WILL secure IPSec tunnel

Similar Questions

• RV180 dhcp via IPSEC Tunnel

  Hello

  I have set up an ipsec tunnel between rv180 (site A) and asa5520 (site B) successful. The dhcp server to clients is on the B site. The dhcp clients request going through the tunnel, they leave the rv180 on the wan interface and arrive at site B with the wan-ipaddress from site A. The configured dhcp-relay on the website match the remote network (site B), configured in the on site A ipsec tunnel. Is there anyway that all traffic pass through the ipsec tunnel? We want it for security reasons.

  Any help is greatly appreciated.

  Ralf

  Dear Ralf,

  Thank you to reach small business support community.

  Unfortunately the relay DHCP Relay not of DHCP request to the IPSec VPN tunnel.  I hope that this answer to your question and do not hesitate to contact me if there is any additional help with what I can help you.

  Kind regards

  Jeffrey Rodriguez S... : | :. : | :.
  Support Engineer Cisco client

  * Please rate the Post so other will know when an answer has been found.

• Outgoing PAT to the IPSec Tunnel

  Hello

  Situation is with range of IP private tunnel of 3rd party who already uses the same private beach, but not with any of the hosts that we need to connect to. All traffic from the office to the 3rd party must be secure.

  We want to configure an IPSec tunnel between the two sites (easy) and then use PAT on the PIX Office (6.3 (5)) to make all traffic office appear to be a single private address different.

  We tried to do with PDM, but it insists on having no NAT (with an exclusionary rule), or static NAT, but does not seem to allow Pat.

  I have attached a copy sanitized the office configuration. Any standard room in PIX have been removed for brevity

  I would like constructive guidance on where I'm wrong.

  See you soon

  Hello

  The PIX / ASA will make the NAT translation on the steps below. First, it will check if no no (order No. - nat) nat is configured, then it will check the static nat translation and finally, it will check the translation PAT.

  In your configuration, there is a NAT (0) command indicating not to translate any IP of 192.168.0.0 to the remote ip address range, then the PIX won't do the translation and the package is passed to the destination.

  Remove the NAT (0) command and edit list access outside_cryptomap_10 with the ip dried up to the remote ip address for this access list is responsible for interesting traffic that needs to be encrypted.

  pls control and dream of return.

• Problem on the establishment of a GRE/IPsec tunnel between 2 cisco routers

  Hello world

  I am trying to establish a GRE IPsec tunnel between two cisco routers (2620XM and a 836).

  I created a tunnel interfaces on both routers as follows.

  2620XM

  interface Tunnel0

  IP 10.1.5.2 255.255.255.252

  tunnel source x.x.x.x

  tunnel destination y.y.y.y

  end

  836

  interface Tunnel0

  IP 10.1.5.1 255.255.255.252

  tunnel source y.y.y.y

  tunnel destination x.x.x.x

  end

  and configuration of isakmp/ipsec as follows,

  2620XM

  crypto ISAKMP policy 10

  md5 hash

  preshared authentication

  ISAKMP crypto key {keys} address y.y.y.y no.-xauth

  !

  !

  Crypto ipsec transform-set esp - esp-md5-hmac to_melissia

  !

  myvpn 9 ipsec-isakmp crypto map

  defined peer y.y.y.y

  Set transform-set to_melissia

  match address 101

  2620XM-router #sh ip access list 101

  Expand the access IP 101 list

  10 permit host x.x.x.x y.y.y.y host will

  836

  crypto ISAKMP policy 10

  md5 hash

  preshared authentication

  ISAKMP crypto key {keys} address x.x.x.x No.-xauth

  !

  !

  Crypto ipsec transform-set esp - esp-md5-hmac to_metamorfosi

  !

  myvpn 10 ipsec-isakmp crypto map

  defined peer x.x.x.x

  Set transform-set to_metamorfosi

  match address 101

  836-router #sh access list 101

  Expand the access IP 101 list

  10 licences will host host x.x.x.x y.y.y.y

  Unfortunately I had no isakmp security associations at all and when I enter the debugging to this output.

  CRYPTO: IPSEC (crypto_map_check_encrypt_core): CRYPTO: removed package as currently being created cryptomap.

  Any ideas why I get this result? Any help will be a great help

  Thank you!!!

  I think it's possible. It seems to me that you are assuming that the address of the interface where goes the card encryption is peering address. While this is the default action, it is possible to configure it differently.

  As you have discovered the card encryption must be on the physical output interface. If you want the peering address to have a different value of the physical interface address outgoing, then you can add this command to your crypto card:

  card crypto-address

  so if you put loopback0 as the id_interface then he would use loopback0 as peering address even if the card encryption may be affected on serial0/0 or another physical interface.

  HTH

  Rick

• IPSec Tunnel upward, but not accessible from local networks

  Hello

  I have an ASA5520 and a Snapgear. The IPSec tunnel is in place and works very well. But I am not able to access the local LAN on both sides. Here are a few setups:

  SH crypt isakmp his

  Active SA: 1
Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1

1   IKE Peer: 10.10.10.2
Type    : L2L             Role    : responder
Rekey   : no              State   : AM_ACTIVE

  Crypto/isakmp:

  crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto map IPSECTEST_map0 1 match address IPSECTEST_cryptomap
crypto map IPSECTEST_map0 1 set peer 10.10.10.2
crypto map IPSECTEST_map0 1 set transform-set ESP-3DES-SHA
crypto map IPSECTEST_map0 1 set nat-t-disable
crypto map IPSECTEST_map0 1 set phase1-mode aggressive
crypto map IPSECTEST_map0 interface IPSECTEST
crypto isakmp enable outside
crypto isakmp enable IPSECTEST
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 3600

  Route SH:

  C    172.16.3.0 255.255.255.0 is directly connected, VLAN10
C    10.10.10.0 255.255.255.0 is directly connected, IPSECTEST
C    192.168.112.0 255.255.254.0 is directly connected, inside

  access-list:

  IPSECTEST_cryptomap list extended access allowed object-group DM_INLINE_PROTOCOL_1 172.16.3.0 255.255.255.0 object 172.20.20.0

  and here's the scenario:

  

  If I make a ping of the asa to the Remote LAN, I got this:

  ciscoasa (config) # ping 172.20.20.1
  Type to abort escape sequence.
  Send 5, echoes ICMP 100 bytes to 10.172.20.20.1, wait time is 2 seconds:
  No route to the host 172.20.20.1

  Success rate is 0% (0/1)

  No idea what I lack?

  Here's how to set up NAT ASA 8.3 exemption:

  network object obj - 172.16.3.0
  172.16.3.0 subnet 255.255.255.0

  network object obj - 172.20.20.0
  172.20.20.0 subnet 255.255.255.0

  NAT (inside, outside) source static obj - 172.16.3.0 obj - 172.16.3.0 destination static obj - 172.20.20.0 obj - 172.20.20.0

  Here's how it looks to the ASA 8.2 and below:

  Inside_nat0_outbound to access extended list ip 172.16.3.0 allow 255.255.255.0 172.20.20.0 255.255.255.0
  NAT (inside) 0-list of access Inside_nat0_outbound

• IPSec tunnel do not come between two ASA - 5540 s.

  I've included the appropriate configuration of the two ASA lines - 5540 s that I'm trying to set up a tunnel of 2 lan lan between. The first few lines show the messages that are generated when I try to ping another host on each side.

  Did I miss something that will prevent the tunnel to come?

  4 IP = 10.10.1.147, error: cannot delete PeerTblEntry

  3 IP = 10.10.1.147, Removing peer to peer table has not, no match!

  6 IP = 10.10.1.147, P1 retransmit msg sent to the WSF MM

  5 IP is 10.10.1.147, in double Phase 1 detected package. Retransmit the last packet.

  6 IP = 10.10.1.147, P1 retransmit msg sent to the WSF MM

  5 IP is 10.10.1.147, in double Phase 1 detected package. Retransmit the last packet.

  4 IP = 10.10.1.147, error: cannot delete PeerTblEntry

  3 IP = 10.10.1.147, Removing peer to peer table has not, no match!

  6 IP = 10.10.1.147, Queuing KEY-ACQUIRE messages are treated when SA P1 is finished.

  6 IP = 10.10.1.147, Queuing KEY-ACQUIRE messages are treated when SA P1 is finished.

  6 IP = 10.10.1.147, Queuing KEY-ACQUIRE messages are treated when SA P1 is finished.

  5 IP = 10.10.1.147, IKE initiator: New Phase 1, Intf inside, IKE Peer 10.10.1.147 address Proxy local 10.10.1.135, Proxy address remote 10.10.1.155, Card Crypto (outside_map0)

  ROC-ASA5540-A # sh run

  !

  ASA Version 8.0 (3)

  !

  CRO-ASA5540-A host name

  names of

  10.10.1.135 GHC_Laptop description name to test the VPN

  10.10.1.155 SunMed_pc description name to test the VPN

  !

  interface GigabitEthernet0/0

  Speed 100

  full duplex

  nameif inside

  security-level 100

  IP 10.10.1.129 255.255.255.240

  !

  interface GigabitEthernet0/3

  nameif outside

  security-level 0

  IP 10.10.1.145 255.255.255.248

  !

  !

  outside_2_cryptomap list extended access permit ip host host GHC_Laptop SunMed_pc

  !

  ASDM image disk0: / asdm - 603.bin

  !

  Route outside 255.255.255.248 10.10.1.152 10.10.1.147 1

  !

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  card crypto game 2 outside_map0 address outside_2_cryptomap

  outside_map0 crypto map peer set 2 10.10.1.147

  card crypto outside_map0 2 the value transform-set ESP-3DES-SHA

  outside_map0 card crypto 2 set nat-t-disable

  outside_map0 interface card crypto outside

  crypto ISAKMP allow outside

  crypto ISAKMP policy 5

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  !

  Group Policy Lan-2-Lan_only internal

  attributes of Lan-2-Lan_only-group policy

  VPN-filter no

  Protocol-tunnel-VPN IPSec

  tunnel-group 10.10.1.147 type ipsec-l2l

  IPSec-attributes tunnel-group 10.10.1.147

  pre-shared-key *.

  !

  ROC-ASA5540-A #.

  ----------------------------------------------------------

  ROC-ASA5540-B # sh run

  : Saved

  :

  ASA Version 8.0 (3)

  !

  name of host ROC-ASA5540-B

  !

  names of

  name 10.10.1.135 GHC_laptop

  name 10.10.1.155 SunMed_PC

  !

  interface GigabitEthernet0/0

  Speed 100

  full duplex

  nameif inside

  security-level 100

  IP 10.10.1.153 255.255.255.248

  !

  interface GigabitEthernet0/3

  nameif outside

  security-level 0

  IP 10.10.1.147 255.255.255.248

  !

  outside_cryptomap list extended access permit ip host host SunMed_PC GHC_laptop

  !

  ASDM image disk0: / asdm - 603.bin

  !

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  card crypto outside_map2 1 match address outside_cryptomap

  outside_map2 card crypto 1jeu peer 10.10.1.145

  outside_map2 card crypto 1jeu transform-set ESP-3DES-SHA

  outside_map2 card crypto 1jeu nat-t-disable

  outside_map2 interface card crypto outside

  crypto ISAKMP allow inside

  crypto ISAKMP policy 5

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  !

  internal Lan-2-Lan group strategy

  Lan Lan 2-strategy of group attributes

  Protocol-tunnel-VPN IPSec

  tunnel-group 10.10.1.145 type ipsec-l2l

  IPSec-attributes tunnel-group 10.10.1.145

  pre-shared-key *.

  !

  ROC-ASA5540-B #.

  On the ASA of ROC-ASA5540-B, you have "isakmp allows inside", it should be "enable isakmp outside."

  Please reconfigure the ASA and let me know how it goes.

  Kind regards

  Arul

  * Please note the useful messages *.

• Configuration of a timeout for an IPSEC tunnel

  With a VPN connection from site to site between two Cisco 837 s, is it possible that I can set up the IPSEC tunnel to be razed after a period of inactivity and, then, the tunnel is built again when more traffic is passed?

  Hi mitchen

  A sense (but probably not what you're looking for), to "timeout" the IPSEC Session is to use the SA IPSEC-life expectancy.

  If the connection is still required (crypto acl are triggered) the connection will be restored, otherwise it will be demolished.

  HIS life is without delay of inactivity but it is used to "re-authenticate/restore / offer more security" for the IPSEC tunnel on a regular basis.

  With a "Newer" IOS, there is a feature called:

  seconds of downtime ipsec crypto - security association

  This can be created or specified by peers worldwide.

  You will find all the details here:

  http://www.Cisco.com/en/us/partner/products/SW/iosswrel/ps1839/products_feature_guide09186a00801541d4.html#wp1027129

  "Remember messages useful rate."

  Greetings

  Jarle

  Greetings

  Jarle

• IPSec tunnels between duplicate LAN subnets

  Hi all

  Please help to connect three sites with our Central site has all the resources for users, including internet access.

  The three sites will be the ASA 5505 like their WAN device.

  We need to know is - it possible, allowing to configure an IPsec Tunnel between the three ASA with duplicate LAN subnets.

  Central site two networks 192.168.1.x 24, 192.168.100.x 24

  Distance a 24 192.168.1.x subnet

  Two remote a subnet 192.168.100.x 24

  If it is possible we also do hair distance one ping, above two remote to the Central Site to access internet, what sites need are on the Central Site, including e-mail, network, other resource also records.

  We have no other way to make this network, as all security is on our Central Site, website filtering, Application filtering, filtering of network traffic all.

  We understand that we can change two remote sites to a different subnet from the Central Site, but we have so many host devices, it will take weeks or months, so to change the MS AD domain for all users, servers too.

  We really need your expertise to do this in a laboratory and then in production.

  Thank you

  Hello Stephen,

  You can check the following links for the subnets overlap talk to each other:-

  1 LAN-to-LAN IPsec VPN with overlapping networks

  http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a0080b37d0b.shtml

  2 IPsec between two IOS routers with overlapping of private networks

  http://www.Cisco.com/en/us/products/ps5855/products_configuration_example09186a0080a0ece4.shtml

  Important point is local network must connect to the remote network via the translated addresses.

  for example, you won't be ablt to use real IP of the communication.

  For haripinning or turning U:

  http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a00805734ae.shtml

  Hope that helps.

  Kind regards

  Dinesh Moudgil

• Cisco's ASA IPsec tunnel disconnects after a while

  Hi all

  I've set up an IPsec tunnel between sonicwall pro road and cisco ASA 5510. The well established tunnel and two subnets can access each other.

  I then added a static route to a public ip address on the sonicwall ipsec policy, so that all traffic to this ip address will go through the IPsec tunnel. It also works very well.

  But the problem is aftre tunnel Ipsec sometimes breaks down, and then I need to renegotiate the ipsec on sonicwall to restore the tunnel.

  This happens twice a day. I'm whther fear that this behavior is because of problems with config. I'm pasting my ASA running Setup here. Plese give some advice.

  SonicWALL publicip 1.1.1.2 192.168.10.0 subnet

  Cisco ASA publicip 1.1.1.1 subnet 192.168.5.0

  ciscoasa # sh run
  : Saved
  :
  ASA Version 8.2 (1)
  !
  ciscoasa hostname
  domain default.domain.invalid
  activate 8Ry2YjIyt7RRXU24 encrypted password
  2KFQnbNIdI.2KYOU encrypted passwd
  names of
  !
  interface Ethernet0/0
  Speed 100
  full duplex
  nameif outside
  security-level 0
  IP 1.1.1.1 255.255.255.248
  !
  interface Ethernet0/1
  nameif inside
  security-level 100
  192.168.5.1 IP address 255.255.255.0
  !
  interface Ethernet0/2
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface Ethernet0/3
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface Management0/0
  nameif management
  security-level 100
  IP 192.168.1.1 255.255.255.0
  management only
  !
  passive FTP mode
  DNS domain-lookup outside
  DNS lookup field inside
  DNS server-group DefaultDNS
  Server name 66.28.0.45
  Server name 66.28.0.61
  domain default.domain.invalid
  permit same-security-traffic inter-interface
  permit same-security-traffic intra-interface
  object-group service rdp tcp
  EQ port 3389 object
  object-group service tcp OpenVPN
  port-object eq 1194
  access list outside extended permit icmp any any echo response
  access list outside extended permit tcp any host # eq pptp
  outside allowed extended access will list any host #.
  list of extended outside access permit udp any any eq 1701
  extended outdoor access allowed icmp a whole list
  access list outside extended permit tcp any host # eq ftp
  access list outside extended permit tcp any host # eq ssh
  list of extended outside access permit tcp any host # object - group rdp
  turn off journal
  access list outside extended permit tcp any host 1.1.1.1 object - group Open
  VPN
  access-list sheep extended ip 192.168.5.0 allow 255.255.255.0 192.168.5.0 255
  . 255.255.0
  access-list sheep extended ip 192.168.5.0 allow 255.255.255.0 192.168.10.0 255
  . 255.255.0
  L2L 192.168.5.0 ip extended access-list allow 255.255.255.0 192.168.10.0 255.2
  55.255.0
  pager lines 24
  Enable logging
  asdm of logging of information
  Outside 1500 MTU
  Within 1500 MTU
  management of MTU 1500
  IP local pool ippool 192.168.5.131 - 192.168.5.151 mask 255.255.255.0
  IP local pool l2tppool 192.168.5.155 - 192.168.5.200 mask 255.255.255.0
  ICMP unreachable rate-limit 1 burst-size 1
  ASDM image disk0: / asdm - 621.bin
  don't allow no asdm history
  ARP timeout 14400
  Global 1 interface (outside)
  NAT (outside) 1 192.168.10.0 255.255.255.0
  NAT (outside) 1 192.168.5.0 255.255.255.0
  NAT (inside) 0 access-list sheep
  NAT (inside) 1 192.168.5.0 255.255.255.0
  outside access-group in external interface
  Route outside 0.0.0.0 0.0.0.0 38.106.51.121 1
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  dynamic-access-policy-registration DfltAccessPolicy
  the ssh LOCAL console AAA authentication
  AAA authentication LOCAL telnet console
  Enable http server
  http 192.168.1.0 255.255.255.0 management
  http 192.168.5.0 255.255.255.0 inside
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown cold start
  Crypto ipsec transform-set esp-3des esp-sha-hmac RIGHT
  life crypto ipsec security association seconds 28800
  Crypto ipsec kilobytes of life - safety 4608000 association
  Crypto-map dynamic dynmap 5 the value reverse-road
  Crypto easyvpn dynamic-map 10 transform-set RIGHT
  Crypto-map dynamic easyvpn 10 reverse-drive value
  card crypto mymap 10 correspondence address l2l
  card crypto mymap 10 set peer 1.1.1.2
  card crypto mymap 10 transform-set RIGHT
  map mymap 30000-isakmp ipsec crypto dynamic easyvpn
  mymap outside crypto map interface
  crypto isakmp identity address
  crypto ISAKMP allow outside
  crypto ISAKMP policy 10
  preshared authentication
  3des encryption
  md5 hash
  Group 2
  life 86400
  crypto ISAKMP policy 20
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  crypto ISAKMP policy 65535
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  Crypto isakmp nat-traversal 3600
  Telnet 192.168.5.0 255.255.255.0 inside
  Telnet timeout 5
  SSH 0.0.0.0 0.0.0.0 outdoors
  SSH timeout 5
  Console timeout 0
  Hello to tunnel L2TP 10
  management of 192.168.1.2 - dhcpd address 192.168.1.254
  enable dhcpd management
  !
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  WebVPN
  internal DefaultRAGroup group strategy
  attributes of Group Policy DefaultRAGroup
  value of 66.28.0.45 DNS server 66.28.0.61
  Protocol-tunnel-VPN IPSec l2tp ipsec
  field default value cisco.com
  attributes of Group Policy DfltGrpPolicy
  internal band easyvpn strategy
  attributes of the strategy of band easyvpn
  value of 66.28.0.45 DNS server 66.28.0.61
  Protocol-tunnel-VPN IPSec
  enable IPSec-udp
  Split-tunnel-policy tunnelall
  the address value ippool pools
  VPN-group-policy DefaultRAGroup
  attributes global-tunnel-group DefaultRAGroup
  address l2tppool pool
  Group Policy - by default-DefaultRAGroup
  IPSec-attributes tunnel-group DefaultRAGroup
  pre-shared-key *.
  tunnel-group DefaultRAGroup ppp-attributes
  No chap authentication
  ms-chap-v2 authentication
  tunnel-group 1.1.1.2 type ipsec-l2l
  1.1.1.2 tunnel-group ipsec-attributes
  pre-shared-key *.
  tunnel-group easyvpn type remote access
  tunnel-group easyvpn General attributes
  Group Policy - by default-easyvpn
  easyvpn group tunnel ipsec-attributes
  pre-shared-key *.
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the netbios
  inspect the tftp
  inspect the pptp
  !
  global service-policy global_policy
  context of prompt hostname
  Cryptochecksum:5542615c178d2803f764c9b8f104732b
  : end

  I guess you have typo in the configuration of the ASA?

  L2L 192.168.5.0 ip extended access-list allow 255.255.255.0 192.168.10.0 255.255.255.0
  list access extended extended permitted host ip voip pubic ip 192.168.10.0 255.255.255.0

  Can you confirm that you have configured instead the following:

  access-list l2l extended permitted host ip voip pubic ip 192.168.10.0 255.255.255.0

  Moreover, even if the crypto map tag says easyvpn; peer address is correct to point 1.1.1.2

  In addition, don't know why you have the following configuration (but if it is not necessary I suggest to be removed and 'clear xlate' after the withdrawal):

  NAT (outside) 1 192.168.10.0 255.255.255.0

  Finally, pls turn off keepalive to SonicWall.

  If the foregoing still don't resolve the issue, can you try to remove the card dynamic encryption of the ASA (no map mymap 30000-isakmp ipsec crypto dynamic easyvpn), release the tunnel and try to open the tunnel between the ASA and SonicWall and take the exit of "show the isa cry his ' and ' show cry ipsec his» I'm curious to see why he is always referred to the easyvpn crypto map. When you remove the dynamic encryption card, dynamic vpn lan-to-lan of remote access client does not work.

• Cannot reach the destination of an IPSec tunnel through another IPSec tunnel

  Hi all

  I have a PIX 515E version 8.0 (2).

  I have two remote sites connected to this PIX via IPSec tunnels.

  Each remote site can reach local networks behind the PIX, but I can't reach remoteSiteB remoteSiteA.

  Thus,.

  SiteA <----- ipsec="" -----="">PIX1 SiteX <---------------->10.0.8.1 10.30.8.254

  SiteB <----- ipsec="" -----="">PIX1 SiteX <---------------->10.0.8.1 10.138.34.21

  SiteA can ping SiteX

  SiteB can ping SiteX

  SiteA cannot ping SiteB

  SiteB cannot ping SiteA

  If I do not show crypto isakmp ipsec his I see appropriate subnets:

  Tag crypto map: CRYPTO-MAP, seq num: 4, local addr: 203.166.1.1

  permit access-list ACLVPN-TO_SITEA ip 10.138.34.16 255.255.255.240 host 10.30.8.254

  local ident (addr, mask, prot, port): (10.138.34.16/255.255.255.240/0/0)

  Remote ident (addr, mask, prot, port): (10.30.8.254/255.255.255.255/0/0)

  current_peer: 104.86.2.4

  Tag crypto map: CRYPTO-MAP, seq num: 5, local addr: 203.166.1.1

  access-list ACLVPN-TO_SITEB allowed host ip 10.30.8.254 10.138.34.16 255.255.255.240

  local ident (addr, mask, prot, port): (10.30.8.254/255.255.255.255/0/0)

  Remote ident (addr, mask, prot, port): (10.138.34.16/255.255.255.240/0/0)

  current_peer: 216.178.200.200

  Journal messages that seem to point to the problem...

  April 18, 2013 13:27:35: % PIX-4-402116: IPSEC: received a package of ESP (SPI = 0xD51BB13A, sequence number = 0x21A) 104.86.2.4 (user = 104.86.2.4) at 203.166.1.1.  Inside the package décapsulés does not match policy negotiated in the SA.  The package indicates its destination as 10.138.34.21, its source as 10.30.8.254 and its Protocol 6.  SA specifies its local proxy like 10.0.8.0/255.255.255.0/0/0 and his remote_proxy as 10.30.8.254/255.255.255.255/0/0

  My question is really what I have to do something funky to allow traffic to pass between the two tunnels?

  Hello

  This could be much easier if we have seen the real configurations.

  But here are some things to be confirmed in the configurations (some of them you mentioned above, but I still quote once again)

  • Make sure that each firewall, you set the appropriate VPN L2L ACL
  • Make sure that you have configured NAT0 on the central PIX "outside" interface for the Site A and Site B
  • Make sure the Central PIX has "same-security-traffic permit intra-interface" configured. This will allow the Site traffic to enter the Central PIX 'outside' interface and head back on the same interface to Site B. And vice versa.

  To view some actual configurations that may be required provided everything else is ok. (I assume that all devices are Cisco)

  Central PIX

  permit same-security-traffic intra-interface

  A connection to the site

  SITE-A-CRYPTOMAP of the 10.0.8.0 ip access list allow 255.255.255.0 host 10.30.8.254

  SITE-A-CRYPTOMAP of the 10.138.34.16 ip access list allow 255.255.255.240 host 10.30.8.254

  Site B connection

  SITE-B-CRYPTOMAP of the 10.0.8.0 ip access list allow 255.255.255.0 10.138.34.16 255.255.255.240

  SITE-B-CRYPTOMAP to the list of allowed access host ip 10.30.8.254 10.138.34.16 255.255.255.240

  NAT0

  access list for the INTERIOR-NAT0 allowed ip 10.0.8.0 255.255.255.0 host 10.30.8.254

  access list for the INTERIOR-NAT0 allowed ip 10.0.8.0 255.255.255.0 10.138.34.16 255.255.255.240

  NAT (inside) 0-list of access to the INTERIOR-NAT0

  OUTSIDE-NAT0 allowed host ip 10.30.8.254 access list 10.138.34.16 255.255.255.240

  OUTSIDE-NAT0 allowed ip 10.138.34.16 access list 255.255.255.240 host 10.30.8.254

  NAT (outside) 0-list of access OUTSIDE-NAT0

  Site has

  CENTRAL-SITE-CRYPTOMAP to the list of allowed access host ip 10.30.8.254 10.0.8.0 255.255.255.0

  CENTRAL-SITE-CRYPTOMAP to the list of allowed access host ip 10.30.8.254 10.138.34.16 255.255.255.240

  the INTERIOR-NAT0 allowed host ip 10.30.8.254 access list 10.0.8.0 255.255.255.0

  the INTERIOR-NAT0 allowed host ip 10.30.8.254 access list 10.138.34.16 255.255.255.240

  NAT (inside) 0-list of access to the INTERIOR-NAT0

  Site B

  CENTRAL-SITE-CRYPTOMAP of the 10.138.34.16 ip access list allow 255.255.255.240 10.0.8.0 255.255.255.0

  CENTRAL-SITE-CRYPTOMAP of the 10.138.34.16 ip access list allow 255.255.255.240 host 10.30.8.254

  the INTERIOR-NAT0 allowed host ip 10.138.34.16 access list 255.255.255.240 10.0.8.0 255.255.255.0

  the INTERIOR-NAT0 allowed host ip 10.138.34.16 access list 255.255.255.240 host 10.30.8.254

  NAT (inside) 0-list of access to the INTERIOR-NAT0

  Hope this helps

  -Jouni

• ASA5510-CISCO871 DOWN IPSEC TUNNEL

  Help!

  Site between ASA 5510 and 871 ROUTER ipsec tunnel site cannot be established.

  Config and debug info:

  ASA:
  1.1.1.26 external ip address
  1.1.1.254 the gateway ip
  3.3.3.0 LAN network
  3.3.3.250 ip LAN
  3.3.3.20 PC in LAN

  ROUTER 871
  2.2.2.226 external ip address
  2.2.2.225 the gateway ip
  4.4.4.0 network LAN
  4.4.4.254 ip LAN
  4.4.4.28 PC in LAN

  ASA 5510 CONFIG:

  interface Ethernet0/0
  WAN description
  nameif AI_WAN
  security-level 0
  IP 1.1.1.26 255.255.255.248

  interface GigabitEthernet1/0
  network LAN AB Description
  nameif AB_LAN
  security-level 100
  IP 3.3.3.250 255.255.255.0

  Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
  Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
  Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
  Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
  Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
  Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
  Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac
  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
  Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
  life crypto ipsec security association seconds 28800
  Crypto ipsec kilobytes of life - safety 4608000 association

  crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set
  Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
  Crypto than dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 the value reverse-road

  card crypto AI_WAN_map 1 corresponds to the address AI_WAN_1_cryptomap
  card crypto AI_WAN_map 1 set peer 2.2.2.226
  AI_WAN_map 1 transform-set ESP-DES-MD5 crypto card game
  card crypto AI_WAN_map 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
  AI_WAN_map AI_WAN crypto map interface

  ISAKMP crypto enable AI_WAN
  crypto ISAKMP policy 10
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  crypto ISAKMP policy 30
  preshared authentication
  the Encryption
  sha hash
  Group 2
  life 86400
  crypto ISAKMP ipsec-over-tcp port 10000
  crypto ISAKMP disconnect - notify

  Route 0.0.0.0 AI_WAN 0.0.0.0 1.1.1.254
  Route AI_WAN 4.4.4.0 255.255.255.0 2.2.2.226

  AI_WAN_1_cryptomap to access extended list ip 3.3.3.0 allow 255.255.255.0 4.4.4.0 255.255.255.0

  tunnel-group 2.2.2.226 type ipsec-l2l
  tunnel-group 2.2.2.226 General-attributes
  IPSec-attributes tunnel-group 2.2.2.226
  pre-shared key *.

  CONFIG ROUTER 871:

  crypto ISAKMP policy 2
  preshared authentication
  Group 2
  isakmp encryption key * address 1.1.1.26

  Crypto ipsec transform-set esp - esp-md5-hmac des-md5

  map SDM_CMAP_1 1 ipsec-isakmp crypto
  Description Tunnel to1.1.1.26
  defined by peer 1.1.1.26
  the transform-set des-md5 value
  match address 100

  interface FastEthernet4
  IP 2.2.2.226 255.255.255.0
  IP virtual-reassembly
  automatic duplex
  automatic speed
  map SDM_CMAP_1 crypto

  interface Vlan1
  IP 4.4.4.254 255.255.255.0
  IP virtual-reassembly

  IP route 0.0.0.0 0.0.0.0 2.2.2.225
  IP route 3.3.3.0 255.255.255.0 1.1.1.26

  access-list 100 permit ip 4.4.4.0 0.0.0.255 3.3.3.0 0.0.0.255

  DEBUGGING OF ASA 5510

  ciscoasa (config) # 25 Feb 21:58:07 [IKEv1]: IP = 2.2.2.226, IKE_DECODE RECEIPT Message (msgid = 0) with payloads: HDR + SA (1) the SELLER (13) + the SELLER (13), SELLER (13) + (0) NONE total length: 180
  25 FEV 21:58: 07 [IKEv1 DEBUG]: IP = 2.2.2.226, SA payload processing
  25 FEV 21:58: 07 [IKEv1]: Phase 1 failed: Mismatched types of attributes of class Group Description: RRs would be: Cfg 1 group would be: Group 2
  25 FEV 21:58: 07 [IKEv1]: Phase 1 failed: Mismatched types of attributes of class Group Description: RRs would be: Cfg 1 group would be: Group 2
  25 FEV 21:58: 07 [IKEv1]: Phase 1 failed: Mismatched types of attributes of class Group Description: RRs would be: Cfg 1 group would be: Group 2
  25 FEV 21:58: 07 [IKEv1]: Phase 1 failed: Mismatched types of attributes of class Group Description: RRs would be: Cfg 1 group would be: Group 2
  25 FEV 21:58: 07 [IKEv1 DEBUG]: IP = 2.2.2.226, Oakley proposal is acceptable
  25 FEV 21:58: 07 [IKEv1 DEBUG]: IP = 2.2.2.226, payload processing VID
  25 FEV 21:58: 07 [IKEv1 DEBUG]: IP = 2.2.2.226, payload processing VID
  25 FEV 21:58: 07 [IKEv1 DEBUG]: IP = 2.2.2.226, worm received 03 NAT-Traversal, VID
  25 FEV 21:58: 07 [IKEv1 DEBUG]: IP = 2.2.2.226, payload processing VID
  25 FEV 21:58: 07 [IKEv1 DEBUG]: IP = 2.2.2.226, received NAT-Traversal worm 02 VID
  25 FEV 21:58: 07 [IKEv1 DEBUG]: IP = 2.2.2.226, IKE SA payload processing
  25 FEV 21:58: 07 [IKEv1]: Phase 1 failed: Mismatched types of attributes of class Group Description: RRs would be: Cfg 1 group would be: Group 2
  25 FEV 21:58: 07 [IKEv1]: Phase 1 failed: Mismatched types of attributes of class Group Description: RRs would be: Cfg 1 group would be: Group 2
  25 FEV 21:58: 07 [IKEv1]: Phase 1 failed: Mismatched types of attributes of class Group Description: RRs would be: Cfg 1 group would be: Group 2
  25 FEV 21:58: 07 [IKEv1]: Phase 1 failed: Mismatched types of attributes of class Group Description: RRs would be: Cfg 1 group would be: Group 2
  25 FEV 21:58: 07 [IKEv1 DEBUG]: IP = 2.2.2.226, IKE SA proposal # 1, turn # 1 entry overall IKE acceptable matches # 4
  25 FEV 21:58: 07 [IKEv1 DEBUG]: IP = 2.2.2.226, build the payloads of ISAKMP security
  25 FEV 21:58: 07 [IKEv1 DEBUG]: IP = 2.2.2.226, constructing the payload of the NAT-Traversal VID ver 02
  25 FEV 21:58: 07 [IKEv1 DEBUG]: IP = 2.2.2.226, construction of Fragmentation VID + load useful functionality
  25 FEV 21:58: 07 [IKEv1]: IP = 2.2.2.226, IKE_DECODE SEND Message (msgid = 0) with payloads: HDR, HIS (1), SELLER (13) of the SELLER (13) + (0) NONE total length: 128
  25 FEV 21:58: 15 [IKEv1]: IP = 2.2.2.226, IKE_DECODE new SEND Message (msgid = 0) with payloads: HDR, HIS (1), SELLER (13) of the SELLER (13) + (0) NONE total length: 128
  25 FEV 21:58: 17 [IKEv1]: IP = 2.2.2.226, first detected duplicate package.  Ignoring the package.
  25 FEV 21:58: 23 [IKEv1]: IP = 2.2.2.226, IKE_DECODE new SEND Message (msgid = 0) with payloads: HDR, HIS (1), SELLER (13) of the SELLER (13) + (0) NONE total length: 128
  25 FEV 21:58: 27 [IKEv1]: IP = 2.2.2.226, first detected duplicate package.  Ignoring the package.
  25 FEV 21:58: 31 [IKEv1]: IP = 2.2.2.226, IKE_DECODE new SEND Message (msgid = 0) with payloads: HDR, HIS (1), SELLER (13) of the SELLER (13) + (0) NONE total length: 128
  25 FEV 21:58: 37 [IKEv1]: IP = 2.2.2.226, first detected duplicate package.  Ignoring the package.
  25 FEV 21:58: 39 [IKEv1 DEBUG]: IP = 2.2.2.226, case of mistaken IKE MM Responder WSF (struct & 0xadb2fdf8) , : MM_DONE, EV_ERROR--> MM_WAIT_MSG3, EV_TIMEOUT--> MM_WAIT_MSG3 NullEvent--> MM_SND_MSG2, EV_SND_MSG--> MM_SND_MSG2, EV_START_TMR--> MM_SND_MSG2, EV_RESEND_MSG--> MM_WAIT_MSG3, EV_TIMEOUT--> MM_WAIT_MSG3, NullEvent
  25 FEV 21:58: 39 [IKEv1 DEBUG]: IP = 2.2.2.226, IKE SA MM:8d4057b1 ending: flags 0 x 01000002, refcnt 0, tuncnt 0
  25 FEV 21:58: 39 [IKEv1 DEBUG]: IP = 2.2.2.226, sending clear/delete with the message of reason
  25 FEV 21:58: 47 [IKEv1]: IP = 2.2.2.226, IKE_DECODE RECEIPT Message (msgid = 0) with payloads: HDR + SA (1) the SELLER (13) + the SELLER (13), SELLER (13) + (0) NONE total length: 180
  25 FEV 21:58: 47 [IKEv1 DEBUG]: IP = 2.2.2.226, SA payload processing
  25 FEV 21:58: 47 [IKEv1]: Phase 1 failed: Mismatched types of attributes of class Group Description: RRs would be: Cfg 1 group would be: Group 2
  25 FEV 21:58: 47 [IKEv1]: Phase 1 failed: Mismatched types of attributes of class Group Description: RRs would be: Cfg 1 group would be: Group 2
  25 FEV 21:58: 47 [IKEv1]: Phase 1 failed: Mismatched types of attributes of class Group Description: RRs would be: Cfg 1 group would be: Group 2
  25 FEV 21:58: 47 [IKEv1]: Phase 1 failed: Mismatched types of attributes of class Group Description: RRs would be: Cfg 1 group would be: Group 2
  25 FEV 21:58: 47 [IKEv1 DEBUG]: IP = 2.2.2.226, Oakley proposal is acceptable
  25 FEV 21:58: 47 [IKEv1 DEBUG]: IP = 2.2.2.226, payload processing VID
  25 FEV 21:58: 47 [IKEv1 DEBUG]: IP = 2.2.2.226, payload processing VID
  25 FEV 21:58: 47 [IKEv1 DEBUG]: IP = 2.2.2.226, worm received 03 NAT-Traversal, VID
  25 FEV 21:58: 47 [IKEv1 DEBUG]: IP = 2.2.2.226, payload processing VID
  25 FEV 21:58: 47 [IKEv1 DEBUG]: IP = 2.2.2.226, received NAT-Traversal worm 02 VID
  25 FEV 21:58: 47 [IKEv1 DEBUG]: IP = 2.2.2.226, IKE SA payload processing
  25 FEV 21:58: 47 [IKEv1]: Phase 1 failed: Mismatched types of attributes of class Group Description: RRs would be: Cfg 1 group would be: Group 2
  25 FEV 21:58: 47 [IKEv1]: Phase 1 failed: Mismatched types of attributes of class Group Description: RRs would be: Cfg 1 group would be: Group 2
  25 FEV 21:58: 47 [IKEv1]: Phase 1 failed: Mismatched types of attributes of class Group Description: RRs would be: Cfg 1 group would be: Group 2
  25 FEV 21:58: 47 [IKEv1]: Phase 1 failed: Mismatched types of attributes of class Group Description: RRs would be: Cfg 1 group would be: Group 2
  25 FEV 21:58: 47 [IKEv1 DEBUG]: IP = 2.2.2.226, IKE SA proposal # 1, turn # 1 entry overall IKE acceptable matches # 4
  25 FEV 21:58: 47 [IKEv1 DEBUG]: IP = 2.2.2.226, build the payloads of ISAKMP security
  25 FEV 21:58: 47 [IKEv1 DEBUG]: IP = 2.2.2.226, constructing the payload of the NAT-Traversal VID ver 02
  25 FEV 21:58: 47 [IKEv1 DEBUG]: IP = 2.2.2.226, construction of Fragmentation VID + load useful functionality
  25 FEV 21:58: 47 [IKEv1]: IP = 2.2.2.226, IKE_DECODE SEND Message (msgid = 0) with payloads: HDR, HIS (1), SELLER (13) of the SELLER (13) + (0) NONE total length: 128
  25 FEV 21:58: 55 [IKEv1]: IP = 2.2.2.226, IKE_DECODE new SEND Message (msgid = 0) with payloads: HDR, HIS (1), SELLER (13) of the SELLER (13) + (0) NONE total length: 128
  25 FEV 21:58: 57 [IKEv1]: IP = 2.2.2.226, first detected duplicate package.  Ignoring the package.
  25 FEV 21:59: 03 [IKEv1]: IP = 2.2.2.226, IKE_DECODE new SEND Message (msgid = 0) with payloads: HDR, HIS (1), SELLER (13) of the SELLER (13) + (0) NONE total length: 128
  25 FEV 21:59: 11 [IKEv1]: IP = 2.2.2.226, IKE_DECODE new SEND Message (msgid = 0) with payloads: HDR, HIS (1), SELLER (13) of the SELLER (13) + (0) NONE total length: 128
  25 FEV 21:59: 19 [IKEv1 DEBUG]: IP = 2.2.2.226, case of mistaken IKE MM Responder WSF (struct & 0xadb2fdf8) , : MM_DONE, EV_ERROR--> MM_WAIT_MSG3, EV_TIMEOUT--> MM_WAIT_MSG3 NullEvent--> MM_SND_MSG2, EV_SND_MSG--> MM_SND_MSG2, EV_START_TMR--> MM_SND_MSG2, EV_RESEND_MSG--> MM_WAIT_MSG3, EV_TIMEOUT--> MM_WAIT_MSG3, NullEvent
  25 FEV 21:59: 19 [IKEv1 DEBUG]: IP = 2.2.2.226, IKE SA MM:7622 has 639 ending: flags 0 x 01000002, refcnt 0, tuncnt 0
  25 FEV 21:59: 19 [IKEv1 DEBUG]: IP = 2.2.2.226, sending clear/delete with the message of reason

  DEBUGGING OF 871 ROUTER

  871_router #debu cry isa
  871_router #ping 3.3.3.20 4.4.4.254 source

  Type to abort escape sequence.
  Send 5, echoes ICMP 100 bytes to 3.3.3.20, wait time is 2 seconds:
  Packet sent with a source address of 4.4.4.254

  Feb 25 21:58:06.799: ISAKMP: (0): profile of THE request is (NULL)
  21:58:06.799 25 Feb: ISAKMP: created a struct peer 1.1.1.26, peer port 500
  21:58:06.799 25 Feb: ISAKMP: new position created post = 0x834B2AB4 peer_handle = 0x8000000C
  21:58:06.799 25 Feb: ISAKMP: lock struct 0x834B2AB4, refcount 1 to peer isakmp_initiator
  21:58:06.799 25 Feb: ISAKMP: 500 local port, remote port 500
  21:58:06.799 25 Feb: ISAKMP: set new node 0 to QM_IDLE
  25 Feb 21:58:06.799: insert his with his 83476114 = success
  21:58:06.799 25 Feb: ISAKMP: (0): cannot start aggressive mode, try the main mode.
  21:58:06.799 25 Feb: ISAKMP: (0): pair found pre-shared key matching 1.1.1.26
  Feb 25 21:58:06.799: ISAKMP: (0): built the seller-07 ID NAT - t
  Feb 25 21:58:06.799: ISAKMP: (0): built of NAT - T of the seller-03 ID
  Feb 25 21:58:06.799: ISAKMP: (0): built the seller-02 ID NAT - t
  21:58:06.799 25 Feb: ISAKMP: (0): entry = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
  21:58:06.799 25 Feb: ISAKMP: (0): former State = new State IKE_READY = IKE._I_MM1

  Feb 25 21:58:06.803: ISAKMP: (0): Beginner Main Mode Exchange
  Feb 25 21:58:06.803: ISAKMP: (0): lot of 1.1.1.26 sending my_port 500 peer_port 500 (I) MM_NO_STATE...
  Success rate is 0% (0/5)
  Sokuluk #.
  Feb 25 21:58:16.803: ISAKMP: (0): transmit phase 1 MM_NO_STATE...
  21:58:16.803 25 Feb: ISAKMP (0:0): increment the count of errors on his, try 1 5: retransmit the phase 1
  Feb 25 21:58:16.803: ISAKMP: (0): transmit phase 1 MM_NO_STATE
  Feb 25 21:58:16.803: ISAKMP: (0): lot of 1.1.1.26 sending my_port 500 peer_port 500 (I) MM_NO_STATE
  Feb 25 21:58:26.803: ISAKMP: (0): transmit phase 1 MM_NO_STATE...
  21:58:26.803 25 Feb: ISAKMP (0:0): increment the count of errors on his, try 2 of 5: retransmit the phase 1
  Feb 25 21:58:26.803: ISAKMP: (0): transmit phase 1 MM_NO_STATE
  Feb 25 21:58:26.803: ISAKMP: (0): lot of 1.1.1.26 sending my_port 500 peer_port 500 (I) MM_NO_STATE
  21:58:36.799 25 Feb: ISAKMP: set new node 0 to QM_IDLE
  21:58:36.799 25 Feb: ISAKMP: (0): SA is still budding. Attached new request ipsec. (2.2.2.226 local 1.1.1.26 remote)
  21:58:36.799 25 Feb: ISAKMP: error during the processing of HIS application: failed to initialize SA
  21:58:36.799 25 Feb: ISAKMP: error while processing message KMI 0, error 2.
  Feb 25 21:58:36.803: ISAKMP: (0): transmit phase 1 MM_NO_STATE...
  21:58:36.803 25 Feb: ISAKMP (0:0): increment the count of errors on his, try 3 of 5: retransmit the phase 1
  Feb 25 21:58:36.803: ISAKMP: (0): transmit phase 1 MM_NO_STATE
  Feb 25 21:58:36.803: ISAKMP: (0): lot of 1.1.1.26 sending my_port 500 peer_port 500 (I) MM_NO_STATE
  Feb 25 21:58:46.803: ISAKMP: (0): transmit phase 1 MM_NO_STATE...
  21:58:46.803 25 Feb: ISAKMP (0:0): increment the count of errors on his, try 4 out 5: retransmit the phase 1
  Feb 25 21:58:46.803: ISAKMP: (0): transmit phase 1 MM_NO_STATE
  Feb 25 21:58:46.803: ISAKMP: (0): lot of 1.1.1.26 sending my_port 500 peer_port 500 (I) MM_NO_STATE
  Feb 25 21:58:56.803: ISAKMP: (0): transmit phase 1 MM_NO_STATE...
  21:58:56.803 25 Feb: ISAKMP (0:0): increment the count of errors on his, try 5 of 5: retransmit the phase 1
  Feb 25 21:58:56.803: ISAKMP: (0): transmit phase 1 MM_NO_STATE
  Feb 25 21:58:56.803: ISAKMP: (0): lot of 1.1.1.26 sending my_port 500 peer_port 500 (I) MM_NO_STATE
  21:59:06.799 25 Feb: ISAKMP: (0): the peer is not paranoid KeepAlive.

  21:59:06.799 25 Feb: ISAKMP: (0): removal of reason HIS State "P1 remove notification (en)" (I) MM_NO_STATE (post 1.1.1.26)
  21:59:06.799 25 Feb: ISAKMP: (0): removal of reason HIS State "P1 remove notification (en)" (I) MM_NO_STATE (post 1.1.1.26)
  21:59:06.799 25 Feb: ISAKMP: Unlocking counterpart struct 0x834B2AB4 for isadb_mark_sa_deleted(), count 0
  21:59:06.799 25 Feb: ISAKMP: delete peer node by peer_reap for 1.1.1.26: 834B2AB4
  21:59:06.799 25 Feb: ISAKMP: (0): node-254301187 error suppression FALSE reason 'IKE deleted.
  21:59:06.799 25 Feb: ISAKMP: (0): node-1584635621 error suppression FALSE reason 'IKE deleted.
  21:59:06.799 25 Feb: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
  21:59:06.799 25 Feb: ISAKMP: (0): former State = new State IKE_I_MM1 = IKE_DEST_SA

  Here is the download page for 871 router - IOS 12.4 (15) T14:

  http://www.Cisco.com/Cisco/software/release.html?mdfid=279624003&dvdid=279978467&flowid=8212&softwareid=280805680&release=12.4.15T14&rellifecycle=MD&relind=available&RelType=all

  However, you will need to have Smartnet contract and your link of CEC account to the contract in order to download the software.

• Error 1079: The account specified for this service is different from the account specified for other services running in the same process. When you attempt to start the Secure Socket Tunneling Protocol

  I try to use my verizon air card, a PC770; VZ Access Manager version 7.2.7.1 recognizes the card very well, but whenever I try to "connect WWAN" I get the following message - "failed to connect - connection not available." Through the verizon forums, I trace this error to the 'Remote Access Connection eating' service that is not started. I try to start this service and receive error 1068: the dependency service or group could start. I have check the Dependencies tab and see Secure Socket Tunneling Protocol. When I go to this service, I see that it is not started, try to start this service result in error in my, title = error 1079.

  I saw many others issues related to the error code 1079, but nothing that she wears on the SSTP service.

  How can I fix it or what additional information is required to help diagnose?  Regards, Paul

  Bud13:
  Dude... May want to lay off the crack for a while before this extreme paranoia Gets the best of you...

  To the OP:

  Just go to the properties of the service you are trying to start, then select "this account".  Browse your computer and find the "Local Service" account  Clear the password so that it is empty and apply.  You will get a dialog box indicating that the account has been given to the connection as a good service.  Then start your service.  This should solve your problem.  I have seen this question many times and there are many, many reasons why it could have happened, but there is nothing to worry.

• can I change the IKE, transform together... without affecting IPSEC tunnels?

  Hello

  In the production network, I can change the IPSEC settings, e.g. time of HIS life, pre-shared key, etc...? They will affect the tunnels?

  You can change them, they will not be used until the tunnel is rebuilt (hourly by default for SA Phase 2 and every 24 hours for Phase 1). Make sure that you change them on both sides of the tunnel well so that they match.

• IPSec Tunnel permanent between two ASA

  Hello

  I configured a VPN IPSec tunnel between two ASA 5505 firewall. I want to assure you as the IPSec tunnel (this is why the security association) is permanent and do not drop due to the idle state.

  What should I do?

  Thanks for any help

  Yves

  Disables keepalive IKE processing, which is enabled by default.

  (config) #tunnel - 10.165.205.222 group ipsec-attributes

  KeepAlive (ipsec-tunnel-config) #isakmp disable

  Set a maximum time for VPN connections with the command of vpn-session-timeout in group policy configuration mode or username configuration mode:

  attributes of hostname (config) #-Group Policy DfltGrpPolicy
  hostname (Group Policy-config) #vpn - idle - timeout no

  attributes of hostname (config) #-Group Policy DfltGrpPolicy
  hostname (Group Policy-config) #vpn - session - timeout no

  Thank you

  Ajay

• IPSEC tunnels does not connect

  Out of sudden IPSEC tunnel on remote site 202.68.211.20 is not plug in. Previously is OK. There is no change in config.

  IKE Phase 1 even not connect.

  I'm debugging, but I don't know what could be the error.

  -----------------------------------------------------------------------------

  = ~ = ~ = ~ = ~ = ~ = ~ = ~ = ~ = ~ = ~ = ~ = PuTTY connect 2016.05.12 15:19:36 = ~ = ~ = ~ = ~ = ~ = ~ = ~ = ~ = ~ = ~ = ~ =.
  12 May 12:06:50 [IKEv1 DEBUG]: pitcher: a message key acquisition, spi 0 x 0
  12 May 12:06:50 [IKEv1]: IP = 202.68.211.20, Queuing KEY-ACQUIRE messages are treated when SA P1 is finished.
  12 May 12:06:53 [IKEv1 DEBUG]: pitcher: a message key acquisition, spi 0 x 0
  12 May 12:06:53 [IKEv1]: IP = 202.68.211.20, Queuing KEY-ACQUIRE messages are treated when SA P1 is finished.
  12 May 12:06:54 [IKEv1 DEBUG]: IP = 202.68.211.20, case of mistaken IKE MM Initiator WSF (struct & 0xd84aff40) , : MM_DONE, EV_ERROR--> MM_WAIT_MSG2, EV_RETRY--> MM_WAIT_MSG2, EV_TIMEOUT--> MM_WAIT_MSG2 NullEvent--> MM_SND_MSG1, EV_SND_MSG--> MM_SND_MSG1, EV_START_TMR--> MM_SND_MSG1, EV_RESEND_MSG--> MM_WAIT_MSG2, EV_RETRY
  12 May 12:06:54 [IKEv1 DEBUG]: IP = 202.68.211.20, IKE SA MM:914f04ce ending: flags 0 x 01000022, refcnt 0, tuncnt 0
  12 May 12:06:54 [IKEv1 DEBUG]: IP = 202.68.211.20, sending clear/delete with the message of reason
  12 May 12:06:59 [IKEv1 DEBUG]: pitcher: a message key acquisition, spi 0 x 0
  12 May 12:06:59 [IKEv1]: IP = 202.68.211.20, initiator of IKE: New Phase 1, Intf internal, IKE Peer 202.68.211.20 address proxy local 10.215.20.0 address remote Proxy 10.210.0.0, Card Crypto (VPN_map)
  12 May 12:06:59 [IKEv1 DEBUG]: IP = 202.68.211.20, build the payloads of ISAKMP security
  12 May 12:06:59 [IKEv1 DEBUG]: IP = 202.68.211.20, construction of Fragmentation VID + load useful functionality
  12 May 12:06:59 [IKEv1]: IP = 202.68.211.20, IKE_DECODE SEND Message (msgid = 0) with payloads: HDR + HER (1), SELLER (13) + (0) NONE total length: 112
  12 May 12:07 [IKEv1 DEBUG]: pitcher: a message key acquisition, spi 0 x 0
  12 May 12:07 [IKEv1]: IP = 202.68.211.20, Queuing KEY-ACQUIRE messages are treated when SA P1 is finished.
  12 May 12:07:03 [IKEv1 DEBUG]: pitcher: a message key acquisition, spi 0 x 0
  12 May 12:07:03 [IKEv1]: IP = 202.68.211.20, Queuing KEY-ACQUIRE messages are treated when SA P1 is finished.
  12 May 12:07:07 [IKEv1]: IP = 202.68.211.20, IKE_DECODE new SEND Message (msgid = 0) with payloads: HDR + HER (1), SELLER (13) + (0) NONE total length: 112
  12 May 12:07:09 [IKEv1 DEBUG]: pitcher: a message key acquisition, spi 0 x 0
  12 May 12:07:09 [IKEv1]: IP = 202.68.211.20, Queuing KEY-ACQUIRE messages are treated when SA P1 is finished.
  12 May 12:07:15 [IKEv1]: IP = 202.68.211.20, IKE_DECODE new SEND Message (msgid = 0) with payloads: HDR + HER (1), SELLER (13) + (0) NONE total length: 112
  12 May 12:07:23 [IKEv1]: IP = 202.68.211.20, IKE_DECODE new SEND Message (msgid = 0) with payloads: HDR + HER (1), SELLER (13) + (0) NONE total length: 112
  12 May 12:07:31 [IKEv1 DEBUG]: IP = 202.68.211.20, case of mistaken IKE MM Initiator WSF (struct & 0xd8457958) , : MM_DONE, EV_ERROR--> MM_WAIT_MSG2, EV_RETRY--> MM_WAIT_MSG2, EV_TIMEOUT--> MM_WAIT_MSG2 NullEvent--> MM_SND_MSG1, EV_SND_MSG--> MM_SND_MSG1, EV_START_TMR--> MM_SND_MSG1, EV_RESEND_MSG--> MM_WAIT_MSG2, EV_RETRY
  12 May 12:07:31 [IKEv1 DEBUG]: IP = 202.68.211.20, IKE SA MM:be63ea64 ending: flags 0 x 01000022, refcnt 0, tuncnt 0
  12 May 12:07:31 [IKEv1 DEBUG]: IP = 202.68.211.20, sending clear/delete with the message of reason
  12 May 12:07:37 [IKEv1 DEBUG]: pitcher: a message key acquisition, spi 0 x 0
  12 May 12:07:37 [IKEv1]: IP = 202.68.211.20, initiator of IKE: New Phase 1, Intf internal, IKE Peer 202.68.211.20 address proxy local 10.215.20.0 address remote Proxy 10.210.0.0, Card Crypto (VPN_map)
  12 May 12:07:37 [IKEv1 DEBUG]: IP = 202.68.211.20, build the payloads of ISAKMP security
  12 May 12:07:37 [IKEv1 DEBUG]: IP = 202.68.211.20, construction of Fragmentation VID + load useful functionality
  12 May 12:07:37 [IKEv1]: IP = 202.68.211.20, IKE_DECODE SEND Message (msgid = 0) with payloads: HDR + HER (1), SELLER (13) + (0) NONE total length: 112
  12 May 12:07:40 [IKEv1 DEBUG]: pitcher: a message key acquisition, spi 0 x 0
  12 May 12:07:40 [IKEv1]: IP = 202.68.211.20, Queuing KEY-ACQUIRE messages are treated when SA P1 is finished.
  12 May 12:07:45 [IKEv1]: IP = 202.68.211.20, IKE_DECODE new SEND Message (msgid = 0) with payloads: HDR + HER (1), SELLER (13) + (0) NONE total length: 112
  12 May 12:07:46 [IKEv1 DEBUG]: pitcher: a message key acquisition, spi 0 x 0
  12 May 12:07:46 [IKEv1]: IP = 202.68.211.20, Queuing KEY-ACQUIRE messages are treated when SA P1 is finished.
  12 May 12:07:53 [IKEv1]: IP = 202.68.211.20, IKE_DECODE new SEND Message (msgid = 0) with payloads: HDR + HER (1), SELLER (13) + (0) NONE total length: 112
  q

  Hello

  It seems that the tunnel is blocked to MSG_2.

  You can check if the UDP 500 traffic is not blocked between peers?

  Please check with your provider.

  Kind regards

  Aditya

  Please evaluate the useful messages and mark the correct answers.