VPN site to Site only in passing traffic in one direction

Hi guys

I have a little problem, I hope you can help me with.

I have a site at LAN VPN connection upward and running between a router and a Cisco ASA 5512 X Cisco 881 Zone firewall running. The tunnel is OK.

The router:

MAGURELE-R #sh crypto isa his
IPv4 Crypto ISAKMP Security Association
DST CBC conn-State id
89.45.179.202 89.249.1.238 QM_IDLE 2098 ACTIVE

IPv6 Crypto ISAKMP Security Association

MAGURELE-R #.

MAGURELE-R #sh crypto ipsec his

Interface: FastEthernet4
Tag crypto map: outside_map, local addr 89.45.179.202

protégé of the vrf: (none)
local ident (addr, mask, prot, port): (192.168.201.0/255.255.255.0/0/0)
Remote ident (addr, mask, prot, port): (10.2.0.0/255.255.255.0/0/0)
current_peer 89.249.1.238 port 500
LICENCE, flags is {origin_is_acl},
#pkts program: encrypt 0, #pkts: 0, #pkts digest: 0
#pkts decaps: 15841, #pkts decrypt: 15841, #pkts check: 15841
compressed #pkts: 0, unzipped #pkts: 0
#pkts uncompressed: 0, #pkts compr. has failed: 0
#pkts not unpacked: 0, #pkts decompress failed: 0
Errors #send 0, #recv 0 errors

local crypto endpt. : 89.45.179.202, remote Start crypto. : 89.249.1.238
Path mtu 1500, mtu 1500 ip, ip mtu IDB FastEthernet4
current outbound SPI: 0x6B607F06 (1801486086)
PFS (Y/N): N, Diffie-Hellman group: no

SAS of the esp on arrival:
SPI: 0x53D22529 (1406281001)
transform: aes - esp esp-md5-hmac.
running parameters = {Tunnel}
Conn ID: 9, flow_id: VPN:9 on board, sibling_flags 80000040, crypto card: outside_map
calendar of his: service life remaining (k/s) key: (4284358/2828)
Size IV: 16 bytes
support for replay detection: Y
Status: ACTIVE (ACTIVE)

the arrival ah sas:

SAS of the CFP on arrival:

outgoing esp sas:
SPI: 0x6B607F06 (1801486086)
transform: aes - esp esp-md5-hmac.
running parameters = {Tunnel}
Conn ID: 10, flow_id: VPN:10 on board, sibling_flags 80000040, crypto card: outside_map
calendar of his: service life remaining (k/s) key: (4284359/2828)
Size IV: 16 bytes
support for replay detection: Y
Status: ACTIVE (ACTIVE)

outgoing ah sas:

outgoing CFP sas:
MAGURELE-R #.

I do not know the settings VPN is identical in both ends. But only the traffic over the side ASA is spent.

I can see that traffic is hollow coming from the side ASA on the router:

MAGURELE-R #sh connect | I have 10.2.0.254
* 11:43:25.785 14 April: % s-6-IPACCESSLOGDP: list customer_access allowed icmp 10.2.0.254-> 192.168.201.1 (0/0), 1 packet
* 11:48:52.025 14 April: % s-6-IPACCESSLOGDP: list customer_access allowed icmp 10.2.0.254-> 192.168.201.1 (0/0), 3 sachets
* 11:58:52.025 14 April: % s-6-IPACCESSLOGDP: list customer_access allowed icmp 10.2.0.254-> 192.168.201.1 (0/0), 3 sachets
MAGURELE-R #.

But never any traffic of retur.

Router IOS is: Cisco IOS software, software C880 (C880DATA-UNIVERSALK9-M), Version 15.2 (4) M2, VERSION of the SOFTWARE (fc2)

I'm a little lost here. What could be the problem?

Concerning

Mikkel

Had a look on your config. It seems that all trades are natted, according to me, it's why the traffic in return are not working/not can not get to the ASA. You must ensure traffic of 192.168.201.0/24 for 10.2.0.0/24 are not natted router.

Change your ACL #199 as follows:

 access-list 199 deny ip 192.168.201.0 0.0.0.255 10.2.0.0 0.0.0.255 access-list 199 permit ip any any

HTH,

Tags: Cisco Security

Similar Questions

  • Site to Site VPN, but I want only to simple traffic

    I have 2 SonicWALLS a connection from site to site. I want the company to access all the resources on the Site of company B.

    But I don't want to company B to access ONE of the assets of the company in addition to what I have 'ok '.

    How can I go about it?

    I thought about access rules already, but I was unable to change the rules, because it was created automatically.

    I then noticed the post showing on repression.

    I'll give these a try. Thanks to you two.

    Note: For this to work the way I needed to:

    Site to Site:

    Create/configure VPN tunnels:

    Hand-> Site 1

    Hand-> Site 2

    Under Advanced, select 'Remove automatic creation of VPN access rules political' (only should be on hand Sonicwall)

    Firewall:

    (Only on main façade)

    VPN > LAN:

    Source: Site 1 (2) Destination: (IP address must be seen from Sites 1 and 2) allow any Service.

    LAN > VPN:

    Source: Any Destination: Site 1 (2) Service all allow.

    This allows my analysis (in hand) scan server all devices (Site 1/2) through the tunnel from site to site. It also allows me to RDP into any machine on the site 1 or 2. But they can't scan network or access all devices on the main site.

    Thank you guys!

  • VPN site to site only original by ping on one side

    I use asa5505 (8.2) SiteA iskamp site to site VPN for ikev1 asa5515x (8.6) SiteB. The will of the tunnel upward and running that if first ping of SiteA

    I don't know why tunnel cannot work if I try to ping initial siteB. Is there any installation that I get bored I can do the two initial ping to the site to bring up the tunnel?

    The two site 5505 A and B 5515 x use static IP peer.

    Sent by Cisco Support technique iPhone App

    There are a couple of settings in the configuration of IPSec - that can cause this behavior if they do not match on both sides. First check that entries in your Crypto-ACL are really in reverse. That's what I saw most often this problem. Also check if you have configured 'insider only' or ' answer only ' on your ASAs that may also cause this problem.

    Sent by Cisco Support technique iPad App

  • Cannot access the internal resources for VPN site-to-site

    We have two ASA.  We set up just VPN site-to-site.  For some reason, we are not able to access internal resources at the main office of the remote office.  Do you have any suggestions?  Thank you.

    as wu suggested, please first confirm that the tunnel is mounted correctly

    "sh cry isa his '-> will tell u if the phase 1 is in place

    "sh cry ips its '-> say if phase 2 is in place

    now once they r upward, when you ping from site to site b

    program in the site, you should see one and decaps site b for traffic from a to b and vice versa for return transportation

    Now we have to see where it is a failure

    could be tht package is coming up to the asa but not getting is not encrypted or that the package does not come to the asa itself

    You can run tracer package to see if it's getting wrapped, or in other words hits vpn tunnel

    It might be a nat problem, and sometimes if it is a new configuration probably ISP may have blocked the esp traffic in one direction or in the other direction

    the best approach, that it is turn on "management of access to the inside" on the firewall and make a ping of source of asa

    inside ping

  • X 200 fingerprint reader Tablet reads only in one direction

    Hi all

    I bought an X 200 Tablet and I got free upgrade to Windows 7 from Lenovo. After I've manually upgraded from Vista to Win7 (not a fresh install), what's up.

    The fingerprint reader works very well and he even kept my impressions of Vista. However, with Windows 7, I can just slide my fingers in one direction (from right to left, if you use the 200 X in the direction of the normal laptop). If you are a user of Tablet, you would know that there is a left and right 'tooth' that surrounds the player, allowing you to slide your fingers in both sense.

    I tried to reinstall the software of fingerprint - as well as my stored reset reader fingerprints - but it only let me slip in one direction. If I slip my fingers from left to right, I get an error 'no match '. I erased my impressions and stored once again, drag from left to right with the screen to its normal position. Lenovo Fingerprint Software my impressions, but when I connect to Windows, I can still only slide from right to left. Is it a question of Win7?

    I finally thought to it! I went to my device manager > biometric devices > one click with the right button on authentic Tech > properties. The pilot appeared to be outdated, so I tried 'Update Driver' for fun. Windows 7 has actually found an updated online version, and now it is updated to v.8.1.2.56, dated dated 07/07/2009. Now, I can slide my fingers from left to right or from right to left!

  • Unable to pass traffic between ASA Site to Site VPN Tunnel

    Hello

    I have problems passing traffic between two ASA firewall. The VPN tunnel is up with a dynamic IP and static IP address. I have attached a diagram of the VPN connection. I'm not sure where the problem lies and what to check next. I think I have all the roads and in the access lists are needed.

    I've also attached the ASA5505 config and the ASA5510.

    This is the first time that I've set up a VPN connection any guidance would be greatly appreciated.

    Thank you

    Adam

    Hello

    Regarding your opinion of configuration Remote Site ASA that you have not added the internal networks of the Central Site VPN L2L configurations at all so the traffic does not pass through the VPN.

     access-list outside_1_cryptomap extended permit ip 10.1.1.0 255.255.255.128 10.182.226.0 255.255.*.* access-list exempt extended permit ip 10.1.1.0 255.255.255.128 10.182.226.0 255.255.*.* access-list exempt extended permit ip 10.1.1.0 255.255.255.128 10.182.0.0 255.255.*.* access-list exempt extended permit ip 10.1.1.0 255.255.255.128 192.168.170.0 255.255.*.* access-list exempt extended permit ip 10.1.1.0 255.255.255.128 192.168.172.0 255.255.*.* access-list exempt extended permit ip 10.1.1.0 255.255.255.128 140.15.0.0 255.255.*.*

    Take a look at ACL configurations above. The 'exempt' ACL is used in configurations NAT0 and tells the ASA what traffic of exempting from NAT. "outside_1_cryptomap" ACL is used to tell the traffic between the subnets should be using the L2L VPN connection.

    So in short on the Remote Site ASA these ACLs should be identical. Make additions to the LIST of VPN L2L, then try again.

    I would also like to point out that to ensure that the Central ASAs L2L VPN ACL Site contains the same networks. The ACL on the Central Site will, of course, its internal subnets as the source and the site LAN remote destination.

    THW out of ' crypto ipsec to show his " shows you that only the SA between binding Site Central network and the Remote Site LAN was established. Others have not formed as the configuration is lacking at LEAST on the Remote Site ASA. Can also be the Central Site.

    -Jouni

  • Site to site VPN upward but not pass traffic (ASA 5505 8.3.1 and 9.2.3 version)

    Hello

    I'll put up a tunnel vpn site-to-site between two locations.  Both have cisco ASA 5505 running a different version, I'll explain in more detail below.  so far, I was able to get the tunnel to come but I can't seem to pass traffic, I work at this for days now and have not been able to understand why he will not pass traffic.  Needless to say that the customer's PO would be on the fact that their VPN is not upward and they had to do by hand.  I'll put the configs below, if possible can someone help me as soon as POSSIBLE, I really want to get this site up and running so that we do not lose the customer.

    An IP address of 0.0.0.0 = site
    Site B IP = 1.1.1.1

    A Version of the site = 8.3.1
    Version of the site B = 9.2.3

    __________________________

    _________

    A RACE OF THE SITE CONFIGURATION

    Output of the command: "sh run".

    : Saved
    :
    ASA Version 8.3 (1)
    !
    hostname SDMCLNASA01
    SDMCLNASA01 domain name. LOCAL
    Select 5E8js/Fs7qxjxWdp of encrypted password
    2KFQnbNIdI.2KYOU encrypted passwd
    names of
    !
    interface Vlan1
    nameif inside
    security-level 100
    the IP 192.168.0.1 255.255.255.0
    !
    interface Vlan2
    nameif outside
    security-level 0
    the IP 0.0.0.0 255.255.255.252
    !
    interface Ethernet0/0
    switchport access vlan 2
    !
    interface Ethernet0/1
    !
    interface Ethernet0/2
    !
    interface Ethernet0/3
    !
    interface Ethernet0/4
    !
    interface Ethernet0/5
    !
    interface Ethernet0/6
    !
    interface Ethernet0/7
    !
    passive FTP mode
    clock timezone CST - 6
    clock to summer time recurring CDT
    DNS lookup field inside
    DNS domain-lookup outside
    DNS server-group DefaultDNS
    SDMCLNASA01 domain name. LOCAL
    permit same-security-traffic inter-interface
    permit same-security-traffic intra-interface
    network of the NETWORK_OBJ_192.168.0.0_24 object
    192.168.0.0 subnet 255.255.255.0
    network of the NETWORK_OBJ_192.168.1.0_24 object
    subnet 192.168.1.0 255.255.255.0
    network lan_internal object
    192.168.0.0 subnet 255.255.255.0
    purpose of the smtp network
    Home 192.168.0.245
    Network http object
    Home 192.168.0.245
    rdp network object
    Home 192.168.0.245
    network ssl object
    Home 192.168.0.245
    network camera_1 object
    host 192.168.0.13
    network camerahttp object
    host 192.168.0.13
    service object 8081
    source eq 8081 destination eq 8081 tcp service
    Dvr description
    network camera-http object
    host 192.168.0.13
    network dvr-http object
    host 192.168.0.13
    network dvr-mediaport object
    host 192.168.0.13
    object-group Protocol DM_INLINE_PROTOCOL_1
    object-protocol udp
    object-tcp protocol
    object-group Protocol TCPUDP
    object-protocol udp
    object-tcp protocol
    DM_INLINE_TCP_1 tcp service object-group
    EQ port 3389 object
    port-object eq www
    EQ object of the https port
    EQ smtp port object
    DM_INLINE_TCP_2 tcp service object-group
    port-object eq 34567
    port-object eq 34599
    EQ port 8081 object
    permit access ip 192.168.0.0 scope list outside_1_cryptomap 255.255.255.0 192.168.1.0 255.255.255.0
    outside_access_in list extended access permit tcp any any eq smtp
    outside_access_in list extended access permit tcp any any DM_INLINE_TCP_1 object-group
    outside_access_in list extended access permit tcp any any DM_INLINE_TCP_2 object-group
    permit access ip 192.168.0.0 scope list inside_nat0_outbound 255.255.255.0 192.168.1.0 255.255.255.0
    pager lines 24
    Enable logging
    asdm of logging of information
    Within 1500 MTU
    Outside 1500 MTU
    ICMP unreachable rate-limit 1 burst-size 1
    ICMP allow any inside
    ICMP allow all outside
    don't allow no asdm history
    ARP timeout 14400
    NAT (inside, outside) static static source NETWORK_OBJ_192.168.1.0_24 destination NETWORK_OBJ_192.168.0.0_24 NETWORK_OBJ_192.168.0.0_24 NETWORK_OBJ_192.168.1.0_24
    NAT (exterior, Interior) static static source NETWORK_OBJ_192.168.0.0_24 destination NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.0.0_24
    !


    network lan_internal object
    NAT dynamic interface (indoor, outdoor)
    purpose of the smtp network
    NAT (all, outside) interface static tcp smtp smtp service
    Network http object
    NAT (all, outside) interface static tcp www www service
    rdp network object
    NAT (all, outside) interface static service tcp 3389 3389
    network ssl object
    NAT (all, outside) interface static tcp https https service
    network dvr-http object
    NAT (all, outside) interface static 8081 8081 tcp service
    network dvr-mediaport object
    NAT (all, outside) interface static 34567 34567 tcp service
    Access-group outside_access_in in interface outside
    Route outside 0.0.0.0 0.0.0.0 71.42.194.209 1
    Timeout xlate 03:00
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-registration DfltAccessPolicy
    http server enable 8080
    http 192.168.0.0 255.255.255.0 inside
    http 192.168.1.0 255.255.255.0 inside
    http 192.168.1.0 255.255.255.0 outside
    http 71.40.221.136 255.255.255.252 inside
    http 71.40.221.136 255.255.255.252 outside
    http 192.168.0.0 255.255.255.0 outside
    http 97.79.197.42 255.255.255.255 inside
    http 97.79.197.42 255.255.255.255 outside
    No snmp server location
    No snmp Server contact
    Server enable SNMP traps snmp authentication linkup, linkdown cold start
    Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
    life crypto ipsec security association seconds 28800
    Crypto ipsec kilobytes of life - safety 4608000 association
    card crypto outside_map 1 match address outside_1_cryptomap
    card crypto outside_map 1 set peer 1.1.1.1
    card crypto outside_map 1 set of transformation-ESP-3DES-SHA
    outside_map interface card crypto outside
    crypto isakmp identity address
    crypto ISAKMP allow outside
    crypto ISAKMP policy 65535
    preshared authentication
    3des encryption
    sha hash
    Group 2
    life 86400
    Telnet timeout 5
    SSH timeout 5
    Console timeout 0
    dhcpd address 192.168.0.50 - 192.168.0.150 inside
    dhcpd dns 192.168.0.245 209.18.47.62 interface inside
    dhcpd SDMCLNASA01 field. LOCAL inside interface
    dhcpd allow inside
    !

    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    WebVPN
    attributes of Group Policy DfltGrpPolicy
    Protocol-tunnel-VPN IPSec l2tp ipsec
    tunnel-group 1.1.1.1 type ipsec-l2l
    tunnel-group 1.1.1.1 ipsec-attributes
    pre-shared key *.
    !
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    !
    context of prompt hostname
    call-home
    Profile of CiscoTAC-1
    no active account
    http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address
    email address of destination [email protected] / * /
    destination-mode http transport
    Subscribe to alert-group diagnosis
    Subscribe to alert-group environment
    Subscribe to alert-group monthly periodic inventory
    monthly periodicals to subscribe to alert-group configuration
    daily periodic subscribe to alert-group telemetry
    Cryptochecksum:462428c25e9748896e98863f2d8aeee7
    : end

    ________________________________

    SITE B RUNNING CONFIG

    Output of the command: "sh run".

    : Saved
    :
    : Serial number: JMX1635Z1BV
    : Material: ASA5505, 512 MB RAM, 500 MHz Geode Processor
    :
    ASA Version 9.2 (3)
    !
    ciscoasa hostname
    activate qddbwnZVxqYXToV9 encrypted password
    volatile xlate deny tcp any4 any4
    volatile xlate deny tcp any4 any6
    volatile xlate deny tcp any6 any4
    volatile xlate deny tcp any6 any6
    volatile xlate deny udp any4 any4 eq field
    volatile xlate deny udp any4 any6 eq field
    volatile xlate deny udp any6 any4 eq field
    volatile xlate deny udp any6 any6 eq field
    names of
    !
    interface Ethernet0/0
    switchport access vlan 2
    !
    interface Ethernet0/1
    !
    interface Ethernet0/2
    !
    interface Ethernet0/3
    !
    interface Ethernet0/4
    !
    interface Ethernet0/5
    !
    interface Ethernet0/6
    !
    interface Ethernet0/7
    !
    interface Vlan1
    nameif inside
    security-level 100
    IP 192.168.1.1 255.255.255.0
    !
    interface Vlan2
    nameif outside
    security-level 0
    IP 1.1.1.1 255.255.255.252
    !
    passive FTP mode
    clock timezone CST - 6
    clock to summer time recurring CDT
    permit same-security-traffic inter-interface
    permit same-security-traffic intra-interface
    network camera_http object
    host 192.168.1.13
    network camera_media object
    host 192.168.1.13
    network of the NETWORK_OBJ_192.168.0.0_24 object
    192.168.0.0 subnet 255.255.255.0
    network of the NETWORK_OBJ_192.168.1.0_24 object
    subnet 192.168.1.0 255.255.255.0
    outside_access_in list extended access permit tcp any any eq 9000
    outside_access_in list extended access permit tcp any any eq www
    outside_access_in list extended access permit icmp any one
    outside_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 object NETWORK_OBJ_192.168.0.0_24
    pager lines 24
    Enable logging
    asdm of logging of information
    Within 1500 MTU
    Outside 1500 MTU
    no failover
    ICMP unreachable rate-limit 1 burst-size 1
    ICMP allow any inside
    ICMP allow all outside
    ASDM image disk0: / asdm - 732.bin
    don't allow no asdm history
    ARP timeout 14400
    no permit-nonconnected arp
    NAT (inside, outside) static static source NETWORK_OBJ_192.168.0.0_24 destination NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.0.0_24
    NAT (exterior, Interior) static static source NETWORK_OBJ_192.168.1.0_24 destination NETWORK_OBJ_192.168.0.0_24 NETWORK_OBJ_192.168.0.0_24 NETWORK_OBJ_192.168.1.0_24
    !
    network camera_http object
    NAT (all, outside) interface static tcp www www service
    network camera_media object
    NAT (all, outside) interface static 9000 9000 tcp service
    !
    NAT source auto after (indoor, outdoor) dynamic one interface
    Access-group outside_access_in in interface outside
    Route outside 0.0.0.0 0.0.0.0 71.40.221.137 1
    Timeout xlate 03:00
    Pat-xlate timeout 0:00:30
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    Floating conn timeout 0:00:00
    dynamic-access-policy-registration DfltAccessPolicy
    identity of the user by default-domain LOCAL
    Enable http server
    http 192.168.1.0 255.255.255.0 inside
    No snmp server location
    No snmp Server contact
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
    Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit
    Crypto ipsec ikev2 AES256 ipsec-proposal
    Protocol esp encryption aes-256
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 ipsec-proposal AES192
    Protocol esp encryption aes-192
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 ipsec-proposal AES
    Esp aes encryption protocol
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 proposal ipsec 3DES
    Esp 3des encryption protocol
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 ipsec-proposal OF
    encryption protocol esp
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec pmtu aging infinite - the security association
    card crypto outside_map 1 match address outside_cryptomap
    card crypto outside_map 1 peer set 0.0.0.0
    card crypto outside_map 1 set transform-set ESP-3DES-SHA ikev1
    outside_map interface card crypto outside
    trustpool crypto ca policy
    IKEv2 crypto policy 1
    aes-256 encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 10
    aes-192 encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 20
    aes encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 30
    3des encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 40
    the Encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    Crypto ikev1 allow outside
    IKEv1 crypto policy 120
    preshared authentication
    3des encryption
    sha hash
    Group 2
    life 86400
    Telnet timeout 5
    SSH stricthostkeycheck
    SSH timeout 5
    SSH group dh-Group1-sha1 key exchange
    Console timeout 0

    dhcpd address 192.168.1.50 - 192.168.1.150 inside
    dhcpd dns 192.168.0.245 209.18.47.61 interface inside
    dhcpd SDPHARR field. LOCAL inside interface
    dhcpd allow inside
    !
    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    WebVPN
    AnyConnect essentials
    attributes of Group Policy DfltGrpPolicy
    Ikev1 VPN-tunnel-Protocol
    internal GroupPolicy_0.0.0.0 group strategy
    attributes of Group Policy GroupPolicy_0.0.0.0
    VPN-tunnel-Protocol ikev1, ikev2
    tunnel-group 0.0.0.0 type ipsec-l2l
    tunnel-group 0.0.0.0 ipsec-attributes
    IKEv1 pre-shared-key *.
    remote control-IKEv2 pre-shared-key authentication *.
    pre-shared-key authentication local IKEv2 *.
    !
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    !
    context of prompt hostname
    no remote anonymous reporting call
    call-home
    Profile of CiscoTAC-1
    no active account
    http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address
    email address of destination [email protected] / * /
    destination-mode http transport
    Subscribe to alert-group diagnosis
    Subscribe to alert-group environment
    Subscribe to alert-group monthly periodic inventory
    monthly periodicals to subscribe to alert-group configuration
    daily periodic subscribe to alert-group telemetry
    Cryptochecksum:19031ab1e3bae21d7cc8319fb7ecf0eb
    : end

    Sorry my mistake.

    Delete this if it's still there

    card crypto external_map 1 the value reverse-road

    Add this to both sides

    card crypto outside_map 1 the value reverse-road

    Sorry about that.

    Mike

  • VPN Site to Site ASA (only happens with interesting traffic)

    Is anyway to get an ASA to VPN site-to-site ASA addition interesting traffic?  I need to keep this tunnel independently of traffic is anyway to do this?

    Unfortunately, no such feature has been developed on the SAA. You need to deceive the ASA with a host located in the "interesting" part of the network to constantly generate interesting traffic. Here are a few suggestions:

    -Use the IP SLA on a Cisco device

    -Perform a host TCP ping

    -Setting up a host of the site has press site B as a NTP source ASA

    Thank you for evaluating useful messages!

  • ASA 8.3 VPN site-to-site does not UDP traffic to other peer

    Hello!!!

    Someone turned off the lights :-) I say this because that's 6.2 6.3 I can't get the basic things...

    On a SAA, I created a "site-site" VPN profile to connect to a remote site, on the other side (ASA 8.2) sees no problem, I can pass all IP traffic via VPN without NAT; but on a new ASA5505 with 8.3 (1) version fw and ASDM 6.3 (1) can't do that in any way :-(

    What I get is trivial...

    ... It works perfectly with TCP and ICMP traffic, but does not have UDP traffic: in practice, if I followed the traffic to a remote private IP, TCP and ICMP traffic I see only packets in vlan "inside" with the private IP, but with the UDP traffic on top of that, I see traffic on vlan 'out' with the IP public ASA and source port changed :

    Inside: UDP to 172.16.2.128:6000 to 172.16.0.200:6000
    Outside: UDP to 5.5.5.5:23400 to 172.16.0.200:6000

    Why?

    Of course, the traffic is not encrypted and does not reach the other side of the tunnel!

    Here are the important parts of the configuration:

    interface Vlan1
    nameif inside
    security-level 100
    172.16.2.1 IP address 255.255.255.0

    network obj_any object
    subnet 0.0.0.0 0.0.0.0

    remote network object
    172.16.0.0 subnet 255.255.254.0

    outside_cryptomap to access extended list ip 172.16.2.0 allow 255.255.255.0 network remote control object

    NAT (inside, outside) static source any any destination static remote-remote network

    network obj_any object

    NAT dynamic interface (indoor, outdoor)

    card crypto outside_map0 1 match address outside_cryptomap

    outside_map0 card crypto 1jeu pfs

    card crypto outside_map0 1 set ip.ip.ip.ip counterpart

    outside_map0 card crypto 1jeu nat-t-disable

    outside_map0 interface card crypto outside

    Given that the new business object, I have not yet quite clear (ok, I don't find time to do a deep reading of the documentation), someone is able to direct me to fix this trivial?

    Note: If I remove my drive manual nat and I flag "network translating" on the remote network object thus indicate that they want NAT with ip network remote control then don't work any IP vs. remote site traffic. Why, why have not more than the simple rules of 'nat exception' the old version and why the crypto-plan applies only to TCP traffic? Possible that there is an object any which takes all IP traffic?

    A big thank you to all.

    73,

    Arturo

    Hi Arturo,.

    I know that there is a certain NAT related bugs in 8.3 (1) and although I don't remember a specific which corresponds to your symptoms, I would say you try 8.3 (2) instead, or maybe even the last available version of a temp (currently to 8.3 (2.4):)

    http://tools.cisco.com/support/downloads/go/ImageList.x?relVer=8.3.2+Interim&mdfid=279916854&sftType=Adaptive+Security+Appliance+%28ASA%29+Software&optPlat=&nodecount=9&edesignator=null&modelName=Cisco+ASA+5510+Adaptive+Security+Appliance&treeMdfId=268438162&modifmdfid=&imname=&treeName=Security&hybrid=Y&imst=N

    If you still see the problem, then, check

    entry Packet-trace within the udp 172.16.2.2 1025 172.16.0.1 detail 123

    entry Packet-trace inside tcp 172.16.2.2 1025 172.16.0.1 detail 123

    and check what's different.

    HTH

    Herbert

  • Cisco VPN Site to Site - Interesting traffic required to put in place a VPN or not?

    A really quick and easy for the guru there VPN...

    Essentially, I am setting up a VPN for backup, but there is NO interesting traffic unfortunately and we need VPN upward.

    So... is this possible?

    Thanks in advance

    Arnoult

    I would also like to add to David's response. Some persistent according to which firewall and configuration, you use either have phase 1 KeepAlive, or full end-to-end KeepAlive 2 phase.

    I do not know the equivalent of Cisco or if they even have one. Example of this with Juniper dead-peer-detection (DPD) sends only persistent IKEv1/2, while the monitoring of VPN sends ICMP echo requests to follow the VPN / or says he's dead.

    With DPD, it isn't exactly a traffic interesting survey, it's just the IKE "Hello you're here" messages. After awhile, the vpn can go down due to lack of interesting traffic or having to re - negotiate the phase 2. However, to create interesting traffic, you can assign an sla for icmp ip end-to-end.

    You may have noticed in the past that VPN will just down after a while (if you have this configuration)

    There are three modes of RE how actually starts in the negotiations on the SAA

    One answer: Specifies that this peer does respond to incoming connections from IKE first during the exchange of the original owner to determine the appropriate peer to connect to.

    Bidirectional (default): Specifies that this peer can accept and come from the connections based on this crypto map entry. This is the type of default login for Site-to-Site connections. [Only if interesting traffic is put in correspondence]

    Originate only: Specifies that this peer is launching the first Exchange of industrial property to determine the appropriate peer to connect to.

    For the ASA Experts out there, please correct me if I'm wrong.

    Hope this helps

    Bilal

  • VPN site to Site one-way traffic

    Hi all

    I set up a Vpn site-to site and everything works well in the remote site to the corporate site, but since the site of the company asa 5510, I can't access to the remote site asa 5505.  I checked the logging on the SAA and I can see the packets being fallen but I can't find what I need to do to allow this traffic through.  Here are most of my 5510 config, I'm sure it's something simple I'm missing, but I can't run it please help.

    REMOTE network is 192.168.72.0

    : Saved

    : Written by enable_15 at 10:29:17.163 GMT/BDT Thu Jun 10 2010

    !

    ASA Version 8.0 (5)

    !

    host name Casa

    uk domain name

    activate the encrypted password of VgZT0UwPdkSV9l7N

    zlo5ImUVRkHl4lcl encrypted passwd

    names of

    name 192.168.103.14 description of Appliance CITRIX CITRIX Appliance

    name 192.168.3.12 description villages villages

    DNS-guard

    !

    interface Ethernet0/0

    nameif outside

    security-level 0

    IP address x.x.x.123 255.255.255.224

    !

    interface Ethernet0/1

    nameif inside

    security-level 100

    192.168.3.254 IP address 255.255.255.0

    !

    interface Ethernet0/2

    nameif dmz

    security-level 50

    IP 192.168.103.254 255.255.255.0

    !

    interface Ethernet0/3

    Shutdown

    No nameif

    no level of security

    no ip address

    !

    interface Management0/0

    nameif management

    security-level 100

    IP 192.168.1.1 255.255.255.0

    management only

    !

    boot system Disk0: / asa805 - k8.bin

    boot system Disk0: / asa707 - k8.bin

    passive FTP mode

    clock timezone GMT/UTC 0

    summer time clock GMT/BDT recurring last Sun Mar 01:00 last Sun Oct 02:00

    DNS server-group DefaultDNS

    uk domain name

    object-group network ExternalAccess

    Description hosts allowed direct web access

    network object-SVR-01 255.255.255.255

    SVR GIS 255.255.255.255 network-object

    host of network-object cient

    host villages network-object

    the ExternalAccessFromDMZ object-group network

    Description hosts allowed direct web access to DMZ

    CITRIX-device 255.255.255.255 network-object

    network-object IRONPORT1 255.255.255.255

    worker of the object-network 255.255.255.255

    MitelUDPinternet udp service object-group

    Description Mitel UDP services on the internet

    20000-27000 object-port Beach

    port-object eq sip

    port-object eq 5064

    MitelTCPinternet tcp service object-group

    Description Mitel TCP services on the internet

    port-object eq 2114

    port-object eq 2116

    port-object eq 35000

    port-object eq 37000

    port-object eq 3998

    6801-6802 object-port Beach

    port-object eq 6880

    port-object eq www

    EQ object of the https port

    port-object eq 6800

    EQ object Port 3478

    port-object eq sip

    EQ port ssh object

    MitelTCPinternetOpt tcp service object-group

    Description Mitel TCP optional services on the internet

    port-object eq 3300

    6806-6807 object-port Beach

    36005 36005 object-port Beach

    36005 36006 object-port Beach

    EQ object Port 3478

    port-object eq sip

    MitelUDP2LAN udp service object-group

    Description Mitel UDP for the local network of services

    object-port range 1024-65535

    port-object eq sip

    MitelTCP2LAN tcp service object-group

    Description Mitel TCP for the local network of services

    port-object eq 2114

    port-object eq 2116

    port-object eq 35000

    port-object eq 37000

    port-object eq 1606

    object-port 4443 eq

    port-object eq 3998

    port-object eq 3999

    6801-6802 object-port Beach

    port-object eq 6880

    port-object eq www

    EQ object of the https port

    EQ object Port 3478

    port-object eq sip

    acl_outside list extended access permit icmp any any echo response

    acl_outside list extended access allow all unreachable icmp

    acl_outside list extended access permit icmp any any source-quench

    acl_outside list extended access permit tcp any host Mail_Outside_AGH eq smtp

    acl_outside list extended access permit tcp any host Mail_Outside_AGH eq https

    acl_outside list extended access permit tcp any host x.x.x.123 eq ssh

    acl_outside list extended access permit tcp host x.x.x.x host Icritical_Outside eq ssh

    acl_outside list extended access permit tcp any host Citrix_Portal_outside eq 8088

    acl_outside list extended access permit tcp any host Citrix_Portal_outside eq https

    acl_outside list extended access permit tcp any host Citrix_Portal_outside eq 8081

    acl_outside list extended access permit tcp any host Mail_Outside_AVON eq smtp

    acl_outside list extended access permit tcp any host Mail_Outside_AVON eq https

    acl_outside list extended access permit udp host x.x.x.x host Icritical_Outside eq snmp

    acl_outside list extended access permit udp host x.x.x.x host Icritical_Outside eq snmp

    acl_outside list extended access permit tcp any host teleworker_outside MitelTCPinternet object-group

    acl_outside list extended access permit udp any host teleworker_outside MitelUDPinternet object-group

    acl_outside list extended access permit tcp any host teleworker_outside MitelTCPinternetOpt object-group

    acl_outside list extended access permit tcp host x.x.x.x host Icritical_Outside eq ssh

    acl_outside list extended access permit udp any host ESX-PAL-01 eq ntp

    acl_outside list extended access permit udp any host ESX-PAL-02 eq ntp

    acl_outside list extended access permit udp any host ESX-PAL-03 eq ntp

    inside_outbound_nat0_acl to access ip 192.168.1.0 scope list allow 255.255.255.0 172.30.100.0 inactive 255.255.255.224

    inside_outbound_nat0_acl list of allowed ip extended access all 172.31.1.0 255.255.255.0

    inside_outbound_nat0_acl to access extended list ip 192.168.3.0 allow 255.255.255.0 192.168.103.0 255.255.255.0

    inside_outbound_nat0_acl to access extended list ip 192.168.3.0 allow 255.255.255.0 192.168.72.0 255.255.255.0

    inside_pnat_outbound list extended access allowed object-group ip ExternalAccess everything

    acl_dmz list extended access permit ip host host IRONPORT1 Mail_Inside_AGH

    acl_dmz list extended access permit udp host field of pal-svr-22 eq IRONPORT1 host

    acl_dmz list extended access permit tcp host IRONPORT1 host pal-svr-22 eq 3268

    acl_dmz list extended access permit udp host host IRONPORT1 ARM-SVR-01 eq field

    acl_dmz list extended access permit tcp host IRONPORT1 host ARM-SVR-01 eq 3268

    acl_dmz list extended access permit udp host host IRONPORT1 Pal-Svr-17 eq field

    acl_dmz list extended access allowed icmp host host IRONPORT1 Mail_Inside_AGH

    access extensive list ip 192.168.103.0 acl_dmz allow 255.255.255.0 any

    acl_dmz list extended access permit tcp host host CITRIX-device-CITRIXCSG-lan eq https inactive

    acl_dmz list extended access permit ip any host CITRIXCSG-lan idle

    acl_dmz list extended access permit tcp host IRONPORT1 eq Mail_Outside_AGH smtp

    acl_dmz list extended access permit tcp host teleworker host 192.168.20.1 object-group MitelTCP2LAN

    acl_dmz list extended access permit udp host teleworker host 192.168.20.1 object-group MitelUDP2LAN

    dmz_pnat_outbound list extended access allowed object-group ip ExternalAccessFromDMZ all

    access extensive list ip 192.168.103.0 dmz_nat0_inbound allow 255.255.255.0 192.168.3.0 255.255.255.0

    dmz_nat0_inbound list of ip host 192.168.20.1 telecommuter host allowed extended access

    access extensive list ip 192.168.21.0 inside_pnat_outbound_AVON allow 255.255.255.0 any

    access extensive list ip 192.168.22.0 inside_pnat_outbound_AVON allow 255.255.255.0 any

    access extensive list ip 192.168.23.0 inside_pnat_outbound_AVON allow 255.255.255.0 any

    access extensive list ip 192.168.24.0 inside_pnat_outbound_AVON allow 255.255.248.0 all

    inside_pnat_outbound_AVON to access extended list ip 192.168.32.0 allow 255.255.240.0 everything

    access extensive list ip 192.168.48.0 inside_pnat_outbound_AVON allow 255.255.248.0 all

    access extensive list ip 192.168.56.0 inside_pnat_outbound_AVON allow 255.255.252.0 all

    access extensive list ip 192.168.60.0 inside_pnat_outbound_AVON allow 255.255.255.0 any

    allow any scope to an entire ip access list

    inside_nat_AVON_Marshall list extended access permit ip host Mail_Inside_AVON all

    dmz_pnat1_outbound list of ip telecommuter host allowed extended access any

    outside_1_cryptomap to access extended list ip 192.168.3.0 allow 255.255.255.0 192.168.72.0 255.255.255.0

    pager lines 24

    Enable logging

    asdm of logging of information

    logging e-mail notifications

    uk address record

    exploitation forest-address recipient [email protected] / * / critical level

    Outside 1500 MTU

    Within 1500 MTU

    MTU 1500 dmz

    management of MTU 1500

    IP local pool vpnpool 172.31.1.1 - 172.31.1.254 mask 255.255.255.0

    no failover

    ICMP unreachable rate-limit 1 burst-size 1

    ICMP allow any inside

    ICMP allow no dmz echo

    ICMP allow all dmz

    ASDM image disk0: / asdm-625 - 53.bin

    ASDM location SVR-01 255.255.255.255 inside

    ASDM location svr-02 255.255.255.255 inside

    ASDM location IRONPORT1 255.255.255.255 dmz

    ASDM location 194.81.55.226 255.255.255.255 dmz

    ASDM 255.255.255.255 inside server location

    ASDM location CITRIX-device 255.255.255.255 dmz

    ASDM group ExternalAccess inside

    ASDM group dmz ExternalAccessFromDMZ

    don't allow no asdm history

    ARP timeout 14400

    Global x.x.x.121 2 (outdoor)

    Global 1 x.x.x.125 (outside)

    Global Mail_Outside_AVON 3 (outside)

    Global Mail_Outside_AGH 4 (outside)

    Global teleworker_outside 5 (outside)

    NAT (inside) 0-list of access inside_outbound_nat0_acl

    NAT (inside) 2-list of access inside_pnat_outbound_AVON

    NAT (inside) 3 access-list inside_nat_AVON_Marshall

    NAT (inside) 1 access-list inside_pnat_outbound

    NAT (dmz) 0-list of access dmz_nat0_inbound outside

    NAT (dmz) 4 access-list dmz_pnat_outbound

    NAT (dmz) 5 access-list dmz_pnat1_outbound

    static (inside, outside) tcp ssh Icritical ssh netmask 255.255.255.255 Icritical_Outside

    static (inside, outside) tcp https Mail_Outside_AGH Mail_Inside_AGH https netmask 255.255.255.255

    static (dmz, outside) tcp smtp smtp IRONPORT1 netmask 255.255.255.255 Mail_Outside_AGH

    static (inside, outside) tcp https Mail_Outside_AVON Exchange_Inside_AVON https netmask 255.255.255.255

    static (inside, outside) tcp smtp smtp Mail_Inside_AVON netmask 255.255.255.255 Mail_Outside_AVON

    static (inside, outside) udp snmp Icritical snmp netmask 255.255.255.255 Icritical_Outside

    static (dmz, outside) device-CITRIX-Citrix_Portal_outside netmask 255.255.255.255

    static (inside, outside) Mail_Outside_AVON Mail_Inside_AVON netmask 255.255.255.255

    static (dmz, external) teleworker_outside netmask 255.255.255.255 teleworker

    Access-group acl_outside in interface outside

    Access-group acl_dmz in dmz interface

    Route outside 0.0.0.0 0.0.0.0 X.X.X.254 1

    Route inside 192.168.0.0 255.255.0.0 192.168.3.3 1

    Timeout xlate 03:00

    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

    timeout tcp-proxy-reassembly 0:01:00

    dynamic-access-policy-registration DfltAccessPolicy

    Enable http server

    oner http 255.255.255.255 inside

    http 192.168.1.0 255.255.255.0 management

    No snmp server location

    No snmp Server contact

    Server enable SNMP traps snmp authentication linkup, linkdown cold start

    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

    Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

    Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

    Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

    Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

    Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

    life crypto ipsec security association seconds 28800

    Crypto ipsec kilobytes of life - safety 4608000 association

    Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

    card crypto outside_map 1 match address outside_1_cryptomap

    card crypto outside_map 1 set pfs Group1

    card crypto outside_map 1 set r.r.r.244 counterpart

    card crypto outside_map 1 set of transformation-ESP-3DES-SHA

    outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

    outside_map interface card crypto outside

    crypto ISAKMP allow outside

    crypto ISAKMP policy 10

    preshared authentication

    3des encryption

    sha hash

    Group 2

    life 86400

    No encryption isakmp nat-traversal

    Telnet timeout 5

    SSH x.x.x.x 255.255.255.255 outside

    SSH Mail_Inside_AGH 255.255.255.255 inside

    SSH timeout 5

    Console timeout 0

    management of 192.168.1.2 - dhcpd address 192.168.1.254

    enable dhcpd management

    !

    a basic threat threat detection

    statistical threat detection port

    Statistical threat detection Protocol

    Statistics-list of access threat detection

    a statistical threat detection tcp-interception rate-interval 30 burst-400-rate average rate 200

    prefer NTP server SVR - DC1 source inside

    internal VPN group policy

    attributes of VPN group policy

    value 192.168.x.x 192.168.x.x WINS server

    Server DNS value 192.168.x.x 192.168.x.x

    enable IPSec-udp

    value by default domain-ACE

    username, password pmmPwcDD/inpnNfB VPN encrypted privilege 0

    attributes of VPN username

    Strategy-Group-VPN VPN

    VPN Tunnel-group type remote access

    General-attributes of VPN Tunnel-group

    address vpnpool pool

    Group Policy - by default-VPN

    Group-tunnel VPN ipsec-attributes

    pre-shared key *.

    tunnel-group r.r.r.244 type ipsec-l2l

    r.r.r.244 tunnel ipsec-attributes group

    pre-shared key *.

    by default-group r.r.r.244 tunnel-Group-map

    !

    class-map inspection_default

    match default-inspection-traffic

    !

    !

    type of policy-card inspect dns migrated_dns_map_1

    parameters

    message-length maximum 512

    Policy-map global_policy

    class inspection_default

    inspect the migrated_dns_map_1 dns

    inspect the ftp

    inspect h323 h225

    inspect the h323 ras

    inspect the rsh

    inspect the rtsp

    inspect esmtp

    inspect sqlnet

    inspect the skinny

    inspect sunrpc

    inspect xdmcp

    inspect the netbios

    inspect the tftp

    inspect the sip

    !

    global service-policy global_policy

    context of prompt hostname

    Cryptochecksum:8360816431357f109b3c4b950d545c86

    : end

    This route is duplicated with the remote network

    Route inside 192.168.0.0 255.255.0.0 192.168.3.3 1

    I suggest to make this more specific subnet or add something like

    Route outside 192.168.72.0 255.255.255.0 outside_default_gateway_ip

    Internal, if above not in fact help, put a trace packet to simulate traffic even that fails on the 5510.

    http://www.Cisco.com/en/us/docs/security/ASA/asa80/command/reference/p.html#wp1878788

    Kind regards

  • VPN site to Site IDLE-UP and no traffic...

    Hello

    I have two Office (hand and brach) each with a router cisco 887 15.3 with s + ios k9

    I have configured the vpn client (works without any problem at all) and a site to site VPN.

    The tunnel between main and the site of the direction is up (according to sh cry session and sh crypto isakamp her) but I can't send traffic from one site to another and the condition of the tunnel is still 'IDLE-UP '.

    (address removed)

    MAIN SITE

    Interface: Dialer0
    The session state: IDLE-UP
    Peer: Port of 500 intellectual PROPERTY branch
    Session ID: 0
    IKEv1 SA: active local
    FLOW IPSEC: allowed ip 10.0.0.0/255.255.255.0 192.168.1.0/255.255.255.0
    Active sAs: 0, origin: card crypto

    IPv4 Crypto ISAKMP Security Association
    DST CBC conn-State id
    QM_IDLE 2009 ACTIVE

    Interface: Dialer0
    Tag crypto map: clientmap, local addr

    protégé of the vrf: (none)
    local ident (addr, mask, prot, port): (10.0.0.0/255.255.255.0/0/0)
    Remote ident (addr, mask, prot, port): (192.168.1.0/255.255.255.0/0/0)
    current_peer port 500
    PERMITS, flags = {origin_is_acl, ipsec_sa_request_sent}
    #pkts program: encrypt 0, #pkts: 0, #pkts digest: 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0
    compressed #pkts: 0, unzipped #pkts: 0
    #pkts uncompressed: 0, #pkts compr. has failed: 0
    #pkts not unpacked: 0, #pkts decompress failed: 0
    #send 458, #recv errors 0

    endpt local crypto. :, remote Start crypto. :
    clearly, mtu 1500, path mtu 1500, ip mtu 1500 ip mtu BID Dialer0
    current outbound SPI: 0x0 (0)
    PFS (Y/N): N, Diffie-Hellman group: no

    SAS of the esp on arrival:

    the arrival ah sas:

    SAS of the CFP on arrival:

    outgoing esp sas:

    outgoing ah sas:

    outgoing CFP sas:

    GENERAL MANAGEMENT OF THE

    Interface: Dialer0
    The session state: IDLE-UP
    Peer: HAND IP port 500
    Session ID: 0
    IKEv1 SA: active local
    FLOW IPSEC: allowed ip 10.0.0.0/255.255.255.0 192.168.1.0/255.255.255.0
    Active sAs: 0, origin: card crypto

    Crypto isakmp HS her
    IPv4 Crypto ISAKMP Security Association
    DST CBC conn-State id
    QM_IDLE 2012 ASSETS

    SH crypto ipsec his

    Interface: Dialer0
    Tag crypto map: clientmap, local addr

    protégé of the vrf: (none)
    local ident (addr, mask, prot, port): (192.168.1.0/255.255.255.0/0/0)
    Remote ident (addr, mask, prot, port): (10.0.0.0/255.255.255.0/0/0)
    current_peer 79.0.238.28 port 500
    LICENCE, flags is {origin_is_acl},
    #pkts program: encrypt 0, #pkts: 0, #pkts digest: 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0
    compressed #pkts: 0, unzipped #pkts: 0
    #pkts uncompressed: 0, #pkts compr. has failed: 0
    #pkts not unpacked: 0, #pkts decompress failed: 0
    #send 30, #recv errors 0

    endpt local crypto. :, remote Start crypto. :
    clearly, mtu 1500, path mtu 1500, ip mtu 1500 ip mtu BID Dialer0
    current outbound SPI: 0x0 (0)
    PFS (Y/N): N, Diffie-Hellman group: no

    SAS of the esp on arrival:

    the arrival ah sas:

    SAS of the CFP on arrival:

    outgoing esp sas:

    outgoing ah sas:

    outgoing CFP sas:

    Set both the sh run CONF.
    I see no problem with peer and ACL configuration for nat and traffic

    Thanks for any help.

    I'm not for some without seeing a cry of debugging IPsec, but I think you can be matching your dynamic map first with a seq of 10.  I would try delete and assigning to 100 or something on both sides.  Disable sessions and try again.

    No map clientmap 10-isakmp ipsec crypto dynamic dynmap

    100 ipsec-isakmp crypto map clientmap Dynamics dynmap

    Claire crying its

    Disable the IPsec Security Association cry

    HTH

  • VPN site to site UP, but no traffic

    Dear friends,

    I did a VPN site to site using ASA 5555 02 in each site running the Version of the software 9.2 (4).

    The VPN is UP, as shown below:

    ASA-SSP-Pri (config) # sh isak his

    There are no SAs IKEv1

    IKEv2 SAs:

    Session-id: 1, State: UP-ACTIVE, IKE County: 1, number of CHILDREN: 1

    Tunnel-id Local remote status role
    201.23.100.130/500 268373031 200.174.36.19/500 LOAN MACHINE
    BA: AES - CBC, keysize: 256, Hash: SHA96, Grp:5 DH, Auth sign: PSK, Auth check: PSK
    Duration of life/active: 86400/272 sec
    His child: selector local 10.69.0.0/0 - 10.69.0.255/65535
    selector of distance 10.12.20.0/0 - 10.12.20.255/65535
    SPI ESP/output: 0xf89430e6/0x86a5cd8f

    But when I try to ping from one site to another, is not possible, the result of the ping command is '?

    I did some research on this problem and a lot of people say that Miss crypto isakmp nat-traversal 20 command, but this command is already enabled.

    Exempt from NAT is enabled and I did tests of deactivation as well.

    Hello

    The last thing I think is that there is a SPINNAKER twice on the table of the asp and that is why the traffic is not encrypted everything seems correct, run the following command on the ASA:

    clear crypto ipsec its inactive

    test again

  • Routing of traffic between two VPN Site-to-Site Tunnels

    Hi people,

    I am trying to establish routing between two vpn Site-to-Site tunnels which are destined for the same outside the interface of my Cisco ASA.

    Please find attached flowchart for the same thing. All used firewalls are Cisco ASA 5520.

    Two VPN tunnels between Point A and Point B, Point B and Point C is too much upward. I activated same command to permit security level interface also intra.

    How can I activate the LAN subnets traffic behind Point to join LAN subnets behind C Point without having to create a tunnel separated between Point A and Point C

    Thank you very much.

    Hello

    Basically, you will need to NAT0 and VPN rules on each site to allow this traffic.

    I think that the configurations should look something like below. Naturally you will already probably a NAT0 configuration and certainly the L2L VPN configuration

    Site has

    access-list NAT0 note NAT0 rule for SiteA SiteC traffic

    access-list allowed NAT0 ip 192.168.1.0 255.255.255.0 192.168.3.0 255.255.255.0

    NAT (inside) 0 access-list NAT0

    Note L2L-VPN-CRYPTO-SITEB access-list interesting traffic for SiteA to SiteC

    access-list L2L-VPN-CRYPTO-SITEB permit ip 192.168.1.0 255.255.255.0 192.168.3.0 255.255.255.0

    Where

    • NAT0 = is the ACL to be used in the NAT0 rules that will exempt SiteA SiteC NAT traffic
    • NAT = is the line of configuration NAT0
    • L2l-VPN-CRYPTO-SITEB = LCA in configurations VPN L2L that defines the SiteA LAN to LAN SiteC traffic must use the VPN L2L existing SiteB

    Site B

    access list OUTSIDE-NAT0 note NAT0 rule for SiteA SiteC traffic

    OUTSIDE-NAT0 allowed 192.168.1.0 ip access list 255.255.255.0 192.168.3.0 255.255.255.0

    NAT (outside) 0-list of access OUTSIDE-NAT0

    Note L2L-VPN-CRYPTO-SITEA access-list traffic for SiteA to SiteC through a Tunnel between A - B

    access-list L2L-VPN-CRYPTO-SITEA ip 192.168.3.0 allow 255.255.255.0 192.168.1.0 255.255.255.0

    Note L2L-VPN-CRYPTO-SITEC access-list traffic for SiteA to SiteC through a Tunnel between B - C

    access-list L2L-VPN-CRYPTO-SITEC permit ip 192.168.1.0 255.255.255.0 192.168.3.0 255.255.255.0

    Where

    • OUTSIDE-NAT0 = is the ACL to be used in the NAT0 rules that will exempt SiteA SiteC NAT traffic. It is this time tied to the 'outer' interface, as traffic will be coming in and out through this interface to SiteB
    • NAT = is the line of configuration NAT0
    • L2l-VPN-CRYPTO-SITEA (and SITEC) = are the ACL in the configurations of VPN L2L that defines the SiteA LAN to LAN SiteC traffic should use existing VPN L2L connections.

    Site C

    access-list NAT0 note NAT0 rule for SiteC SiteA traffic

    NAT0 192.168.3.0 ip access list allow 255.255.255.0 192.168.1.0 255.255.255.0

    NAT (inside) 0 access-list NAT0

    Note list-access-L2L-VPN-CRYPTO-SITEB SiteC to SiteA interesting traffic

    L2L-VPN-CRYPTO-SITEB 192.168.3.0 ip access list allow 255.255.255.0 192.168.1.0 255.255.255.0

    Where

    • NAT0 = is the ACL to be used in the NAT0 rules that will exempt SiteC to SiteA NAT traffic
    • NAT = is the line of configuration NAT0
    • L2l-VPN-CRYPTO-SITEB = LCA in configurations VPN L2L that defines the SiteC LAN to LAN SiteA traffic must use the VPN L2L existing SiteB

    To my knowledge, the foregoing must manage the selection NAT0 and traffic for VPN L2L connections. Naturally, the Interface/ACL names may be different depending on your current configuration.

    Hope this helps

    -Jouni

  • the traffic in a vpn site-to-site tunnel restrictions

    Hello

    I have install a VPN site-to site between an ASA 5550 7.2 (3) and the external network of the contractor. I have set up the VPN using the wizard and it worked fine. The wizard has created the cryptomap acl see below

    outside_2_cryptomap list extended access allowed object-group ip 10.0.0.0 LOCAL_IPS 255.255.255.0

    where LOCAL_IPS is a group of objects containing our local subnets to be dug and 10.0.0.0/24 is the network of the remote end.

    I'm trying to restrict the traffic tunnel at about 6 tcp ports, so I changed the acl (using the GUI as well from the CLI) to the following:-

    outside_2_cryptomap list extended access permitted tcp object-group LOCAL_IPS 10.0.0.0 255.255.255.0 PERMITTED_TRAFFIC object-group

    where PERMITTED_TRAFFIC is a group of TCP services containing the ports we'd like to tunnel.

    As soon as I apply this acl (applied at the other end also) the tunnel down and or end it can re - open.

    My question is - how do you restrict what traffic (tcp ports) that you want to send in the tunnel on the SAA?

    Thank you

    Andy

    You have 2 options.

    VPN-filter

    http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a0080641a52.shtml

    Or something like that...

    No sysopt permi-vpn connection

    list of access vpn extended permitted tcp object-group LOCAL_IPS 10.0.0.0 255.255.255.0 PERMITTED_TRAFFIC object-group

    list of vpn access deny ip 10.0.0.0 LOCAL_IPS object-group 255.255.255.0

    extended vpn allowed any one ip access list

    group-access vpn in interface inside

Maybe you are looking for

  • Satellite A500-ST6644 reviews

    I filled out a list of characteristics of mobile at http://forum.notebookreview.com/what-notebook-should-i-buy/484100-selecting-asus-notebook.html#4 I don't do any game or scientific computing, CPU performance requirements are modest. I'll especially

  • Legend of the plot does not update?

    My legend of conspiracy will not show the new names I'm wiring. It displays the default plot 0, track 1, and so on, rather than the column headers it is supposed to read the data file. Any ideas? See the attached VI and the associated text file that

  • How to integrate systems with Labview

    Hello I have a computer (running Windows xp embedded) who uses labview to poster of the resistance of different resistances. We will call this strongest How can I do such as other computers on the same network that this computer will be able to commu

  • Runninng Vista 32-Bit Windows Update - white screen updated

    When I run the windows update program, the window appears without all elements inside. Just a progress bar continues to show action but nothing happens also after a long wait. Here's what it looks like:First: http://img205.imageshack.us/img205/3678/e

  • updates Windows vista basic

    I just got a laptop is really inportant to make all windows updates? It will be slowing my speed?