249.117.203, dest:70.91.20.245 spt:500 dpt:5
  00
  Exchange OAK_MM
  ISAKMP (0): processing KE payload. Message ID = 0

  ISAKMP (0): processing NONCE payload. Message ID = 0

  ISAKMP (0): load useful treatment vendor id

  ISAKMP (0): load useful treatment vendor id

  ISAKMP (0): provider v6 code received xauth

  ISAKMP (0): load useful treatment vendor id

  ISAKMP (0): addressing another box of IOS!

  ISAKMP (0): load useful treatment vendor id

  ISAKMP (0): addressing a VPN3000 concentrator

  ISAKMP (0): ID payload
  next payload: 8
  type: 1
  Protocol: 17
  Port: 0
  Length: 8
  ISAKMP (0): the total payload length: 12
  to return to the State is IKMP_NO_ERROR
  crypto_isakmp_process_block:src:208.249.117.203, dest:70.91.20.245 spt:500 dpt:5
  00
  Exchange OAK_MM
  ISAKMP (0): processing ID payload. Message ID = 0
  ISAKMP (0): HASH payload processing. Message ID = 0
  ISAKMP (0): keep treatment alive: proposal = 32767/32767 sec., real = 3276/2 sec.

  ISAKMP (0): load useful treatment vendor id

  ISAKMP (0): Peer Remote supports dead peer detection

  ISAKMP (0): SA has been authenticated.

  ISAKMP (0): start Quick Mode changes, 413131006:189fe0feIPSEC (key_e M - ID
  (Display): had an event of the queue...
  IPSec (spi_response): spi 0x3e9451fa graduation (1049907706) for SA
  from 208.249.117.203 to 70.91.20.245 for prot 3

  to return to the State is IKMP_NO_ERROR
  ISAKMP (0): send to notify INITIAL_CONTACT
  ISAKMP (0): sending message 24578 NOTIFY 1 protocol
  Peer VPN: ISAKMP: approved new addition: ip:208.249.117.203/500 Total VPN peer: 1
  Peer VPN: ISAKMP: ip:208.249.117.203/500 Ref cnt is incremented to peers: 1 Total VPN
  Peers: 1
  crypto_isakmp_process_block:src:208.249.117.203, dest:70.91.20.245 spt:500 dpt:5
  00
  ISAKMP (0): processing DELETE payload. Message ID = 3425658127, spi size = 16
  ISAKMP (0): delete SA: src 70.91.20.245 dst 208.249.117.203
  to return to the State is IKMP_NO_ERR_NO_TRANS
  ISADB: Reaper checking HIS 0xac149c, id_conn = 0 DELETE IT!

  Peer VPN: ISAKMP: ip:208.249.117.203/500 Ref cnt decremented to peers: 0 Total VPN
  Peers: 1
  Peer VPN: ISAKMP: deleted peer: ip:208.249.117.203/500 VPN peer Total: 0IPSEC (ke
  y_engine): got an event from the queue.
  IPSec (key_engine_delete_sas): rec would remove the ISAKMP notify
  IPSec (key_engine_delete_sas): remove all SAs shared with 208.249.117.203
  IPSec (key_engine): request timer shot: count = 2,.
  local (identity) = 70.91.20.245, distance = 208.249.117.203.
  local_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4),
  remote_proxy = 206.200.22.0/255.255.255.0/0/0 (type = 4)

  Hello

  Newspapers, I see you are using a VPN 3000 Concentrator as the remote vpn end point. Now, also of the debugs next section is interesting:

  local (identity) = 70.91.20.245, distance = 208.249.117.203.
  local_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4),
  remote_proxy = 206.200.22.0/255.255.255.0/0/0 (type = 4)

  -Looks like our traffic interesting PIX and the hub are not mirrors of each other, and does not. Can you please paste the PIX here cryptographic access lists, so that I can analyze the entries.

  -Also, please make sure that you have followed all the steps during the vpn configuration according to the following links:

  If your PIX is running at version 7.x and more: http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a008064a06f.shtml

  If your PIX is running version 6.3.x: http://www.cisco.com/en/US/products/hw/vpndevc/ps2284/products_configuration_example09186a00800949d2.shtml

  Once you check the config on PIX and concentrator, please provide me with the output of "sh cry isa his" and "sh cry ipsec his ' of the PIX. With this release, we can continue to troubleshoot if there is more questions.

  Let me know if this can help,

  See you soon,.

  Christian V

• Problem with Site-to-Site VPN. VPN tunnel is broken but can ping

  OK, so I am trying to understand why I can't not only appears when I sh crypto isakmp his or sh crypto ipsec his. I did the basic to site vpn settings to another and I can't ping on both networks fine no problem. So, when I ping from one pc to the address 172.16.0.0 192.168.0.0 network network there is no problem at all because the pings are very well received. But when I go to sh crypto isakmp sa, there's simply nothing and I can't for the life of understand me why. I watched my sh run for both routers and all seems well, but I guess I could be overlooking something. I would really appreciate if someone could help me to diagnose this problem.

  I've attached my plotter file of package and two routers use the binary password. I also have the sh run two routers also attached.

  I'm not on any of the router 172.16.0.0/24 only 172.16.0.0/16 and I think that is the question.

  In Crypto ACL you have on the router of branch:

  !

  S2S-VPN-TRAFFIC extended IP access list

  Licensing ip 192.168.0.0 0.0.0.255 172.16.0.0 0.0.0.255

  If it should not be:

  !

  S2S-VPN-TRAFFIC extended IP access list

  Licensing ip 192.168.0.0 0.0.0.255 172.16.0.0 0.0.255.255

  and coursed mirrored on the main router.

  If this isn't the case, you are saying that some ping between 192.168.0.x and 172.16.0.x is going ok. Can you please indicate exactly that one? I could see that you have attached a package tracer, but I couldn't open it.

• IPSEC VPN from Site to Site - NAT problem with address management

  Hi all

  I have two Cisco ASA 5505 performing of IPSEC Site to Site VPN. All traffic inside each firewall through the VPN tunnel and I have full connectivity. From site A, I can connect to the inside address of the ASA at the site B and launch of the ASDM or SSH, etc.

  The problem I have is when I'm logged on the ASA site B management traffic is given the external address. I created this as interesting traffic to get it to go through the VPN but I need to use the inside address of ASA B. The following is possible:

  • If I can make the ASA Site B to use inside interface as its address management (I already have management access to the inside Interface)
  • I have NAT can address external interfaces to Site B before moving through the VPN tunnel management traffic so that it appears to come from Site B inside the address
  • I can NAT VPN traffic as it appears in the Site A for management traffic to Site B on the right address.

  The problem is that my PRACTICE Please also come from this address and I need the application before being on an internal address to even if my CA.

  Thanks for any help.

  Ian

  Thanks, I understand what you are trying to achieve now.

  However, I think that I don't have good news for you. Unfortunately PEIE request can be initiated of the SAA within the interface, as there is no option to start the query from the inside interface. With other features of management such as AAA, logging, you have an option to specify what ASA desired originally to demand from interface, but CEP doesn't have this option.

  Here's how you can configure under the trustpoint crypto, but unfortunately by specifying the interface doesn't not part of option:

  http://www.Cisco.com/en/us/docs/security/ASA/asa84/command/reference/C5.html#wp2262210

• VPN - PC (vpn client) problem-> router-> (site to site vpn)-> local network

  Hello

  is it possible to install?

  I have a pc and I want to connect to the Remote LAN.

  PC (using vpn client) - vpn (internet)---> ROUTER1 - a vpn (MPLS network)---> ROUTER2---> SERVER site

  How can I connect to a remote server? Is there an easy way?

  I did the configuration of the vpn client (I can connect ROUTER1 and access a LAN via vpn with 192.168.1.x), but I can't connect to the server, even if I set the subnet (192.168.1.x) under the access list of site to site vpn (access list for traffic that must pass between ROUTER1 and ROUTER2).

  Please advise! Thanks in advance.

  Looks like I've not well explained.

  On ROUTER1

  ===================

  1 ACL VNC_acl is used to split tunnel, so you should include IP server_NET it NOT vpn IP pool.

  2 ACL najavorbel is used to set the lan lan traffic between ROUTER1 and ROUTER2, 2 you should inlcude

  IP 192.168.133.0 allow 0.0.0.255 0.0.0.255

  You must change the crypto ROUTER2 ACL of the minor or the najavorbel of the ACL

  The other way to is to the client VPN NAT IP to a local area network lan IP ROUTER1, in this way, you don't need any changes on ROUTER2. But I have to take a look at your configuration to make the suggestion.

• Problems with site-to-site vpn with of the asa 2

  I tried different ways so that this works, but failed. After 8 hours, I literally have a bad headache and have to step away for a minute.  I realize I need to ping between the tunnels mentioned, but still can not to. can someone take a look and tell me where I have gone wrong?  Im trying to configure a site to site vpn between:

  ASA_A

  external interface 5.179.17.66

  inside the interface 10.1.1.1

  ASA B

  external interface 5.81.57.19

  inside the 10.1.2.1 interface

  Frist why do you have two DGs on box -

  Route outside 0.0.0.0 0.0.0.0 5.179.121.65 1

  Route outside 0.0.0.0 0.0.0.0 5.179.17.65 1

  Attach the two end then it should work.

  Thank you

  Ajay

• Site to site VPN, I need all internet traffic to exit the site.

  I have 2 sites connected via a pair of SRX5308

  A = 192.168.1.0/24

  IP WAN = 1.1.1.1

  B = 192.168.2.0/24

  IP WAN = 2.2.2.2

  Now what I need to do, is to have all traffic from B to go to the site one even traffic destined to the internet. That is, I need internet traffic out of our network with the IP 1.1.1.1, even if it is from the network B.

  On my I have set up a route 1.1.1.1 of the ISP, then a value by default 0/0 to 192.168.1.1 it ASA knows how to get to the peer VPN is a more specific route, but sends everything above the tunnel, at the remote end which then hairpin of ASA routes internet outside its own WAN port traffic.

  I can understand though not how to so the same thing on the pair of SRX5308 they either don't raise the tunnel or internet route to the local site address B.

  Anyone have any ideas?

  I need to do this because we are logging and monitoring of internet traffic to A site via tapping from upstream to various IDS solutions and will not (cannot) reproduce this to all our remote sites.

  Thank you

  Dave.

  After some more thought and testing I came up with a workable solution to my own problem. I'll share it here in case it can help others.

  (1) use the wizard at both ends to implement a normal VPN that connects the two segments of network 192.168.1.0 and 192.168.2.0

  (2) go to site VPN - VPN policy remote router192.168.2.1 and click Edit

  (a) disable Netbios

  (b) select "None" from the drop-down list the remote IP address.

  (c) to apply the change

  3) go to the VPN-> VPN policy on the head end site (192.168.1.1) and click Edit

  (a) disable Netbios

  (b) select "None" from the drop-down list the local IP address

  (c) to apply the change

  Now all the traffic wil go down the VPN tunnel and exit to the internet on the site of head end. Hope this helps others with the same question.