topic Re: Syslog ID 106006 in Network Security

Syslog ID 106006

jjizzle1985 — Tue, 12 Mar 2019 11:18:36 GMT

Hey Guys;

Hopefully I can get some help here with this issue; as my head is spinning around in circles in trying to figure this out; long story short. My friend and I are doing a site 2 site vpn using a 1900 cisco router >>> Cisco Fw >>>> Vpn Net. I believe I have the correct routes on my router and fw; but whenever my friend tests the vpn I keep getting "Deny inbound UDP from ISP/500 to FriendsWan/60710 on interface OUT. I have allowed all ports all interfaces to test routes; but I keep getting the same message as my friend can't vpn connect. Please can someone look over my setup and see where im doing wrong or what can I do to fix this; this is my only project left is vpn setup and this is killing me (lol)...

Please see attachment for Fw and Router

Thanks

Re: Syslog ID 106006

balaji.bandi — Sat, 05 Jan 2019 06:07:48 GMT

looks like one of the device behind NAT.look at this URL and make changes accordingly..

https://packetpushers.net/site-site-ipsec-vpn-nat/

Re: Syslog ID 106006

Mohammed al Baqari — Sat, 05 Jan 2019 09:03:48 GMT

Where is the vpn terminated, on fw or router. If on firewall, did you apply
the crypto map to isp interface and have you enabled isakmp or ikev1 on isp
interface

Re: Syslog ID 106006

jjizzle1985 — Sat, 05 Jan 2019 23:24:28 GMT

Hello;

Could it be possible that my nat is a problem on my firewall; i tried exempting it and it didn't work; i tried enable ip,upd,tcp on all interfaces still doesn't work; but i can always see the traffic when my friend tries vpn connection to me

Thanks

Re: Syslog ID 106006

jjizzle1985 — Sat, 05 Jan 2019 23:22:19 GMT

Hello;
it seems like when my friend starts the vpn connection it dies and ends once its hits my firewall; and only maps i have is on my router to start the initiated vpn.

Thanks