Site to Site VPN working without Crypto Card (ASA 8.2 (1))

Hi all

Find a strange situation on our firewall to ASA5540:

We have a few Site to Site VPN and also activate on the ASA VPN cleint, all are working properly. But finding that a VPN from Site to Site is running without crypto map configuration. Is this possible?

I tried to erase isa his and claire ipsec his then VPN came once again. Tested too, it's the ping requests to a remote site through the VPN.

I saw there are config tunnel-group for VPN but saw no card crypto and ACL.

How is the firewall knows what traffic should be encrypted for this VPN tunnel without crypto card?

This is the bug?

Thanks in advance,

It can be an easy vpn configuration.

Could you post output config operation remove any sensitive information. This could help us answer your question more specifically.

Tags: Cisco Security

Similar Questions

Site to site VPN works only on Cisco 881

I have 2 problems with a cisco 881. The first problem is that Vlan2 (192.168.5.xx) cannot access the internet on the outside. But I know that the router has internet, because I can ping the external ip address. The 2nd problem is that I have a set of site to another upward, but when I test the Site to site I get this error:

destination of traffic of the tunnel must be channelled through the crypto map interface. The destination following (s) doesn't have a routing entry in the routing table
192.168.2.0

I copied the config form this router from another cisco 881 work, where everything works. The only difference is that this router needs a site to site vpn connection.

My question is how I can get internet on vlan2 and who can I solve the connection to site to site.

Here's the running configuration:

Building configuration...

Current configuration: 12698 bytes
!
version 15.3
horodateurs service debug datetime msec
Log service timestamps datetime msec
no password encryption service
!
hostname Cisco_881
!
boot-start-marker
boot-end-marker
!
AQM-registry-fnf
!
logging buffered 51200 warnings
!
AAA new-model
!
!
AAA authentication login default local
AAA authorization exec default local
AAA authorization network default local
!
!
!
!
!
AAA - the id of the joint session
!
Crypto pki trustpoint TP-self-signed-1151531093
enrollment selfsigned
name of the object cn = IOS - Self - signed - certificate - 1151531093
revocation checking no
rsakeypair TP-self-signed-1151531093
!
Crypto pki trustpoint TP-self-signed-2011286623
enrollment selfsigned
name of the object cn = IOS - Self - signed - certificate - 2011286623
revocation checking no
rsakeypair TP-self-signed-2011286623
!
!
TP-self-signed-1151531093 crypto pki certificate chain
certificate self-signed 01
3082022B 30820194 02020101 300 D 0609 2A 864886 F70D0101 05050030 A0030201
2 060355 04031326 494F532D 53656 C 66 2 AND 536967 6E65642D 43657274 31312F30
69666963 31313531 35333130 6174652D 3933301E 170 3135 30343031 31363230
34315A 17 0D 323030 31303130 30303030 305A 3031 06035504 03132649 312F302D
4F532D53 5369676E 656C662D 43 65727469 66696361 74652 31 31353135 65642D
33313039 3330819F 300 D 0609 2A 864886 01050003, 818, 0030, 81890281 F70D0101
8100AC6E E7FA8AFD 9D4E206C 2B23DFC1 990AFDB3 98CD84A7 37697253 A7EF2520
0C45190E 298B6E9F E2711580 80DCFBFB 05A6A0BA 347B960B D9DA17FC B1543B9D
FBC048F3 063EBBC5 02391432 F0232A73 EAC7278E 8CB83005 D13A1D47 BEF18198
A 547469, 2 F65ED0E6 249BF517 1E74117D C94BE542 46EE487D A3843F12 364639B 4
0B 090203 010001 HAS 3 53305130 1 130101 FF040530 030101FF 301F0603 0F060355
551 2304 18301680 147996F4 3E6D0EE2 2D9065BB D726137C 2DF42ABE 01301D 06
03551D0E 04160414 7996F43E 6D0EE22D 9065BBD7 26137C2D F42ABE01 300 D 0609
2A 864886 F70D0101 8181002A 05050003 677B9BE6 CB60D188 73227C4B 2DC33101
BD448017 EDEF0296 FF7438A3 4C46519B 144C775F 1429CF06 7DB29F2D EB16EE75
22100B 63 0D75511A 98DC57DC EF87BED2 1C1635C8 B5352706 3963037A 4E9B739A
3A1EC9BE 8431BD70 116D3B31 E4A2AC4C 0F934B3F 196AF829 AD537005 6935B 451
EB31DB3F A9BA6D70 65B70D19 D00158
quit smoking
TP-self-signed-2011286623 crypto pki certificate chain
no ip source route
!
!
!
!

!
DHCP excluded-address IP 10.10.10.1
DHCP excluded-address IP 192.168.5.1 192.168.5.49
DHCP excluded-address IP 192.168.5.150 192.168.5.254
!
DHCP IP CCP-pool
import all
Network 10.10.10.0 255.255.255.248
default router 10.10.10.1
Rental 2 0
!
IP dhcp Internet pool
network 192.168.5.0 255.255.255.0
router by default - 192.168.5.254
DNS-Server 64.59.135.133 64.59.128.120
lease 6 0
!
!
!
no ip domain search
"yourdomain.com" of the IP domain name
name of the IP-Server 64.59.135.133
name of the IP-Server 64.59.128.120
IP cef
No ipv6 cef
!
!
!
!
!
Authenticated MultiLink bundle-name Panel
!
!
!
!
!
!
!
udi pid C881-K9 sn FTX18438503 standard license
!
!
Archives
The config log
hidekeys
username * privilege 15 secret 5 $1$IBY.$X5/iqYy47a5vAWWuG4/Oa/
username * secret 5 $1$ 17 ST$ QzJMvQnZ9Q.1y7u0rYXFa0
username * secret 5 $1$ L4W9$ zBKpawZ3i5nXxwyS9H6Lf1
!
!
!
!
!
no passive ftp ip
!
!
crypto ISAKMP policy 1
BA aes 256
preshared authentication
Group 2
!
crypto ISAKMP policy 2
BA 3des
preshared authentication
Group 2
isakmp encryption key * address 208.98.212.xx
!
Configuration group crypto isakmp MPE client
key *.
pool VPN_IP_POOL
ACL 100
include-local-lan
10 Max-users
netmask 255.255.255.0
banner ^ practive entered the field

This area is reserved for administrators of control systems.

If you are here by mistake, please disconnect immediately.

You have full access to 192.168.125.0 / 0.0.0.255

Support on continue to start your session. ^ C
!
Configuration group customer crypto isakmp PALL
key *.
pool VPN_IP_POOL_PALL
ACL 101
include-local-lan
Max - 1 users
netmask 255.255.255.0
banner ^ practive entered the field

This area is limited to the PALL access only.

If you are here by mistake, please disconnect immediately.

You have full access to 192.168.125.0 / 0.0.0.255

Support on continue to start your session. ^ C
ISAKMP crypto profile vpn_isakmp_profile
game of identity EMT group
client authentication list default
Default ISAKMP authorization list
client configuration address respond
virtual-model 1
ISAKMP crypto profile vpn_isakmp_profile_2
match of group identity PALL
client authentication list default
Default ISAKMP authorization list
client configuration address respond
virtual-model 2
!
!
Crypto ipsec transform-set esp - aes 256 esp-sha-hmac VPN_TRANSFORM
tunnel mode
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
tunnel mode
!
Profile of crypto ipsec VPN_PROFILE_MPE
Set the security association idle time 3600
game of transformation-VPN_TRANSFORM
vpn_isakmp_profile Set isakmp-profile
!
Profile of crypto ipsec VPN_PROFILE_PALL
Set the security association idle time 1800
game of transformation-VPN_TRANSFORM
vpn_isakmp_profile_2 Set isakmp-profile
!
!
!
map SDM_CMAP_1 1 ipsec-isakmp crypto
Description Tunnel to208.98.212.xx
the value of 208.98.212.xx peer
game of transformation-ESP-3DES-SHA
match address 102
!
!
!
!
!
!
interface Loopback0
IP 192.168.40.254 255.255.255.0
!
interface FastEthernet0
no ip address
!
interface FastEthernet1
no ip address
!
interface FastEthernet2
switchport access vlan 2
no ip address
!
interface FastEthernet3
switchport access vlan 2
no ip address
!
interface FastEthernet4
IP address 208.98.213.xx 255.255.255.224
IP access-group 111 to
NAT outside IP
IP virtual-reassembly in
automatic duplex
automatic speed
map SDM_CMAP_1 crypto
!
type of interface virtual-Template1 tunnel
IP unnumbered Loopback0
ipv4 ipsec tunnel mode
Tunnel VPN_PROFILE_MPE ipsec protection profile
!
tunnel type of interface virtual-Template2
IP unnumbered Loopback0
ipv4 ipsec tunnel mode
Tunnel VPN_PROFILE_PALL ipsec protection profile
!
interface Vlan1
Description of control network
IP 192.168.125.254 255.255.255.0
IP access-group CONTROL_IN in
IP access-group out CONTROL_OUT
IP nat inside
IP virtual-reassembly in
IP tcp adjust-mss 1452
!
interface Vlan2
Description Internet network
IP 192.168.5.254 255.255.255.0
IP access-group INTERNET_IN in
IP access-group out INTERNET_OUT
IP nat inside
IP virtual-reassembly in
!
local IP VPN_IP_POOL 192.168.40.100 pool 192.168.40.150
local IP VPN_IP_POOL_PALL 192.168.40.151 pool 192.168.40.152
IP forward-Protocol ND
IP http server
23 class IP http access
local IP http authentication
IP http secure server
IP http timeout policy slowed down 60 life 86400 request 10000
!
!
IP nat inside source static tcp 192.168.125.2 25000 25000 FastEthernet4 interface
IP nat inside source overload map route SDM_RMAP_1 interface FastEthernet4
IP route 0.0.0.0 0.0.0.0 FastEthernet4 permanent 208.98.236.xx
!
CONTROL_IN extended IP access list
Note the access control
Note the category CCP_ACL = 17
allow any host 192.168.125.254 eq non500-isakmp udp
allow any host 192.168.125.254 eq isakmp udp
allow any host 192.168.125.254 esp
allow any host 192.168.125.254 ahp
IP 192.168.125.0 allow 0.0.0.255 192.168.125.0 0.0.0.255
Note the VPN access
IP 192.168.125.0 allow 0.0.0.255 192.168.40.0 0.0.0.255
Note Access VNC
permit tcp host 192.168.125.2 eq 25000 one
Comment by e-mail to WIN911
permit tcp host 192.168.125.2 any eq smtp
Note DNS traffic
permit udp host 192.168.125.2 host 64.59.135.133 eq field
permit udp host 192.168.125.2 host 64.59.128.120 eq field
Note Everything Else block
refuse an entire ip
CONTROL_OUT extended IP access list
Note the access control
IP 192.168.125.0 allow 0.0.0.255 192.168.125.0 0.0.0.255
Note the VPN access
ip permit 192.168.40.0 0.0.0.255 192.168.125.0 0.0.0.255
Note Access VNC
allow any host 192.168.125.2 eq 25000 tcp
Comment by e-mail to WIN911
allow any host 192.168.125.2 eq smtp tcp
Note DNS responses
allowed from any host domain eq 192.168.125.2 udp
Note deny all other traffic
refuse an entire ip
INTERNET_IN extended IP access list
Note Access VNC on VLAN
allow any host 192.168.125.2 eq 25000 tcp
Note block all other controls and VPN
deny ip any 192.168.125.0 0.0.0.255
deny ip any 192.168.40.0 0.0.0.255
Note leave all other traffic
allow an ip
INTERNET_OUT extended IP access list
Note a complete outbound Internet access
allow an ip
WAN_IN extended IP access list
allow an ip host 207.229.14.xx
Note PERMIT ESTABLISHED TCP connections
allow any tcp smtp created everything eq
Note ALLOW of DOMAIN CONNECTIONS
permit udp host 64.59.135.133 eq field all
permit udp host 64.59.128.120 eq field all
Note ALLOW ICMP WARNING RETURNS
allow all all unreachable icmp
permit any any icmp parameter problem
allow icmp all a package-too-big
allow a whole icmp administratively prohibited
permit icmp any any source-quench
allow icmp all once exceed
refuse a whole icmp
allow an ip
!
auto discovering IP sla
not run cdp
!
allowed SDM_RMAP_1 1 route map
corresponds to the IP 103
!
access-list 1 remark out to WAN routing
Note CCP_ACL the access list 1 = 16 category
access-list 1 permit 192.168.125.2
access-list 1 permit 192.168.5.0 0.0.0.255
Note access-list 23 SSH and HTTP access permissions
access-list 23 permit 192.168.125.0 0.0.0.255
access-list 23 permit 192.168.40.0 0.0.0.255
access-list 23 allow one
Note access-list 100 VPN traffic
access-list 100 permit ip 192.168.125.0 0.0.0.255 any
access-list 100 permit ip 192.168.40.0 0.0.0.255 any
Note access-list 101 for PALL VPN traffic
access-list 101 permit ip 192.168.125.0 0.0.0.255 any
Note access-list 102 CCP_ACL category = 4
Note access-list 102 IPSec rule
access-list 102 permit ip 192.168.5.0 0.0.0.255 192.168.2.0 0.0.1.255
Note access-list 103 CCP_ACL category = 2
Note access-list 103 IPSec rule
access-list 103 deny ip 192.168.5.0 0.0.0.255 192.168.2.0 0.0.1.255
access-list 103 allow ip 192.168.5.0 0.0.0.255 any
access-list 103 allow the host ip 192.168.125.2 all
Note access-list 111 CCP_ACL category = 17
access-list 111 permit udp any host 208.98.213.xx eq non500-isakmp
access-list 111 permit udp any host 208.98.213.xx eq isakmp
access-list 111 allow esp any host 208.98.213.xx
access-list 111 allow ahp any host 208.98.213.xx
Note access-list 111 IPSec rule
access-list 111 permit ip 192.168.2.0 0.0.1.255 192.168.5.0 0.0.0.255
Note access-list 111 IPSec rule
access-list 111 permit ip 192.168.2.0 0.0.1.255 192.168.4.0 0.0.1.255
access-list 111 permit udp host 208.98.212.xx host 208.98.213.xx eq non500-isakmp
access-list 111 permit udp host 208.92.12.xx host 208.92.13.xx eq isakmp
access-list 111 allow esp host 208.92.12.xx host 208.92.13.xx
access-list 111 allow ahp host 208.92.12.xx host 208.92.13.xx
access-list 111 permit icmp any host 208.92.13.xx
access-list 111 permit tcp any host 208.92.13.xx eq 25000
access-list 111 permit tcp any host 208.92.13.xx eq 22
access-list 111 permit tcp any host 208.92.13.xx eq telnet
access-list 111 permit tcp any host 208.92.13.xx eq www
!
!
!
control plan
!
!
!
MGCP behavior considered range tgcp only
MGCP comedia-role behavior no
disable the behavior MGCP comedia-check-media-src
disable the behavior of MGCP comedia-sdp-force
!
profile MGCP default
!
!
!
!
exec banner ^ C
% Warning of password expiration.
-----------------------------------------------------------------------

Unplug IMMEDIATELY if you are not an authorized user
^ C
!
Line con 0
no activation of the modem
line to 0
line vty 0 4
access-class 23 in
password *.
transport input telnet ssh
transportation out all
line vty 5 15
access-class 160 in
password *.
transport of entry all
transportation out all
!
max-task-time 5000 Planner
Scheduler allocate 20000 1000
!
end

Thank you.

It seems that DNS has failed, because it is indeed happened to internet, but it does not work when internet DNS resolution.

Go ahead and try to ping this 157.166.226.25, and it's on the browser http://157.166.226.25/, CNN.com. Let's try those. Also just in case where to configure a DNS SERVER on your router.

- http://www.cisco.com/c/en/us/support/docs/ip/domain-name-system-dns/2418...

Disable any ZBF just in case.

David Castro,

Kind regards

IPSec tunnel problem work without configuration on asa

Hello world

I have a problem with one asa version 8.4.3.

I have a tunnel if I do not set up the tunnel and if I configure it does not mount to mount with a remote site

someone that you already see that? With version 8.2, we had no worries, but since he problem of migration.

Tunnel configuration we get this error:

IKEv1]: Group = x.x.x.x IP x.x.x.x, QM WSF error = (P2 struct & 0x49ba5a0, mess id 0xcd600011).

[IKEv1]: Group = x.x.x.x, IP = x.x.x.x, removing counterpart of correlator table failed, no match!

Thanks for your response

I have never seen as the result of an ASA simple upgrade, but in general there are a number of things that could cause this problem. Generally, this is one unidentified peer or peer without valid card crypto trying to establish VPN site site that generates the message above.

Please take a look at this troubleshooting guide.

If it does not help. Thanks for posting your script

Site to site VPN works not

Hello

I can't get my work vpn site-to-site. Not only that but I am unable to get an internet connection through my ASA. I need to use the IP address public for my local network provided by IPS = 99.143.97.186 - 190 = 255.255.255.248 subnet mask

I followed this tutorial: http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-nex...

can someone please take a look at my settings and help out me? Very much appreciated. Thank you.

See the ciscoasa config (config) #.
: Saved
: Written by enable_15 at 01:12:15.869 UTC Thu Sep 4 2008
!
ASA Version 8.2 (5)
!
ciscoasa hostname
activate 8Ry2YjIyt7RRXU24 encrypted password
2KFQnbNIdI.2KYOU encrypted passwd
names of
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
nameif inside
security-level 100
IP 99.143.97.186 255.255.255.248
!
interface Vlan2
nameif outside
security-level 0
IP 192.168.1.84 255.255.255.0
!
interface Vlan3
No nameif
no level of security
no ip address
!
passive FTP mode
access-list extended 100 permit ip 99.143.97.184 255.255.255.248 host 206.127.20.63
99.143.97.184 IP Access-list extended sheep 255.255.255.248 allow host 206.127.20.63
pager lines 24
Enable logging
asdm of logging of information
Outside 1500 MTU
Within 1500 MTU
ICMP unreachable rate-limit 1 burst-size 1
don't allow no asdm history
ARP timeout 14400
Global 1 interface (outside)
NAT (inside) 0 access-list sheep
NAT (inside) 1 0.0.0.0 0.0.0.0
Route outside 206.127.20.63 255.255.255.255 192.168.1.254 1
Route outside 206.127.21.3 255.255.255.255 192.168.1.254 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
Floating conn timeout 0:00:00
dynamic-access-policy-registration DfltAccessPolicy
Enable http server
http 99.143.97.184 255.255.255.248 inside
http 99.143.97.0 255.255.255.0 inside
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set esp-3des esp-sha-hmac RIGHT
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
correspondence address card crypto outside_map 20 100
peer set card crypto outside_map 20 206.127.21.3
card crypto outside_map 20 transform-set RIGHT
outside_map interface card crypto outside
Crypto ca trustpoint _SmartCallHome_ServerCA
Configure CRL
crypto ISAKMP allow outside
crypto ISAKMP policy 10
preshared authentication
3des encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 65535
preshared authentication
3des encryption
sha hash
Group 2
life 86400
Telnet timeout 5
SSH timeout 5
Console timeout 0
dhcpd outside auto_config
!
dhcpd address 99.143.97.187 - 99.143.97.190 inside
!

a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
WebVPN
tunnel-group 206.127.21.3 type ipsec-l2l
IPSec-attributes tunnel-group 206.127.21.3
pre-shared-key *.
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
maximum message length automatic of customer
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the rsh
inspect the rtsp
inspect esmtp
inspect sqlnet
inspect the skinny
inspect sunrpc
inspect xdmcp
inspect the sip
inspect the netbios
inspect the tftp
Review the ip options
!
global service-policy global_policy
context of prompt hostname
anonymous reporting remote call
Cryptochecksum:0ab759de3926ddb63f79f18a8422409e

ciscoasa (config) # show crypto isakmp his

There is no isakmp sas

ciscoasa (config) # show ip performance
!
interface Vlan1
nameif inside
security-level 100
IP 99.143.97.186 255.255.255.248
!
interface Vlan2
nameif outside
security-level 0
IP 192.168.1.84 255.255.255.0
!

You have an interface incorrect configuration: -.

Add these lines and share how it rates:

interface Vlan1
no address ip 99.143.97.186 255.255.255.248
IP 192.168.1.84 255.255.255.0

interface Vlan2
no address ip 192.168.1.84 255.255.255.0
IP 99.143.97.186 255.255.255.248

Kind regards
Dinesh Moudgil

PS Please rate helpful messages.

Site to site VPN ASA2ASA funny crypto ACL behavior

Hello

I use a VPN site-to site between two ASAs. It works but it should not work, in my opinion, there is a bug. The thing is that when I set the traffic is encrypted in an ACL, this traffic is denied and the tunnel doen't work. If I remove the ACL entries, I'm really interested in encryption, it works...

Thus, for example.

I affermirai a tunnel between the two ASAs and specify

access allowed extended VPN ip host 172.16.0.60 list 172.20.24.60

colt_map card crypto 20 matches the VPN address

card crypto test_map 20 peers set 1.1.1.1
test_map crypto 20 card value transform-set TEST
3600 seconds, duration of life card crypto test_map 20 set - the security association
card crypto test_map 20 set security-association life kilobytes 4608000

When I have it, there is no traffic allowed between 172.16.0.60 and 172.20.24.60. And when I do:

VPN access list extended deny ip host 172.16.0.60 172.20.24.60

access allowed extended VPN ip host 172.16.0.59 list 172.20.24.59

Can I get a communication between 172.16.0.60 172.20.24.60 of the host, but not between 172.16.0.59 the host 172.20.24.59.

It seems very weird to me. I was wondering if anyone had this behaviour before or she could explain it?

Thanks in advance.

Yes.

In Janan all traffic VPN is not checked against the external ACL because of a single command: sysopt connection permit VPN

You can see if this command is enabled by practice: sh run all the sysopt

If you remove this command: no sysopt permit vpn connection

then, all VPN traffic is checked against the ACL interface (and you can only allow what you need).

A better approach is to let the sysopt connection permit-vpn default and create a vpn-filter ACL that is applied to group policy for tunnel groups you need.

Federico.

Installation of site to site VPN IPSec using PIX and ASA

/ * Style definitions * / table. MsoNormalTable {mso-style-name : « Table Normal » ; mso-tstyle-rowband-taille : 0 ; mso-tstyle-colband-taille : 0 ; mso-style-noshow:yes ; mso-style-priorité : 99 ; mso-style-qformat:yes ; mso-style-parent : » « ;" mso-rembourrage-alt : 0 à 5.4pt 0 à 5.4pt ; mso-para-margin : 0 ; mso-para-marge-bottom : .0001pt ; mso-pagination : widow-orphelin ; police-taille : 11.0pt ; famille de police : « Calibri », « sans-serif » ; mso-ascii-font-family : Calibri ; mso-ascii-theme-font : minor-latin ; mso-fareast-font-family : « Times New Roman » ; mso-fareast-theme-font : minor-fareast ; mso-hansi-font-family : Calibri ; mso-hansi-theme-font : minor-latin ; mso-bidi-font-family : « Times New Roman » ; mso-bidi-theme-font : minor-bidi ;}

I am a site configuration to site IPSec VPN using a PIX515E to site A and ASA5520 to Site B.

I have attached the lab diagram. Consider PIX and ASA are in default configuration, which means that nothing is configured on both devices.

According to the scheme

ASA5520

External interface is the level of security 11.11.10.1/248 0

The inside interface is 172.16.9.2/24 security level 100

Default route is 0.0.0.0 0.0.0.0 11.11.10.2 1

PIX515E

External interface is the level of security 123.123.10.2/248 0

The inside interface is 172.16.10.1/24 security level 100

Default route is 0.0.0.0 0.0.0.0 123.123.10.1 1

/ * Style definitions * / table. MsoNormalTable {mso-style-name : « Table Normal » ; mso-tstyle-rowband-taille : 0 ; mso-tstyle-colband-taille : 0 ; mso-style-noshow:yes ; mso-style-priorité : 99 ; mso-style-qformat:yes ; mso-style-parent : » « ;" mso-rembourrage-alt : 0 à 5.4pt 0 à 5.4pt ; mso-para-margin : 0 ; mso-para-marge-bottom : .0001pt ; mso-pagination : widow-orphelin ; police-taille : 11.0pt ; famille de police : « Calibri », « sans-serif » ; mso-ascii-font-family : Calibri ; mso-ascii-theme-font : minor-latin ; mso-fareast-font-family : « Times New Roman » ; mso-fareast-theme-font : minor-fareast ; mso-hansi-font-family : Calibri ; mso-hansi-theme-font : minor-latin ; mso-bidi-font-family : « Times New Roman » ; mso-bidi-theme-font : minor-bidi ;}

Could someone tell me how to set up this configuration? I tried but didn't workout. Here is the IKE protocol I have used.

IKE information:

IKE Encrytion OF

MD5 authentication method

Diffie Helman Group 2

Failure to life

IPSEC information:

IPsec encryption OF

MD5 authentication method

Failure to life

Please enter the following command

on asa

Sysopt connection permit VPN

on pix not sure of the syntax, I think it is

Permitted connection ipsec sysopt

What we are trying to do here is basically allowing vpn opening ports

Alternatively you can open udp 500 and esp (or port ip 50) out to in on the two firewalls

SSL vpn site to site vpn

I have a couple of site to site VPN working properly on an ASA 5515. Don't know what is on the other side, as I haven't seen them. I configured a SSL vpn for remote users who must be able to access resources on remote sites. I got access to the network of site without any problems and and have added the range of IP addresses for remote users to links from site to site, but I am unable to connect. Anyone who has this performance, it would be greatly appreciated if you can help.

Hi mbluemel,

You need to configure the remote side to allow traffic from the remote side for SSL VPN users.
This list of documents the measures taken to achieve this: -.

http://www.petenetlive.com/kb/article/0000040.htm

For more information: -.
http://www.Cisco.com/c/en/us/support/docs/security/ASA-5500-x-series-NEX...

Kind regards
Dinesh Moudgil

PS Please rate helpful messages.

Question about ACL's with the 2621 when using site to site VPN

I set up two site to site vpn. We have an ASA at our headquarters and branches will IOS routers - one is a 1811 and the other 2621. Both are running the latest versions of IOS, respectively. The two VPN site-to-site do not work. I have a list of inbound on the external interfaces of both routers, access that allows only the IP address of the ASA IP traffic. All other traffic is denied. I put NAT overload upward in the typical form, and I use ip outgoing inspection on the same interface, to allow incoming traffic back to surfing the internet. This configuration works very well with the 1811, where all traffic is blocked except traffic IP (IPSEC) coming from the ASA. Guests at our headquarters can reach hosts behind the 1811 and vice versa.

Here's my problem: the 2621 is processing traffic encapsulated on the external interface and block this traffic because it does not match. I know because when I turn on logging / debugging on the 2621, I see inbound traffic blocked by the ACL. Technically, I guess that it does not, but to this interface, the traffic is always encapsulated so I think it fits to this access list and then go to the Cryptography decapsulation card and be sent to the destination host. Just as it does on the 1811. I have not 'wan' t to create another line in the access list for all subnets to Headquarters. Why is not it works the same way as it does on the 1811? Is there something else I need to activate?

------------------------------------------------------------------------

Config of 1811:

!
version 12.4
horodateurs service debug datetime msec
Log service timestamps datetime localtime show-timezone msec
encryption password service
!
hostname BranchVPN1
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 notifications
!
AAA new-model
!
!
AAA authentication login default local
activate the default AAA authentication no
authorization AAA console
AAA authorization exec default local
!
AAA - the id of the joint session
no ip source route
IP cef
!
!
IP inspect the audit trail
inspect the IP dns-timeout 10
inspect the name IP internet udp timeout 30
inspect the name IP internet tcp timeout 30
inspect the name IP internet ftp timeout 30
inspect the name IP internet http timeout 30
inspect the name firewall tcp IP
inspect the name IP firewall udp
inspect the name IP firewall icmp
IP inspect the dns name of the firewall
inspect the name IP firewall ftp
inspect the name IP firewall http
inspect the name IP firewall https
inspect the IP firewall name ftps
property intellectual auth-proxy max-nodata-& 3
property intellectual admission max-nodata-& 3
!
!
IP domain name xxxx
!
!
!
!
username xxxxxxxxxx
!
!
!
class-map correspondence vpn_traffic
police name of group-access game
!
!
VPN policy-map
class vpn_traffic
in line-action police 2000000 37500 pass drop exceeds-action
!
!
!
crypto ISAKMP policy 10
BA aes 256
preshared authentication
Group 2
ISAKMP crypto key address xxxx xxxxxx
ISAKMP crypto keepalive 10
!
life crypto ipsec security association seconds 28800
!
Crypto ipsec transform-set esp - aes 256 esp-sha-hmac xxtransform
!
xxmap 10 ipsec-isakmp crypto map
defined peer xxxx
Set transform-set xxtransform
PFS group2 Set
match the address tunnelnetworks
static inverse-road
!
!
!
interface Loopback0
172.16.99.1 the IP 255.255.255.255
!
interface FastEthernet0/0
Description Connection to Internet (DHCP)
DHCP IP address
IP access-group outside_in in
no ip redirection
no ip unreachable
no ip proxy-arp
inspect the firewall on IP
NAT outside IP
IP virtual-reassembly
automatic duplex
automatic speed
No cdp enable
xxmap card crypto
!
interface FastEthernet0/1
Description of the connection to the local network
address 172.20.1.1 IP 255.255.255.0
no ip redirection
no ip unreachable
no ip proxy-arp
IP nat inside
IP virtual-reassembly
automatic duplex
automatic speed
No cdp enable
VPN service-policy input
!
interface Serial0/0/0
no ip address
Shutdown
No cdp enable
!
interface Serial0/1/0
no ip address
Shutdown
!
IP forward-Protocol ND
IP route 0.0.0.0 0.0.0.0 dhcp
!
no ip address of the http server
local IP http authentication
no ip http secure server
IP nat inside source list nat - acl interface FastEthernet0/0 overload
!
IP nat - acl extended access list
refuse any 10.0.0.0 0.255.255.255 ip
allow an ip
outside_in extended IP access list
allow udp any eq bootps host 255.255.255.255 eq bootpc
allow an ip host (ASA IPADDR)
deny ip any any newspaper
IP extended access list police
deny ip host xxxx any
deny ip any host xxxx
IP 172.20.1.0 allow 0.0.0.255 10.0.0.0 0.255.255.255
tunnelnetworks extended IP access list
permit host 172.16.99.1 ip 10.0.0.0 0.255.255.255
IP 172.20.1.0 allow 0.0.0.255 10.0.0.0 0.255.255.255
!
recording of debug trap
logging source-interface Loopback0
exploitation forest xxxx
access-list 160 note t is
not run cdp
!
!
control plan
!
Banner motd ^ CC

Authorized technician!

^ C
!
Line con 0
line to 0
line vty 0 4
exec-timeout 5 0
Synchronous recording
entry ssh transport
line vty 5 15
exec-timeout 5 0
Synchronous recording
entry ssh transport
!
Scheduler allocate 20000 1000
end

------------------------------------------------------------------------

2621 Config:

!
version 12.3
horodateurs service debug datetime msec
Log service timestamps datetime localtime show-timezone msec
encryption password service
!
hostname BranchVPN2
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 notifications
no console logging
!
AAA new-model
!
!
AAA authentication login default local
activate the default AAA authentication no
authorization AAA console
AAA authorization exec default local
AAA - the id of the joint session
IP subnet zero
no ip source route
IP cef
!
!
IP domain name xxxx
!
IP inspect the audit trail
inspect the IP dns-timeout 10
inspect the name IP internet udp timeout 30
inspect the name IP internet tcp timeout 30
inspect the name IP internet ftp timeout 30
inspect the name IP internet http timeout 30
inspect the name firewall tcp IP
inspect the name IP firewall udp
inspect the name IP firewall icmp
inspect the name IP firewall ftp
inspect the name IP firewall http
Max-events of po verification IP 100
!
!
!
!
!
!
!
!
!
!
!
!
username xxxxxxxxxxxx
!
!
!
class-map correspondence vpn_traffic
police name of group-access game
!
!
VPN policy-map
class vpn_traffic
in line-action police 2000000 37500 pass drop exceeds-action
!
!
!
crypto ISAKMP policy 10
BA aes 256
preshared authentication
Group 2
ISAKMP crypto key address xxxx xxxxx
ISAKMP crypto keepalive 10
!
life crypto ipsec security association seconds 28800
!
Crypto ipsec transform-set esp - aes 256 esp-sha-hmac xxtransform
!
xxmap 10 ipsec-isakmp crypto map
defined peer xxxx
Set transform-set xxtransform
PFS group2 Set
match the address tunnelnetworks
reverse-road remote-peer
!
!
!
!
interface Loopback0
172.16.99.2 the IP 255.255.255.255
!
interface FastEthernet0/0
Description Connection to Internet (DHCP)
DHCP IP address
IP access-group outside_in in
no ip redirection
no ip unreachable
no ip proxy-arp
NAT outside IP
inspect the firewall on IP
automatic duplex
automatic speed
No cdp enable
xxmap card crypto
!
interface Serial0/0
no ip address
Shutdown
No cdp enable
!
interface FastEthernet0/1
Description of the connection to the local network
IP 172.20.2.1 255.255.255.0
no ip redirection
no ip unreachable
no ip proxy-arp
IP nat inside
automatic duplex
automatic speed
No cdp enable
VPN service-policy input
!
interface Serial0/1
no ip address
Shutdown
No cdp enable
!
IP nat inside source list nat - acl interface FastEthernet0/0 overload
no ip address of the http server
local IP http authentication
no ip http secure server
IP classless
IP route 0.0.0.0 0.0.0.0 dhcp
!
!
!
IP nat - acl extended access list
refuse any 10.0.0.0 0.255.255.255 ip
allow an ip
outside_in extended IP access list
allow udp any eq bootps host 255.255.255.255 eq bootpc
allow an ip host (ASA IPADDR)
deny ip any any newspaper
IP extended access list police
deny ip host xxxx any
deny ip any host xxxx
IP 172.20.2.0 allow 0.0.0.255 10.0.0.0 0.255.255.255
tunnelnetworks extended IP access list
permit host 172.16.99.2 ip 10.0.0.0 0.255.255.255
IP 172.20.2.0 allow 0.0.0.255 10.0.0.0 0.255.255.255
recording of debug trap
logging source-interface Loopback0
exploitation forest xxxx
not run cdp
!
!
!
!
!
Banner motd ^ CCC

Authorized technician!

^ C
!
Line con 0
line to 0
line vty 0 4
exec-timeout 5 0
Synchronous recording
entry ssh transport
line vty 5 15
exec-timeout 5 0
Synchronous recording
entry ssh transport
!
!
end

Please check if this helps:

http://www.Cisco.com/en/us/docs/iOS/12_3t/12_3t8/feature/guide/gt_crpks.html

Federico.

Multi-site VPN problem

Greetings,

I practice implementation of VPN and it seems to have fallen on a small issue that solution eludes me. Everything works in my current topology with the exception of a multi-site vpn. I have 3 ASA, which is outside the interface is connected via a switch. The inside interface is connected to a local area network that contains a workstation on each subnet. I'm trying to set up a solution where I can have all 3 ASA related between them via a VPN. The question I have is when I raise a single tunnel, scathing from a workstation behind the ASA, I can't set up a second tunnel scathing from a different network. To explain that better, here is an explanation:

ASA #1

outdoors: 10.0.1.1/24

inside: 192.168.0.1/24

workstation: 192.168.0.100

ASA #2

outside: 10.0.1.2/24

inside: 192.168.1.1/24

workstation: 192.168.1.100

ASA #3

outside: 10.0.1.3/24

inside: 192.168.2.1/24

workstation: 192.168.2.100

If I ping 192.168.0.100 192.168.1.100, the tunnel opens very well and I get answers. If I can try and ping 192.168.0.100 192.168.2.100, does not open the tunnel to 192.168.2.0. If I clear all its on ASA #1 and then ping 192.168.0.100 192.168.2.100, the tunnel opens very well and I get a response. Then I try and ping 192.168.0.100 192.168.1.100 and the same thing happens, no tunnel and no response. When I enabled logging on ASA #1 seems that it sends the ping for the different network on the tunnel open instead of opening a new tunnel to the correct network. Can someone tell me what is happening here and if I just missed something simple with routing? Or is it maybe a problem with VPN?

Craig,

You have default route badly configured on all the ASA. Here's what you have configured

ASA1

Route outside 0.0.0.0 0.0.0.0 192.168.0.1 1

It's sendning the package for outside inside IP address. Here's what you need to do on the ASA

ASA1

No route outside 0.0.0.0 0.0.0.0 192.168.0.1 1

Route outside 0.0.0.0 0.0.0.0 10.0.1.2

ASA2

No route outside 0.0.0.0 0.0.0.0 192.168.1.1 1

Route outside 0.0.0.0 0.0.0.0 10.0.1.1

ASA3

No route outside 0.0.0.0 0.0.0.0 192.168.2.1 1

Route outside 0.0.0.0 0.0.0.0 10.0.1.1

Also delete icmp access list crypto that you allowed to what IP is the same access list. IP covers both the ICMP.

Kindly let me know change default allows traffic.

Kind regards

Bad Boy

P.S. Please mark this message as 'Responded' If you find this information useful so that it brings goodness to other users of the community

IPsec Site to Site VPN multisession?

Hi people.

I recently faced a problem at work. Customers want to dismiss ipsec site to site vpn. I have 2 asa 5520 working in a stack. Is it possible to configure the vpn site to site in a redundant mode, as the first ip address is x.x.x.x and secondary is y.y.y.y (backup)?

Thank you much in advance.

Hello

You can define several counterparts in the card encryption, see:

http://www.Cisco.com/en/us/docs/security/ASA/asa72/command/reference/c5_72.html#wp2066090

You can define several tunnels and leave the routing protocol to choose the best route.

Hope this helps,

Bastien.

Site to Site VPN. pick up DfltGrpPolicy instead of Tunnel-Group

Hello

Our ASA was set by a consultant some time ago to allow connectivity SSLVPN RSA backend. I am now trying to get a Site to Site VPN working but seem to get into a lot of difficulties. I get a load of the l2l VPN-related debugging messages which I believe is set up correctly. Here's what I think is of interest

"January 24, 2009 12:13:01: % ASA-6-113009: AAA recovered in group policy by default (DfltGrpPolicy) to the user = x.x.x.x".

The user specifies the IP address of the Cisco router remote that we try to get the VPN configuration.

I have to admit that I haven't done a lot with the side things SSLVPN so this part of the config is out of my depth, that's why I post here.

If anyone can help it would be really appreciated.

Here are the relevant details (I can post more if there isn't enough). My question is, how do I get the l2l using the tunnel-group and not the default group policy?

Thanks in advance for any help.

dynamic-access-policy-registration

DfltAccessPolicy

WebVPN

list of URLS no

SVC request no svc default

RADIUS protocol AAA-server VPNAUTH

AAA-server VPNAUTH *. *. *

interval before new attempt-5

timeout 3

key *.

AAA authentication enable LOCAL console

AAA authentication http LOCAL console

LOCAL AAA authentication serial console

the ssh LOCAL console AAA authentication

AAA authentication LOCAL telnet console

LOCAL AAA authorization command

attributes of Group Policy DfltGrpPolicy

value of DNS server! !. !. !

VPN-idle-timeout no

VPN-tunnel-Protocol webvpn

enable IP-comp

enable IPSec-udp

field default value mondomaine.fr

the address value vpnpool pools

WebVPN

enable http proxy

SVC Dungeon - install any

SVC keepalive 60

SVC generate a new method ssl key

SVC request no svc default

disable ActiveX-relays

disable file entry

exploration of the disable files

disable the input URL

tunnel-group DefaultRAGroup webvpn-attributes

message of rejection-RADIUS-

IPSec-attributes tunnel-group DefaultRAGroup

pre-shared-key *.

tunnel-group DefaultRAGroup ppp-attributes

PAP Authentication

ms-chap-v2 authentication

attributes global-tunnel-group DefaultWEBVPNGroup

address vpnpool pool

authentication-server-group VPNAUTH

tunnel-group DefaultWEBVPNGroup webvpn-attributes

message of rejection-RADIUS-

tunnel-group x.x.x.x type ipsec-l2l

tunnel-group ipsec-attributes x.x.x.x

pre-shared-key *.

Wayne

Do "sh run all tunnel-group" you should see the strategy of group associated with it.

for example:

tunnel-group 1.1.1.1 type ipsec-l2l

tunnel-group 1.1.1.1 General attributes

no accounting server group

Group Policy - by default-DfltGrpPolicy

tunnel-group 1.1.1.1 ipsec-attributes

pre-shared-key *.

by the peer-id-validate req

no chain

no point of trust

ISAKMP retry threshold 10 keepalive 2

Let me know if it helps.

See you soon,.

Gilbert

Have a vpn site to site of work, added second who has problems

We've had a success vpn site to site working for several months now. It's a 5510 ASA to Headquarters for an ASA 5505 in a branch in another State. We add a second vpn site to site in another State this time of the AC to a Sonicwall TZ100. After connecting the Sonicwall to the Qwest modem in bridge mode tunnel came right up. I was unable to ping all off the coast of the private IPs to the HQ of the new branch, but was able to use the remote desktop in servers and workstations at Headquarters. Also, all computers appear when you browse the network of the new branch.

The first part, we are able to ping both directions and use remote desktop in both directions.

When using tracers of package in ASDM on the ASA HQ and rattling one of the IPs in HQ protected network to an IP address in the new network of agencies EXEMPT from NAT looks good, but when it hits the first NAT it fits on the "dynamic translation to the pool (10.1.255.254) 10 [Interface PAT]" (which is the default route to all VLAN access to Internet).

Next NAT (subtype - host-limits) is more beautiful and this one goes to the IP address of the external interface of the ASA 5510 HQ, but then the third NAT (subtype - rpf-check) returns to the ' 10 (10.1.255.254) Interface PAT] "and the package is ABANDONED. Also there is no step VPN in Packet Tracer after NAT.

So obviously the HQ ASA 5510 does not consider this to be interesting traffic but I don't know why.

Here is the output of sh crypto ipsec his ffrom HQ ASA:

Interface: outside
Tag crypto map: outside_map, seq num: 30 local addr: 209.X.X.X

access-list encrypt_acl-30 permit ip 10.1.1.0 255.255.255.0 10.1.8.0 255.255.255.0
local ident (addr, mask, prot, port): (10.1.1.0/255.255.255.0/0/0)
Remote ident (addr, mask, prot, port): (10.1.8.0/255.255.255.0/0/0)
current_peer: 65.102.14.72

#pkts program: 229450, #pkts encrypt: 229450, #pkts digest: 229450
#pkts decaps: 172516, #pkts decrypt: 172516, #pkts check: 172516
compressed #pkts: 0, unzipped #pkts: 0
#pkts uncompressed: 229450, comp #pkts failed: 0, #pkts Dang failed: 0
success #frag before: 0, failures before #frag: 0, #fragments created: 0
Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
#send errors: 0, #recv errors: 0

local crypto endpt. : 209.X.X.X, remote Start crypto. : 65.102.X.X

Path mtu 1500, fresh ipsec generals 58, media, mtu 1500
current outbound SPI: 91860025

SAS of the esp on arrival:
SPI: 0x88957B9C (2291497884)
transform: esp-3des esp-md5-hmac no compression
running parameters = {L2L, Tunnel}
slot: 0, id_conn: 2600960, crypto-card: outside_map
calendar of his: service life remaining key (s): 59068
Size IV: 8 bytes
support for replay detection: Y
Anti-replay bitmap:
0xFFFFFFFF to 0xFFFFFFFF
outgoing esp sas:
SPI: 0 x 91860025 (2441478181)
transform: esp-3des esp-md5-hmac no compression
running parameters = {L2L, Tunnel}
slot: 0, id_conn: 2600960, crypto-card: outside_map
calendar of his: service life remaining key (s): 59068
Size IV: 8 bytes
support for replay detection: Y
Anti-replay bitmap:
0x00000000 0x00000001

Tag crypto map: outside_map, seq num: 30 local addr: 209.X.X.X

access-list encrypt_acl-30 permit ip 10.1.10.0 255.255.255.0 10.1.8.0 255.255.255.0
local ident (addr, mask, prot, port): (10.1.10.0/255.255.255.0/0/0)
Remote ident (addr, mask, prot, port): (10.1.8.0/255.255.255.0/0/0)
current_peer: 65.102.x.x

#pkts program: encrypt 0, #pkts: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0
compressed #pkts: 0, unzipped #pkts: 0
#pkts uncompressed: 0, comp #pkts failed: 0, #pkts Dang failed: 0
success #frag before: 0, failures before #frag: 0, #fragments created: 0
Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
#send errors: 0, #recv errors: 0

local crypto endpt. : 209.X.X.X, remote Start crypto. : 65.102.X.X

Path mtu 1500, fresh ipsec generals 58, media, mtu 1500
current outbound SPI: A204BAE2

SAS of the esp on arrival:
SPI: 0xDA8C653A (3666634042)
transform: esp-3des esp-md5-hmac no compression
running parameters = {L2L, Tunnel}
slot: 0, id_conn: 2600960, crypto-card: outside_map
calendar of his: service life remaining key (s): 84670
Size IV: 8 bytes
support for replay detection: Y
Anti-replay bitmap:
0x00000000 0x00000001
outgoing esp sas:
SPI: 0xA204BAE2 (2718218978)
transform: esp-3des esp-md5-hmac no compression
running parameters = {L2L, Tunnel}
slot: 0, id_conn: 2600960, crypto-card: outside_map
calendar of his: service life remaining key (s): 84621
Size IV: 8 bytes
support for replay detection: Y
Anti-replay bitmap:
0x00000000 0x00000001

Here is the output of sh crypto isakmp his on HQ ASA:

3 peer IKE: 65.102.x.x

Type: L2L role: answering machine

Generate a new key: no State: MM_ACTIVE

Here is the config:

ASA Version 8.0 (4)
!
hostname COMPASA
domain COMPfirm.com
activate the encrypted password of TMACBloMlcBsq1kp
TMACBloMlcBsq1kp encrypted passwd
names of
DNS-guard
!
interface Ethernet0/0
nameif outside
security-level 0
IP 209.X.X.X 255.255.255.224
!
interface Ethernet0/1
nameif inside
security-level 100
IP 10.1.255.254 255.255.255.248
!
interface Ethernet0/2
nameif dmz
security-level 50
10.2.2.1 IP address 255.255.255.0
!
interface Ethernet0/3
Shutdown
No nameif
no level of security
no ip address
!
interface Management0/0
nameif management
security-level 100
IP 192.168.1.1 255.255.255.0
management only
!
boot system Disk0: / asa804 - k8.bin
passive FTP mode
clock timezone MDT - 7
clock to summer time recurring MDT
DNS domain-lookup outside
DNS server-group DefaultDNS
Name-Server 4.2.2.1
domain COMPfirm.com
permit same-security-traffic inter-interface
permit same-security-traffic intra-interface
list of allowed inbound tcp extended access any host 209.X.X.X eq www
list of allowed inbound tcp extended access any host 209.X.X.X eq https
list of allowed inbound tcp extended access any host 209.X.X.X eq ftp
list of allowed inbound tcp extended access any host 209.X.X.X eq ftp - data
list of allowed inbound tcp extended access any host 209.X.X.X eq ssh
list of allowed inbound tcp extended access any host 209.X.X.X eq imap4
list of allowed inbound tcp extended access any host 209.X.X.X eq pop3
list of allowed inbound tcp extended access any host 209.X.X.X eq www
list of allowed inbound tcp extended access any host 209.X.X.X eq https
list of allowed inbound tcp extended access any host 209.X.X.X eq smtp
list of extended inbound icmp permitted access a whole
access list entering note MMS-1755
list incoming extended access permit tcp any eq 1755 host inactive 209.X.X.X
inbound access list notice MMS - UDP
list of inbound udp allowed extended access all eq 1755 host inactive 209.X.X.X
DMZ list extended access permit tcp host 10.2.2.2 10.1.1.11 host eq smtp
DMZ list extended access permit tcp host 10.2.2.2 host 10.1.1.50 eq 8777
access-list extended sheep allowed ip 10.1.0.0 255.255.0.0 172.16.22.0 255.255.255.0
access-list sheep extended ip 10.1.10.0 allow 255.255.255.0 10.0.0.0 255.255.255.0
access-list extended sheep allowed ip 10.1.1.0 255.255.255.0 10.0.0.0 255.255.255.0
access-list sheep extended ip 10.1.10.0 allow 255.255.255.0 10.1.8.0 255.255.255.0
access-list extended sheep allowed ip 10.1.1.0 255.255.255.0 10.1.8.0 255.255.255.0
access extensive list ip 10.1.0.0 vpnsplit allow 255.255.0.0 172.16.22.0 255.255.255.0
access extensive list ip 10.1.10.0 encrypt_acl allow 255.255.255.0 10.0.0.0 255.255.255.0
permit encrypt_acl to access extended list ip 10.1.1.0 255.255.255.0 10.0.0.0 255.255.255.0
global_mpc list extended access permitted tcp a whole
access-list encrypt_acl-30 scope ip 10.1.10.0 allow 255.255.255.0 10.1.8.0 255.255.255.0
access-list encrypt_acl-30 permit extended ip 10.1.1.0 255.255.255.0 10.1.8.0 255.255.255.0
pager lines 24
Enable logging
asdm of logging of information
Outside 1500 MTU
Within 1500 MTU
MTU 1500 dmz
management of MTU 1500
IP local pool vpnpool 172.16.22.1 - 172.16.22.254 mask 255.255.255.0
ICMP unreachable rate-limit 1 burst-size 1
ICMP allow any inside
ASDM image disk0: / asdm - 61551.bin
don't allow no asdm history
ARP timeout 14400
Global (outside) 10 209.X.X.X netmask 255.255.255.0
Global interface (10 Interior)
Global interface (dmz) 10
NAT (inside) 0 access-list sheep
NAT (inside) 10 0.0.0.0 0.0.0.0
NAT (dmz) 10 0.0.0.0 0.0.0.0
static (dmz, external) 209.X.X.X 10.2.2.2 netmask 255.255.255.255
static (inside, outside) 209.X.X.X 10.1.1.11 netmask 255.255.255.255
static (dmz, inside) 10.2.2.2 10.2.2.2 netmask 255.255.255.255
static (inside, dmz) 10.1.1.11 10.1.1.11 netmask 255.255.255.255
static (inside, dmz) 10.1.1.50 10.1.1.50 netmask 255.255.255.255
Access-group interface incoming outside
Access-group in interface dmz dmz
Route outside 0.0.0.0 0.0.0.0 209.X.X.X 1
Route inside 10.1.0.0 255.255.0.0 10.1.255.249 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
dynamic-access-policy-registration DfltAccessPolicy
Ray of AAA-server vpn Protocol
AAA-server vpn (inside) host 10.1.1.12
key--> ZZZZZZ
the ssh LOCAL console AAA authentication
AAA authentication LOCAL telnet console
local AAA authentication attempts 16 max in case of failure
Enable http server
http 172.16.22.0 255.255.255.0 inside
http 10.1.0.0 255.255.0.0 inside
No snmp server location
No snmp Server contact
Sysopt noproxyarp inside
Sysopt noproxyarp dmz
Sysopt noproxyarp management
Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
Crypto ipsec transform-set esp-3des esp-md5-hmac HQset
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
Crypto-map dynamic outside_dyn_map 10 the transform-set ESP-3DES-MD5 value
life together - the association of security crypto dynamic-map outside_dyn_map 10 28800 seconds
Crypto-map dynamic outside_dyn_map 10 kilobytes of life together - the association of safety 4608000
Crypto-map dynamic outside_dyn_map 10 the value reverse-road
card crypto outside_map 20 match address encrypt_acl
card crypto outside_map 20 game peers 67.42.X.X
outside_map 20 game of transformation-HQset crypto card
life safety association set card crypto outside_map 20 28800 seconds
card crypto outside_map 20 set security-association life kilobytes 4608000
card crypto 30 match address encrypt_acl-30 outside_map
crypto outside_map 30 peer 65.102.X.X card game
crypto outside_map 30 card value transform-set HQset
86400 seconds, duration of life card crypto outside_map 30 set - the security association
card crypto outside_map 30 set security-association life kilobytes 4608000
map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map
outside_map interface card crypto outside
crypto ISAKMP allow outside
crypto ISAKMP policy 10
preshared authentication
3des encryption
md5 hash
Group 2
life 86400
Crypto isakmp nat-traversal 50
Telnet 10.1.0.0 255.255.0.0 inside
Telnet timeout 15
SSH 0.0.0.0 0.0.0.0 outdoors
SSH 10.1.0.0 255.255.0.0 inside
SSH timeout 30
Console timeout 0
management-access inside
management of 192.168.1.2 - dhcpd address 192.168.1.254
enable dhcpd management
!
a basic threat threat detection
threat scan-threat detection
threat detection statistics
a statistical threat detection tcp-interception rate-interval 30 burst-400-rate average rate 200
Server NTP 192.43.244.18
WebVPN
allow outside
SVC disk0:/anyconnect-win-2.3.0254-k9.pkg 1 image
enable SVC
tunnel-group-list activate
internal Clients_VPN group strategy
Group Policy Clients_VPN attributes
value of server WINS 10.1.1.12
value of server DNS 10.1.1.12
Protocol-tunnel-VPN IPSec
enable IPSec-udp
Split-tunnel-policy tunnelspecified
value of Split-tunnel-network-list vpnsplit
value by default-field COMPfirm.local
Split-dns value COMPfirm.local
the address value vpnpool pools
internal clientgroup group policy
attributes of the strategy of group clientgroup
value of server WINS 10.1.1.12
value of server DNS 10.1.1.12
VPN-tunnel-Protocol svc webvpn
Split-tunnel-policy tunnelall
WebVPN
SVC Dungeon-Installer installed
time to generate a new key of SVC 30
SVC generate a new method ssl key
SVC request no svc default
ssluser1 encrypted password username
username bcurtis encrypted password privilege 0 v
username privilege 15 WPDR encrypted password
username admin privilege 15 encrypted password
username privilege password encrypted XXXXXXX 0
tunnel-group M & J type remote access
tunnel-group M & J - global attributes
address vpnpool pool
Vpn server authentication group
strategy - by default-group Clients_VPN
tunnel-group M & J ipsec-attributes
pre-shared-key *.
type tunnel-group sslgroup remote access
tunnel-group sslgroup General-attributes
address vpnpool pool
Vpn server authentication group
Group Policy - by default-clientgroup
tunnel-group sslgroup webvpn-attributes
activation of the Group sslgroup_users alias
tunnel-group 67.42.X.X type ipsec-l2l
IPSec-attributes tunnel-group 67.42.X.X
pre-shared-key *.
tunnel-group 65.102.X.X type ipsec-l2l
IPSec-attributes tunnel-group 65.102.X.X
pre-shared-key *.
!
Global class-card class
corresponds to the global_mpc access list
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns migrated_dns_map_1
parameters
message-length maximum 768
Policy-map global_policy
class inspection_default
inspect the migrated_dns_map_1 dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the rsh
inspect the rtsp
inspect sqlnet
inspect the skinny
inspect sunrpc
inspect xdmcp
inspect the sip
inspect the netbios
inspect the tftp
Global category
IPS inline sensor vs0 relief
!
global service-policy global_policy
context of prompt hostname
Cryptochecksum:ZZZZZZZZZZZZZZZZZZZZZ
: end

Is the problem may be due to the fact that my 2 new ACL to fall "encrypt_acl-30" after "access-list extended global_mpc permit tcp any any" in the config and it flows into the implied all refuse?

Thanks for looking at this.

Rather than replace the static route, you can simply add a new static route to 10.1.8.0/24 as follows:

outdoor 10.1.8.0 255.255.255.0 209.X.X.X 1

Because it is more precise it will take precedence over your most generic static route from 10.1.0.0/16 inward.

Good spot btw!

Site to Site VPN Cisco IOS 1941 15.0 (1) M1

Hello

I am currently developing a Site VPN site between an ASA and a router in 1941. Configuring VPN on the SAA seems to be ok, because it works without problem with router 1841 with IOS 12.4 to the other site. The same VPN configuration on the new router in 1941 with M1 IOS 15.0 (1) does not work. It seems that the access to the crypto map list is the problem. The router never start the VPN connection. When the ASA attempts to establish the VPN, the debugging of the router log shows:

...

* 14:37:52.263 may 5: ISAKMP: (1007): proposal of IPSec checking 1
* 14:37:52.263 may 5: ISAKMP: turn 1, ESP_3DES
* 14:37:52.263 may 5: ISAKMP: attributes of transformation:
* 14:37:52.263 may 5: ISAKMP: type of life in seconds
* 14:37:52.263 may 5: ISAKMP: life of HIS (basic) of 28800
* 14:37:52.263 may 5: ISAKMP: type of life in kilobytes
* 14:37:52.263 may 5: ISAKMP: service life of SA (IPV) 0x0 0 x 46 0 50 x 0 x 0
* 14:37:52.263 may 5: ISAKMP: program is 1 (Tunnel)
* 14:37:52.263 may 5: ISAKMP: authenticator is HMAC-SHA
* 14:37:52.263 may 5: ISAKMP: group is 2
* 14:37:52.263 may 5: ISAKMP: (1007): atts are acceptable.
* 5 May 14:37:52.263: ISAKMP: (1007): IPSec policy invalidated proposal with error 32
* 5 May 14:37:52.263: ISAKMP: (1007): politics of ITS phase 2 is not acceptable! (local... remote control...)

...

Any clue?

Concerning

Claudia

The configuration of the router:

version 15.0
horodateurs service debug datetime msec
Log service timestamps datetime msec
no password encryption service
!
hostname Cisco1941
!
No aaa new-model
!
No ipv6 cef
no ip source route
IP cef
!
IP domain name xyz.de
!
Authenticated MultiLink bundle-name Panel
!
Crypto pki trustpoint TP-self-signature-...
!
TP-self-signature-... crypto pki certificate chain
quit smoking
license udi pid CISCO1941/K9 sn...
!
username privilege 15 secret 5 xyz $1$...
!
redundancy
!
session of crypto consignment
!
crypto ISAKMP policy 10
BA 3des
preshared authentication
Group 2
ISAKMP crypto key... address 1.2.3.4
invalid-spi-recovery crypto ISAKMP
!
Crypto ipsec transform-set esp-3des esp-sha-hmac tsAsa
!
ASA 10 ipsec-isakmp crypto map
defined peer 1.2.3.4
Set transform-set tsAsa
PFS group2 Set
match address 100
!
interface GigabitEthernet0/0
Description * inside *.
IP 10.100.100.1 255.255.255.0
automatic duplex
automatic speed
!
!
interface GigabitEthernet0/1
IP 5.6.7.8 255.255.255.240
IP access-group 111 to
no ip-cache cef route
no ip route cache
automatic duplex
automatic speed
card crypto asa
!
!
ATM0/0/0 interface
no ip address
Shutdown
No atm ilmi-keepalive
!
!
IP forward-Protocol ND
!
IP route 0.0.0.0 0.0.0.0 1.2.3.5
!
access-list 100 permit ip 10.100.100.0 0.0.0.255 10.10.10.0 0.0.0.255
access-list 111 allow esp 1.2.3.4 host 5.6.7.8
access-list 111 permit udp host 1.2.3.4 host 5.6.7.8 eq isakmp
access-list 111 allow ahp host 1.2.3.4 5.6.7.8
access-list 111 deny ip any any newspaper

....

end

Try to do this:

IP route 10.10.10.0 255.255.255.0 interface Ge0/1

Route IP 1.2.3.4 255.255.255.255 by default-gateway-to-Ge0/1

The rest of your config looks very good.

Upgrade of site to Site VPN 8.2-> 8.3-> 8.4

Hi all

I did some research to find out where is my mistake, but I came up empty, so I was hoping someone might be able to shed light on the situation. I just recently upgraded an ASA of 8.2 to 8.4 (1 8.4 (4) to be precise). We have two site to site VPN, inheriting from the ASA and came one of the VPN and the other didn't. It seems that it happened yet to isakmp Exchange. However, I noticed that an ASA is configured with encryption card that points to an ACL using and object-group and one that works uses a card encryption that points to a network of the object. Should the automatic conversion of upgrade process the converted code the object-group, a network of the object or is this still a valid way to define interesting traffic on the SAA?

As for my NAT statement for free traffic, I saw many people using the identity nat without the additions non-proxy-arp and route search and others with. Which is the right way to 8.4? Any information would be much appreciated!

Best regards

Alan

Hello Alan,.

The route search is for a bug when you are unable to ping from the inside interface from the other side of the tunnel.

Now as long as the crypto ACL is set correctly does not matter if you use one of the other...

You can share the two configs to site to another and I can check out them if you wish

Please note all useful posts

Julio

A Site with IPsec without restoring a new tunnel

Hello, I have a question about IPSec S2S.

Network.PNG

In this topoloy, I would like to that IPSec S2S between 172.21.0.0/24 and 172.22.0.0/24.

The serial line is the first priority and route on ISP is the second priority for routing.

The question is how can I create the IPsec Site to Site connection without restore when the routing path changes?

The AR configuration:

!
version 15.1
no service the timestamps don't log datetime msec
no service timestamps debug datetime msec
no password encryption service
!
hostname AR
!
!
!
!
!
!
!
!
no ip cef
No ipv6 cef
!
!
!
username cisco password 0 BR
!
!
license udi pid CISCO2901/K9 sn FTX1524YO05
licence start-up module c2900 technology-package securityk9
!
!
!
crypto ISAKMP policy 10
BA 3des
md5 hash
preshared authentication
Group 2
!
cisco key crypto isakmp 10.0.0.2 address
address of cisco crypto isakmp 200.200.200.2 keys
!
!
!
Crypto ipsec transform-set esp-3des esp-sha-hmac TS
!
CMAP 10 ipsec-isakmp crypto card
defined peer 10.0.0.2
defined by peer 200.200.200.2
game of transformation-TS
match the vpn address
!
!
!
!
!
!
pvst spanning-tree mode
!
!
!
!
!
!
interface GigabitEthernet0/0
IP 100.100.100.2 255.255.255.252
automatic duplex
automatic speed
card crypto WCPA
!
interface GigabitEthernet0/1
IP 172.21.0.254 255.255.255.0
automatic duplex
automatic speed
!
interface Serial0/0/0
the IP 10.0.0.1 255.255.255.252
encapsulation ppp
Chap PPP authentication protocol
2000000 clock frequency
card crypto WCPA
!
interface Serial0/0/1
no ip address
2000000 clock frequency
Shutdown
!
interface Vlan1
no ip address
Shutdown
!
router ospf 1
Log-adjacency-changes
Network 10.0.0.0 0.0.0.3 area 0
network 172.21.0.0 0.0.0.255 area 0
!
router RIP
version 2
network 100.0.0.0
network 172.21.0.0
No Auto-resume
!
IP classless
!
IP flow-export version 9
!
!
list of IP - vpn access scope
IP 172.21.0.0 allow 0.0.0.255 172.22.0.0 0.0.0.255
!
!
!
!
!
Line con 0
!
line to 0
!
line vty 0 4
opening of session
!
!
!
end

Configuration of BR:

!
version 15.1
no service the timestamps don't log datetime msec
no service timestamps debug datetime msec
no password encryption service
!
hostname BR
!
!
!
!
!
!
!
!
no ip cef
No ipv6 cef
!
!
!
Cisco spends 0 username AR
!
!
license udi pid CISCO2901/K9 sn FTX1524L63A
licence start-up module c2900 technology-package securityk9
!
!
!
crypto ISAKMP policy 10
BA 3des
md5 hash
preshared authentication
Group 2
!
cisco key crypto isakmp 10.0.0.1 address
address of cisco crypto isakmp 100.100.100.2 keys
!
!
!
Crypto ipsec transform-set esp-3des esp-sha-hmac TS
!
CMAP 10 ipsec-isakmp crypto card
defined peer 10.0.0.1
defined by peer 100.100.100.2
game of transformation-TS
match the vpn address
!
!
!
!
!
!
pvst spanning-tree mode
!
!
!
!
!
!
interface GigabitEthernet0/0
IP 200.200.200.2 255.255.255.252
automatic duplex
automatic speed
card crypto WCPA
!
interface GigabitEthernet0/1
IP 172.22.0.254 255.255.255.0
automatic duplex
automatic speed
!
interface Serial0/0/0
the IP 10.0.0.2 255.255.255.252
encapsulation ppp
Chap PPP authentication protocol
card crypto WCPA
!
interface Serial0/0/1
no ip address
2000000 clock frequency
Shutdown
!
interface Vlan1
no ip address
Shutdown
!
router ospf 1
Log-adjacency-changes
Network 10.0.0.0 0.0.0.3 area 0
network 172.22.0.0 0.0.0.255 area 0
!
router RIP
version 2
network 172.22.0.0
network 200.200.200.0
No Auto-resume
!
IP classless
!
IP flow-export version 9
!
!
list of IP - vpn access scope
IP 172.22.0.0 allow 0.0.0.255 172.21.0.0 0.0.0.255
!
!
!
!
!
Line con 0
!
line to 0
!
line vty 0 4
opening of session
!
!
!
end

Thank you very much!

Although you might go this route, I wouldn't.

I would use VTI (GRE tunnels that run over IPSec) interfaces. One on the series circuit and the other on the circuit of the ISP.

You can then either use GRE KeepAlive to detect which tunnels are in place and use static routes or dynamic routing as EIGRP Protocol (put a higher value of the 'bandwidth' with the 'bandwidth' command on the favorite tunnel).

Site to Site VPN working without Crypto Card (ASA 8.2 (1))

Similar Questions

Network.PNG

Maybe you are looking for