topic Re: Allow IPSec Traffic in Network Security

Allow IPSec Traffic

dharmendra2shah — Mon, 11 Mar 2019 16:33:14 GMT

We are trying to establish vpn connection using cisco vpn client on laptop to a vpn concentrator in a remote office. All network devices are in the same private network. There is a Cisco ASA 5505 firewall sitting between VPN client and VPN Concentrator. IPSec over TCP & IPSec over UDP works fine. But plain IPsec will not work. We will be able to establish connection with plain IPSec but can't access resources behind the VPN concentrator. I am attaching the config Cisco ASA firewall for your reference. Please let me know what I am missing.

Re: Allow IPSec Traffic

Ivan Martinon — Wed, 28 Oct 2009 21:22:42 GMT

Try getting rid of the global defined on your config and disable nat-control, also just remember that ipsec pass through is only applicable for one to one translations, since your static is in place this should work ok. Try that and let us know.

Re: Allow IPSec Traffic

dharmendra2shah — Wed, 28 Oct 2009 21:36:58 GMT

Imartino,

I got rid of those 2 commands using:

no global (outside) 1 interface

no nat-control

But still the same problem.

Re: Allow IPSec Traffic

Ivan Martinon — Wed, 28 Oct 2009 21:40:45 GMT

Please get the show service-policy and the logs when the client is trying to pass traffic.

Re: Allow IPSec Traffic

dharmendra2shah — Wed, 28 Oct 2009 21:45:11 GMT

Result of the command: "show service-policy"

Interface outside:

Service-policy: test-udp-policy

Class-map: test-udp-class

Inspect: ipsec-pass-thru pol-type1, packet 42, drop 0, reset-drop 0

Result of the command: "show conn"

9 in use, 12 most used

AH outside 0.0.0.0 inside 0.0.0.0, idle 0:11:52, bytes 0

ESP outside 0.0.0.0 inside 0.0.0.0, idle 0:11:52, bytes 0

ESP outside 192.168.34.7 inside 10.47.200.5, idle 0:01:01, bytes 12592

AH outside 192.168.34.7 inside 10.47.200.5, idle 0:11:52, bytes 0

ESP outside 192.168.34.7 inside 10.47.200.5, idle 0:11:52, bytes 0

UDP outside 192.168.34.7:500 inside 10.47.200.5:500, idle 0:01:01, bytes 3431, flags -

Re: Allow IPSec Traffic

Ivan Martinon — Wed, 28 Oct 2009 21:46:35 GMT

Do you get any drops on the logs?

Re: Allow IPSec Traffic

dharmendra2shah — Wed, 28 Oct 2009 21:49:00 GMT

No I don't see any drops on the log. This problem is killing me. I thought it would be simple.

Re: Allow IPSec Traffic

Ivan Martinon — Wed, 28 Oct 2009 21:50:31 GMT

Can you change the acess-list to include IP rather than udp.

Re: Allow IPSec Traffic

dharmendra2shah — Wed, 28 Oct 2009 23:55:35 GMT

I allowed ip traffic instead of udp. Still no success.

Re: Allow IPSec Traffic

Amadou TOURE — Thu, 29 Oct 2009 02:30:02 GMT

Hi,

Could you connect your laptop to the outside network and ensure that it's working without passing through ASA ?

1. with the no nat-control you don't need the static statement, so can you remove it also.

2.in second test if you keep the static Identity, use nat exemption instead (I already experienced problem related to that).

Regards