topic Yes it could be an issue with in Network Security

ASA- WARNING: Crypto map has incomplete entries.

sandin.barucic1 — Tue, 12 Mar 2019 07:16:25 GMT

I attempt to crypto map MAP-VPN interface OUTSIDE I receive WARNING: crypto map has incomplete entries. Any recommendation here are the conf

ASA Version 8.4(2)

hostname ciscoasa

names

interface Ethernet0/0

switchport access vlan 2

interface Ethernet0/1

interface Ethernet0/2

interface Ethernet0/3

interface Ethernet0/4

interface Ethernet0/5

interface Ethernet0/6

interface Ethernet0/7

interface Vlan1

nameif inside

security-level 100

ip address 172.16.22.1 255.255.255.0

interface Vlan2

nameif outside

security-level 80

ip address 22.22.22.22 255.255.255.0

route outside 172.16.22.0 255.255.255.0 11.11.11.1 1

access-list ACL-BLUE-VPN extended permit icmp 172.16.22.0 255.255.255.0 192.168.11.0 255.255.255.0

access-list ACL-INSIDE-NONAT extended permit icmp 192.168.11.0 255.255.255.0 172.16.22.0 255.255.255.0

access-list ACL-INSIDE-NONAT extended permit icmp 172.16.22.0 255.255.255.0 192.168.11.0 255.255.255.0

telnet timeout 5

ssh timeout 5

crypto ipsec ikev1 transform-set ESP-AES128-SHA esp-aes esp-sha-hmac

crypto map MAP-VPN 10 match address ACL-BLUE-VPN

crypto map MAP-VPN 10 set peer 11.11.11.11

crypto map MAP-VPN 10 set ikev1 transform-set ESP-AES128-SHA

crypto map MAP-VPN interface outside

crypto ikev1 enable outside

crypto ikev1 policy 15

encr aes

authentication pre-share

group 2

tunnel-group 11.11.11.11 type ipsec-l2l

tunnel-group 11.11.11.11 ipsec-attributes

ikev1 pre-shared-key sekretk3y

It looks ok to me. Maybe try

Philip D'Ath — Thu, 11 Feb 2016 00:18:24 GMT

It looks ok to me. Maybe try adding:

group-policy GroupPolicy_11.11.11.11 internal
group-policy GroupPolicy_11.11.11.11 attributes
  vpn-tunnel-protocol ikev1

tunnel-group 11.11.11.11 general-attributes
  default-group-policy GroupPolicy_11.11.11.11

Hi sandin.barucic1,

Dinesh Moudgil — Thu, 11 Feb 2016 03:39:20 GMT

Hi sandin.barucic1,

Tried the same config and it works in my setup.
Can you try removing "crypto map MAP-VPN interface outside" and re-adding this command and let me know how it fares?

Regards,
Dinesh Moudgil

P.S. Please rate the helpful posts.

is phase 1 getting stuck at

Marius Gunnerud — Thu, 11 Feb 2016 06:56:46 GMT

is phase 1 getting stuck at any stage? issue show crypto isa sa and see. Could be a misconfiguration at the other end.

do a debug to get some more info

debug cry condition peer 11.11.11.11

debug cry ikev1 127

debug cry ipsec 127

post the output here please, preferably in an attached file

Please remember to select a correct answer and rate helpful posts

Just noticed you are missing

Marius Gunnerud — Thu, 11 Feb 2016 07:03:00 GMT

Just noticed you are missing the command:

crypto ikev1 enable outside

Please remember to select a correct answer and rate helpful posts

Hey Dinesh,

sandin.barucic1 — Thu, 11 Feb 2016 14:20:24 GMT

Hey Dinesh,

Thank you for responding i tried removing and reapplying the crypto map MAP-VPN interface outside and it still giving me warring

crypto map has incomplete entries

Morning Marius,

sandin.barucic1 — Thu, 11 Feb 2016 14:23:24 GMT

Morning Marius,

i tried to apply all of the commands above but i am unable to run the debug command on that ASA5505

Cisco Adaptive Security Appliance Software Version 8.4(2)

Device Manager Version 6.4(5)

Hey Philip no go still

sandin.barucic1 — Thu, 11 Feb 2016 14:27:14 GMT

Hey Philip no go still receiving incomplete entries

ASA Version 8.4(2)

hostname ciscoasa

names

interface Ethernet0/0

switchport access vlan 2

interface Ethernet0/1

interface Ethernet0/2

interface Ethernet0/3

interface Ethernet0/4

interface Ethernet0/5

interface Ethernet0/6

interface Ethernet0/7

interface Vlan1

nameif inside

security-level 100

ip address 172.16.22.1 255.255.255.0

interface Vlan2

nameif outside

security-level 80

ip address 22.22.22.22 255.255.255.0

route outside 172.16.22.0 255.255.255.0 11.11.11.1 1

access-list ACL-BLUE-VPN extended permit icmp 172.16.22.0 255.255.255.0 192.168.11.0 255.255.255.0

access-list ACL-INSIDE-NONAT extended permit icmp 192.168.11.0 255.255.255.0 172.16.22.0 255.255.255.0

access-list ACL-INSIDE-NONAT extended permit icmp 172.16.22.0 255.255.255.0 192.168.11.0 255.255.255.0

group-policy GroupPolicy_11.11.11.11 internal

group-policy GroupPolicy_11.11.11.11 attributes

vpn-tunnel-protocol ssl-clientless

telnet timeout 5

ssh timeout 5

crypto ipsec ikev1 transform-set ESP-AES128-SHA esp-aes esp-sha-hmac

crypto map MAP-VPN 10 match address ACL-BLUE-VPN

crypto map MAP-VPN 10 set peer 11.11.11.11

crypto map MAP-VPN 10 set ikev1 transform-set ESP-AES128-SHA

crypto map MAP-VPN interface outside

crypto ikev1 enable outside

crypto ikev1 policy 15

encr aes

authentication pre-share

group 2

tunnel-group 11.11.11.11 type ipsec-l2l

tunnel-group 11.11.11.11 general-attributes

default-group-policy GroupPolicy_11.11.11.11

tunnel-group 11.11.11.11 ipsec-attributes

ikev1 pre-shared-key sekretk3y

Are you able to upgrade to 8

Philip D'Ath — Thu, 11 Feb 2016 18:56:00 GMT

Are you able to upgrade to 8.4(7) ?

I wish, i am using Cisco

sandin.barucic1 — Thu, 11 Feb 2016 19:15:14 GMT

I wish, i am using Cisco packet tracer to replicate possible deployment before i deploy. i tried everything i know.

ciscoasa#sh crypto isakmp sa

There are no IKEv1 SAs

There are no IKEv2 SAs

ciscoasa#sh crypto ip

ciscoasa#sh crypto ipsec sa

There are no ipsec sas

Oh, you didn't say you were

Philip D'Ath — Thu, 11 Feb 2016 19:19:33 GMT

Oh, you didn't say you were using an emulator. It is probably an issue with your emulator. I think the config is fine.

that is what i am starting to

sandin.barucic1 — Thu, 11 Feb 2016 19:24:20 GMT

that is what i am starting to assume as well. i tried everything and nothing seems to be working. Well thank you for your help.

Yes it could be an issue with

Marius Gunnerud — Fri, 12 Feb 2016 22:27:47 GMT

Yes it could be an issue with the emulator. Have you tried building the setup again from scratch?

The debug commands for 8.4 are debug crypto isakmp 127 and debug crypto ipsec 127

Or it might be debug crypto isa sa 127 and debug crypto ipsec sa 127

Please remember to select a correct answer and rate helpful posts