topic Re: Help with Basic site to site VPN setup in Network Security

Help with Basic site to site VPN setup

thellco01 — Mon, 11 Mar 2019 14:27:17 GMT

I am trying to set up a site to site VPN tunnel from a asa 5510 to a 5505. I am useing the GUI wizard to set it up with out much luck. Here is the running config for the 5510. I dont have the config from the remote site 5505 but it was set up the same way.

: Saved

ASA Version 7.2(4)18

hostname Paetec

domain-name Paetec.thelandlcompany.com

enable password nRkrK2UDMhbxbMqH encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

dns-guard

interface Ethernet0/0

nameif Outside

security-level 0

ip address 74.9.142.210 255.255.255.240

interface Ethernet0/1

nameif Inside

security-level 100

ip address 10.11.0.242 255.255.0.0

interface Ethernet0/2

shutdown

no nameif

no security-level

no ip address

interface Ethernet0/3

shutdown

no nameif

no security-level

no ip address

interface Management0/0

nameif management

security-level 100

ip address 192.168.1.1 255.255.255.0

management-only

boot system disk0:/asa724-18-k8.bin

ftp mode passive

dns server-group DefaultDNS

domain-name Paetec.thelandlcompany.com

access-list Inside_nat0_outbound extended permit ip 10.11.0.0 255.255.0.0 10.50.0.0 255.255.0.0

access-list Outside_1_cryptomap extended permit ip 10.11.0.0 255.255.0.0 10.50.0.0 255.255.0.0

pager lines 24

logging enable

logging asdm informational

mtu Outside 1500

mtu Inside 1500

mtu management 1500

no failover

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-52450.bin

no asdm history enable

arp timeout 14400

global (Outside) 101 interface

nat (Inside) 0 access-list Inside_nat0_outbound

nat (Inside) 101 0.0.0.0 0.0.0.0

nat (management) 101 0.0.0.0 0.0.0.0

no threat-detection statistics tcp-intercept

route Outside 0.0.0.0 0.0.0.0 74.9.142.209 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

http server enable

http 192.168.1.0 255.255.255.0 management

http 10.11.0.0 255.255.0.0 Inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto map Outside_map 1 match address Outside_1_cryptomap

crypto map Outside_map 1 set peer 162.83.93.74

crypto map Outside_map 1 set transform-set ESP-3DES-SHA

crypto map Outside_map interface Outside

crypto isakmp enable Outside

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

telnet 10.11.0.0 255.255.0.0 Inside

telnet timeout 5

ssh timeout 5

console timeout 0

dhcpd address 192.168.1.2-192.168.1.254 management

dhcpd enable management

tunnel-group 162.83.93.74 type ipsec-l2l

tunnel-group 162.83.93.74 ipsec-attributes

pre-shared-key *

class-map inspection_default

match default-inspection-traffic

policy-map global_policy

class inspection_default

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

service-policy global_policy global

prompt hostname context

Cryptochecksum:a75cc847840c7454f60b84da2e519aca

: end

asdm image disk0:/asdm-52450.bin

no asdm history enable

also, what do I have to do to bring up the VPN, will a ping do it?

Thanks for any help.

Re: Help with Basic site to site VPN setup

John Blakley — Wed, 17 Dec 2008 20:27:26 GMT

A ping to the private network on the other side will bring the VPN up.

Your config looks right, so it's hard to tell what the problem is. What is it doing? Does it not bring the tunnel up?

Make sure that the encryption matches the other end (3des/sha for ipsec, and 3des/sha for isakmp). Also, make sure that your acl is reversed on the other end:

This end: 10.11.0.0 255.255.0.0 10.50.0.0 255.255.0.0

The other end: 10.50.0.0 255.255.255.0 10.11.0.0 255.255.0.0

HTH,

John

Re: Help with Basic site to site VPN setup

thellco01 — Wed, 17 Dec 2008 21:16:49 GMT

The ping fails and no tunnel is opened. The internet is up and working at both sites. T1 at host and Verizon static DSL at remote.here is the remote config.

Saved:ASA Version 7.2(4) !hostname Culpeperdomain-name Culpeper.thelandlcompany.comenable password nRkrK2UDMhbxbMqH encryptedpasswd Lowik8FFent8v7l9 encryptednames!interface Vlan1 nameif inside security-level 100 ip address 10.50.0.5 255.255.0.0 !interface Vlan2 nameif outside security-level 0 ip address 162.83.93.74 255.255.255.0 !interface Vlan3 no forward interface Vlan1 nameif dmz security-level 50 ip address 10.32.0.10 255.255.0.0 !interface Ethernet0/0 switchport access vlan 2!interface Ethernet0/1!interface Ethernet0/2!interface Ethernet0/3!interface Ethernet0/4!interface Ethernet0/5!interface Ethernet0/6!interface Ethernet0/7 switchport access vlan 3!ftp mode passivedns domain-lookup insidedns domain-lookup outsidedns server-group DefaultDNS domain-name Culpeper.thelandlcompany.comaccess-list inside_nat0_outbound extended permit ip 10.50.0.0 255.255.0.0 10.11.0.0 255.255.0.0 access-list outside_1_cryptomap extended permit ip 10.50.0.0 255.255.0.0 10.11.0.0 255.255.0.0 pager lines 24logging enablelogging asdm informationalmtu inside 1500mtu outside 1500mtu dmz 1500ip local pool Cul 10.50.0.10-10.50.0.30 mask 255.255.0.0icmp unreachable rate-limit 1 burst-size 1icmp deny any outsideasdm image disk0:/asdm-524.binno asdm history enablearp timeout 14400nat-controlglobal (outside) 1 interfacenat (inside) 0 access-list inside_nat0_outboundnat (inside) 1 0.0.0.0 0.0.0.0route outside 0.0.0.0 0.0.0.0 162.83.93.1 1timeout xlate 3:00:00timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolutehttp server enablehttp 10.11.0.0 255.255.0.0 dmzhttp 10.32.0.0 255.255.0.0 dmzhttp 10.50.0.0 255.255.0.0 insideno snmp-server locationno snmp-server contactsnmp-server enable traps snmp authentication linkup linkdown coldstartcrypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto map outside_map 1 match address outside_1_cryptomapcrypto map outside_map 1 set peer 74.9.142.210 crypto map outside_map 1 set transform-set ESP-3DES-SHAcrypto map outside_map interface outsidecrypto isakmp enable outsidecrypto isakmp policy 10 authentication pre-share encryption 3des hash sha group 2 lifetime 86400no vpn-addr-assign aaano vpn-addr-assign dhcptelnet 10.50.0.0 255.255.0.0 insidetelnet timeout 5ssh timeout 5console timeout 0dhcpd auto_config outside! tunnel-group 74.9.142.210 type ipsec-l2ltunnel-group 74.9.142.210 ipsec-attributes pre-shared-key *!class-map inspection_default match default-inspection-traffic!!policy-map type inspect dns preset_dns_map parameters message-length maximum 512policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp !service-policy global_policy globalprompt hostname context Cryptochecksum:2005003b9cea63c18a605e291f62f63f: endasdm image disk0:/asdm-524.binno asdm history enable

Re: Help with Basic site to site VPN setup

thellco01 — Wed, 17 Dec 2008 22:01:30 GMT

Wow sorry about that formating. Here is the remote config again.

: Saved

ASA Version 7.2(4)

hostname Culpeper

domain-name Culpeper.thelandlcompany.com

enable password nRkrK2UDMhbxbMqH encrypted

passwd Lowik8FFent8v7l9 encrypted

names

interface Vlan1

nameif inside

security-level 100

ip address 10.50.0.5 255.255.0.0

interface Vlan2

nameif outside

security-level 0

ip address 162.83.93.74 255.255.255.0

interface Vlan3

no forward interface Vlan1

nameif dmz

security-level 50

ip address 10.32.0.10 255.255.0.0

interface Ethernet0/0

switchport access vlan 2

interface Ethernet0/1

interface Ethernet0/2

interface Ethernet0/3

interface Ethernet0/4

interface Ethernet0/5

interface Ethernet0/6

interface Ethernet0/7

switchport access vlan 3

ftp mode passive

dns domain-lookup inside

dns domain-lookup outside

dns server-group DefaultDNS

domain-name Culpeper.thelandlcompany.com

access-list inside_nat0_outbound extended permit ip 10.50.0.0 255.255.0.0 10.11.0.0 255.255.0.0

access-list outside_1_cryptomap extended permit ip 10.50.0.0 255.255.0.0 10.11.0.0 255.255.0.0

pager lines 24

logging enable

logging asdm informational

mtu inside 1500

mtu outside 1500

mtu dmz 1500

ip local pool Cul 10.50.0.10-10.50.0.30 mask 255.255.0.0

icmp unreachable rate-limit 1 burst-size 1

icmp deny any outside

asdm image disk0:/asdm-524.bin

no asdm history enable

arp timeout 14400

nat-control

global (outside) 1 interface

nat (inside) 0 access-list inside_nat0_outbound

nat (inside) 1 0.0.0.0 0.0.0.0

route outside 0.0.0.0 0.0.0.0 162.83.93.1 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

http server enable

http 10.11.0.0 255.255.0.0 dmz

http 10.32.0.0 255.255.0.0 dmz

http 10.50.0.0 255.255.0.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto map outside_map 1 match address outside_1_cryptomap

crypto map outside_map 1 set peer 74.9.142.210

crypto map outside_map 1 set transform-set ESP-3DES-SHA

crypto map outside_map interface outside

crypto isakmp enable outside

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

no vpn-addr-assign aaa

no vpn-addr-assign dhcp

telnet 10.50.0.0 255.255.0.0 inside

telnet timeout 5

ssh timeout 5

console timeout 0

dhcpd auto_config outside

tunnel-group 74.9.142.210 type ipsec-l2l

tunnel-group 74.9.142.210 ipsec-attributes

pre-shared-key *

class-map inspection_default

match default-inspection-traffic

policy-map type inspect dns preset_dns_map

parameters

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

service-policy global_policy global

prompt hostname context

Cryptochecksum:2005003b9cea63c18a605e291f62f63f

: end

asdm image disk0:/asdm-524.bin

no asdm history enable

Re: Help with Basic site to site VPN setup

John Blakley — Wed, 17 Dec 2008 22:22:44 GMT

What errors do you get when it tries to connect?

Re: Help with Basic site to site VPN setup

thellco01 — Wed, 17 Dec 2008 22:32:30 GMT

I will have to try tommorow when I am back at work. It doesnt even apear to try to open a tunnel. I see it try to ping in the log file but it fails. I never see anything in the log about VPN tunnel. I will dobble check tomorrow.

Thanks for the help.

Re: Help with Basic site to site VPN setup

thellco01 — Thu, 18 Dec 2008 12:32:07 GMT

I am going to move this post to the VPN forums that I didn't see before.