VPN tunnel with U-turn

Similar Questions

• RV042 VPN tunnel with Samsung Ubigate ibg2600 need help

  Hi all, ok before I completely remove all of my hair, I thought stop by here and ask the volume for you all with the hope that someone can track down the problem.

  In short I am configuring a 'Gateway to gateway' vpn tunnel between two sites, I don't have access to the config of the router from Samsung, but the ISPS making sure that they followed my setup - watching newspapers RV042, I don't however see the reason for the failure - im no expert vpn...

  Sorry if the log file turns on a bit, I didn't know where the beginning and the end was stupid I know... any advice would be greatly welcomed lol.

  System log
  Current time: Fri Sep 2 03:37:52 2009 all THE Log Log Log Log VPN Firewall Access system
   
  Time
  Type of event Message
  2 sep 03:36:01 2009 value of VPN Log [Tunnel negotiation Info] Inbound SPI = c3bdba08
  2 sep 03:36:01 2009 value of outbound SPI VPN Log [Tunnel negotiation Info] = c664c1ca
  2 sep 03:36:02 2009 VPN Log [Tunnel negotiation Info] > initiator send fast Mode 3rd package
  2 sep 03:36:02 2009 VPN Log [Tunnel negotiation Info] Quick Mode Phase 2 SA established, IPSec Tunnel connected
  2 sep 03:36:02 2009 VPN journal Dead Peer Detection start, DPD delay = timeout = 10 sec 10 sec timer
  2 sep 03:36:02 2009 VPN received log delete SA payload: ISAKMP State #627 removal
  2 sep 03:36:02 2009 VPN Log Main Mode initiator
  2 sep 03:36:02 2009 VPN Log [Tunnel negotiation Info] > Send main initiator Mode 1 package
  2 sep 03:36:02 2009 charge of VPN journal received Vendor ID Type = [Dead Peer Detection]
  2 sep 03:36:02 2009 VPN Log [Tunnel negotiation of Info]< initiator="" received="" main="" mode="" 2nd="" packet="">
  2 sep 03:36:02 2009 VPN Log [Tunnel negotiation Info] > initiator send Mode main 3rd package
  2 sep 03:36:03 2009 VPN Log [Tunnel negotiation of Info]< initiator="" received="" main="" mode="" 4th="" packet="">
  2 sep 03:36:03 2009 Log [Tunnel negotiation Info] VPN > main initiator Mode to send 5 packs
  2 sep 03:36:03 2009 Log [Tunnel negotiation Info] VPN > initiator receive hand Mode 6 Pack
  2 sep 03:36:03 2009 log VPN main mode peer ID is ID_IPV4_ADDR: '87.85.xxx.xxx '.
  2 sep 03:36:03 2009 Log [Tunnel negotiation Info] VPN Mode main Phase 1 SA established
  2 sep 03:36:03 2009 log VPN [Tunnel negotiation Info] initiator Cookies = c527 d584 595 c 2c3b
  2 sep 03:36:03 2009 log VPN [Tunnel negotiation Info] responder Cookies = b62c ca31 1a5f 673f
  2 sep 03:36:03 2009 log quick launch Mode PSK VPN + TUNNEL + PFS
  2 sep 03:36:03 2009 Log [Tunnel negotiation Info] VPN > initiator send fast Mode 1 package
  2 sep 03:36:04 2009 VPN Log [Tunnel negotiation of Info]< initiator="" received="" quick="" mode="" 2nd="" packet="">
  2 sep 03:36:04 2009 value of VPN Log [Tunnel negotiation Info] Inbound SPI = c3bdba09
  2 sep 03:36:04 2009 value of outbound SPI VPN Log [Tunnel negotiation Info] = e3da1469
  2 sep 03:36:04 2009 VPN Log [Tunnel negotiation Info] > initiator send fast Mode 3rd package
  2 sep 03:36:04 2009 VPN Log [Tunnel negotiation Info] Quick Mode Phase 2 SA established, IPSec Tunnel connected
  2 sep 03:36:04 2009 VPN journal Dead Peer Detection start, DPD delay = timeout = 10 sec 10 sec timer
  2 sep 03:36:05 2009 VPN received log delete SA payload: ISAKMP State #629 removal

  PFS - off on tada and linksys router does not support the samsung lol! connected!

• VPN tunnel with only one authorized service

  Hello

  has got a pix 520 with V 6.22. Now, I created a VPN Tunnel from our server to a

  annother company server and I only want to have ssh connection. If it works

  pretty good - but the other host, it is possible to connect on our host by

  ICMP, ftp, telnet... How can I manage configured my pix to refuse all this

  services?

  Here is my configuration:

  name 10.x.x.x ffmz1_is

  name 212.x.x.x conliner_os

  conliner_ssh name 192.168.0.250

  object-group network conliner

  object-network 192.168.0.0 255.255.255.0

  access list on the inside to allow icmp host ffmz1_is a

  access-list inside permit TCP host ffmz1_is any ftp eq

  access-list inside allow host ffmz1_is udp any eq smtp

  access-list inside allow host ffmz1_is host conliner_ssh eq ssh tcp

  no_nat list of allowed access host ip conliner object-group ffmz1_is

  access-list allowed conliner host ip conliner object-group ffmz1_is

  ...

  crypto VPN 30 card matches the address conliner

  card crypto VPN 30 set peer conliner_os

  ...

  Thank you very much

  The sole purpose of "ipsec sysopt connection permit" is to allow traffic through a tunnel to bypass access-groups. It is not necessary to use it, but then you must explicitly allow traffic you want through your access list.

  The command is very useful when you need to establish a vpn using the cisco customer remotely. Because you must use dynamic crypto maps and you don't know the IP address of the peer, if you didn't have the sysopt command, you will need to allow traffic from an source.

  And you don't have to open all ports for the PIX to be able to establish the tunnel with its ipsec peer.

  You need to allow udp 500 and protocol 50-51 when ipsec traffic through your firewall. Let's say you have another PIX inside who wants to establish a vpn on your main PIX with a third PIX on the outside, you must open the ports in your main PIX.

• Between Cisco ASA VPN tunnels with VLAN + hairpin.

  I have two Cisco ASA (5520 and 5505) both with version 9.1 (7) with Over VPN and Security Plus licenses. I try to understand all the internet a traffic tunnel strategy VLAN especially on the 5520 above the 5505 for further routing to the internet (such as a hair/u-turn hairpin). A few warnings:

  1. The 5505 has a dynamically assigned internet address.
  2. The 5505 has sometimes no device turned on behind her, bringing interfaces down to the inside (which can cause problems from site to site).
  3. The 5520 cannot be a client of ezvpn due to its current role as a server of webvpn (anyconnect).

  Let me know if I need to post my current config. Basically, I'm starting from scratch after several attempts.

  Thank you!

  1. The 5505 has a dynamically assigned internet address.

  You can use the following doc to set up the VPN and then this document to configure Hairping/U tuning

  2. the 5505 has sometimes no device turned on behind her, bringing interfaces down to the inside (which can cause problems from site to site).

  Make sure that the interface is connected to a switch so that it remains all the TIME.

  3. 5520 the may not be a ezvpn customer due to she has current as one role anyconnect webvpn ()) server.

  You can use dynamic VPN with normal static rather EZVPN tunnel.

  Kind regards
  Dinesh Moudgil

  PS Please rate helpful messages.

• NAT on 8.3 and VPN tunnel with overlapping addresses

  Hi all

  I was looking at this document from Cisco and I think I understand how to convert the nat policy than the version 8.3 and later, but I was wondering what is happening to the acl crypto, you are always using the same as the older versions? As you know the 8.3 then NAT requires to use the original instead of the address translated to the ACL, but I don't know if this applies to crypto ACL as well. Pointers?

  Example from the link:

   access-list new extended permit ip 192.168.2.0 255.255.255.0 192.168.3.0 255.255.255.0 !--- This access list (new) is used with the crypto map (outside_map) !--- in order to determine which traffic should be encrypted !--- and sent across the tunnel. access-list policy-nat extended permit ip 192.168.1.0 255.255.255.0 192.168.3.0 255.255.255.0 !--- The policy-nat ACL is used with the static !--- command in order to match the VPN traffic for translation. 

   static (inside,outside) 192.168.2.0 access-list policy-nat !--- It is a Policy NAT statement. !--- The static command with the access list (policy-nat), !--- which matches the VPN traffic and translates the source (192.168.1.0) to !--- 192.168.2.0 for outbound VPN traffic.

   crypto map outside_map 20 match address new !--- Define which traffic should be sent to the IPsec peer with the !--- access list (new).

  Thank you

  V

  Hi rc001g0241,

  I posted your question for clarity sake along.

  "what happens to the crypto acl, always use you even as older versions?"

  As you can see, Cisco doc you posted shows that you need to target for crypto engine is what happens after the nat policy has succeeded, illustrated here: "address match map crypto outside_map 20 new".

  "As you know the 8.3 then NAT requires to use the original instead of the address translated to the ACL, but I don't know if this applies to crypto ACL as well. Pointers?

  There is no such requirement and ACL target you in the engine crytop for the tunnel bound traffic can be a natted post address, that's what shows Cisco Doc and it is correct.

  Hope that answers your questions.

  Thank you

  Rizwan James

• VPN tunnel with IP dynamic

  Question:

  Is it possible to install a GRE tunnel between two routers, one that has a dynamic IP, the other has a static IP address. If this isn't the case, GRE, is there another tunneling protocol we could use?

  In the search for setting up a VPN, I found that the way suggested to do is a GRE tunnel, so that dynamic routing work via VPN. We do not use dynamic routing, but I want the flexible design for future changes that will occur.

  Our facility is:

  2651XM (hub) to the corporate office (static IP). DS-1

  827H (spokes) to each branch (dynamic IP via DHCP). ADSL.

  IOS version 12.2 (13) T supports Multipoint GRE function which will allow your GRE tunnel on the side of ADSL to use a dynamic IP address. Locate the CCO love and documentation DMVPN (dynamic multipoint VPN).

• 2 separated on same ASA VPN tunnels can communicate with each other

  Here's the scenario that I have a VPN tunnel with one of my remote locations.   I also have a VPN Tunnel with a provider that supports the equipment for my organization.   I need to have my supplier able to communicate with equipment that live in my other VPN tunnel.   The two Tunnels are on the same ASA5540.

  1 is it Possible?

  2 How set it up?

  Thank you

  Follow this link for example. Enhanced spoke-to-spoke VPN, allows the two tunnels ending to your asa5540 to connect, using parameter permit intra-interface with configuration accless-list permits traffic of each endpoint of the tunnel.

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00804675ac.shtml

• ASA L2L VPN UP with incoming traffic

  Hello

  I need help with this one, I have two identical VPN tunnel with two different customers who need access to one of our internal server, one of them (customer) works well, but the other (CustomerB) I can only see traffic from the remote peer (ok, RX but no TX). I put a sniffer on ports where the ASA and the server are connected and saw that traffic is to reach the server and traffic to reach the ASA of the server then nothing...

  See the result of sh crypto ipsec his below and part of the config for both clients

  ------------------

  address:

  local peer 100.100.100.178

  local network 10.10.10.0 / 24

  local server they need access to the 10.10.10.10

  Customer counterpart remote 200.200.200.200

  Customer remote network 172.16.200.0 / 20

  CustomerB peer remote 160.160.143.4

  CustomerB remote network 10.15.160.0 / 21

  ---------------------------

  Output of the command: "SH crypto ipsec its peer 160.160.143.4 det".

  address of the peers: 160.160.143.4
  Tag crypto map: outside_map, seq num: 3, local addr: 100.100.100.178

  outside_cryptomap list of allowed access host ip 10.10.10.10 10.15.160.0 255.255.248.0
  local ident (addr, mask, prot, port): (10.10.10.10/255.255.255.255/0/0)
  Remote ident (addr, mask, prot, port): (10.15.160.0/255.255.248.0/0/0)
  current_peer: 160.160.143.4

  #pkts program: encrypt 0, #pkts: 0, #pkts digest: 0
  #pkts decaps: 827, #pkts decrypt: 827, #pkts check: 827
  compressed #pkts: 0, unzipped #pkts: 0
  #pkts uncompressed: 0, comp #pkts failed: 0, #pkts Dang failed: 0
  success #frag before: 0, failures before #frag: 0, #fragments created: 0
  Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
  #pkts not his (send): 0, invalid #pkts his (RRs): 0
  #pkts program failed (send): 0, #pkts decaps failed (RRs): 0
  #pkts invalid prot (RRs): 0, #pkts check failed: 0
  invalid identity #pkts (RRs): 0, #pkts invalid len (RRs): 0
  #pkts incorrect key (RRs): 0,
  #pkts invalid ip version (RRs): 0,
  replay reversal (send) #pkts: 0, #pkts replay reversal (RRs): 0
  #pkts replay failed (RRs): 0
  #pkts min frag mtu failed (send): bad frag offset 0, #pkts (RRs): 0
  #pkts internal err (send): 0, #pkts internal err (RRs): 0

  local crypto endpt. : 100.100.100.178, remote Start crypto. : 160.160.143.4

  Path mtu 1500, fresh ipsec generals 58, media, mtu 1500
  current outbound SPI: C2AC8AAE

  SAS of the esp on arrival:
  SPI: 0xD88DC8A9 (3633170601)
  transform: esp-3des esp-md5-hmac no compression
  running parameters = {L2L, Tunnel}
  slot: 0, id_conn: 5517312, crypto-card: outside_map
  calendar of his: service life remaining (KB/s) key: (4373959/20144)
  Size IV: 8 bytes
  support for replay detection: Y
  Anti-replay bitmap:
  0xFFFFFFFF to 0xFFFFFFFF
  outgoing esp sas:
  SPI: 0xC2AC8AAE (3266087598)
  transform: esp-3des esp-md5-hmac no compression
  running parameters = {L2L, Tunnel}
  slot: 0, id_conn: 5517312, crypto-card: outside_map
  calendar of his: service life remaining (KB/s) key: (4374000/20144)
  Size IV: 8 bytes
  support for replay detection: Y
  Anti-replay bitmap:
  0x00000000 0x00000001

  -The configuration framework

  ASA Version 8.2 (1)

  !

  172.16.200.0 customer name

  name 10.15.160.0 CustomerB

  !

  interface Ethernet0/0

  nameif outside

  security-level 0

  IP 100.100.100.178 255.255.255.240

  !

  interface Ethernet0/1

  nameif inside

  security-level 100

  10.10.10.0 IP address 255.255.255.0

  !

  outside_1_cryptomap list extended access allowed host ip 10.10.10.10 customer 255.255.240.0

  inside_nat0_outbound_1 list extended access allowed host ip 10.10.10.10 customer 255.255.240.0

  inside_nat0_outbound_1 list extended access allowed host ip 10.10.10.10 CustomerB 255.255.248.0

  outside_cryptomap list extended access allowed host ip 10.10.10.10 CustomerB 255.255.248.0

  NAT-control

  Overall 101 (external) interface

  NAT (inside) 0-list of access inside_nat0_outbound_1

  NAT (inside) 101 0.0.0.0 0.0.0.0

  Route outside 0.0.0.0 0.0.0.0 100.100.100.177

  Route inside 10.10.10.0 255.255.255.0 10.10.10.254 1

  Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

  Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

  Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

  Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

  Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

  life crypto ipsec security association seconds 28800

  Crypto ipsec kilobytes of life - safety 4608000 association

  crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set

  Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

  card crypto outside_map 1 match address outside_1_cryptomap

  card crypto outside_map 1 set pfs

  peer set card crypto outside_map 1 200.200.200.200

  card crypto outside_map 1 set of transformation-ESP-3DES-SHA

  card crypto outside_map 3 match address outside_cryptomap

  peer set card crypto outside_map 3 160.160.143.4

  card crypto outside_map 3 game of transformation-ESP-3DES-MD5

  outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

  outside_map interface card crypto outside

  crypto ISAKMP allow outside

  crypto ISAKMP policy 10

  preshared authentication

  3des encryption

  md5 hash

  Group 2

  life 86400

  crypto ISAKMP policy 20

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  crypto ISAKMP ipsec-over-tcp port 10000

  attributes of Group Policy DfltGrpPolicy

  Protocol-tunnel-VPN IPSec svc

  internal customer group strategy

  Customer group policy attributes

  Protocol-tunnel-VPN IPSec svc

  internal CustomerB group strategy

  attributes of Group Policy CustomerB

  Protocol-tunnel-VPN IPSec

  tunnel-group 160.160.143.4 type ipsec-l2l

  tunnel-group 160.160.143.4 General-attributes

  Group Policy - by default-CustomerB

  IPSec-attributes tunnel-group 160.160.143.4

  pre-shared key xxx

  tunnel-group 200.200.200.200 type ipsec-l2l

  tunnel-group 200.200.200.200 General attributes

  Customer by default-group-policy

  IPSec-attributes tunnel-group 200.200.200.200

  pre-shared key yyy

  Thank you

  A.

  Hello

  It seems that the ASA is not Encrypting traffic to the second peer (However there is no problem of routing).

  I saw this 7.x code behaviors not on code 8.x

  However you can do a test?

  You can change the order of cryptographic cards?

  card crypto outside_map 1 match address outside_cryptomap

  peer set card crypto outside_map 1 160.160.143.4

  map outside_map 1 set of transformation-ESP-3DES-MD5 crypto

  card crypto outside_map 3 match address outside_1_cryptomap

  card crypto outside_map 3 set pfs

  peer set card crypto outside_map 3 200.200.200.200

  card crypto outside_map 3 game of transformation-ESP-3DES-SHA

  I just want to see if by setting the peer nonworking time to be the first, it works...

  I know it should work the way you have it, I just want to see if this is the same behavior I've seen.

  Thank you.

  Federico.

• IPSEC VPN tunnel on issue of Zonebased Firewall

  Help, please!

  I'm trying to configure a router lab ISR1921 to build the VPN tunnel with vmware vshield edge. The configuration of the 1921 is pasted below. There is not a lot of adjustment on the side of vshield really and I'm sure both sides are adapting to phase 1 & 2.

  The question I have: the tunnel can be built correctly and I also see from show crypto ipsec release encap and decap counters. However the devices on each side can communicate. That said, I can ping from 1921 to the IP of the internal interface of the vshield with IP source specified. But just no communication part and other...

  I did debugs and only "error" messages are:

  01:58:03.193 20 February: ISAKMP: (1001): error suppression node 1656104565 FALSE reason 'informational (in) State d1.

  ...

  01:58:03.193 20 February: ISAKMP: (1001): purge the node-1657220080

  I hope that I did a stupid thing to configure error, but I spent too much time on it. It is supposed to be a really simple installation... Please help!

  !

  version 15.4

  horodateurs service debug datetime msec

  Log service timestamps datetime msec

  no password encryption service

  !

  Lab-1900 host name

  !

  boot-start-marker

  boot system flash: c1900-universalk9-mz. Spa. 154 - 1.T1.bin

  boot system flash: c1900-universalk9-mz. Spa. 151 - 4.M7.bin

  boot system flash: c1900-universalk9-mz. Spa. 150 - 1.M4.bin

  boot-end-marker

  !

  AAA new-model

  !

  AAA authentication login default local

  authorization AAA console

  AAA authorization exec default local

  !

  AAA - the id of the joint session

  clock timezone AST - 4 0

  clock to summer time recurring ADT 3 Sun Mar 2 Sun Nov 02:00 02:00

  !

  DHCP excluded-address IP 192.168.100.1 192.168.100.40

  !

  dhcp DHCPPOOL IP pool

  import all

  network 192.168.100.0 255.255.255.0

  LAB domain name

  DNS 8.8.8.8 Server 4.2.2.2

  default router 192.168.100.1

  4 rental

  !

  Laboratory of IP domain name

  8.8.8.8 IP name-server

  IP-server names 4.2.2.2

  inspect the IP log drop-pkt

  IP cef

  No ipv6 cef

  !

  type of parameter-card inspect global

  Select a dropped packet newspapers

  Max-incomplete 18000 low

  20000 high Max-incomplete

  Authenticated MultiLink bundle-name Panel

  !

  redundancy

  !

  property intellectual ssh version 2

  !

  type of class-card inspect entire game ESP_CMAP

  match the name of group-access ESP_ACL

  type of class-card inspect the correspondence SDM_GRE_CMAP

  match the name of group-access GRE_ACL

  type of class-card inspect entire game PAC-cls-icmp-access

  match icmp Protocol

  tcp protocol match

  udp Protocol game

  type of class-card inspect correspondence sdm-cls-VPNOutsideToInside-13

  game group-access 154

  class-card type check ALLOW-VPN-TRAFFIC-OUT match-all

  match the ALLOW-VPN-TRAFFIC-OUT access group name

  type of class-card inspect entire game PAC-cls-insp-traffic

  match Protocol pptp

  dns protocol game

  ftp protocol game

  https protocol game

  match icmp Protocol

  match the imap Protocol

  pop3 Protocol game

  netshow Protocol game

  Protocol shell game

  match Protocol realmedia

  match rtsp Protocol

  smtp Protocol game

  sql-net Protocol game

  streamworks Protocol game

  tftp Protocol game

  vdolive Protocol game

  tcp protocol match

  udp Protocol game

  http protocol game

  type of class-card inspect entire game AH_CMAP

  match the name of group-access AH_ACL

  inspect the class-map match ALLOW VPN TRAFFIC type

  match the ALLOW-VPN-TRAFFIC-OUT access group name

  type of class-card inspect correspondence ccp-invalid-src

  game group-access 126

  type of class-card inspect entire game PAC-insp-traffic

  corresponds to the class-map PAC-cls-insp-traffic

  type of class-card inspect entire game SDM_VPN_TRAFFIC

  match Protocol isakmp

  match Protocol ipsec-msft

  corresponds to the AH_CMAP class-map

  corresponds to the ESP_CMAP class-map

  type of class-card inspect correspondence ccp-icmp-access

  corresponds to the class-ccp-cls-icmp-access card

  type of class-card inspect the correspondence SDM_VPN_PT

  game group-access 137

  corresponds to the SDM_VPN_TRAFFIC class-map

  !

  type of policy-card inspect self-out-pmap

  class type inspect PCB-icmp-access

  inspect

  class class by default

  Pass

  policy-card type check out-self-pmap

  class type inspect SDM_VPN_PT

  Pass

  class class by default

  Drop newspaper

  policy-card type check out-pmap

  class type inspect PCB-invalid-src

  Drop newspaper

  class type inspect ALLOW VPN TRAFFIC OUT

  inspect

  class type inspect PCB-insp-traffic

  inspect

  class class by default

  Drop newspaper

  policy-card type check out in pmap

  class type inspect sdm-cls-VPNOutsideToInside-13

  inspect

  class class by default

  Drop newspaper

  !

  security of the area outside the area

  safety zone-to-zone

  safety zone-pair zp-self-out source destination outside zone auto

  type of service-strategy inspect self-out-pmap

  safety zone-pair zp-out-to source out-area destination in the area

  type of service-strategy check out in pmap

  safety zone-pair zp-in-out source in the area of destination outside the area

  type of service-strategy inspect outside-pmap

  source of zp-out-auto security area outside zone destination auto pair

  type of service-strategy check out-self-pmap

  !

  crypto ISAKMP policy 1

  BA 3des

  preshared authentication

  Group 2

  ISAKMP crypto key iL9rY483fF address 172.24.92.103

  !

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  tunnel mode

  !

  IPSEC_MAP 1 ipsec-isakmp crypto map

  Tunnel Sandbox2 description

  defined by peer 172.24.92.103

  Set security-association second life 28800

  game of transformation-ESP-3DES-SHA

  PFS group2 Set

  match address 150

  !

  the Embedded-Service-Engine0/0 interface

  no ip address

  Shutdown

  !

  interface GigabitEthernet0/0

  WAN description

  IP 172.24.92.18 255.255.255.0

  NAT outside IP

  No virtual-reassembly in ip

  outside the area of security of Member's area

  automatic duplex

  automatic speed

  No mop enabled

  card crypto IPSEC_MAP

  Crypto ipsec df - bit clear

  !

  interface GigabitEthernet0/1

  LAN description

  IP 192.168.100.1 address 255.255.255.0

  IP nat inside

  IP virtual-reassembly in

  Security members in the box area

  automatic duplex

  automatic speed

  !

  IP forward-Protocol ND

  !

  IP http server

  access-class 2 IP http

  local IP http authentication

  IP http secure server

  !

  IP nat inside source map route RMAP_4_PAT interface GigabitEthernet0/0 overload

  IP route 0.0.0.0 0.0.0.0 172.24.92.254

  !

  AH_ACL extended IP access list

  allow a whole ahp

  ALLOW-VPN-TRAFFIC-OUT extended IP access list

  IP 192.168.100.0 allow 0.0.0.255 192.168.1.0 0.0.0.255

  ESP_ACL extended IP access list

  allow an esp

  TELNET_ACL extended IP access list

  permit tcp any any eq telnet

  !

  allowed RMAP_4_PAT 1 route map

  corresponds to the IP 108

  !

  1snmp2use RO SNMP-server community

  access-list 108 deny ip 192.168.100.0 0.0.0.255 192.168.1.0 0.0.0.255

  access-list 108 allow ip 192.168.100.0 0.0.0.255 any

  access-list 126 allow the ip 255.255.255.255 host everything

  access-list 126 allow ip 127.0.0.0 0.255.255.255 everything

  access-list 137 allow ip 172.24.92.0 0.0.0.255 any

  access-list 150 permit ip 192.168.100.0 0.0.0.255 192.168.1.0 0.0.0.255

  access-list 154 allow ip 192.168.1.0 0.0.0.255 192.168.100.0 0.0.0.255

  !

  control plan

  !

  Line con 0

  exec-timeout 0 0

  Synchronous recording

  line to 0

  line 2

  no activation-character

  No exec

  preferred no transport

  transport output pad rlogin lapb - your MOP v120 udptn ssh telnet

  StopBits 1

  line vty 0 4

  access-class TELNET_ACL in

  exec-timeout 0 0

  Synchronous recording

  transport of entry all

  line vty 5 15

  access-class TELNET_ACL in

  exec-timeout 0 0

  Synchronous recording

  transport of entry all

  !

  Scheduler allocate 20000 1000

  0.ca.pool.ntp.org server NTP prefer

  1.ca.pool.ntp.org NTP server

  !

  end

  NAT looks fine.

  Please create an ACL with bidirecctional ACEs and add it as a group of access to the interface of penetration:

  IP access-list extended 180

  IP 192.168.100.0 allow 0.0.0.255 192.168.1.0 0.0.0.255 connect

  ip permit 192.168.1.0 0.0.0.255 192.168.100.0 0.0.0.255 connect

  allow an ip

  interface GigabitEthernet0/1

  IP access-group 180 to

  IP access-group out 180

  Generer generate traffic, then run the command display 180 access lists .

  Also, if possible activate debug ip icmp at the same time.

  Share the results.

  Thank you

• Conflict of IPSec between IPSec and business VPN tunnels

  I crushed a 2821 current c2800nm-adventerprisek9 - mz.124 - 22.YB8 at home with 2 gre IPSec tunnels for personal use, and my office will be held that a customer based IPSec VPN to connect to the corporate VPN.  My problem is that when I want to connect to the corporate VPN, I see packages being encrypted and sent, but I would have never received the return packets.  It seems that the IPSec VPN tunnels with IPSec from my office and router packages conflict trying to decrypt and gives this error.  (I removed the public addresses for anonymity)

  CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec would be package IPSEC a bad spi to destaddr = "myaddress", prot = 50, spi = 0xDB32344E (3677500494), port = "corpvpn".

  When I remove the card encryption off-side WAN router, my Office VPN works immediately.  I can change the configuration, either on the side of the IPSec GRE tunnels, but has no way for me to change any configuration on the corporate VPN.  Does anyone know of a workaround on the cisco router?  I can provide the running configs or view orders.

  The 2821 also performs NAT overload for internet access.

  Hello, Reed.

  1. try to remove the interface crypto map and add "protection... profile ipsec tunnel." "to your VTI:

  Crypto ipsec IPSEC profile

  solid Set trans

  int g0/0

  No crypto map card

  int tu1

  Ipsec IPSEC protection tunnel profile

  int tu2

  Ipsec IPSEC protection tunnel profile

  2. try to force your corpVPN to use encapsulation UDP instead of ESP.

• LRT224 impossible to deal simultaneously with more than one VPN tunnel?

  We have configured a client to gateway VPN tunnel group and six in the tunnels of single user gateway on a LRT224. Each unique connection works perfectly using Shrew soft client. But when we try to connect with a second tunnel, the first tunnel disconnects. It seems that the LRT224 cannot process more than one VPN tunnel at the same time? Is there any configuration, that we would have missed?

  TLR log seem to indicate that the Shrew Soft customers use all 192.168.30.0 that their IP address instead of a random IP address in this range.

  Try to set each Shrew Soft client with a specific IP address in the 192.168.30.1 - 50 rank instead of ' use virtual adapter and address randomly.

• Tunnel from site to site ASA with U turn to config

  Hello

  I have a VPN tunnel site race between ASA 5510 (8.2) and Cisco PIX506 (remote site). I need allow remote users to surf the net. I was looking for in the documentation here and circulation activated to enter/exit the same interface on the ASA (same-security-traffic intra-interface permit), however it still something lack. I don't know how to fix this...

  ASA is configured for NAT inside customers to a single public IP address (VPN tunnel ends also at this interface)

  ASA:

  Global 1 208.x.x.x (outside)
  NAT (inside) - 0 no.-Nat-VPN access list
  NAT (inside) 1 0.0.0.0 0.0.0.0

  So when packets Internet comes through the tunnel, there need be sent on the same interface and NATted (but for the tunnel at work I had to exempt intrested NAT traffic). What is the cause of a problem?

  Hello

  NAT rules should be like this:

  Global 1 208.x.x.x (outside)
  NAT (outside) 1 mask x.x.x.x--> pool VPN

  With the foregoing, you are from the VPN clients out to the Internet.

  You can always leave the SHEEP ACL for the VPN itself traffic.

  Federico.

• Impossible to achieve secondary with VPN tunnel

  Hello

  I configured a Cisco Pix Firewall to my VPN tunnels and which works fine when I connect to the local network where the Pix is connected.

  When I want to communicate with a server on a secondary location over the vpn tunnel I get no response.

  The pix can ping the server, but I can't ping the server via the vpn tunnel rooms

  PIX from IP 10.1.0.254

  Router 10.1.10.254 IP address

  Secondary router IP address 10.2.10.254

  Secondary server IP address 10.2.0.1

  The default gateway on the local network is 10.1.10.254

  This router is a gre tunnel 3 of to 10.2.10.254

  On this router, there is a default route for the pix (for internet).

  Hello...

  Make sure that you send the IP pool configured on the PIX of the secondary router/server. just try to ping the IP address that the VPN client is obtained from the server...

  You must also make sure that you add this subnet secondary access sheep... otherwise list your ip pool will see the natted IP server...

  on sheep access list, allow all traffic from the pool of secondary for the IP pool...

  I hope this helps... all the best...

• Help with a VPN tunnel between ASA 5510 and Juniper SSG20

  Hello

  We have a customer wanting to configure a VPN Site to Site tunnel between a new purchased 5510 of ASA located in his direction with its Juniper SSG20 Office, located in the main office. We contacted HP and they send us a Cisco professional to do the job.

  After 2 days from 16:00 to 22:00 and error and countless hours of research online and nunerous calls, we are still unable to get traffic from the network of agencies to enter the tunnel.

  Main branch
  1.1.1.2                                 1.1.1.1
  -----                                               -----------
  192.168.8.0/24 | ASA|-----------------------------------| Juniper |    192.168.1.0/24
  -----                                               -----------
  192.168.8.254 192.168.1.254

  According to Cisco professionals, the tunnel is now in place but no traffic through. We are unable to ping anything on the network on the other side (192.168.1.0/24). We receive timeout ping all the time. The Cisco professional told us it's a routing or NAT problem and he's working on a solution!

  Through research, I came across a post on Experts-Exchange (here) [the 1st comment on the original post] which States "...". that both sides of the VPN must have a different class of LAN for the VPN to work... " Would that be our problem?

  It has become a critical issue to the point that he had to replace the Cisco ASA with a temporary Juniper SSG5 on another subnet (192.168.7.0/24) to get the tunnel upward and through traffic until the ASA VPN issue is resolved and I didn't need to say that the client is killing us!

  Help is very appreciated.

  Thank you

  1. Yes, ping package from the interface of the ASA is considered valuable traffic to the LAN of Juniper.

  SAA, need you traffic from the interface source ASA's private, because interesting to determine by crypto ACL MYLIST traffic between 192.168.8.0/24 and 192.168.1.0/24.

  You will also need to add the following configuration to be able to get the ping of the interface of the ASA:

  management-private access

  To initiate the ping of the private interface ASA:

  ping 192.168.1.254 private

  2. the default time before the next generation of new key is normally 28800 seconds, and if there is no interesting traffic flowing between 2 subnets, he'll tear the VPN tunnel down. As soon as there is interesting traffic, the VPN tunnel will be built automatically into the next generation of new key. However, if there is traffic before generating a new key, the new tunnel will be established, and VPN tunnel will remain standing and continue encrypt and decrypt traffic.

  Currently, your configuration has been defined with ITS lifetime of 3600 seconds GOLD / 4608000 kilobytes of traffic before the next generate a new key (it will be either 3600 seconds, or 4608000 kilobytes period expires first). You can certainly change it by default to 28800 seconds without configuring kilobytes. SA life is negotiated between the ASA and Juniper, and whatever is the lowest value will be used.

  Hope that helps.

• ASA5505 with 2 VPN tunnels failing to implement the 2nd tunnel

  Hello

  I have an ASA5505 that currently connects a desktop remotely for voip and data.  I added a 2nd site VPN tunnel to a vendor site.  It's this 2nd VPN tunnel that I have problems with.  It seems that the PHASE 1 negotiates well.  However, I'm not a VPN expert!  So, any help would be greatly appreciated.  I have attached the running_config on my box, debug (ipsec & isakmp) information and information about the provider they gave me today.  They use an ASA5510.

  My existing VPN tunnel (which works) is marked 'outside_1_cryptomap '.  It has the following as interesting traffic:

  192.168.1.0/24-> 192.168.3.0/24

  192.168.2.0/24-> 192.168.3.0/24

  10.1.1.0/24-> 192.168.3.0/24

  -> 192.168.3.0/24 10.1.2.0/24

  10.1.10.0/24-> 192.168.3.0/24

  10.2.10.0/24-> 192.168.3.0/24

  The new VPN tunnel (does not work) is labeled "eInfomatics_1_cryptomap".  It has the following as interesting traffic:

  192.168.1.25/32-> 10.10.10.83/32

  192.168.1.25/32-> 10.10.10.47/32

  192.168.1.26/32-> 10.10.10.83/32

  192.168.1.26/32-> 10.10.10.47/32

  Here's the info to other VPN (copy & pasted from the config)

  permit access list extended ip 192.168.1.26 eInfomatics_1_cryptomap host 10.10.10.83

  permit access ip host 192.168.1.25 extended list eInfomatics_1_cryptomap 10.10.10.83

  permit access ip host 192.168.1.25 extended list eInfomatics_1_cryptomap 10.10.10.47

  permit access list extended ip 192.168.1.26 eInfomatics_1_cryptomap host 10.10.10.47

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  life crypto ipsec security association seconds 28800

  Crypto ipsec kilobytes of life - safety 4608000 association

  card crypto outside_map 1 match address outside_1_cryptomap

  peer set card crypto outside_map 1 24.180.14.50

  card crypto outside_map 1 set of transformation-ESP-3DES-SHA

  card crypto outside_map 2 match address eInfomatics_1_cryptomap

  peer set card crypto outside_map 2 66.193.183.170

  card crypto outside_map 2 game of transformation-ESP-3DES-SHA

  outside_map interface card crypto outside

  crypto isakmp identity address

  crypto ISAKMP allow outside

  crypto ISAKMP policy 10

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  tunnel-group 24.180.14.50 type ipsec-l2l

  IPSec-attributes tunnel-group 24.180.14.50

  pre-shared key *.

  tunnel-group 66.193.183.170 type ipsec-l2l

  IPSec-attributes tunnel-group 66.193.183.170

  pre-shared key *.

  Thanks in advance

  -Matt

  Hello

  The seller put a parameter group2 PFS (Perfect Forward Secrecy) of Phase 2, so that you don't have it.

  So you can probalby try adding the following

  card crypto outside_map 2 pfs group2 set

  I think he'll simply enter as

  card crypto outside_map 2 set pfs

  Given that the 'group 2' is the default

  -Jouni