Using OSPF on entirely mesh VPN L2L

We have four sites linked together (full mesh) over VPN tunnels on the features of the NSA.  The traffic from a given site can use a VPN tunnel to connect directly with any other peer on the network. We want to use OSPF to redirect traffic when the VPN tunnel between two sites goes down.

For example, if the VPN between sites A and B goes down we want to redirect the traffic from site A, (designed for Site B) to be diverted to site C, and site C traffic would then cross the tunnel to B.

How can we define it?

Hi Christine,

In the course of Network Security Advanced Administration (SSSC), hands-on exercise Guide (NS-202-EG-A) on page 61, you'll find a VPN type exercise road using OSPF. Works great!

Tags: Dell Tech

Similar Questions

  • Direct specific ports down a VPN L2L

    I have a client who is trying to use an ISP hosted web filtering and content management a gateway, the ISP wants to use and L2L ISPEC VPN on site at their front door to control the traffic. Today we have the tunnel with an ACL test for peripheral test side customer down the tunnel, but that it blocks all traffic that is not being analyzed. The problem is that they are on an ASA 5510 with 8.2.2. You cannot add ports tcp in the ACL sheep, it error when you try to apply the nat 0 access-list statement sheep (inside). We can define the ports to go down the VPN traffic interesting ACL with number, but there is no way to send just the web ports down the VPN and allow the other ports on regular overflow interface NAT I was look in 8.4 and see if it allows a policy NAT (twice the NAT for virtual private networks) to set a port to a range of IPS (IE (: nat static destination WEBINSPECT-WEBINSPECT (indoor, outdoor) static source a whole) but who only define as web ports.

    I do not have an ASA test to use, but I guess that vpn l2l will be only by IP and I can not define a port tunnel.

    In any case, it is a strange, but the ideas are welcome. I don't think it's possible, but I thought I'd see if anyone encountered at the front.

    Hello

    Well to give you a simple example where we use the double NAT / manual transmission NAT to handle traffic

    For example a configuration example I just did on my 8.4 (5) ASA

    The following configuration will

    • Set the 'object' that contains the source network for NAT
    • Set the 'object' that contains the service for NAT
    • Define the real NAT

    The real NAT is going to make any connection from the network under 'Wireless' network object to the destination port TCP/80 will be sent 'WAN' interface without NAT

    Of course it is the next step with VPN L2L network under 'network wireless of the object' would correspond to the ACL of VPN L2L. But that seemed straight forward for you already

    the subject wireless network

    10.0.255.0 subnet 255.255.255.0

    service object WWW

    Service tcp destination eq www

    NAT (WLAN, WAN) static source without WIRE WIRELESS WWW WWW service

    The following configuration will

    • Define the "object-group", that defines networks of the source of the rule by default PAT for Internet traffic
    • Set the 'object' for the PAT address (could just use 'interface' instead of the 'object')
    • Define the real NAT

    The NAT configuration will just make a rule by default PAT for the wireless network. The key thing to note here is that we use the setting "auto after." This basically inserts the NAT rule to the priority of the very bottom of the ASA.

    object-group, network WIRELESS-network

    object-network 10.0.255.0 255.255.255.0

    network of the PAT object - 1.1.1.1

    host 1.1.1.1

    NAT (WLAN, WAN) after the automatic termination of wireless - NETWORK PAT dynamic source - 1.1.1.1

    Now we can use the command "packet - trace" to confirm that the NAT works as expected.

    WWW TEST-TRAFFIC

    ASA (config) # packet - trace 12355 1.2.3.4 entry WLAN tcp 10.0.255.100 80

    Phase: 1

    Type: UN - NAT

    Subtype: static

    Result: ALLOW

    Config:

    NAT (WLAN, WAN) static source without WIRE WIRELESS WWW WWW service

    Additional information:

    NAT divert on the output WAN interface

    Untranslate 1.2.3.4/80 to 1.2.3.4/80

    Phase: 2

    Type: IP-OPTIONS

    Subtype:

    Result: ALLOW

    Config:

    Additional information:

    Phase: 3

    Type: NAT

    Subtype:

    Result: ALLOW

    Config:

    NAT (WLAN, WAN) static source without WIRE WIRELESS WWW WWW service

    Additional information:

    Definition of static 10.0.255.100/12355 to 10.0.255.100/12355

    Phase: 4

    Type: HOST-LIMIT

    Subtype:

    Result: ALLOW

    Config:

    Additional information:

    Phase: 5

    Type: NAT

    Subtype: rpf check

    Result: ALLOW

    Config:

    NAT (WLAN, WAN) static source without WIRE WIRELESS WWW WWW service

    Additional information:

    Phase: 6

    Type: USER-STATISTICS

    Subtype: user-statistics

    Result: ALLOW

    Config:

    Additional information:

    Phase: 7

    Type: IP-OPTIONS

    Subtype:

    Result: ALLOW

    Config:

    Additional information:

    Phase: 8

    Type: USER-STATISTICS

    Subtype: user-statistics

    Result: ALLOW

    Config:

    Additional information:

    Phase: 9

    Type: CREATING STREAMS

    Subtype:

    Result: ALLOW

    Config:

    Additional information:

    New workflow created with the 1727146 id, package sent to the next module

    Result:

    input interface: WLAN

    entry status: to the top

    entry-line-status: to the top

    the output interface: WAN

    the status of the output: to the top

    output-line-status: to the top

    Action: allow

    TEST FTP - TRAFFIC

    ASA (config) # packet - trace entry tcp 10.0.255.100 WLAN 12355 1.2.3.4 21

    Phase: 1

    Type:-ROUTE SEARCH

    Subtype: entry

    Result: ALLOW

    Config:

    Additional information:

    in 0.0.0.0 0.0.0.0 WAN

    Phase: 2

    Type: IP-OPTIONS

    Subtype:

    Result: ALLOW

    Config:

    Additional information:

    Phase: 3

    Type: INSPECT

    Subtype: inspect-ftp

    Result: ALLOW

    Config:

    class-map inspection_default

    match default-inspection-traffic

    Policy-map global_policy

    class inspection_default

    inspect the ftp

    global service-policy global_policy

    Additional information:

    Phase: 4

    Type: NAT

    Subtype:

    Result: ALLOW

    Config:

    NAT (WLAN, WAN) after the automatic termination of wireless - NETWORK PAT dynamic source - 1.1.1.1

    Additional information:

    Definition of dynamic 10.0.255.100/12355 to 1.1.1.1/12355

    Phase: 5

    Type: HOST-LIMIT

    Subtype:

    Result: ALLOW

    Config:

    Additional information:

    Phase: 6

    Type: NAT

    Subtype: rpf check

    Result: ALLOW

    Config:

    NAT (WLAN, WAN) after the automatic termination of wireless - NETWORK PAT dynamic source - 1.1.1.1

    Additional information:

    Phase: 7

    Type: USER-STATISTICS

    Subtype: user-statistics

    Result: ALLOW

    Config:

    Additional information:

    Phase: 8

    Type: IP-OPTIONS

    Subtype:

    Result: ALLOW

    Config:

    Additional information:

    Phase: 9

    Type: USER-STATISTICS

    Subtype: user-statistics

    Result: ALLOW

    Config:

    Additional information:

    Phase: 10

    Type: CREATING STREAMS

    Subtype:

    Result: ALLOW

    Config:

    Additional information:

    New workflow created with the 1727154 id, package sent to the next module

    Result:

    input interface: WLAN

    entry status: to the top

    entry-line-status: to the top

    the output interface: WAN

    the status of the output: to the top

    output-line-status: to the top

    Action: allow

    As you can see traffic TCP/80 corresponds to rule on the other. And the FTP used for example corresponds to rule by default PAT as expected.

    If you want to know a little more about the new NAT 8.3 format + you can check a document I created

    https://supportforums.Cisco.com/docs/doc-31116

    Hope this helps you, please mark it as answered in the affirmative or rate of answer.

    Naturally ask more if necessary

    -Jouni

  • Question of redundancy VPN l2l using 2811 as endpoint devices

    I have a new implementation of VPN L2L passes using two 2811 s than VPN terminal devices. I'll try to use the HSRP address between the public interfaces of both routers as VPN peer address. The problem that I found during the test is that the tunnel will become active and debugs watch the HSRP address as an invalid address to form the tunnel. Have a work-around, or a better plan for redundancy on peering address using similar devices? Thanks in advance.

    Take a look at this doc about IOS IPSec HA.

    http://www.Cisco.com/en/us/docs/iOS/security/configuration/guide/sec_vpn_ha_enhance_ps6922_TSD_Products_Configuration_Guide_Chapter.html#wp1039849

  • Using VPN L2L static and dynamic dedicated tunnels

    We have an ASA 5510 running 8.0 at our company headquarters. We have remote sites who need to create VPN L2L at the HQ ASA tunnels. Some remote sites have static IP addresses and others have dynamic IP addresses.

    I found documentation Cisco L2L static IP VPN tunnels and make them work. I found another Cisco documentation for static IP dynamic L2L VPN tunnels using the tunnel-group "DefaultL2LGroup".

    My question is, can you have two types of tunnels on the same ASA L2L? If so, simply by using the definitions of "DefaultL2LGroup" tunnel-group and of tunnel-group work? Is there a reason to not do? Is better technology (ASA HQ and a combination of ASA 5505 and 1861 at remote sites) available?

    Yes, you can have both types of tunnels L2L. If you use a PSK - remember that the IP address of the remote site is used to 'validate' to connect to Headquarters. As long as you use a sure PSK = 64 characters and all with upper/lower case alpha numeric - you should be OK.

    A better way to do it - is to get the static IP addresses for the site that currently have DHCP from ISP.

    HTH >

  • 3000 VPN concentrator using ospf md5 authentication failed

    Hi all

    I just tested ospf with a 3005 VPN connected with a cisco router using ospf md5 authentication, but fail. Cisco router, I can see neighbouring State ospf is "INIT", but can not see any connection VPN 3005, physical connection is good, ping can be reached between them. I tried the command "ip ospf authentication message-digest & ip ospf authentication-key ' and"ip ospf message-digest-key"command in the router the password is the same in both sides and the md5 id has been set. But when I use simple authentication or disable authentication that the neighbor relationship can ride. Any body met this case before? Thank you!

    Best regards

    Teru Lei

    Hello

    This is a known bug, I also met this before: CSCef38044

    It is not possible to accumulate OSPF with newer versions of IOS, on which they'RE ability is enabled using MD5 hash neighborship. They'RE capa is activated somewhere of 12.2 T. This behavior can be found on CVPN 4.1.5 and above whose 4.7 also.

    I tested it with several IOS and OS CVPN - same result. The symptom: router ospf neighborship remains in the State INIT/DROTHER.

    Workaround is to configure the router:

    router ospf 1

    No they're ability

    This will solve your problem.

    Attila Suba

  • Go simple configuration of vpn L2L comply with security requirements

    Hello

    I have successfully install a L2L connection (5510, 7.2) and a 3rd party (SonicWall).

    Security requirements are such that (contractors) to our office users to connect to various devices to the 3rd party, BUT nothing to the 3rd party must connect to what be it at our office.

    I tried an outbound ACL (access-group L2L-RESTRICT the interface inside) inside the interface. But the funny thing is that I'm getting hits on the declarations of refusal on the ACL, although tests show no problems for you connect to multiple hosts to our site of the 3rd party. My ACL config looks like the following:

    <..snip..>

    Note to L2L-RESTRICT access-list * ATTENTION * WITH CAUTION - RESTRICTIONS ON the 3rd PARTY VPN L2L

    L2L-RESTRICT access-list scope allow icmp 192.168.16.0 255.255.255.0 10.180.21.0 255.255.255.0 echo-reply

    deny access list L2L-RESTRICT the scope ip 192.168.16.0 255.255.255.0 no matter what newspaper

    Note to L2L-RESTRICT access-list > NOTE< last="" line="" *must*="" be="" permit="" any="">

    L2L-RESTRICT access-list scope ip allow a whole

    !

    L2L-RESTRICT the interface inside access-group

    <..snip..>

    Their network is obviously 192.168.16.x and they won't be able to use a vlan from different source as "interesting traffic" ACL won't allow it. So that sounds good in theory

    I have it configured correctly? Is there a better way?

    Thanks in advance,

    Mike

    Mike,

    It seems that you might be able to assign a VPN ACL filter via a group assigned to each tunnel L2L policy. I have never done this personally before, but looks like it would work...

    http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00808c9a87.shtml#configs

  • VPN l2l failed inside on ASA 5520 (8.02)

    VPN l2l is dropping packets to Phase 5 because of a rule configured. I have an isakmp his but the client cannot connect to the destination here in my network. I'll post my config to access list at the bottom of the Packet-trace output.

    vpnASA01 # entry packet - trace within the icmp [10.0.0.243] 0 8 10.97.29.73 det

    Phase: 1

    Type: CAPTURE

    Subtype:

    Result: ALLOW

    Config:

    Additional information:

    Direct flow from returns search rule:

    ID = 0xc92087c8, priority = 12, area = capture, deny = false

    hits = 85188209121, user_data = 0xc916a478, cs_id = 0 x 0, l3_type = 0 x 0

    Mac SRC = 0000.0000.0000, mask is 0000.0000.0000

    DST = 0000.0000.0000 Mac, mask is 0000.0000.0000

    Phase: 2

    Type: ACCESS-LIST

    Subtype:

    Result: ALLOW

    Config:

    Implicit rule

    Additional information:

    Direct flow from returns search rule:

    ID = 0xc87f1f98, priority = 1, domain = allowed, deny = false

    hits = 85193048387, user_data = 0 x 0, cs_id = 0 x 0, l3_type = 0 x 8

    Mac SRC = 0000.0000.0000, mask is 0000.0000.0000

    DST = 0000.0000.0000 Mac, mask is 0000.0000.0000

    Phase: 3

    Type: FLOW-SEARCH

    Subtype:

    Result: ALLOW

    Config:

    Additional information:

    Not found no corresponding stream, creating a new stream

    Phase: 4

    Type:-ROUTE SEARCH

    Subtype: entry

    Result: ALLOW

    Config:

    Additional information:

    in 10.0.0.0 255.0.0.0 inside

    Phase: 5

    Type: ACCESS-LIST

    Subtype:

    Result: DECLINE

    Config:

    Implicit rule

    Additional information:

    Direct flow from returns search rule:

    ID = 0xc87f3670, priority = 111, domain = allowed, deny = true

    hits = 67416, user_data = 0 x 0, cs_id = 0 x 0, flags = 0 x 4000, protocol = 0

    SRC ip = 0.0.0.0 mask 0.0.0.0, port = 0 =

    DST ip = 0.0.0.0 mask 0.0.0.0, port = 0 =

    Result:

    input interface: inside

    entry status: to the top

    entry-line-status: to the top

    the output interface: inside

    the status of the output: to the top

    output-line-status: to the top

    Action: drop

    Drop-reason: flow (acl-drop) is denied by the configured rule

    = ACCESS-LIST + Config =.

    the object-group L2LVPN-blah_local network
    network-object 10.97.29.73 255.255.255.255
    the object-group L2LVPN-blah_remote network
    network-object [10.0.0.240] 255.255.255.240

    INBOUND_OUTSIDE list of allowed ip extended access object-L2LVPN-blah_remote L2LVPN-blah_local group object

    L2LVPN-blah_obj allowed extended ip access-list object-L2LVPN-blah_local group L2LVPN-blah_remote

    access-list SHEEP extended permits all ip [10.0.0.243] 255.255.255.240

    Route outside [10.0.0.240] [10.97.29.1] 255.255.255.240 1

    address for correspondence card crypto outside-VPN 46 L2LVPN - blah_obj
    peer set card crypto VPN-exterior 46 [10.0.0.243]
    outside-VPN 46 transform-set esp-sha-aes-256 crypto card
    outside-VPN interface card crypto outside

    IPSec-l2l type tunnel-group [10.0.0.243]
    IPSec-attributes of tunnel-group [10.0.0.243]
    pre-shared-key *.

    [10.0.0.1] is to protect the global addresses of clients. Assume that these are still used in place of the current range of intellectual property. 10.0.0.240/28

    ===========================================

    Thanks in advance.

    Michael Garcia

    Profit Systems, Inc..

    Hi Michael,

    -Is the IP peer really part of the network that make up the field of encryption?

    -Is the ACL INBOUND_OUTSIDE applied (incoming) inside or outside interface (inbound)? It is the current form, it would need to be on the external interface.

    -You specify the peer IP only in the ACL SHEEP, so all other traffic is NAT would and eventually denied because it does not match the field of encryption

    Someone else may have a few ideas, but these are questions I have for the moment.

    James

  • Redirect peer tunnel VPN L2L ina

    Question of curiosity... I have 2 new ASA5515 which I put up for an improvement of the equipment. In the time before I swap them I am using them as a sort of laboratory of fortune to get him going to setup VPN L2L. I didn't use current IP addresses for the test environment, so I used false numbers.

    My question is: can I go back and change the IP address peer and address local/remote without having to tear them up to specifications plant again?

    -Do I have reprint just the type of Tunnel-Group IPsec-l2l X.X.X.X command with the IP address?

    I know that there are a few other of the region that I have to change the IP of both peers, but just of my question is, I can do or do I have to start over?

    -Jon

    Jon

    You should not reconfigure from scratch if that's what you're asking.

    You just need to change the peer IPs everywhere where they appear in your configuration.

    Jon

  • Policy NAT for VPN L2L

    Summary:

    We strive to establish a two-way VPN L2L tunnel with a partner. VPN traffic is one-to-many towards our partner, and our partner they need of a many-to-one to us (they need to access a host on our network). In addition, our partner has many VPN, so they force us to use a separate NAT with two private hosts addresses, one for each direction of the tunnel.

    My initial configuration of the tunnel on my grown up side of Phase 1, but not IPSec. Partner ran debug that revealed that my host did not address NAT'd in the NAT policy. We use an ASA5520, ver 7.0.

    Here is the config:

    # #List of OUR guests

    the OURHosts object-group network

    network-host 192.168.x.y object

    # Hosts PARTNER #List

    the PARTNERHosts object-group network

    network-host 10.2.a.b object

    ###ACL for NAT

    # Many - to - many outgoing

    access-list extended NAT2 allowed ip object-group OURHosts-group of objects PARTNERHosts

    # One - to - many incoming

    VIH3 list extended access permit ip host 192.168.c.d PARTNERHosts object-group

    # #NAT

    NAT (INSIDE) 2-list of access NAT2

    NAT (OUTSIDE) 2 172.20.n.0

    NAT (INSIDE) 3 access-list VIH3

    NAT (OUTSIDE) 3 172.20.n.1

    # #ACL for VPN

    access list permits extended VPN ip object-group objects PARTNERHosts OURHosts-group

    access allowed extended VPN ip host 192.168.c.d PARTNERHosts object-group list

    # #Tunnel

    tunnel-group type ipsec-l2l

    card <#>crypto is the VPN address

    card crypto <#>the value transform-set VPN

    card <#>crypto defined peer

    I realize that the ACL for the VPN should read:

    access allowed extended VPN ip host 172.20.n.0 PARTNERHosts object-group list

    access allowed extended VPN ip host 172.20.n.1 PARTNERHosts object-group list

    .. . If the NAT was working properly, but when this ACL is used, Phase 1 is not even negotiating, so I know the NAT is never translated.

    What am I missing to NAT guests for 172.20 addresses host trying to access their internal addresses via the VPN?

    Thanks in advance.

    Patrick

    Here is the order of operations for NAT on the firewall:

    1 nat 0-list of access (free from nat)

    2. match the existing xlates

    3. match the static controls

    a. static NAT with no access list

    b. static PAT with no access list

    4. match orders nat

    a. nat [id] access-list (first match)

    b. nat [id] [address] [mask] (best match)

    i. If the ID is 0, create an xlate identity

    II. use global pool for dynamic NAT

    III. use global dynamic pool for PAT

    If you can try

    (1) a static NAT with an access list that will have priority on instruction of dynamic NAT

    (2) as you can see on 4A it uses first match with NAT and access list so theoretically Exchange autour should do the trick.

    I don't see any negative consequences? -Well Yes, you could lose all connectivity. I don't think that will happen, but I can't promise if you do absolutely not this after-hours.

    Jon

  • Packet-trace for vpn l2l

    If anyone can help with control of packet - trace to migrate to l2l ipsec vpn

    on ASA (one)

    ciscoasa # packet - trace entry outside tcp 10.10.1.2 12345 192.168.1.2 80

    ASA (one)

    Ip address inside - 192.168.1.2

    Destination port 80

    ASA (b)

    Inside - 10.10.1.2 ip address

    Port source 12345

    Hello

    So if your host 'inside' is 192.168.1.2 and the 'outside' host is 10.10.1.2 then you could just what follows

    Packet-trace entry inside tcp 192.168.1.2 12345 10.10.1.2 80

    If the goal is just to test the VPN negotiation then the ports are not really important, but naturally tested traffic with "packet - tracer" must be authorized by your interface "inside" ACL.  The essential is that the source address and destination match the VPN L2L (Crypto ACL) configurations

    Generally you would use NAT0 for these networks the and remote so NAT should not be a problem to test from that direction. I suppose there might be rare situations where using the command in this sense is not possible

    -Jouni

  • Do you need a VPN L2L NAT

    Hi all

    I need to create a VPN L2L tunnel between us and another local company. We use a 3845 router and the other carrier uses a 3745 router. I created a lot of VPN tunnels in the past using NAT. In this case, I don't have to. is it possible for a tunnel VPN work with the same configuration without using NAT. My router and the device being connected to all have a public IP address on the same subnet.

    Thank you

    Stevan

    Hello

    Yes, you can create L2L without having to use NAT.

    See the examples of configuration (under VPN Site to Site with PIX/IOS):

    http://www.Cisco.com/en/us/partner/products/HW/vpndevc/ps2030/prod_configuration_examples_list.html

    Before that, you have probably more experience configuration tunnel as shown in the url below:

    http://www.Cisco.com/en/us/Partner/Tech/tk583/TK372/technologies_configuration_example09186a00800949ef.shtml

    Rgds,

    AK

  • ASA 8.4. (1) VPN L2L can only be established through default gateway

    Hi all!

    We have an ASA 5510, with two internet connections. A destined for VPN l2l and the other to access inet users in general.

    On asa 8.04, I configured the encryption on inteface "VPNAccess" card and a static route on the remote peer L2L with access internet VPN, the default rotue pointed the router General inet.

    We bought a new firewall with 8.4.1 and now asa only tries to open the remote if peer traffic is on the default gateway.

    It does not take into account routes more specific (I mean longer masks) and always tries to use the gateway by default, but only for VPN, if I do a trace to that peer route, it uses the routing table correctly.

    Any advice?

    Thank you!

    Well well, (any, any) certainly does not help.

    You need to be more specific, otherwise, even once, as suggested earlier, he does not know which interface to use because you don't have specify it.

    In addition, you must also be precise with the source network and destination. Otherwise, the firewall will not know which interface the subnet should be connected to.

    More precise best for NAT statement.

    NAT (, PublicTESAVPNBackup) source static static destination

  • 2811: connecting two VPN l2l ASA5505

    Hello

    We have a HQ site with a 2811 (w/ADVSECURITYK9-M) acting as the firewall. We currently have 1 ASA5505 with an established ipsec VPN l2l.

    I'm trying to connect a 2nd ASA, but I noticed that I only add 1 cryptomap to the external interface.

    A worm watch 1 Module of virtual private network... Surely this does not mean only 1 VPN?

    Can I use a card encryption and add a second "peer set" & "corresponds to" address inside the card Cryptography itself?

    Thank you

    Jason

    Yes, you add another poicy to your configuration encryption.

    Thank you

    Tarik Admani
    * Please note the useful messages *.

  • VPN L2L dynamic to static w/o DefaultL2LGroup

    I was looking for a method to have a VPN L2L static dyn without using DefaultL2LGroup but to set in place several groups of tunnel for each router with a dynamic IP address. Many people say it is not possible, but I found this guide: http://inetpro.org/wiki/LAN-to-LAN_IPSec_VPN_between_PIX/ASA_7.2_hub_and_IOS_spokes_with_dynamic_IP_addresses

    Now the problem: the vpn rises, but I can't reach any device with a ping.

    Side static: ASA 5505 - 8.22

    Side Dynamics: Zyxel P-661HW-D3

    Here is the config for the SAA:

    access-list outside extended permit icmp any any
    
    access-list outside extended deny ip any any
    
    access-list inside extended permit ip 10.1.0.0 255.255.248.0 10.51.10.0 255.255.255.0
    
    access-list inside extended deny ip any any
    
    access-list VPN extended permit ip 10.1.0.0 255.255.248.0 10.51.10.0 255.255.255.0
    
    access-list ST_3710 extended permit ip 10.1.0.0 255.255.248.0 10.51.10.0 255.255.255.0
    

    nat (inside) 0 access-list VPN
    
    nat (inside) 1 10.1.0.0 255.255.248.0
    

    access-group inside in interface inside
    
    access-group outside in interface outside
    

    crypto ipsec transform-set myset esp-3des esp-md5-hmac
    
    crypto ipsec security-association lifetime seconds 28800
    
    crypto ipsec security-association lifetime kilobytes 4608000
    

    crypto dynamic-map DN3710 1 match address ST_3710
    
    crypto dynamic-map DN3710 1 set transform-set myset
    

    crypto map dyn-map 2 ipsec-isakmp dynamic DN3710
    
    crypto map dyn-map interface outside
    

    crypto isakmp enable outside
    

    crypto isakmp policy 10
    
    authentication pre-share
    
    encryption 3des
    
    hash md5
    
    group 2
    
    lifetime 86400
    

    crypto isakmp policy 20
    
    authentication pre-share
    
    encryption des
    
    hash md5
    
    group 2
    
    lifetime 86400
    
    no crypto isakmp nat-traversal
    

    group-policy GP3710 internal
    
    group-policy GP3710 attributes
    
    vpn-filter value ST_3710
    
    vpn-tunnel-protocol IPSec
    

    tunnel-group TG3710 type ipsec-l2l
    
    tunnel-group TG3710 general-attributes
    
    default-group-policy GP3710
    
    tunnel-group TG3710 ipsec-attributes
    
    pre-shared-key *********

    As you can see it the vpn is in place:

    2   IKE Peer: ***.***.***.***
    
        Type    : L2L             Role    : responder
    
        Rekey   : no              State   : AM_ACTIVE

    Thanks in advance if anyone can help me with this problem.

    Kind regards

    Luca

    Hello Luca,

    You have reason for it, you can have the spokes of landing on a separate tunnel-groups, not only for the DefaultL2LGroup, the ASA follows this sequence when making a tunnel-group looup for L2L tunnels with pre-shared keys:

    - ike-id verified first and could be (full fqdn) host name or IP address

    -If ike-id search fails ASA tent peer IP address

    -DefaultRAGroup/DefaultL2LGroup is used as a last resort

    The output of your "sh cry isa his" I can see that at least Phase 1 is in place for your tunnel, please make sure that it landed on the correct tunnel-group.

    The problem I see clearly here is the VPN filter that you have applied Group Policy, keep in mind that we must apply filters on incoming management vpn.

    When a vpn-filter is applied to a political group that governs a LAN to LAN VPN connection, the ACL must be configured with the
    remote network in the position of the ACL src_ip and LAN in the position of dest_ip of the ACL.  Be careful during the construction of the
    ACL for use with the vpn-filter feature.  The ACL are built with traffic after decrypted in mind, however, they are also applied to the traffic
    in the direction opposite.

    In your case, the remote network is 10.51.10.0 255.255.255.0 and the local network 10.1.0.0 255.255.248.0. so let's say you want to allow just telnet:

    The following ACE will allow remote Telnet network for LAN:

    permit access-list vpnfilt-l2l 10.51.10.0 255.255.255.0 10.1.0.0 255.255.248.0 eq 23

    The following ACE will allow LAN to Telnet to the remote network:
    permit access-list vpnfilt-l2l 10.0.0.0 255.255.255.0 eq 23 10.1.0.0 255.255.248.0

    Note: The ACE access-list vpnfilt-l2l allowed 10.51.10.0 255.255.255.0 10.1.0.0 255.255.248.0 eq 23 will allow the local network establish a connection to the remote on any TCP port network if he uses a port source from 23.

    The access-list vpnfilt-l2l allowed 10.0.0.0 ACE 255.255.255.0 eq 23 10.1.0.0 255.255.248.0 will allow the network to remote connect to the LAN on any TCP port if he uses a port source from 23.

    Kind regards

  • ASA IPP on VPN L2L w/NAT

    I have a tunnel VPN L2L on a Cisco ASA 5520 I am trying to get IPPS, to work on. On my ACL cryptomap I defined a local group object and a remote object-group, and I'm the one-to-one NAT scene on the local group. I also have a configured route map that will take the static routes and redistribute in my ACE. EIGRP two things - 1, I noticed, I don't see on my ASA static routes that point to remote subnets and 2, the ACL that I used in my definition of route map is not getting any hits on it.

    Any thoughts on where I can go wrong?

    Thank you

    Darren

    You have configured the following:

    crypto set reverse-road map

    If you do, can you remove and Add again and see if that fixes the problem?

Maybe you are looking for

  • withdrawal of micro sd slate7 card?

    I'm having a problem removing a card micro SD in Slate?

  • Link to Outlook as an Extension IPhoto?

    IPhoto won't allow Outlook to be a vast? So I can't send pictures directly to Outlook. Is there a process to enable Outlook to enable an Extension in IPhoto?

  • WiFi hp Hp Pavilion 17-F067NF

    Hello I would like to find drivers wifi card of my pc in windows seven 64-bit, it's a hp HP Pavilion 17-F067NF I already look on the HP website for drivers but Windows seven 64-bit are not available. I have search on the internet but not great has ch

  • How can I stop the songs of copy as well as on file when I sync in WMP 11 for my device

    Whenever manually copy or move songs to synchronize songs copy on my mp3 player in separate folders. Which is fine, but the files contain only one song per folder. SO, I have to move the songs one by one in each folder where I want that they. Is anyw

  • Vista Home premium 32B...

    I have a HDD to die on my PC toshiba laptop 4yo. CoA sticker is worn. I bought a 120 GB ssd drive and im looking to buy a home disc 32 bit vista premium off Amazon. all I need is to use the product key. Since my old hard drive does not turn any more