Test on IPSEC Tunnel MTU size

How can I test the MTU size, through an IPSEC tunnel to an ASA 5520 to an ASA 5510? I have fears that problems with my equipment are due to the insufficient MTU size.

You can use extended ping to see the size of the package you can send through the tunnel with little DF

game do not fragment. for ex: -.

If you have two windows machines, one on each side of the vpn with ip add 10.2.2.10 and 10.3.3.10.

Ping 10.2.2.10 to help: -.

Ping 10.3.3.10

success of the response

Ping 10.3.3.10-l 1500 f {where-l 1500 sets the MTU to 1500 and f said do not fragment}

package has need to be fragmented but df set

Ping 10.3.3.10-l 1300 f

the fragmentation of packets needs but df set

Ping 10.3.3.10 l - 1270 f

success of the response

Thank you

Manish

Tags: Cisco Security

Similar Questions

Strange problem in IPSec Tunnel - 8.4 NAT (2)

Helloo all,.

This must be the strangest question I've seen since the year last on my ASA.

I have an ASA 5540, who runs the code of 8.4 (2) without any problem until I ran into this problem last week and I spent sleepless nights with no resolution! Then, take a deep breath and here is a brief description of my setup and the problem:

A Simple IPSEC tunnel between my 8.4 (2) ASA 5540 and a Juniper SSG 140 6.3.0r9.0 (road OS based VPN) screen

The tunnel rises without any problem but the ASA refused to encrypt the traffic but it decrypts with GLORY!

Here are a few outputs debug, see the output and a package tracer output that also has an explanation of my problem of NAT WEIRD:

my setup - (I won't get into the details of encryption tunnel as my tunnel negotiations are perfect and returns from the outset when the ASA is configured as response only)

CISCO ASA - IPSec network details

LAN - 10.2.4.0/28

REMOTE NETWORK - 192.168.171.8/32

JUNIPER SSG 140 - IPSec networks details

ID OF THE PROXY:

LAN - 192.168.171.8/32

REMOTE NETWORK - 10.2.4.0/28

Name host # sh cry counterpart his ipsec

peer address:

Tag crypto map: outside_map, seq num: 5, local addr:

outside_cryptomap_4 to access extended list ip 10.2.4.0 allow 255.255.255.240 host 192.168.171.8

local ident (addr, mask, prot, port): (10.2.4.0/255.255.255.240/0/0)

Remote ident (addr, mask, prot, port): (192.168.171.8/255.255.255.255/0/0)

current_peer:

#pkts program: encrypt 0, #pkts: 0, #pkts digest: 0

#pkts decaps: 72, #pkts decrypt: 72, #pkts check: 72

compressed #pkts: 0, unzipped #pkts: 0

#pkts uncompressed: 0, comp #pkts failed: 0, #pkts Dang failed: 0

success #frag before: 0, failures before #frag: 0, #fragments created: 0

Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0

#send errors: 0, #recv errors: 0

local crypto endpt. : 0, remote Start. crypto: 0

Path mtu 1500, fresh ipsec generals 58, media, mtu 1500

current outbound SPI: 5041C19F

current inbound SPI: 0EC13558

SAS of the esp on arrival:

SPI: 0x0EC13558 (247543128)

transform: esp-3des esp-sha-hmac no compression

running parameters = {L2L, Tunnel}

slot: 0, id_conn: 22040576, crypto-card: outside_map

calendar of his: service life remaining key (s): 3232

Size IV: 8 bytes

support for replay detection: Y

Anti-replay bitmap:

0xFFFFFFFF to 0xFFFFFFFF

outgoing esp sas:

SPI: 0x5041C19F (1346486687)

transform: esp-3des esp-sha-hmac no compression

running parameters = {L2L, Tunnel}

slot: 0, id_conn: 22040576, crypto-card: outside_map

calendar of his: service life remaining key (s): 3232

Size IV: 8 bytes

support for replay detection: Y

Anti-replay bitmap:

0x00000000 0x00000001

CONTEXTS for this IPSEC VPN tunnel:

# Sh asp table det vpn context host name

VPN CTX = 0x0742E6BC

By peer IP = 192.168.171.8

Pointer = 0x78C94BF8

State = upwards

Flags = BA + ESP

ITS = 0X9C28B633

SPI = 0x5041C19D

Group = 0

Pkts = 0

Pkts bad = 0

Incorrect SPI = 0

Parody = 0

Bad crypto = 0

Redial Pkt = 0

Call redial = 0

VPN = filter

VPN CTX = 0x07430D3C

By peer IP = 192.168.1.8

Pointer = 0x78F62018

State = upwards

Flags = DECR + ESP

ITS = 0X9C286E3D

SPI = 0x9B6910C5

Group = 1

Pkts = 297

Pkts bad = 0

Incorrect SPI = 0

Parody = 0

Bad crypto = 0

Redial Pkt = 0

Call redial = 0

VPN = filter

outside_cryptomap_4 to access extended list ip 10.2.4.0 allow 255.255.255.240 host 192.168.171.8

NAT (inside, outside) static source Ren - Ren - about destination static counterpart-host peer to route non-proxy-arp-search

network of the Ren - around object

subnet 10.2.4.0 255.255.255.240

network of the host object counterpart

Home 192.168.171.8

HS cry ipsec his

IKE Peer:

Type: L2L role: answering machine

Generate a new key: no State: MM_ACTIVE

output packet tracer extracted a packet transmitted by the network of 10.2.4.0/28 to 192.168.171.8 host

Phase: 7

Type: VPN

Subtype: encrypt

Result: ALLOW

Config:

Additional information:

Direct flow from returns search rule:

ID = 0x7789d788, priority = 70, domain = encrypt, deny = false

Hits = 2, user_data is0x742e6bc, cs_id = 0x7ba38680, reverse, flags = 0 x 0 = 0 protocol

IP/ID=10.2.4.0 SRC, mask is 255.255.255.240, port = 0

IP/ID=192.168.171.8 DST, mask is 255.255.255.255, port = 0, dscp = 0 x 0

input_ifc = none, output_ifc = external

VPN settings corresponding to the encrytpion + encapsulation and the hits here increment only when I run a test of tracer from my host on the remote peer inside package.

A tracer complete package out for a packet of the 10.2.4.1 255.255.255.255 network to host 192.168.171.8:

Phase: 1

Type: ACCESS-LIST

Subtype:

Result: ALLOW

Config:

Implicit rule

Additional information:

Direct flow from returns search rule:

ID = 0x77ebd1b0, priority = 1, domain = allowed, deny = false

hits = 3037156, user_data = 0 x 0, cs_id = 0 x 0, l3_type = 0 x 8

Mac SRC = 0000.0000.0000, mask is 0000.0000.0000

DST = 0000.0000.0000 Mac, mask is 0100.0000.0000

input_ifc = output_ifc = any to inside,

Phase: 2

Type:-ROUTE SEARCH

Subtype: entry

Result: ALLOW

Config:

Additional information:

in 192.168.171.0 255.255.255.0 outside

Phase: 3

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional information:

Direct flow from returns search rule:

ID = 0x77ec1030, priority = 0, sector = inspect-ip-options, deny = true

hits = 212950, user_data = 0 x 0, cs_id = 0 x 0, reverse, flags = 0 x 0 = 0 protocol

IP/ID=0.0.0.0 SRC, mask is 0.0.0.0, port = 0

IP/ID=0.0.0.0 DST, mask is 0.0.0.0, port = 0, dscp = 0 x 0

input_ifc = output_ifc = any to inside,

Phase: 4

Type:

Subtype:

Result: ALLOW

Config:

Additional information:

Direct flow from returns search rule:

ID = 0x7c12cb18, priority = 18, area = import-export flows, deny = false

hits = 172188, user_data = 0x78b1f438, cs_id = 0 x 0, use_real_addr, flags = 0 x 0,

IP/ID=0.0.0.0 SRC, mask is 0.0.0.0, port = 0

IP/ID=0.0.0.0 DST, mask is 0.0.0.0, port = 0, dscp = 0 x 0

input_ifc = output_ifc = any to inside,

Phase: 5

Type: NAT

Subtype:

Result: ALLOW

Config:

NAT (inside, outside) static source Ren - Ren - about destination static counterpart-host peer to route non-proxy-arp-search

Additional information:

Definition of static 10.2.4.1/2700 to 10.2.4.1/2700

Direct flow from returns search rule:

ID = 0x77e0a878, priority = 6, area = nat, deny = false

hits = 9, user_data is 0x7b7360a8, cs_id = 0 x 0, use_real_addr, flags = 0 x 0, proto

IP/ID=10.2.4.1 SRC, mask is 255.255.255.240, port = 0

IP/ID=192.168.171.8 DST, mask is 255.255.255.255, port = 0, dscp = 0 x 0

input_ifc = inside, outside = output_ifc

(it's the weird NAT problem I see. I see the number of hits is increment only when I run the packet tracer understands even I have pings (traffic) the 192.168.171.8 constant welcomes the 10.2.4.1/28)-s'il please see the package I pasted after the capture section)

Phase: 6

Type: VPN

Subtype: encrypt

Result: ALLOW

Config:

Additional information:

Direct flow from returns search rule:

ID = 0x7b8751f8, priority = 70, domain = encrypt, deny = false

hits = 3, user_data = 0x7432b74, cs_id = 0x7ba38680, reverse, flags = 0 x 0, proto

IP/ID=10.2.4.1 SRC, mask is 255.255.255.240, port = 0

IP/ID=192.168.171.8 DST, mask is 255.255.255.255, port = 0, dscp = 0 x 0

input_ifc = none, output_ifc = external

Phase: 7

Type: VPN

Subtype: ipsec-tunnel-flow

Result: ALLOW

Config:

Additional information:

Reverse flow from returns search rule:

ID = 0x78b0c280, priority = 69 = ipsec-tunnel-flow area, deny = false

hits = 154, user_data is 0x7435f94, cs_id = 0 x 0, reverse, flags = 0 x 0 = 0 protocol

IP/ID=192.168.171.8 SRC, mask is 255.255.255.255, port = 0

IP/ID=10.2.4.1 DST, mask is 255.255.255.240, port = 0, dscp = 0 x 0

input_ifc = out, output_ifc = any

Phase: 8

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional information:

Reverse flow from returns search rule:

ID = 0x77e7a510, priority = 0, sector = inspect-ip-options, deny = true

hits = 184556, user_data = 0 x 0, cs_id = 0 x 0, reverse, flags = 0 x 0 = 0 protocol

IP/ID=0.0.0.0 SRC, mask is 0.0.0.0, port = 0

IP/ID=0.0.0.0 DST, mask is 0.0.0.0, port = 0, dscp = 0 x 0

input_ifc = out, output_ifc = any

Phase: 9

Type: CREATING STREAMS

Subtype:

Result: ALLOW

Config:

Additional information:

New workflow created with the 119880921 id, package sent to the next module

Information module for forward flow...

snp_fp_tracer_drop

snp_fp_inspect_ip_options

snp_fp_tcp_normalizer

snp_fp_translate

snp_fp_adjacency

snp_fp_encrypt

snp_fp_fragment

snp_ifc_stat

Information for reverse flow...

snp_fp_tracer_drop

snp_fp_inspect_ip_options

snp_fp_ipsec_tunnel_flow

snp_fp_translate

snp_fp_tcp_normalizer

snp_fp_adjacency

snp_fp_fragment

snp_ifc_stat

Result:

input interface: inside

entry status: to the top

entry-line-status: to the top

output interface: outside

the status of the output: to the top

output-line-status: to the top

Action: allow

Hostname # sh Cap A1

8 packets captured

1: 12:26:53.376033 192.168.10.252 > 10.2.4.1: icmp: echo request

2: 12:26:53.376597 10.2.4.1 > 192.168.10.252: icmp: echo reply

3: 12:26:56.487905 192.168.171.8 > 10.2.4.1: icmp: echo request

4: 12:27:01.489217 192.168.171.8 > 10.2.4.1: icmp: echo request

5: 12:27:03.378245 192.168.10.252 > 10.2.4.1: icmp: echo request

6: 12:27:03.378825 10.2.4.1 > 192.168.10.252: icmp: echo reply

7: 12:27:06.491597 192.168.171.8 > 10.2.4.1: icmp: echo request

8: 12:27:11.491856 192.168.171.8 > 10.2.4.1: icmp: echo request

8 packets shown

As you can see, there is no echo response packet at all because the package may not be wrapped while he was sent to.

I'm Karen with it. In addition, he is a firewall multi-tenant live production with no problems at all outside this for a Juniper ipsec tunnel!

Also, the 192.168.10.0/24 is another remote network of IPSec tunnel to this network of 10.2.4.0/28 and this IPSEC tunnel has a similar Juniper SSG 140 screen os 6.3.0r9.0 at the remote end and this woks like a charm with no problems, but the 171 is not be encrypted by the ASA at all.

If someone could help me, that would be greatt and greatly appreciated!

Thanks heaps. !

Perfect! Now you must find something else inside for tomorrow--> forecast rain again

Please kindly marks the message as answered while others may learn from it. Thank you.

ASA: VPN IPSEC Tunnel from 5505(ver=8.47) to 5512 (ver = 9.23)

Hi-

We have connected tunnel / VPN configuration between an ASA 5505 - worm = 8.4 (7) and 5512 - worm = 9.2 (3).
We can only ping in a sense - 5505 to the 5512, but not of vice-versa(5512 to 5505).

Networks:

Local: 192.168.1.0 (answering machine)
Distance: 192.168.54.0 (initiator)

See details below on our config:

SH run card cry

card crypto outside_map 2 match address outside_cryptomap_ibfw
card crypto outside_map 2 pfs set group5
outside_map 2 peer XX crypto card game. XX.XXX.XXX
card crypto outside_map 2 set transform-set ESP-AES-256-SHA ikev1
crypto map outside_map 2 set ikev2 AES256 ipsec-proposal

outside_map interface card crypto outside

Note:
Getting to hit numbers below on rules/ACL...

SH-access list. I have 54.0

permit for access list 6 outside_access_out line scope ip 192.168.1.0 255.255.255.0 192.168.54.0 255.255.255.0 (hitcnt = 15931) 0x01aecbcc
permit for access list 1 outside_cryptomap_ibfw line extended ip object NETWORK_OBJ_192.168.1.0_24 object NETWORK_OBJ_192.168.54.0_24 (hitcnt = 3) 0xa75f0671
access-list 1 permit line outside_cryptomap_ibfw extended ip 192.168.1.0 255.255.255.0 192.168.54.0 255.255.255.0 (hitcnt = 3) 0xa75f0671

SH run | I have access-group
Access-group outside_access_out outside interface

NOTE:
WE have another working on the 5512 - VPN tunnel we use IKE peer #2 below (in BOLD)...

HS cry his ikev1

IKEv1 SAs:

HIS active: 2
Generate a new key SA: 0 (a tunnel report Active 1 and 1 to generate a new key during the generate a new key)
Total SA IKE: 2

1 peer IKE: XX. XX.XXX.XXX
Type: L2L role: answering machine
Generate a new key: no State: MM_ACTIVE
2 IKE peers: XXX.XXX.XXX.XXX
Type: L2L role: answering machine
Generate a new key: no State: MM_ACTIVE

SH run tunnel-group XX. XX.XXX.XXX
tunnel-group XX. XX.XXX.XXX type ipsec-l2l
tunnel-group XX. XX.XXX.XXX General-attributes
Group - default policy - GroupPolicy_XX.XXX.XXX.XXX
tunnel-group XX. XX.XXX.XXX ipsec-attributes
IKEv1 pre-shared-key *.
remote control-IKEv2 pre-shared-key authentication *.

SH run | I have political ikev1

ikev1 160 crypto policy
preshared authentication
aes-256 encryption
Group 5
life 86400

SH run | I Dynamics
NAT interface dynamic obj - 0.0.0.0 source (indoor, outdoor)
NAT source auto after (indoor, outdoor) dynamic one interface

NOTE:
To from 5512 at 5505-, we can ping a host on the remote network of ASA local

# ping inside the 192.168.54.20
Type to abort escape sequence.
Send 5, echoes ICMP 100 bytes to 192.168.54.20, wait time is 2 seconds:
!!!!!
Success rate is 100 per cent (5/5), round-trip min/avg/max = 30/32/40 ms

Determination of 192.168.1.79 - local host route to 192.168.54.20 - remote host - derivation tunnel?

The IPSEC tunnel check - seems OK?

SH crypto ipsec his
Interface: outside
Tag crypto map: outside_map, seq num: 2, local addr: XX.XXX.XXX.XXX

outside_cryptomap_ibfw to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.54.0 255.255.255.0
local ident (addr, mask, prot, port): (192.168.1.0/255.255.255.0/0/0)
Remote ident (addr, mask, prot, port): (192.168.54.0/255.255.255.0/0/0)
current_peer: XX. XX.XXX.XXX

#pkts program: 4609, #pkts encrypt: 4609, #pkts digest: 4609
#pkts decaps: 3851, #pkts decrypt: 3851, #pkts check: 3851
compressed #pkts: 0, unzipped #pkts: 0
#pkts uncompressed: 4609, model of #pkts failed: 0, #pkts Dang failed: 0
success #frag before: 0, failures before #frag: 0, #fragments created: 0
Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
#TFC rcvd: 0, #TFC sent: 0
#Valid errors ICMP rcvd: 0, #Invalid ICMP errors received: 0
#send errors: 0, #recv errors: 0

local crypto endpt. : XX.XXX.XXX.XXX/0, remote Start crypto. : XX. XX.XXX.XXX/0
Path mtu 1500, ipsec 74 (44) generals, media, mtu 1500
PMTU time remaining: 0, political of DF: copy / df
Validation of ICMP error: disabled, TFC packets: disabled
current outbound SPI: CDC99C9F
current inbound SPI: 06821CBB

SAS of the esp on arrival:
SPI: 0x06821CBB (109190331)
transform: aes-256-esp esp-sha-hmac no compression
running parameters = {L2L, Tunnel, group 5 PFS, IKEv1}
slot: 0, id_conn: 339968, crypto-card: outside_map
calendar of his: service life remaining (KB/s) key: (3914789/25743)
Size IV: 16 bytes
support for replay detection: Y
Anti-replay bitmap:
0xFFFFFFFF to 0xFFFFFFFF
outgoing esp sas:
SPI: 0xCDC99C9F (3452542111)
transform: aes-256-esp esp-sha-hmac no compression
running parameters = {L2L, Tunnel, group 5 PFS, IKEv1}
slot: 0, id_conn: 339968, crypto-card: outside_map
calendar of his: service life remaining (KB/s) key: (3913553/25743)
Size IV: 16 bytes
support for replay detection: Y
Anti-replay bitmap:
0x00000000 0x00000001

--> The local ASA 5512 - where we have questions - tried Packet Tracer... seems we receive requests/responses...

SH cap CAP

34 packets captured

1: 16:41:08.120477 192.168.1.79 > 192.168.54.20: icmp: echo request
2: 16:41:08.278138 192.168.54.20 > 192.168.1.79: icmp: echo request
3: 16:41:08.278427 192.168.1.79 > 192.168.54.20: icmp: echo reply
4: 16:41:09.291992 192.168.54.20 > 192.168.1.79: icmp: echo request
5: 16:41:09.292282 192.168.1.79 > 192.168.54.20: icmp: echo reply

--> On the ASA 5505 distance - we can ping through the 5512 to the local host (192.168.1.79)

SH cap A2

42 packets captured

1: 16:56:16.136559 802. 1 q vlan P0 192.168.54.20 #1 > 192.168.1.79: icmp: echo request
2: 16:56:16.168860 802. 1 q vlan P0 192.168.1.79 #1 > 192.168.54.20: icmp: echo reply
3: 16:56:17.140434 802. 1 q vlan P0 192.168.54.20 #1 > 192.168.1.79: icmp: echo request
4: 16:56:17.171652 802. 1 q vlan P0 192.168.1.79 #1 > 192.168.54.20: icmp: echo reply
5: 16:56:18.154426 802. 1 q vlan P0 192.168.54.20 #1 > 192.168.1.79: icmp: echo request
6: 16:56:18.186178 802. 1 q vlan P0 192.168.1.79 #1 > 192.168.54.20: icmp: echo reply
7: 16:56:19.168417 802. 1 q vlan P0 192.168.54.20 #1 > 192.168.1.79: icmp: echo request

--> Package trace on 5512 does no problem... but we cannot ping from host to host?

entry Packet-trace within the icmp 192.168.1.79 8 0 detailed 192.168.54.20

Phase: 4
Type: CONN-SETTINGS
Subtype:
Result: ALLOW
Config:
class-map default class
match any
Policy-map global_policy
class class by default
Decrement-ttl connection set
global service-policy global_policy
Additional information:
Direct flow from returns search rule:
ID = 0x7fffa2d0ba90, priority = 7, area = conn-set, deny = false
hits = 4417526, user_data = 0x7fffa2d09040, cs_id = 0 x 0, use_real_addr, flags = 0 x 0 = 0 protocol
IP/ID=0.0.0.0 SRC, mask = 0.0.0.0, port = 0, = 0 tag
IP/ID=0.0.0.0 DST, mask is 0.0.0.0, port = 0, tag = 0, dscp = 0 x 0
input_ifc = output_ifc = any to inside,

Phase: 5
Type: NAT
Subtype:
Result: ALLOW
Config:
NAT interface dynamic obj - 0.0.0.0 source (indoor, outdoor)
Additional information:
Definition of dynamic 192.168.1.79/0 to XX.XXX.XXX.XXX/43904
Direct flow from returns search rule:
ID = 0x7fffa222d130, priority = 6, area = nat, deny = false
hits = 4341877, user_data = 0x7fffa222b970, cs_id = 0 x 0, flags = 0 x 0 = 0 protocol
IP/ID=0.0.0.0 SRC, mask = 0.0.0.0, port = 0, = 0 tag
IP/ID=0.0.0.0 DST, mask is 0.0.0.0, port = 0, tag = 0, dscp = 0 x 0
input_ifc = inside, outside = output_ifc

...

Phase: 14
Type: CREATING STREAMS
Subtype:
Result: ALLOW
Config:
Additional information:
New workflow created with the 7422689 id, package sent to the next module
Information module for forward flow...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_inspect_icmp
snp_fp_translate
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat

Information for reverse flow...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_translate
snp_fp_inspect_icmp
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat

Result:
input interface: inside
entry status: to the top
entry-line-status: to the top
output interface: outside
the status of the output: to the top
output-line-status: to the top
Action: allow

--> On remote ASA 5505 - Packet track is good and we can ping remote host very well... dunno why he "of Nations United-NAT?

Destination - initiator:

entry Packet-trace within the icmp 192.168.54.20 8 0 detailed 192.168.1.79

...
Phase: 4
Type: UN - NAT
Subtype: static
Result: ALLOW
Config:
NAT (inside, outside) static source NETWORK_OBJ_192.168.54.0_24 NETWORK_OBJ_192.168.54.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 non-proxy-arp-search of route static destination
Additional information:
NAT divert on exit to the outside interface
Untranslate 192.168.1.79/0 to 192.168.1.79/0
...

Summary:
We "don't" ping from a host (192,168.1.79) on 5512 - within the network of the 5505 - inside the network host (192.168.54.20).
But we can ping the 5505 - inside the network host (192.168.54.20) 5512 - inside the network host (192.168.1.79).

Please let us know what other details we can provide to help solve, thanks for any help in advance.

-SP

Well, I think it is a NAT ordering the issue.

Basically as static and this NAT rule-

NAT interface dynamic obj - 0.0.0.0 source (indoor, outdoor)

are both in article 1 and in this article, it is done on the order of the rules so it does match the dynamic NAT rule rather than static because that seems to be higher in the order.

To check just run a 'sh nat"and this will show you what order everthing is in.

The ASA is working its way through the sections.

You also have this-

NAT source auto after (indoor, outdoor) dynamic one interface

which does the same thing as first statement but is in section 3, it is never used.

If you do one of two things-

(1) configure the static NAT statement is above the dynamic NAT in section 1 that is to say. You can specify the command line

or

(2) remove the dynamic NAT of section 1 and then your ASA will use the entry in section 3.

There is a very good document on this site for NAT and it is recommended to use section 3 for your general purpose NAT dynamic due precisely these questions.

It is interesting on your ASA 5505 you duplicated your instructions of dynamic NAT again but this time with article 2 and the instructions in section 3 that is why your static NAT works because he's put in correspondence before all your dynamic rules.

The only thing I'm not sure of is you remove the dynamic NAT statement in article 1 and rely on the statement in section 3, if she tears the current connections (sorry can't remember).

Then you can simply try to rearrange so your static NAT is above it just to see if it works.

Just in case you want to see the document here is the link-

https://supportforums.Cisco.com/document/132066/ASA-NAT-83-NAT-operation-and-configuration-format-CLI

Jon

ASA 8.6 - l2l IPsec tunnel established - not possible to ping

Hello world

I have a problem of configuration of the CISCO ASA 5512-x (IOS 8.6).

The IPsec tunnel is created between ASA and an another non-CISCO router (hereinafter "router"). I can send packets ping from router to ASA, but ASA is NOT able to meet these demands. Sending requests of ASA is also NOT possible.

I'm trying to interconnect with the network 192.168.2.0/24 (CISCO, interface DMZ) premises and 192.168.3.0/24 (router).

The CISCO ASA has a static public IP address. The router has a dynamic IP address, so I use the dynamic-map option...

Here is the output of "show run":

---------------------------------------------------------------------------------------------------------------------------------------------

ASA 1.0000 Version 2

!

ciscoasa hostname

activate oBGOJTSctBcCGoTh encrypted password

2KFQnbNIdI.2KYOU encrypted passwd

names of

!

interface GigabitEthernet0/0

nameif outside

security-level 0

address IP X.X.X.X 255.255.255.0

!

interface GigabitEthernet0/1

nameif inside

security-level 100

the IP 192.168.0.1 255.255.255.0

!

interface GigabitEthernet0/2

nameif DMZ

security-level 50

IP 192.168.2.1 255.255.255.0

!

interface GigabitEthernet0/3

Shutdown

No nameif

no level of security

no ip address

!

interface GigabitEthernet0/4

Shutdown

No nameif

no level of security

no ip address

!

interface GigabitEthernet0/5

Shutdown

No nameif

no level of security

no ip address

!

interface Management0/0

nameif management

security-level 100

IP 192.168.1.1 255.255.255.0

management only

!

passive FTP mode

internal subnet object-

192.168.0.0 subnet 255.255.255.0

object Web Server external network-ip

host Y.Y.Y.Y

Network Web server object

Home 192.168.2.100

network vpn-local object - 192.168.2.0

Subnet 192.168.2.0 255.255.255.0

network vpn-remote object - 192.168.3.0

subnet 192.168.3.0 255.255.255.0

outside_acl list extended access permit tcp any object Web server

outside_acl list extended access permit tcp any object webserver eq www

access-list l2l-extensive list allowed ip, vpn-local - 192.168.2.0 vpn-remote object - 192.168.3.0

dmz_acl access list extended icmp permitted an echo

pager lines 24

asdm of logging of information

Outside 1500 MTU

Within 1500 MTU

MTU 1500 DMZ

management of MTU 1500

ICMP unreachable rate-limit 1 burst-size 1

don't allow no asdm history

ARP timeout 14400

NAT (DMZ, outside) static static vpn-local destination - 192.168.2.0 vpn-local - 192.168.2.0, 192.168.3.0 - remote control-vpn vpn-remote control - 192.168.3.0

!

internal subnet object-

NAT dynamic interface (indoor, outdoor)

Network Web server object

NAT (DMZ, outside) Web-external-ip static tcp www www Server service

Access-Group global dmz_acl

Route outside 0.0.0.0 0.0.0.0 Z.Z.Z.Z 1

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

Floating conn timeout 0:00:00

dynamic-access-policy-registration DfltAccessPolicy

identity of the user by default-domain LOCAL

Enable http server

http 192.168.1.0 255.255.255.0 management

No snmp server location

No snmp Server contact

Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start

IKEv1 crypto ipsec transform-set ikev1-trans-set esp-3des esp-md5-hmac

Crypto ipsec ikev2 proposal ipsec 3des-GNAT

Esp 3des encryption protocol

Esp integrity md5 Protocol

Crypto dynamic-map dynMidgeMap 1 match l2l-address list

Crypto dynamic-map dynMidgeMap 1 set pfs

Crypto dynamic-map dynMidgeMap 1 set ikev1 ikev1-trans-set transform-set

Crypto dynamic-map dynMidgeMap 1 set ikev2 ipsec-proposal 3des-GNAT

Crypto dynamic-map dynMidgeMap 1 life span of seconds set association security 28800

Crypto dynamic-map dynMidgeMap 1 the value reverse-road

midgeMap 1 card crypto ipsec-isakmp dynamic dynMidgeMap

midgeMap interface card crypto outside

ISAKMP crypto identity hostname

IKEv2 crypto policy 1

3des encryption

the md5 integrity

Group 2

FRP md5

second life 86400

Crypto ikev2 allow outside

Crypto ikev1 allow outside

IKEv1 crypto policy 1

preshared authentication

3des encryption

md5 hash

Group 2

life 86400

Telnet timeout 5

SSH timeout 5

Console timeout 0

management of 192.168.1.2 - dhcpd address 192.168.1.254

enable dhcpd management

!

a basic threat threat detection

Statistics-list of access threat detection

no statistical threat detection tcp-interception

WebVPN

internal midgeTrialPol group policy

attributes of the strategy of group midgeTrialPol

L2TP ipsec VPN-tunnel-Protocol ikev1, ikev2

enable IPSec-udp

tunnel-group midgeVpn type ipsec-l2l

tunnel-group midgeVpn General-attributes

Group Policy - by default-midgeTrialPol

midgeVpn group of tunnel ipsec-attributes

IKEv1 pre-shared-key *.

remote control-IKEv2 pre-shared-key authentication *.

pre-shared-key authentication local IKEv2 *.

!

class-map inspection_default

match default-inspection-traffic

!

!

type of policy-card inspect dns preset_dns_map

parameters

maximum message length automatic of customer

message-length maximum 512

Policy-map global_policy

class inspection_default

inspect the preset_dns_map dns

inspect the ftp

inspect h323 h225

inspect the h323 ras

inspect the rsh

inspect the rtsp

inspect esmtp

inspect sqlnet

inspect the skinny

inspect sunrpc

inspect xdmcp

inspect the sip

inspect the netbios

inspect the tftp

Review the ip options

!

global service-policy global_policy

context of prompt hostname

no remote anonymous reporting call

Cryptochecksum:fa02572f9ff8add7bbfe622a4801e606

: end

------------------------------------------------------------------------------------------------------------------------------

X.X.X.X - ASA public IP

Y.Y.Y.Y - a web server

Z.Z.Z.Z - default gateway

-------------------------------------------------------------------------------------------------------------------------------

ASA PING:

ciscoasa # ping DMZ 192.168.3.1

Type to abort escape sequence.

Send 5, echoes ICMP 100 bytes to 192.168.3.1, time-out is 2 seconds:

?????

Success rate is 0% (0/5)

PING from router (debug on CISCO):

NAT ciscoasa #: untranslation - outside:192.168.2.1/0 to DMZ:192.168.2.1/0

NAT: untranslation - outside:192.168.2.1/0 to DMZ:192.168.2.1/0

NAT: untranslation - outside:192.168.2.1/0 to DMZ:192.168.2.1/0

Outside ICMP echo request: 192.168.3.1 DMZ:192.168.2.1 ID = 3859 seq = 0 len = 40

Outside ICMP echo request: 192.168.3.1 DMZ:192.168.2.1 ID = 3859 seq = 1 len = 40

Outside ICMP echo request: 192.168.3.1 DMZ:192.168.2.1 ID = 3859 seq = 2 len = 40

Outside ICMP echo request: 192.168.3.1 DMZ:192.168.2.1 ID = 3859 seq = len 3 = 40

-------------------------------------------------------------------------------------------------------------------------------

ciscoasa # show the road outside

Code: C - connected, S - static, RIP, M - mobile - IGRP, R - I, B - BGP

D - EIGRP, OSPF, IA - external EIGRP, O - EX - OSPF inter zone

N1 - type external OSPF NSSA 1, N2 - type external OSPF NSSA 2

E1 - OSPF external type 1, E2 - external OSPF of type 2, E - EGP

i - IS - L1 - IS - IS level 1, L2 - IS - IS IS level 2, AI - IS inter zone

* - candidate by default, U - static route by user, o - ODR

P periodical downloaded static route

Gateway of last resort is Z.Z.Z.Z to network 0.0.0.0

C Z.Z.Z.0 255.255.255.0 is directly connected to the outside of the

S 192.168.3.0 255.255.255.0 [1/0] via Z.Z.Z.Z, outdoors

S * 0.0.0.0 0.0.0.0 [1/0] via Z.Z.Z.Z, outdoors

-------------------------------------------------------------------------------------------------------------------------------

Do you have an idea that I am wrong? Probably some bad NAT/ACL I suppose, but I could always find something only for 8.4 iOS and not 8.6... Perhaps and no doubt I already missed the configuration with the unwanted controls, but I've tried various things...

Please, if you have an idea, let me know! Thank you very much!

Hello

I've never used "global" option in ACL, but it looks to be the origin of the problem. Cisco doc.

"The global access rules are defined as a special ACL that is processed for each interface on the device for incoming traffic in the interface. Thus, although the ACL is configured once on the device, it acts as an ACL defined for Management In secondary interface-specific. (Global rules are always in the direction of In, never Out Management). "

You ACL: access-list extended dmz_acl to any any icmp echo

For example, when you launch the ASA, there is an echo response from the router on the external interface--> global can block.

Then to initiate router, the ASA Launches echo-reply being blocked again.

Try to add permit-response to echo as well.

In addition, you can use both "inspect icmp" in world politics than the ACL.

If none does not work, you can run another t-shoot with control packet - trace on SAA.

THX

MS

Cisco's ASA IPsec tunnel disconnects after a while

Hi all

I've set up an IPsec tunnel between sonicwall pro road and cisco ASA 5510. The well established tunnel and two subnets can access each other.

I then added a static route to a public ip address on the sonicwall ipsec policy, so that all traffic to this ip address will go through the IPsec tunnel. It also works very well.

But the problem is aftre tunnel Ipsec sometimes breaks down, and then I need to renegotiate the ipsec on sonicwall to restore the tunnel.

This happens twice a day. I'm whther fear that this behavior is because of problems with config. I'm pasting my ASA running Setup here. Plese give some advice.

SonicWALL publicip 1.1.1.2 192.168.10.0 subnet

Cisco ASA publicip 1.1.1.1 subnet 192.168.5.0

ciscoasa # sh run
: Saved
:
ASA Version 8.2 (1)
!
ciscoasa hostname
domain default.domain.invalid
activate 8Ry2YjIyt7RRXU24 encrypted password
2KFQnbNIdI.2KYOU encrypted passwd
names of
!
interface Ethernet0/0
Speed 100
full duplex
nameif outside
security-level 0
IP 1.1.1.1 255.255.255.248
!
interface Ethernet0/1
nameif inside
security-level 100
192.168.5.1 IP address 255.255.255.0
!
interface Ethernet0/2
Shutdown
No nameif
no level of security
no ip address
!
interface Ethernet0/3
Shutdown
No nameif
no level of security
no ip address
!
interface Management0/0
nameif management
security-level 100
IP 192.168.1.1 255.255.255.0
management only
!
passive FTP mode
DNS domain-lookup outside
DNS lookup field inside
DNS server-group DefaultDNS
Server name 66.28.0.45
Server name 66.28.0.61
domain default.domain.invalid
permit same-security-traffic inter-interface
permit same-security-traffic intra-interface
object-group service rdp tcp
EQ port 3389 object
object-group service tcp OpenVPN
port-object eq 1194
access list outside extended permit icmp any any echo response
access list outside extended permit tcp any host # eq pptp
outside allowed extended access will list any host #.
list of extended outside access permit udp any any eq 1701
extended outdoor access allowed icmp a whole list
access list outside extended permit tcp any host # eq ftp
access list outside extended permit tcp any host # eq ssh
list of extended outside access permit tcp any host # object - group rdp
turn off journal
access list outside extended permit tcp any host 1.1.1.1 object - group Open
VPN
access-list sheep extended ip 192.168.5.0 allow 255.255.255.0 192.168.5.0 255
. 255.255.0
access-list sheep extended ip 192.168.5.0 allow 255.255.255.0 192.168.10.0 255
. 255.255.0
L2L 192.168.5.0 ip extended access-list allow 255.255.255.0 192.168.10.0 255.2
55.255.0
pager lines 24
Enable logging
asdm of logging of information
Outside 1500 MTU
Within 1500 MTU
management of MTU 1500
IP local pool ippool 192.168.5.131 - 192.168.5.151 mask 255.255.255.0
IP local pool l2tppool 192.168.5.155 - 192.168.5.200 mask 255.255.255.0
ICMP unreachable rate-limit 1 burst-size 1
ASDM image disk0: / asdm - 621.bin
don't allow no asdm history
ARP timeout 14400
Global 1 interface (outside)
NAT (outside) 1 192.168.10.0 255.255.255.0
NAT (outside) 1 192.168.5.0 255.255.255.0
NAT (inside) 0 access-list sheep
NAT (inside) 1 192.168.5.0 255.255.255.0
outside access-group in external interface
Route outside 0.0.0.0 0.0.0.0 38.106.51.121 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-registration DfltAccessPolicy
the ssh LOCAL console AAA authentication
AAA authentication LOCAL telnet console
Enable http server
http 192.168.1.0 255.255.255.0 management
http 192.168.5.0 255.255.255.0 inside
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set esp-3des esp-sha-hmac RIGHT
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
Crypto-map dynamic dynmap 5 the value reverse-road
Crypto easyvpn dynamic-map 10 transform-set RIGHT
Crypto-map dynamic easyvpn 10 reverse-drive value
card crypto mymap 10 correspondence address l2l
card crypto mymap 10 set peer 1.1.1.2
card crypto mymap 10 transform-set RIGHT
map mymap 30000-isakmp ipsec crypto dynamic easyvpn
mymap outside crypto map interface
crypto isakmp identity address
crypto ISAKMP allow outside
crypto ISAKMP policy 10
preshared authentication
3des encryption
md5 hash
Group 2
life 86400
crypto ISAKMP policy 20
preshared authentication
3des encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 65535
preshared authentication
3des encryption
sha hash
Group 2
life 86400
Crypto isakmp nat-traversal 3600
Telnet 192.168.5.0 255.255.255.0 inside
Telnet timeout 5
SSH 0.0.0.0 0.0.0.0 outdoors
SSH timeout 5
Console timeout 0
Hello to tunnel L2TP 10
management of 192.168.1.2 - dhcpd address 192.168.1.254
enable dhcpd management
!
a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
WebVPN
internal DefaultRAGroup group strategy
attributes of Group Policy DefaultRAGroup
value of 66.28.0.45 DNS server 66.28.0.61
Protocol-tunnel-VPN IPSec l2tp ipsec
field default value cisco.com
attributes of Group Policy DfltGrpPolicy
internal band easyvpn strategy
attributes of the strategy of band easyvpn
value of 66.28.0.45 DNS server 66.28.0.61
Protocol-tunnel-VPN IPSec
enable IPSec-udp
Split-tunnel-policy tunnelall
the address value ippool pools
VPN-group-policy DefaultRAGroup
attributes global-tunnel-group DefaultRAGroup
address l2tppool pool
Group Policy - by default-DefaultRAGroup
IPSec-attributes tunnel-group DefaultRAGroup
pre-shared-key *.
tunnel-group DefaultRAGroup ppp-attributes
No chap authentication
ms-chap-v2 authentication
tunnel-group 1.1.1.2 type ipsec-l2l
1.1.1.2 tunnel-group ipsec-attributes
pre-shared-key *.
tunnel-group easyvpn type remote access
tunnel-group easyvpn General attributes
Group Policy - by default-easyvpn
easyvpn group tunnel ipsec-attributes
pre-shared-key *.
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the rsh
inspect esmtp
inspect sqlnet
inspect the skinny
inspect sunrpc
inspect xdmcp
inspect the netbios
inspect the tftp
inspect the pptp
!
global service-policy global_policy
context of prompt hostname
Cryptochecksum:5542615c178d2803f764c9b8f104732b
: end

I guess you have typo in the configuration of the ASA?

L2L 192.168.5.0 ip extended access-list allow 255.255.255.0 192.168.10.0 255.255.255.0
list access extended extended permitted host ip voip pubic ip 192.168.10.0 255.255.255.0

Can you confirm that you have configured instead the following:

access-list l2l extended permitted host ip voip pubic ip 192.168.10.0 255.255.255.0

Moreover, even if the crypto map tag says easyvpn; peer address is correct to point 1.1.1.2

In addition, don't know why you have the following configuration (but if it is not necessary I suggest to be removed and 'clear xlate' after the withdrawal):

NAT (outside) 1 192.168.10.0 255.255.255.0

Finally, pls turn off keepalive to SonicWall.

If the foregoing still don't resolve the issue, can you try to remove the card dynamic encryption of the ASA (no map mymap 30000-isakmp ipsec crypto dynamic easyvpn), release the tunnel and try to open the tunnel between the ASA and SonicWall and take the exit of "show the isa cry his ' and ' show cry ipsec his» I'm curious to see why he is always referred to the easyvpn crypto map. When you remove the dynamic encryption card, dynamic vpn lan-to-lan of remote access client does not work.

How to configure ASA5520 of Checkpoint IPsec tunnel configuration

Hi guys and under tension, a lot of it!

I have a problem, I set up an IPsec tunnel between my ASA5520 at a Checkpoint Firewall (PE) CONFIG below (not true FT)

network of the ASA_MAPPED object

4.4.4.0 subnet 255.255.255.0

network of the CHECKPOINT_MAPPED object

5.5.5.5.0 SUBNET 255.255.255.0

OUT_CRYPTO extended access list permit ip object ASA_MAPPED object CHECKPOINT_MAPPED

Crypto ipsec transform-set ikev1 CHECKPOINT_SET aes - esp esp-sha-hmac

destination NAT (INSIDE, OUTSIDE) static source ALLNETWORKS(10.0.0.0/16) ASA_MAPPED CHECKPOINT_MAPPED of CHECKPOINT_MAPPED static

NAT (INSIDE, OUTSIDE) source of destination ALLNETWORKS(10.0.0.0/16) static ASA_MAPPED static 4.4.4.11 5.5.5.11

card crypto OUTSIDE_MAP 5 corresponds to the address OUT_CRYPTO

OUTSIDE_MAP 5 set crypto map peer X.X.X.X

card crypto OUTSIDE_MAP 5 set transform-set CHECKPOINT_SET ikev1

card crypto OUTSIDE_MAP 5 defined security-association life seconds 3600

CHECKPOINT_MAP interface card crypto OUTSIDE

tunnel-group X.X.X.X type ipsec-l2l

tunnel-group ipsec-attributes X.X.X.X

IKEv1 pre-shared-key 1234

ISAKMP crypto 10 nat-traversal

Crypto ikev1 allow outside

IKEv1 crypto policy 10

preshared authentication

aes encryption

sha hash

Group 5

life 86400

IPsec Tunnel is in place and I can access the server on the other side via the beach of NATTED, for example a server behind the checkpoint with the IP 10.90.55.11 is accessible behind the ASA as 4.4.4.11, the problem is that I have never worked on a Checkpoint Firewall and servers/Server 4.4.4.11 that I can't connect to my environment to that checkpoint is configured with a Tunnel interface that is also supposed to to make NAT because of the superimposition of networks, at one point, I added an access to an entire list and bidirectional routing has been reached, but I encountered a new problem, I could not overlook from my servers public became unaccessecable, since all traffic was encrypted and get dropped to VPN: ipsec-tunnel-flow... for now the Tunnel is up and I can access the server via NAT 4.4.4.11, but can't access my internal servers. What did I DO WRONG (also, I don't have access to the Checkpoint Firewall (PE)) how their installation would be or how it should be to allow bidirectional routing?

========================================================

Tag crypto map: CHECKPOINT_MAP, seq num: 5, local addr: X.X.X.X

Access extensive list ip 4.4.4.0 OUT_5_CRYPTO allow 255.255.255.0 5.5.5.0 255.255.255.0

local ident (addr, mask, prot, port): (4.4.4.0/255.255.255.0/0/0)

Remote ident (addr, mask, prot, port): (5.5.5.0/255.255.255.0/0/0)

current_peer: X.X.X.X

#pkts program: 3207, #pkts encrypt: 3207, #pkts digest: 3207

#pkts decaps: 3417, #pkts decrypt: 3417, #pkts check: 3417

compressed #pkts: 0, unzipped #pkts: 0

#pkts uncompressed: 3207, model of #pkts failed: 0, #pkts Dang failed: 0

success #frag before: 0, failures before #frag: 0, #fragments created: 0

Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0

#send errors: 0, #recv errors: 0

local crypto endpt. : X.X.X.X/0, remote Start crypto. : X.X.X.X/0

Path mtu 1500, fresh ipsec generals 74, media, mtu 1500

current outbound SPI: 5254EDC6

current inbound SPI: 36DAB960

SAS of the esp on arrival:

SPI: 0x36DAB960 (920303968)

transform: aes - esp esp-sha-hmac no compression

running parameters = {L2L, Tunnel}

slot: 0, id_conn: 19099648, crypto-card: CHECKPOINT_MAP

calendar of his: service life remaining (KB/s) key: (3914999/3537)

Size IV: 16 bytes

support for replay detection: Y

Anti-replay bitmap:

0 x 00000000 0x0000000F

outgoing esp sas:

SPI: 0x5254EDC6 (1381297606)

transform: aes - esp esp-sha-hmac no compression

running parameters = {L2L, Tunnel}

slot: 0, id_conn: 19099648, crypto-card: CHECKPOINT_MAP

calendar of his: service life remaining (KB/s) key: (3914999/3537)

Size IV: 16 bytes

support for replay detection: Y

Anti-replay bitmap:

0x00000000 0x00000001
```
unless I include any any on my access-list and the problem with that is  that my Public servers then get encrypted from the OUTSIDE interface  unless you know of a way to bypass the VPN
```
No, u certainly shouldn't allow 0.0.0.0 for proxy ACL. Again, your config is very good. In addition, package account, this show that traffic is going throug the tunnel in two ways:

#pkts program: 3207

#pkts decaps: 3417

Also, looking at the meter, I can guess that some of the traffic comes from the other site, but does not return back (maybe that's where you can not connect from behing Checkpoint). If you say that 0.0.0.0 solved the problem, are there no other NAT rules for subnet behind ASA, so the server IP, for which you are trying to connect behind the checkpoint, translates into something else (not the beach, included in proxy ACL), when to come back?

How to choose right for the WAN Interface MTU size?

Hello

I would like to know How to determine the right size MTU to set in the properties of the WAN interface (in my case, NSA appliances).

First of all. I noticed that with SonicOS Enhanced 5.9.x, there is a Tool of diagnosis called PMTU discovery:

This tool is not available with SonicOS Enhanced 5.8.x.

I guess using this built-in tool is a way to determine the right MTU size to apply.

Second, for SonicOS versions that do not have this tool and to understand just how to manually determine the size MTU, I would like to know what is the method to follow.

On the Internet, I found this method by using the ping-f-l command. Once you have determined the largest possible packet size, it ask you to Add 28 to that number and you get the MTU size to define the interface.

Case study:

In my business, there are 2 sites: 1 in China and 1 in South Korea. Both have a firewall SonicWALL NSA.

To determine the MTU size that is applicable from the Chinese site, I get the same results with the 2 methods mentioned above.

With the help of the PMTU discovery:

I get 2 IPs: 8.8.8.8 and the Korean FW IP WAN. I get the same result: 1500.

However, I noticed that the MTU size should be set to its maximum (1500) of size on the properties of the interface WAN for this test to work properly. Indeed, when I put in 1404 to test, PMTU discovery find 1404 such as MTU size:

With the help of ping - f - l:

When you use the ping with FW Korea WAN IP method, I found 1472 as the maximum packet size:

According to the method I've read on the Internet, adding 28 will make me a MTU of 1500, same size as the PMTU discovery method.

My question is: can you confirm that these 2 methods are correct determine the MTU size to set the WAN interface? Especially the one with the ping command? If not, how do?

Thanks in advance for your comments.

I can tell you that as technicians, we use the way to CMD line to adjust the MTU on WAN interfaces. We saw this as a number to work with.

Thank you
Ben D
#Iwork4Dell

IPSEC tunnel between 2 7606 PE

I am creating an IPSec tunnel between two 7606 PE routers... get this error when I ping everywhere and if I start using the path descends LDP.

12 Nov 16:32:22.801 IS: IPSEC (key_engine): request timer shot: count = 1,.

local (identity) = 10.10.135.1, distance = 10.10.135.2.

local_proxy = 10.10.0.0/255.255.0.0/0/0 (type = 4),

remote_proxy = 10.10.0.0/255.255.0.0/0/0 (type = 4)

12 Nov 16:32:22.801 IS: IPSEC (sa_request):,.

(Eng. msg key.) Local OUTGOING = 10.10.135.1, distance = 10.10.135.2.

local_proxy = 10.10.0.0/255.255.0.0/0/0 (type = 4),

remote_proxy = 10.10.0.0/255.255.0.0/0/0 (type = 4),

Protocol = ESP, transform = NONE (Tunnel),

lifedur = 190 s and 4608000 Ko,.

SPI = 0 x 0 (0), id_conn = 0, keysize = 256, flags = 0 x 0

12 Nov 16:32:22.801 IS: ISAKMP: (0): profile of ITS application is test

12 Nov 16:32:22.801 IS: ISAKMP: created a struct peer 10.10.135.2, peer port 500

12 Nov 16:32:22.801 IS: ISAKMP: new position created post = 0x5326A08C peer_handle = 0x8000001A

12 Nov 16:32:22.801 IS: ISAKMP: lock struct 0x5326A08C, refcount 1 to peer isakmp_initiator

12 Nov 16:32:22.801 IS: ISAKMP: 500 local port, remote port 500

12 Nov 16:32:22.801 IS: ISAKMP: impossible to allocate IKE SA

12 Nov 16:32:22.801 IS: ISAKMP: Unlocking counterpart struct 0x5326A08C for isadb_unlock_peer_delete_sa(), count 0

12 Nov 16:32:22.801 IS: ISAKMP: delete peer node by peer_reap for 10.10.135.2: 5326A08C

12 Nov 16:32:22.801 IS: ISAKMP: (0): purge SA., his = 0, delme = 532E8364

PE2 #.

12 Nov 16:32:22.801 IS: ISAKMP: error during the processing of HIS application: failed to initialize SA

12 Nov 16:32:22.801 IS: ISAKMP: error while processing message KMI 0, error 2.

12 Nov 16:32:22.801 IS: IPSEC (key_engine): had an event of the queue with 1 KMI message (s)

PE2 #.

12 Nov 16:32:52.801 IS: IPSEC (key_engine): request timer shot: count = 2,.

local (identity) = 10.10.135.1, distance = 10.10.135.2.

local_proxy = 10.10.0.0/255.255.0.0/0/0 (type = 4),

remote_proxy = 10.10.0.0/255.255.0.0/0/0 (type = 4)

IPsec only is not supported on the 6500 and 7600 without module series IPsec (IPsec-SPA or VPNSM), sorry.

Using Loopback Interface as Source GRE/IPSec tunnel

Hi all:

I need one to spend a working router to router VPN tunnel using an IP WAN IP interface loopback as a source. I am able to ping the loopback from the other router. As soon as I change the source of tunnel to use the loopback IP address, change the encryption ACL map, and move the cryptographic card of the WAN interface to the loopback interface, the tunnel will not come to the top. If I remove all the crypto config, the tunnel comes up fine as just a GRE tunnel. On the other router, I see the message that says that's not encrypting the traffic below.

* 00:10:33.515 Mar 1: % CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd package not an IPSEC packet. (ip) vrf/adr_dest = 192.168.0.1, src_addr = 192.168.1.2, prot = 47

What Miss me? Is there something else that needs to be done to use the closure of a GRE/IPSec tunnel?

I have install below config in the laboratory to see if I can get it even work in a non-production environment.

R1 WAN IP: 192.168.0.1

R2 WAN IP: 192.168.0.2

R2 Closure: 192.168.1.2

hostname R2

!

crypto ISAKMP policy 1

BA 3des

md5 hash

preshared authentication

Group 2

ISAKMP crypto key abc123 address 192.168.0.1

!

Crypto ipsec transform-set esp-3des esp-md5-hmac T1

transport mode

!

crypto map 1 VPN ipsec-isakmp

Description remote control

defined peer 192.168.0.1

game of transformation-T1

match address VPN1

!

interface Loopback0

IP 192.168.1.2 255.255.255.255

VPN crypto card

!

Tunnel1 interface

IP 172.30.240.2 255.255.255.252

IP mtu 1440

KeepAlive 10 3

tunnel source 192.168.1.2

tunnel destination 192.168.0.1

VPN crypto card

!

interface FastEthernet0

IP 192.168.0.2 255.255.255.0

!

VPN1 extended IP access list

allow ACCORD 192.168.1.2 host 192.168.0.1

you have tried to add "card crypto VPN 1 - address Loopback0".

Protection of IPSEC Tunnel and tunnel QOS shaping does no formatting.

I have an implosion of the little brain as to why it won't work.

I tried the QOS policy on tunnel interfaces and the ATM interface. No formatting occurs. Interfaces to transmit at their leisure.

Please can someone have a better day me to tell me what I am doing wrong?

Here is the config relevant (and standard). without the political order applied anywhere. Any help appreciated.

---------------------------------------------------------------------------------

class-map correspondence-everything APPSERVEURS
match the name of group-access TERMINALSERVERS
class-map correspondence-any VOICE
sip protocol game
match Protocol rtp
match dscp ef
!
!
Policy-map QOSPOLICY
class VOICE
priority 100
class APPSERVEURS
33% of bandwidth
class class by default
Fair/salon-tail 16
Policy-map of TUNNEL
class class by default
form average 350000
QOSPOLICY service-policy
!
!
interface Tunnel0
bandwidth 350
IP 172.20.58.2 255.255.255.0
IP mtu 1420
load-interval 30
QoS before filing
source of Dialer0 tunnel
destination tunnel X.X.X.X
ipv4 ipsec tunnel mode
tunnel path-mtu-discovery
Tunnel IPSECPROFILE ipsec protection profile
!
Tunnel1 interface
bandwidth 350
IP 172.21.58.2 255.255.255.0
IP mtu 1420
load-interval 30
delay 58000
QoS before filing
source of Dialer0 tunnel
destination tunnel Y.Y.Y.Y
ipv4 ipsec tunnel mode
tunnel path-mtu-discovery
Tunnel IPSECPROFILE ipsec protection profile
!
!
ATM0/0/0 interface
no ip address
load-interval 30
No atm ilmi-keepalive
!
point-to-point interface ATM0/0/0.1
PVC 0/38
aal5mux encapsulation ppp Dialer
Dialer pool-member 1
!
!
interface Dialer0
bandwidth 400
the negotiated IP address

---------------------------------------------------------------------------------------------------------

Thank you

Paul

Paul,

One of the reasons could be because of the VTI overload.

That being said I don't know which is the way to go with your QoS:

https://Tools.Cisco.com/bugsearch/bug/CSCsz63683/?reffering_site=dumpcr

My suggestion: give it a try with 15.2 M/T and prosecute TAC with discount people rather than VPN QoS ;-)

M.

Public static IPsec tunnel between two routers cisco [VRF aware]

Hi all

I am trying to configure static IPsec tunnel between two routers. Router R1 has [no VRF] only global routing table.

Router R2 has two routing tables:

* vrf INET - used for internet connectivity

* global routing table - used for VPN connections

Here are the basic configs:

R1

crypto ISAKMP policy 1
BA 3des
md5 hash
preshared authentication
Group 2
ISAKMP crypto key 7V7u841k2D3Q7v98d6Y4z0zF address 203.0.0.3
invalid-spi-recovery crypto ISAKMP
!
Crypto ipsec transform-set esp - aes 256 esp-sha-hmac TRSET_AES-256_SHA
transport mode
!
Crypto ipsec TUNNEL-IPSEC-PROTECTION profile
game of transformation-TRSET_AES-256_SHA
!
interface Loopback0
10.0.1.1 IP address 255.255.255.255
IP ospf 1 zone 0
!
interface Tunnel0
IP 192.168.255.34 255.255.255.252
IP ospf 1 zone 0
source of tunnel FastEthernet0/0
tunnel destination 203.0.0.3
ipv4 ipsec tunnel mode
Ipsec TUNNEL-IPSEC-PROTEC protection tunnel profile
!
interface FastEthernet0/0
IP 102.0.0.1 255.255.255.0

!

IP route 203.0.0.3 255.255.255.255 FastEthernet0/0 102.0.0.2

#######################################################

R2

IP vrf INET
RD 1:1
!
Keyring cryptographic test vrf INET
address of pre-shared-key 102.0.0.1 key 7V7u841k2D3Q7v98d6Y4z0zF
!
crypto ISAKMP policy 1
BA 3des
md5 hash
preshared authentication
Group 2
invalid-spi-recovery crypto ISAKMP
crypto isakmp profile test
door-key test
function identity address 102.0.0.1 255.255.255.255
!
Crypto ipsec transform-set esp - aes 256 esp-sha-hmac TRSET_AES-256_SHA
transport mode
!
Crypto ipsec TUNNEL-IPSEC-PROTECTION profile
game of transformation-TRSET_AES-256_SHA
Test Set isakmp-profile
!
interface Loopback0
IP 10.0.2.2 255.255.255.255
IP ospf 1 zone 0
!
interface Tunnel0
IP 192.168.255.33 255.255.255.252
IP ospf 1 zone 0
source of tunnel FastEthernet0/0
tunnel destination 102.0.0.1
ipv4 ipsec tunnel mode
tunnel vrf INET
Ipsec TUNNEL-IPSEC-PROTEC protection tunnel profile
!
interface FastEthernet0/0
IP vrf forwarding INET
IP 203.0.0.3 255.255.255.0

!

IP route 102.0.0.1 255.255.255.255 FastEthernet0/0 203.0.0.2

#######################################################

There is a router between R1 and R2, it is used only for connectivity:

interface FastEthernet0/0
IP 102.0.0.2 255.255.255.0
!
interface FastEthernet0/1
IP 203.0.0.2 255.255.255.0

The problem that the tunnel is not coming, I can't pass through phase I.

The IPsec VPN are not my strength. So if someone could show me what mistake I make, I'd appreciate it really.

I joined ouptup #debug R2 crypto isakmp

Source and destination Tunnel0 is belong to VRF INET, the static route need to be updated.

IP route vrf INET 102.0.0.1 255.255.255.255 FastEthernet0/0 203.0.0.2

crypto isakmp profile test

VRF INET

door-key test
function identity address 102.0.0.1 255.255.255.255

GRE over IPSec tunnel cannot pass traffic through it

I am trying to configure a GRE over IPSec tunnel between sites, we use the router cisco 7613 SUP720 (IOS: s72033-advipservicesk9_wan - mz.122 - 18.SXF15a.bin) and 3845 router (IOS:c3845 - advsecurityk9 - mz.124 - 25c.bin), we are facing problems when we use the tunnel because traffic is not passing through it. the configuration was working when we were using two routers cisco 3845 (IOS:c3845 - advsecurityk9 - mz.124 - 25c.bin), but for some reason, it doesn't work anymore when I paste the configuration on the new 7613 router.

Head office

crypto ISAKMP policy 10
BA aes
preshared authentication
Group 5
ISAKMP crypto key T3ST001 address 0.0.0.0 0.0.0.0
!
!
Crypto ipsec transform-set IPSec_PLC aes - esp esp-sha-hmac
transport mode
!
map PLC - CUM 10 ipsec-isakmp crypto
defined by peer 167.134.216.89
game of transformation-IPSec_PLC
match address 100
!
!
!
Tunnel1 interface
bandwidth 1984
IP 167.134.216.94 255.255.255.252
Mtu 1476 IP
load-interval 30
source of tunnel Serial0/1/0:0
tunnel destination 167.134.216.89

interface Serial0/1/0:0
IP 167.134.216.90 255.255.255.252
card crypto PLC - CUM

access-list 100 permit gre 167.134.216.90 host 167.134.216.8

Router eigrp 100
network 167.134.216.92 0.0.0.3

Directorate-General of the

crypto ISAKMP policy 10
BA aes
preshared authentication
Group 5
ISAKMP crypto key T3ST001 address 0.0.0.0 0.0.0.0
!
!
Crypto ipsec transform-set IPSec_PLC aes - esp esp-sha-hmac
transport mode
!
map PLC - CUM 10 ipsec-isakmp crypto
defined by peer 167.134.216.90
game of transformation-IPSec_PLC
match address 100

Tunnel1 interface
bandwidth 1984
IP 167.134.216.93 255.255.255.252
Mtu 1476 IP
load-interval 30
source of tunnel Serial1/0/0:1
tunnel destination 167.134.216.90

interface Serial1/0/0:1
bandwidth 1984
IP 167.134.216.89 255.255.255.252
IP access-group 101 in
load-interval 30
no fair queue
card crypto PLC - CUM

access-list 100 permit gre 167.134.216.89 host 167.134.216.90

ER-7600 #sh crypto isakmp his
conn-id State DST CBC slot
167.134.216.89 167.134.216.90 QM_IDLE 3 0

ER-3845 #sh crypto isakmp his
status of DST CBC State conn-id slot
167.134.216.89 167.134.216.90 QM_IDLE 3 0 ACTIVE

ER-3845 #sh active cryptographic engine connections

Algorithm of address State IP Interface ID encrypt decrypt
3 Serial0/1/0: 167.134.216.90 0 HMAC_SHA + AES_CBC 0 0 value
3001 Serial0/1/0: 167.134.216.90 0 set AES + SHA 0 0
3002 Serial0/1/0: 167.134.216.90 0 set AES + SHA 61 0

ER-7600 #sh active cryptographic engine connections

Algorithm of address State IP Interface ID encrypt decrypt
3 Serial1/0/0:1 167.134.216.89 set HMAC_SHA + AES_CBC 0 0
2000 Serial1/0/0:1 167.134.216.89 set HMAC_SHA + 0 66 AES_CBC
2001 Serial1/0/0:1 167.134.216.89 set HMAC_SHA + AES_CBC 0 0

I had this error on the er-3845: % CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd package not an IPSEC packet and this one on the IPSEC (epa_des_crypt) UH-7600: decrypted packet has no control of his identity

Please help, it's so frustrating...

Thanks in advance

Oscar

Here is a document from cisco, mentioning clearly for a card encryption on the two physical as tunnel interface well.

http://www.Cisco.com/en/us/Tech/tk583/TK372/technologies_configuration_example09186a008009438e.shtml

It may be useful

Manish

Cisco 1841 ipsec tunnel protocol down after a minute

I have a strange problem where im manages to get a tha cisco ipsec tunnel 1841 to a RV016 linksys/cisco for about a minute and ping/encrypt the packets through the linen for about a minute before it breaks down. I tried different configuration and it all results in the tunnel for a minute then descend to come. I don't know if im hitting a bug and decide to if im doing something wrong.

any help is appreciated paul

RV016 firmware 2.0.18

Cisco 1841: C1841-ADVENTERPRISEK9-M), Version 12.4 (24) T

my config

no default isakmp crypto policy

!

crypto ISAKMP policy 1

BA 3des

md5 hash

preshared authentication

Group 2

lifetime 28800

ISAKMP crypto key address 0.0.0.0 eaton1234 0.0.0.0

!

!

Crypto ipsec transform-set esp-3des esp-sha-hmac ESSTS

transport mode

no default crypto ipsec transform-set

!

Crypto ipsec profile ipsec_profile1

Description in the location main site to site VPN tunnel

game of transformation-ESSTS

PFS group2 Set

!

!

!

!

!

!

!

Tunnel1 interface

Description of the location of the hand

IP unnumbered Serial0/0/0

source of tunnel Serial0/0/0

destination 209.213.x.x tunnel

ipv4 ipsec tunnel mode

tunnel path-mtu-discovery

protection of ipsec profile ipsec_profile1 tunnel

!

a debug output

Apr 24 16:42:07: IPSEC (validate_proposal_request): part #1 the proposal

Apr 24 16:42:07: IPSEC (validate_proposal_request): part #1 of the proposal

(Eng. msg key.) Local INCOMING = 209.213.xx.46, distance = 209.213.xx.164,.

local_proxy = 10.20.86.0/255.255.255.0/0/0 (type = 4),

remote_proxy = 10.0.0.0/255.255.255.0/0/0 (type = 4),

Protocol = ESP, transform = NONE (Tunnel),

lifedur = 0 and 0kb in

SPI = 0 x 0 (0), id_conn = 0, keysize = 0, flags = 0 x 0

Apr 24 16:42:07: mapdb Crypto: proxy_match

ADR SRC: 10.20.86.0

ADR DST: 10.0.0.0

Protocol: 0

SRC port: 0

DST port: 0

Apr 24 16:42:07: IPSEC (key_engine): had an event of the queue with 1 KMI message (s)

Apr 24 16:42:07: mapdb Crypto: proxy_match

ADR SRC: 10.20.86.0

ADR DST: 10.0.0.0

Protocol: 0

SRC port: 0

DST port: 0

Apr 24 16:42:07: IPSEC (policy_db_add_ident): src dest 10.0.0.0, 10.20.86.0, dest_port

0

Apr 24 16:42:07: IPSEC (create_sa): its created.

(his) sa_dest = 209.213.xx.46, sa_proto = 50,.

sa_spi = 0x4CF51011 (1291128849).

sa_trans = sa_conn_id of hmac-sha-esp, esp-3des = 2045

sa_lifetime(k/sec) = (4463729/3600)

Apr 24 16:42:07: IPSEC (create_sa): its created.

(his) sa_dest = 209.213.xx.164, sa_proto = 50,.

sa_spi = 0x1EB77DAF (515341743).

sa_trans = sa_conn_id of hmac-sha-esp, esp-3des = 2046

sa_lifetime(k/sec) = (4463729/3600)

Apr 24 16:42:07: % LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, sta changed

you to

Apr 24 16:42:07: IPSEC (key_engine): had an event of the queue with 1 KMI message (s)

Apr 24 16:42:07: IPSEC (key_engine_enable_outbound): rec would notify of ISAKMP

Apr 24 16:42:07: IPSEC (key_engine_enable_outbound): select SA with spinnaker 515341743/50

Apr 24 16:42:07: IPSEC (update_current_outbound_sa): update peer 209.213.xx.164 curre

NT his outgoing to SPI 1EB77DAF

Apr 24 16:42:12: IPSEC (key_engine): request timer shot: count = 1,.

local (identity) = 209.213.xx.46, distance = 209.213.xx.164,

local_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4),

remote_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4)

Apr 24 16:42:12: IPSEC (sa_request):,.

(Eng. msg key.) Local OUTGOING = 209.213.xx.46, distance = 209.213.xx.164,.

local_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4),

remote_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4),

Protocol = ESP, transform = esp-3des esp-sha-hmac (Tunnel),

lifedur = 3600 s and KB 4608000,

SPI = 0 x 0 (0), id_conn = 0, keysize = 0, flags = 0 x 0

Apr 24 16:42:42: IPSEC (key_engine): request timer shot: count = 2,.

local (identity) = 209.213.xx.46, distance = 209.213.xx.164,

local_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4),

remote_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4)

Apr 24 16:42:42: % LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, sta changed

you all the downu

All possible debugging has been disabled

I would try to set up a VPN Interface virtual Tunnel on the IOS router base and the value of defined transformation in tunnel mode no transport.

In history, I have had several issues with VPN between a router IOS and the series RV.

Traffic is failed on plain IPSec tunnel between two 892 s

Have a weird case and you are looking for some suggestions/thougs where to dig because I have exhausted the options.

Note: I replaced the Networkid real to a mentined below.

Topology: a classic IPSec VPN tunnel between two 892 s of Cisco, with pre-shared key and no GRE. A 892 (branch_892) has access to the Internet using PPPoE and has three network / VLAN behind it. A VLAN is coordinated to the PPPoE internet access. Access to the other two VLAN - VL92 (100.100.200.0/24) and VL93 (100.100.100.0/24) is performed via the VPN tunnel.

Second 892 (892_DC) has just one interface - WAN on Gigabit enabled/connected and a static route to the default GW. It doesn't have any defined interal network. If the router is strictly used to send traffic to VL92/VL93 to the domestic 892 via IPSec tunnel.

Here's the problem: access to VL93 (100.100.100.0/24) works, however for VL92 (100.100.100.0/24) - does not work.

Devices in VL92 I ping IP address of 892_DC through the VPN tunnel. The 892_DC router I can ping devices in VL92. However, I can't VL92 ping any device beyond the 892_DC and at the same time the packets arriving on 892_DC for VL92 are not sent through the VPN tunnel.

I took the package trace on 892_DC using capture point/buffer to nathalie caron to VL92 packages and saw that the traffic coming to the 892_DC. I run the nathalie caron even on Branch_892, and there was not a single package.

So... What's the problem? More interesting, I modified the way left on VL92 access list and still - no packets are sent through the tunnel.

Any idea? Two routers config are below

-------

892_DC #show ru

!

crypto ISAKMP policy 10

BA aes 256

hash sha256

preshared authentication

Group 2

isakmp encryption key * address 1.2.3.4

ISAKMP crypto keepalive 10 periodicals

!

address of 1.2.3.4 crypto isakmp peers

Description of-COIL-892

!

!

Crypto ipsec transform-set IT-IPSec-Transform-Set esp - aes 256 sha256-esp-hmac

Crypto ipsec df - bit clear

!

map IT ipsec - IPSec crypto - Crypto - map 10-isakmp

defined peer 1.2.3.4

disable the kilobytes of life together - the security association

86400 seconds, life of security association set

the transform-set IT-IPSec-Transform-Set value

match a lists 101

market arriere-route

QoS before filing

!

interface GigabitEthernet0

IP 10,20,30,40 255.255.255.240

IP 1400 MTU

IP tcp adjust-mss 1360

automatic duplex

automatic speed

card crypto IT-IPSec-Crypto-map

!

IP route 0.0.0.0 0.0.0.0 10.20.30.41

!

access list 101 ip allow any 100.100.100.0 0.0.0.255 connect

access list 101 ip allow any 100.100.200.0 0.0.0.255 connect

-------------------------------------------------------------------------------------

Branch_892 #sh run

!

crypto ISAKMP policy 10

BA aes 256

hash sha256

preshared authentication

Group 2

isakmp encryption key * address 10,20,30,40

ISAKMP crypto keepalive 10 periodicals

!

address peer isakmp crypto 10,20,30,40

!

!

Crypto ipsec transform-set IT-IPSec-Transform-Set esp - aes 256 sha256-esp-hmac

Crypto ipsec df - bit clear

!

map IT ipsec - IPSec crypto - Crypto - map 10-isakmp

defined peer 10,20,30,40

disable the kilobytes of life together - the security association

86400 seconds, life of security association set

the transform-set IT-IPSec-Transform-Set value

match address 101

market arriere-route

QoS before filing

!

FastEthernet6 interface

Description VL92

switchport access vlan 92

!

interface FastEthernet7

Description VL93

switchport access vlan 93

!

interface GigabitEthernet0

Description # to WAN #.

no ip address

automatic duplex

automatic speed

PPPoE-client dial-pool-number 1

!

interface Vlan1

Description # local to #.

IP 192.168.1.254 255.255.255.0

IP nat inside

IP virtual-reassembly in

!

interface Vlan92

Description fa6-nexus e100/0/40

IP 100.100.200.1 255.255.255.0

!

interface Vlan93

Description fa7-nexus e100/0/38

IP 100.100.100.1 255.255.255.0

!

interface Dialer0

no ip address

No cdp enable

!

interface Dialer1

IP 1.2.3.4 255.255.255.248

IP mtu 1454

NAT outside IP

IP virtual-reassembly in max-pumping 256

encapsulation ppp

IP tcp adjust-mss 1414

Dialer pool 1

Dialer-Group 1

Authentication callin PPP chap Protocol

PPP chap hostname ~ ~ ~

PPP chap password =.

No cdp enable

card crypto IT-IPSec-Crypto-map

!

Dialer-list 1 ip protocol allow

!

access-list 101 permit ip 100.100.100.0 0.0.0.255 any

access-list 101 permit ip 100.100.200.0 0.0.0.255 any

!

IP route 0.0.0.0 0.0.0.0 Dialer1

Yes correct sounds - so another possible problem is the routing is routing 100% correct on both sides? Can you put the two sides config for review?

IPSec tunnel between a client connection mobility and WRV200

Someone has set up an IPSec tunnel between a client connection mobility and WRV200? I can't get the right configuration.

Agitation, these products are treated by the Cisco Small Business support community. Please refer to the URL: https://supportforums.cisco.com/community/netpro/small-business

Test on IPSEC Tunnel MTU size

Similar Questions

Maybe you are looking for