SSH inside network on other end of L2L VPN not working

BrianEschen — Tue, 12 Mar 2019 04:51:03 GMT

I cant get SSH access working for the inside interface on the other end of the L2L tunnel. I also cant SSH into any of my Switches. I cant ping either interface but I can ping the phones on the other end. I am not even close to sure what I am missing for this to work..

RandomHostName# sho run
: Saved
:
ASA Version 9.1(2)8
!
hostname RandomHostname
domain-name random.domain.name
enable password blahblahblahblah12345 encrypted
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
passwd blahblahblahblah12345 encrypted
names
!
interface Ethernet0/0
switchport access vlan 999
!
interface Ethernet0/1
switchport access vlan 582
!
interface Ethernet0/2
switchport access vlan 311
!
interface Ethernet0/3
shutdown
!
interface Ethernet0/4
shutdown
!
interface Ethernet0/5
shutdown
!
interface Ethernet0/6
shutdown
!
interface Ethernet0/7
switchport access vlan 321
!
interface Vlan1
no nameif
no security-level
no ip address
!
interface Vlan582
nameif OUTSIDE
security-level 0
ip address 192.168.1.1 255.255.255.0 standby 192.168.1.2
!
interface Vlan999
description LAN Failover Interface
!
interface Vlan321
nameif INSIDE-Phones
security-level 100
ip address 10.129.0.1 255.255.255.0 standby 10.129.0.2
!
boot system disk0:/asa912-8-k8.bin
ftp mode passive
dns server-group DefaultDNS
domain-name test.com
object network InsidePhones
subnet 10.129.0.0 255.255.255.0
access-list tunnel_all extended permit ip 10.129.0.0 255.255.255.0 any4
pager lines 24
logging enable
logging buffer-size 8182
logging buffered debugging
logging asdm informational
mtu OUTSIDE 1500
mtu INSIDE-Phones 1500
failover
failover lan unit primary
failover lan interface failover-int Vlan999
failover interface ip failover-int 10.129.20.1 255.255.255.0 standby 10.129.20.2
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-715.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
route OUTSIDE 0.0.0.0 0.0.0.0 192.168.0.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server admin protocol radius
aaa-server admin (OUTSIDE) host 192.168.50.1
key *****
authentication-port 1812
accounting-port 1813
aaa-server admin (OUTSIDE) host 192.168.50.2
key *****
authentication-port 1812
accounting-port 1813
aaa-server vpn protocol radius
aaa-server vpn (OUTSIDE) host 192.168.50.1
key *****
aaa-server vpn (OUTSIDE) host 192.168.50.2
key *****
aaa-server RADIUS protocol radius
aaa-server RADIUS (OUTSIDE) host 192.168.50.1
key *****
authentication-port 1812
accounting-port 1813
aaa-server RADIUS (OUTSIDE) host 192.168.50.2
key *****
authentication-port 1812
accounting-port 1813
user-identity default-domain LOCAL
aaa authentication http console RADIUS LOCAL
aaa authentication serial console RADIUS LOCAL
aaa authentication ssh console RADIUS LOCAL
aaa accounting enable console RADIUS
aaa accounting ssh console RADIUS
aaa authorization exec authentication-server
http server enable
http 10.129.30.0 255.255.255.0 OUTSIDE
http 10.129.10.0 255.255.255.0 OUTSIDE
http 192.168.50.1 255.255.255.0 OUTSIDE
http 10.129.10.0 255.255.255.0 INSIDE-Phones
http 10.129.1.0 255.255.255.0 INSIDE-Phones
http redirect OUTSIDE 80
no snmp-server location
no snmp-server contact
crypto ipsec ikev2 ipsec-proposal ESP-AES-256-SHA
protocol esp encryption aes-256
protocol esp integrity sha-1
crypto ipsec security-association pmtu-aging infinite
crypto map outside_map 1 match address tunnel_all
crypto map outside_map 1 set peer 192.168.50.1
crypto map outside_map 1 set ikev2 ipsec-proposal ESP-AES-256-SHA
crypto map outside_map interface OUTSIDE
crypto ca trustpool policy
crypto isakmp identity address
crypto ikev2 policy 10
encryption aes-256
integrity sha
group 2
prf sha
lifetime seconds 86400
crypto ikev2 enable OUTSIDE
telnet timeout 5
ssh 10.129.10.0 255.255.255.0 OUTSIDE
ssh 192.168.50.1 255.255.255.0 OUTSIDE
ssh 10.129.1.0 255.255.255.0 OUTSIDE
ssh 10.129.1.0 255.255.255.0 INSIDE-Phones
ssh 192.168.50.1 255.255.255.0 INSIDE-Phones
ssh 10.129.10.0 255.255.255.0 INSIDE-Phones
ssh timeout 60
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 0

dhcpd dns 192.168.50.1 192.168.50.2
dhcpd domain contoso.net
dhcpd option 150 ip 10.129.100.12 10.129.70.50
dhcpd option 3 ip 10.129.1.1
!
dhcpd address 10.129.1.10-10.129.1.254 INSIDE-Phones
dhcpd enable INSIDE-Phones
!
dhcprelay timeout 60
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 192.168.50.1
ntp server 192.168.50.1 prefer
username LukeSkywalker password pBoKSJVICSq encrypted privilege 15
tunnel-group 192.168.50.1 type ipsec-l2l
tunnel-group 192.168.50.2 ipsec-attributes
ikev2 remote-authentication pre-shared-key *****
ikev2 local-authentication pre-shared-key *****
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:23239ba79ec5f2de8c11d850e7087c57
: end

I figured out the SSH by

BrianEschen — Wed, 01 Oct 2014 19:45:00 GMT

I figured out the SSH by doing management access but my radius stuff still isnt working.

Run the following commandtest

Marius Gunnerud — Thu, 02 Oct 2014 07:24:49 GMT

Run the following command

test aaa authentication RADIUS host 192.168.50.1

username: xxxxx

password: xxxxx

do you see any hits on the radius server?

Also run some debugs while trying to authenticate.

debug radius

debug aaa authen

I suggest changing the radius configuration so it points to the inside interface. This way authentication requests are sent with a source IP of the inside interface instead of the outside interface.

it will help to see a network diagram so we have an idea of how your network is set up.

Please remember to select a correct answer and rate helpful posts

Changing the Radius to the

BrianEschen — Thu, 02 Oct 2014 15:05:11 GMT

Changing the Radius to the inside interface fixed my authentication issues.

topic SSH inside network on other end of L2L VPN not working in Network Security

SSH inside network on other end of L2L VPN not working

I figured out the SSH by

Run the following commandtest

Changing the Radius to the