topic Remote Access IKEv1 VPN DMZ ASA in Network Security

Remote Access IKEv1 VPN DMZ ASA

Nathan Hawkins — Tue, 12 Mar 2019 00:15:10 GMT

Hello All,

I have a test ASA behind an edge firewall (Checkpoint), and I'm trying to set up the ASA for remote VPN access only. The ports being forwarded are UDP/500, UDP/4500 and UDP/TCP/10000. I'd prefer to encapsulate the sessions into TCP/10000. There's two networks that the ASA is connected to. The DMZ (10.11.12.0/24) and an internal segment (10.10.1.0/24), where the external remote client will connect to the DMZ interface and the goal is to access the internal subnet. The pool I want to set up is 10.11.12.150-200. I have upgraded the ASA to the most current IOS [8.4(4)1] / ASDM [6.4(9)] images. Here's what I've come up with, but unfortuantely the client fails to connect. I have messed around several times with settings using the ASDM, but ultimately I cannot get the client to connect. Here's my config:

[code]

hostname RemoteVPNASA

domain-name Domain.local

enable password ---------------- encrypted

passwd ---------------- encrypted

names

interface Ethernet0/0

switchport access vlan 2

interface Ethernet0/1

interface Ethernet0/2

shutdown

interface Ethernet0/3

shutdown

interface Ethernet0/4

shutdown

interface Ethernet0/5

shutdown

interface Ethernet0/6

shutdown

interface Ethernet0/7

shutdown

interface Vlan1

nameif inside

security-level 100

ip address 10.10.1.76 255.255.255.0

interface Vlan2

nameif DMZ

security-level 0

ip address 10.11.12.2 255.255.255.0

banner motd

banner motd +----------------------------------------------------+

banner motd | |

banner motd | *** Unauthorized Use or Access Prohibited *** |

banner motd | |

banner motd | For Authorized Official Use Only |

banner motd | You must have explicit permission to access or |

banner motd | configure this device. All activities performed |

banner motd | on this device may be logged, and violations of |

banner motd | this policy may result in disciplinary action, and |

banner motd | may be reported to law enforcement authorities. |

banner motd | |

banner motd | There is no right to privacy on this device. |

banner motd | |

banner motd +----------------------------------------------------+

banner motd

ftp mode passive

dns server-group DefaultDNS

domain-name Domain.local

object network Network-10.11.12.0

subnet 10.11.12.0 255.255.255.0

object-group icmp-type DefaultICMP

description Default ICMP Types permitted

icmp-object echo-reply

icmp-object unreachable

icmp-object time-exceeded

object-group network DM_INLINE_NETWORK_1

network-object 10.10.1.0 255.255.255.0

network-object 10.11.12.0 255.255.255.0

object-group network DM_INLINE_NETWORK_2

network-object 10.10.1.0 255.255.255.0

network-object 10.11.12.0 255.255.255.0

object-group protocol DM_INLINE_PROTOCOL_1

protocol-object ip

protocol-object icmp

access-list vpn_SplitTunnel remark ACL for VPN Split Tunnel

access-list vpn_SplitTunnel standard permit 10.10.1.0 255.255.255.0

access-list nonat remark ACL for Nat Bypass

access-list nonat extended permit object-group DM_INLINE_PROTOCOL_1 object-group DM_INLINE_NETWORK_1 object-group DM_INLINE_NETWORK_2

access-list acl_DMZ extended permit icmp any any object-group DefaultICMP

pager lines 24

logging enable

logging asdm informational

mtu inside 1500

mtu DMZ 1500

ip local pool IPPool 10.11.12.150-10.11.12.200

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

nat (inside,DMZ) source static any any destination static Network-10.11.12.0 Network-10.11.12.0

access-group acl_DMZ in interface DMZ

route DMZ 0.0.0.0 0.0.0.0 10.11.12.1 1

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

aaa authentication ssh console LOCAL

aaa authentication http console LOCAL

http server enable

http 10.10.1.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

crypto ipsec ikev1 transform-set FirstSet esp-3des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto dynamic-map DynamicMap 1 set ikev1 transform-set FirstSet

crypto dynamic-map DynamicMap 1 set reverse-route

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

crypto map NetMap 1 ipsec-isakmp dynamic DynamicMap

crypto map NetMap interface DMZ

crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map inside_map interface inside

crypto isakmp identity address

crypto ikev1 enable inside

crypto ikev1 enable DMZ

crypto ikev1 ipsec-over-tcp port 10000

crypto ikev1 policy 1

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 43200

crypto ikev1 policy 11

authentication pre-share

encryption 3des

hash md5

group 2

lifetime 86400

crypto ikev1 policy 65535

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

telnet timeout 5

ssh 10.10.1.0 255.255.255.0 inside

ssh timeout 5

ssh key-exchange group dh-group1-sha1

console timeout 0

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

group-policy Network internal

group-policy Network attributes

vpn-idle-timeout 120

vpn-tunnel-protocol ikev1

split-tunnel-policy tunnelspecified

split-tunnel-network-list value vpn_SplitTunnel

username user password ---------------- encrypted privilege 15

tunnel-group NetworkRA type remote-access

tunnel-group NetworkRA general-attributes

address-pool IPPool

default-group-policy Network

tunnel-group NetworkRA ipsec-attributes

ikev1 pre-shared-key *****

class-map inspection_default

match default-inspection-traffic

policy-map type inspect dns preset_dns_map

parameters

message-length maximum client auto

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect ip-options

inspect netbios

inspect rsh

inspect rtsp

inspect skinny

inspect esmtp

inspect sqlnet

inspect sunrpc

inspect tftp

inspect sip

inspect xdmcp

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

call-home

profile CiscoTAC-1

no active

destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

destination address email callhome@cisco.com

destination transport-method http

subscribe-to-alert-group diagnostic

subscribe-to-alert-group environment

subscribe-to-alert-group inventory periodic monthly

subscribe-to-alert-group configuration periodic monthly

subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:d6e568acfb0bed9dc9979dc1a980f24f

: end

[/code]

Any help would be greatly appreciated!

Remote Access IKEv1 VPN DMZ ASA

Julio Carvajal — Sun, 28 Oct 2012 06:23:39 GMT

Hello Nathan,

Can you run some debugs and let us have the outputs, what does the ASA logs say when you attemtp to connect?

Also can you change the following:

no crypto map NetMap 1 ipsec-isakmp dynamic DynamicMap

crypto map NetMap 1 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

Let me know the result,

Regards,

Julio

Remote Access IKEv1 VPN DMZ ASA

Nathan Hawkins — Mon, 29 Oct 2012 12:36:08 GMT

Thanks for that Julio!

I made the change of that command and here's the logging/debug for a connection attempt:

Syslog logging: enabled

Facility: 20

Timestamp logging: disabled

Standby logging: disabled

Debug-trace logging: disabled

Console logging: level debugging, 1566 messages logged

Monitor logging: disabled

Buffer logging: level debugging, 1568 messages logged

Trap logging: disabled

Permit-hostdown logging: disabled

History logging: disabled

Device ID: disabled

Mail logging: disabled

ASDM logging: level informational, 1663 messages logged

%ASA-5-111008: User 'enable_15' executed the 'clear logging buffer' command.

%ASA-5-111010: User 'enable_15', running 'CLI' from IP 10.10.1.23, executed 'clear logging buffer'

%ASA-7-111009: User 'enable_15' executed cmd: show logging

%ASA-7-609001: Built local-host DMZ:74.125.227.20

%ASA-7-609001: Built local-host identity:10.11.12.2

%ASA-6-302013: Built inbound TCP connection 371 for DMZ:74.125.227.20/46673 (74.125.227.20/46673) to identity:10.11.12.2/10000 (10.11.12.2/10000)

%ASA-6-302015: Built inbound UDP connection 372 for DMZ:74.125.227.20/46673 (74.125.227.20/46673) to identity:10.11.12.2/500 (10.11.12.2/500)

%ASA-7-713236: IP = 74.125.227.20, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + KE (4) + NONCE (10) + ID (5) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 829

%ASA-7-713906: IP = 74.125.227.20, Responder: IPSec over TCP encapsulation is used local TCP port: 10000 peer TCP port: 46673

%ASA-7-715047: IP = 74.125.227.20, processing SA payload

%ASA-7-715047: IP = 74.125.227.20, processing ke payload

%ASA-7-715047: IP = 74.125.227.20, processing ISA_KE payload

%ASA-7-715047: IP = 74.125.227.20, processing nonce payload

%ASA-7-715047: IP = 74.125.227.20, processing ID payload

%ASA-7-715047: IP = 74.125.227.20, processing VID payload

%ASA-7-715049: IP = 74.125.227.20, Received xauth V6 VID

%ASA-7-715047: IP = 74.125.227.20, processing VID payload

%ASA-7-715049: IP = 74.125.227.20, Received DPD VID

%ASA-7-715047: IP = 74.125.227.20, processing VID payload

%ASA-7-715049: IP = 74.125.227.20, Received Fragmentation VID

%ASA-7-715064: IP = 74.125.227.20, IKE Peer included IKE fragmentation capability flags: Main Mode: True Aggressive Mode: False

%ASA-7-715047: IP = 74.125.227.20, processing VID payload

%ASA-7-715049: IP = 74.125.227.20, Received Cisco Unity client VID

%ASA-4-713255: IP = 74.125.227.20, Received ISAKMP Aggressive Mode message 1 with unknown tunnel group name 'user'.

%ASA-7-715047: Group = DefaultRAGroup, IP = 74.125.227.20, processing IKE SA payload

%ASA-7-715028: Group = DefaultRAGroup, IP = 74.125.227.20, IKE SA Proposal # 1, Transform # 9 acceptable Matches global IKE entry # 1

%ASA-7-715046: Group = DefaultRAGroup, IP = 74.125.227.20, constructing ISAKMP SA payload

%ASA-7-715046: Group = DefaultRAGroup, IP = 74.125.227.20, constructing ke payload

%ASA-7-715046: Group = DefaultRAGroup, IP = 74.125.227.20, constructing nonce payload

%ASA-7-713906: Group = DefaultRAGroup, IP = 74.125.227.20, Generating keys for Responder...

%ASA-7-715046: Group = DefaultRAGroup, IP = 74.125.227.20, constructing ID payload

%ASA-7-715046: Group = DefaultRAGroup, IP = 74.125.227.20, constructing hash payload

%ASA-7-715076: Group = DefaultRAGroup, IP = 74.125.227.20, Computing hash for ISAKMP

%ASA-7-715046: Group = DefaultRAGroup, IP = 74.125.227.20, constructing Cisco Unity VID payload

%ASA-7-715046: Group = DefaultRAGroup, IP = 74.125.227.20, constructing xauth V6 VID payload

%ASA-7-715046: Group = DefaultRAGroup, IP = 74.125.227.20, constructing dpd vid payload

%ASA-7-715046: Group = DefaultRAGroup, IP = 74.125.227.20, constructing Fragmentation VID + extended capabilities payload

%ASA-7-715046: Group = DefaultRAGroup, IP = 74.125.227.20, constructing VID payload

%ASA-7-715048: Group = DefaultRAGroup, IP = 74.125.227.20, Send Altiga/Cisco VPN3000/Cisco ASA GW VID

%ASA-7-713236: IP = 74.125.227.20, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + KE (4) + NONCE (10) + ID (5) + HASH (8) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 372

%ASA-7-715065: Group = DefaultRAGroup, IP = 74.125.227.20, IKE AM Responder FSM error history (struct &0xcc051860) , : AM_DONE, EV_ERROR-->AM_SND_MSG2, EV_SND_MSG-->AM_SND_MSG2, EV_START_TMR-->AM_BLD_MSG2, EV_BLD_MSG2_TRL-->AM_BLD_MSG2, EV_SKEYID_OK-->AM_BLD_MSG2, NullEvent-->AM_BLD_MSG2, EV_GEN_SKEYID-->AM_BLD_MSG2, EV_BLD_MSG2_HDR

%ASA-7-713906: Group = DefaultRAGroup, IP = 74.125.227.20, IKE SA AM:8642b183 terminating: flags 0x0104c001, refcnt 0, tuncnt 0

%ASA-7-713906: Group = DefaultRAGroup, IP = 74.125.227.20, sending delete/delete with reason message

%ASA-6-302014: Teardown TCP connection 371 for DMZ:74.125.227.20/46673 to identity:10.11.12.2/10000 duration 0:00:00 bytes 396 Flow closed by inspection

Let me know when you can.

Thanks!

Remote Access IKEv1 VPN DMZ ASA

Julio Carvajal — Mon, 29 Oct 2012 16:34:59 GMT

Hello Nathan,

This is our problem:

%ASA-6-302014: Teardown TCP connection 371 for DMZ:74.125.227.20/46673 to identity:10.11.12.2/10000 duration 0:00:00 bytes 396 Flow closed by inspection.

Can you add the following commands and try it one more time

Sysopt connection preserve-vpn-flows

Sysopt connection reclassify-vpn

Can I have the show run nat and show run policy-map

Regards,

Remote Access IKEv1 VPN DMZ ASA

Nathan Hawkins — Mon, 29 Oct 2012 17:43:39 GMT

Here ya go (it still does not connect):

RemoteVPNASA# sh run nat

nat (inside,DMZ) source static any any destination static Network-10.11.12.0 Network-10.11.12.0

RemoteVPNASA# sh run policy-map

policy-map type inspect dns preset_dns_map

parameters

message-length maximum client auto

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect ip-options

inspect netbios

inspect rsh

inspect rtsp

inspect skinny

inspect esmtp

inspect sqlnet

inspect sunrpc

inspect tftp

inspect sip

inspect xdmcp

Syslog logging: enabled

Facility: 20

Timestamp logging: disabled

Standby logging: disabled

Debug-trace logging: disabled

Console logging: level debugging, 2534 messages logged

Monitor logging: disabled

Buffer logging: level debugging, 2536 messages logged

Trap logging: disabled

Permit-hostdown logging: disabled

History logging: disabled

Device ID: disabled

Mail logging: disabled

ASDM logging: level informational, 2066 messages logged

%ASA-7-111009: User 'enable_15' executed cmd: show logging

%ASA-6-302013: Built inbound TCP connection 380 for DMZ:74.125.227.20/20486 (74.125.227.20/20486) to identity:10.11.12.2/10000 (10.11.12.2/10000)

%ASA-6-302015: Built inbound UDP connection 381 for DMZ:74.125.227.20/20486 (74.125.227.20/20486) to identity:10.11.12.2/500 (10.11.12.2/500)

%ASA-7-713906: IP = 74.125.227.20, Responder: IPSec over TCP encapsulation is used local TCP port: 10000 peer TCP port: 20486