topic sh crypto iskamp sa on VPN ASA in Network Security

sh crypto iskamp sa on VPN ASA

mahesh18 — Tue, 12 Mar 2019 03:28:39 GMT

Hi Everyone,

I am studying about VPN these days.

I did

sh crypto isakmp sa

Active SA: 8
Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 8

1   IKE Peer: 198.x
    Type    : user            Role    : responder
    Rekey   : no              State   : AM_ACTIVE
2   IKE Peer: 197.x
    Type    : user            Role    : responder
    Rekey   : no              State   : AM_ACTIVE
3   IKE Peer: 163.x
    Type    : user            Role    : responder
    Rekey   : no              State   : AM_ACTIVE
4   IKE Peer: 51.x
    Type    : user            Role    : responder
    Rekey   : no              State   : AM_ACTIVE
5   IKE Peer: 71.x
    Type    : user            Role    : responder
    Rekey   : no              State   : AM_ACTIVE
6   IKE Peer: 207.x
    Type    : user            Role    : responder
    Rekey   : no              State   : AM_ACTIVE
7   IKE Peer: 71.x
    Type    : user            Role    : responder
    Rekey   : no              State   : AM_ACTIVE
8   IKE Peer: 68.x
    Type    : user            Role    : responder
    Rekey   : no              State   : AM_ACTIVE

Need to know what does this 8 peers mean here does this mean that it has IPSEC tunnels to 8 of these devices?

Regards

Mahesh

sh crypto iskamp sa on VPN ASA

Jouni Forss — Sun, 12 Jan 2014 21:25:15 GMT

Hi Mahesh,

To my understanding that is exactly what it means. That there is 8 VPN connections to your ASA.

This output is the state of the Phase 1. There will only be one ISAKMP SA per VPN connection while there can be multiple IPsec SAs per VPN connection.

Above information tells us the IP address from which user is connecting and also tells us that the ASA has been the responder to this connection. It other words the other end of the VPN has opened/formed/initiated the connection. It also shows that Aggressive Mode is used (AM) which probably means that each of the above connections are VPN Client connections rather than L2L VPN connections.

Hope this helps

- Jouni

sh crypto iskamp sa on VPN ASA

mahesh18 — Sun, 12 Jan 2014 22:02:47 GMT

Hi Jouni,

So need to confirm these all 8 connections are Remote Access VPN connections where clients are connecting to the

Company network right?

Also IP address show are of the Client PC right?

Do the Remote Access VPN always stay in Phase 1 only?

Regards

Mahesh

Re: sh crypto iskamp sa on VPN ASA

Jouni Forss — Sun, 12 Jan 2014 22:15:21 GMT

Hi,

There are other commands to get more information about the connections.

You could for example use

show vpn-sessiondb ?

Find the one there that refers to the Remote Access Clients. It might refer to Remote Access directly or mention IKEv1 RA as the next options (not in that exact format though). It depends on the ASA software version.

The following command would give you a summary of which type of connections there are on the ASA

show vpn-sessiondb summary

Have a try with the other commands with the way I showed above. I mean inserting the question mark "?" after the "show vpn-sessiondb" command so you can see the options.

With regards to the IP address, the IP address is the public IP address from which the connection was formed. Most of the time this is NAT IP address naturally at the remote end where the user is connecting from. For example if a VPN user was connecting from his/her home this public IP address would be his/her Internet router/modems public IP address.

If you had a L2L VPN connection then this public IP address visible would be that of the remote VPN device. This naturally can also be a NAT IP address if the VPN device is behind a NAT device and not directly connected to Internet.

The Phase 1 is always formed/negotiated. When its negotiated the VPN peers will use this Phase 1 connection to negotiate the Phase 2 securely and determine what traffic needs to be protected by the VPN.

The above is naturally a very simple explanation of the VPN. There is probably a lot more information if you are using some material to study the VPN.

Hope this helps

- Jouni

sh crypto iskamp sa on VPN ASA

mahesh18 — Sun, 12 Jan 2014 22:44:45 GMT

Hi Jouni,

I ran the command

sh vpn-sessiondb

Active Session Summary

Sessions:
                           Active : Cumulative : Peak Concurrent : Inactive
SSL VPN               :       0 :          0 :               0
    Clientless only     :       0 :          0 :               0
    With client         :       0 :          0 :               0 :        0
Email Proxy           :       0 :          0 :               0
IPsec LAN-to-LAN      :       0 :          0 :               0
IPsec Remote Access   :       8 :       3850 :              30
VPN Load Balancing    :       0 :          0 :               0
Totals                :       8 :       3850

License Information:
IPsec   :    750    Configured :    750    Active :      8    Load :   1%
SSL VPN :      2    Configured :      2    Active :      0    Load :   0%
                            Active : Cumulative : Peak Concurrent
IPsec               :          8 :       4797 :              30
SSL VPN             :          0 :          0 :               0
    AnyConnect Mobile :          0 :          0 :               0
    Linksys Phone     :          0 :          0 :               0
Totals              :          8 :       4797

Tunnels:
                      Active : Cumulative : Peak Concurrent
IKE           :         8 :       3850 :              30
IPsec         :          0 :          4 :               1
IPsecOverNatT :          1 :        606 :               7
IPsecOverTCP :          7 :       3240 :              24
Totals        :         16 :       7700

Active NAC Sessions:
No NAC sessions to display

Active VLAN Mapping Sessions:
No VLAN Mapping sessions to display

Under Tunnels it shows IKE 8 and IPSECOver NAT 1 and IPsecOver TCP 7.

Does this also refer to Remote Access VPN connection coming from user PC?

Are all the above 3 terms currently refer to Remote Access VPN?

Regards

MAhesh

Re: sh crypto iskamp sa on VPN ASA

Jouni Forss — Sun, 12 Jan 2014 22:58:09 GMT

Hi,

The beginning of the output would seem to suggest that this device has only been used for Client VPN. Atleast from the time when it was last booted as we can only see IPsec Remote Access Cumulative Counter increased.

The same section shows that currenctly Active sessions are all IPsec Remote Access connections.

With regards to the end of the output I am not 100% sure.

It would seem to me that one of the VPN Clients connected is using UDP as its behind a NAT device (IPsecOverNatT) and rest of the 7 VPN Clients are using TCP to connect.

Would probably have to see some "show run crypto" and "show run group-policy" configurations on the device to confirm.

- Jouni

sh crypto iskamp sa on VPN ASA

mahesh18 — Sun, 12 Jan 2014 23:43:06 GMT

Hi Jouni,

Here is info

sh run crypto
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set strong esp-aes esp-sha-hmac
crypto ipsec transform-set strongest esp-aes-256 esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set strongest strong
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime seconds 28800
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime kilobytes 4608000
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 1
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400
crypto isakmp policy 5
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 10
authentication pre-share
encryption des
hash sha
group 2
lifetime 86400
crypto isakmp ipsec-over-tcp port 10000

sh run group-policy
group-policy XGroupPolicy internal
group-policy XGroupPolicy attributes
wins-server none
dns-server value 192.168.50.1
dhcp-network-scope none
vpn-access-hours none
vpn-simultaneous-logins 3
vpn-idle-timeout 30
vpn-session-timeout none
vpn-filter none
vpn-tunnel-protocol IPSec
password-storage disable
ip-comp disable
re-xauth enable
group-lock none
pfs disable
ipsec-udp enable
ipsec-udp-port 10000
split-tunnel-policy tunnelall
split-tunnel-network-list none
default-domain value corp.com
split-dns none
intercept-dhcp disable
secure-unit-authentication disable
user-authentication disable
user-authentication-idle-timeout 15
ip-phone-bypass disable
leap-bypass disable
nem disable
backup-servers keep-client-config
msie-proxy server none
msie-proxy method no-modify
msie-proxy except-list none
msie-proxy local-bypass disable
msie-proxy pac-url none
vlan none
nac-settings none
address-pools value PoolCorp
smartcard-removal-disconnect enable
client-firewall none
client-access-rule none
webvpn
homepage none
svc dtls enable
svc mtu 1406
svc keep-installer installed
svc keepalive none
svc rekey time none
svc rekey method none
svc dpd-interval client 30
svc dpd-interval gateway 30
svc compression deflate
svc modules value vpngina
svc profiles none
svc ask none default webvpn
customization value DfltCustomization

group-policy DfltGrpPolicy attributes

wins-server value 192.168.50.1
dns-server value 192.168.50.1
vpn-tunnel-protocol IPSec svc
ipsec-udp enable
default-domain value corp.com
user-authentication-idle-timeout 15
address-pools value PoolDefault
group-policy YGroupPolicy internal
group-policy YGroupPolicy attributes
wins-server value 192.168.50.1
dns-server value 192.168.50.1
dhcp-network-scope none
vpn-tunnel-protocol IPSec
default-domain value corp.com
address-pools value PoolDefault

Thanks for helping me out.

Regards

Mahesh

sh crypto iskamp sa on VPN ASA

Jouni Forss — Mon, 13 Jan 2014 00:35:40 GMT

Hi,

This command enables the use of TCP for the VPN Client connections. The previous 7 VPN Client connections are connecting with TCP.

crypto isakmp ipsec-over-tcp port 10000

It defines the TCP port to be TCP/10000 although I imagine it could be something else too. This is the default value. I would imagine that your VPN Client users would also have configuration under their VPN Client profiles configurations (the one they use to connect to this device) that selects them to use TCP. Normally the default setting on a newly created profile is to my understanding UDP.

You also seem to have these settings for UDP

ipsec-udp enable

ipsec-udp-port 10000

To be honest, I have not touched this setting previously so I am not sure what the purpose here is. To my understanding the VPN Client and ASA dont need any nondefault configurations to enable for the connection to use UDP. Maybe this sets the values regarding the UDP port to nondefault values. I can't really say unless I tested this at some point.

- Jouni

sh crypto iskamp sa on VPN ASA

mahesh18 — Mon, 13 Jan 2014 01:33:53 GMT

Many thanks Jouni

Regards

MAhesh