Buenos dias.
Estoy intentando configurar un tunel entre un Cisco 870 contra un ASA 5510.
Antes del router tengo un firewall en donde he tenido que hacer NAT, y en el mismo firewall he creado unas reglas de red para que las redes del ASA 5510 que tengo publicado en mi firewall apunten hacia la puerta de entrada del Cisco 870.
La configuracion en el Cisco 870 es la siguiente.
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key madrid1234 address 195.35.148.26
!
!
crypto ipsec transform-set TUNELASA esp-3des esp-sha-hmac
!
crypto map TUNEL 1 ipsec-isakmp
description tunel VPN
set peer 195.35.148.26
set pfs group1
set transform-set TUNELASA
match address 102
!
archive
log config
hidekeys
!
!
!
!
!
interface FastEthernet0
!
interface FastEthernet1
switchport access vlan 2
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
description interface de salida
ip address 213.80.165.52 255.255.255.248
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
crypto map TUNEL
!
interface Vlan1
description Interfaz interna
ip address 192.168.20.1 255.255.255.0
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1452
!
interface Vlan2
ip address 172.20.85.2 255.255.255.0
ip nat inside
ip virtual-reassembly
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 213.80.165.51
ip route 172.20.80.0 255.255.255.0 FastEthernet4
ip route 192.168.105.0 255.255.255.0 FastEthernet4
ip route 192.168.112.0 255.255.255.0 FastEthernet4
ip route 192.168.116.0 255.255.255.0 FastEthernet4
ip route 192.168.120.0 255.255.255.0 FastEthernet4
ip route 195.35.148.26 255.255.255.255 FastEthernet4
!
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source list 60 interface FastEthernet4 overload
ip nat inside source static tcp 192.168.20.2 443 interface FastEthernet4 443
ip nat inside source static tcp 192.168.20.2 22 interface FastEthernet4 22
ip nat inside source static tcp 192.168.20.2 80 interface FastEthernet4 80
ip nat inside source static tcp 192.168.20.2 1723 interface FastEthernet4 1723
ip nat inside source static tcp 192.168.20.2 47 interface FastEthernet4 47
ip nat inside source static udp 192.168.20.2 47 interface FastEthernet4 47
ip nat inside source static udp 192.168.20.2 500 interface FastEthernet4 500
ip nat inside source static udp 192.168.20.2 4500 interface FastEthernet4 4500
ip nat inside source list 102 interface FastEthernet4 overload
ip nat inside source route-map nonat interface FastEthernet4 overload
!
access-list 60 permit 192.168.20.0 0.0.0.255
access-list 102 remark SDM_ACL Category=4
access-list 102 remark IPSec Rule
access-list 102 permit ip 172.20.85.0 0.0.0.255 172.20.80.0 0.0.0.255
access-list 102 permit ip 172.20.85.0 0.0.0.255 192.168.105.0 0.0.0.255
access-list 102 permit ip 172.20.85.0 0.0.0.255 192.168.112.0 0.0.0.255
access-list 102 permit ip 172.20.85.0 0.0.0.255 192.168.116.0 0.0.0.255
access-list 102 permit ip 172.20.85.0 0.0.0.255 192.168.120.0 0.0.0.255
access-list 110 deny ip 172.20.85.0 0.0.0.255 172.20.80.0 0.0.0.255
access-list 110 deny ip 172.20.85.0 0.0.0.255 192.168.105.0 0.0.0.255
access-list 110 deny ip 172.20.85.0 0.0.0.255 192.168.112.0 0.0.0.255
access-list 110 deny ip 172.20.85.0 0.0.0.255 192.168.116.0 0.0.0.255
access-list 110 deny ip 172.20.85.0 0.0.0.255 192.168.120.0 0.0.0.255
access-list 110 permit ip 172.20.85.0 0.0.0.255 0.0.0.255 any
access-list 110 permit ip any any
no cdp run
!
!
route-map nonat permit 10
match ip address 110
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key madrid1234 address 195.35.148.26
!
!
crypto ipsec transform-set TUNELASA esp-3des esp-sha-hmac
!
crypto map TUNEL 1 ipsec-isakmp
description tunel VPN
set peer 195.35.148.26
set pfs group1
set transform-set TUNELASA
match address 102
!
!
!
!
!
interface FastEthernet0
!
interface FastEthernet1
switchport access vlan 2
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
description interface de salida
ip address 213.80.165.52 255.255.255.248
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
crypto map TUNEL
!
interface Vlan1
description Interfaz interna
ip address 192.168.20.1 255.255.255.0
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1452
!
interface Vlan2
ip address 172.20.85.2 255.255.255.0
ip nat inside
ip virtual-reassembly
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 213.80.165.51
ip route 172.20.80.0 255.255.255.0 FastEthernet4
ip route 192.168.105.0 255.255.255.0 FastEthernet4
ip route 192.168.112.0 255.255.255.0 FastEthernet4
ip route 192.168.116.0 255.255.255.0 FastEthernet4
ip route 192.168.120.0 255.255.255.0 FastEthernet4
ip route 195.35.148.26 255.255.255.255 FastEthernet4
!
ip http server
ip http access-class 60
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source list 60 interface FastEthernet4 overload
ip nat inside source static tcp 192.168.20.2 443 interface FastEthernet4 443
ip nat inside source static tcp 192.168.20.2 22 interface FastEthernet4 22
ip nat inside source static tcp 192.168.20.2 80 interface FastEthernet4 80
ip nat inside source static tcp 192.168.20.2 1723 interface FastEthernet4 1723
ip nat inside source static tcp 192.168.20.2 47 interface FastEthernet4 47
ip nat inside source static udp 192.168.20.2 47 interface FastEthernet4 47
ip nat inside source static udp 192.168.20.2 500 interface FastEthernet4 500
ip nat inside source static udp 192.168.20.2 4500 interface FastEthernet4 4500
ip nat inside source list 102 interface FastEthernet4 overload
ip nat inside source route-map nonat interface FastEthernet4 overload
!
access-list 60 permit 192.168.20.0 0.0.0.255
access-list 102 remark SDM_ACL Category=4
access-list 102 remark IPSec Rule
access-list 102 permit ip 172.20.85.0 0.0.0.255 172.20.80.0 0.0.0.255
access-list 102 permit ip 172.20.85.0 0.0.0.255 192.168.105.0 0.0.0.255
access-list 102 permit ip 172.20.85.0 0.0.0.255 192.168.112.0 0.0.0.255
access-list 102 permit ip 172.20.85.0 0.0.0.255 192.168.116.0 0.0.0.255
access-list 102 permit ip 172.20.85.0 0.0.0.255 192.168.120.0 0.0.0.255
access-list 110 deny ip 172.20.85.0 0.0.0.255 172.20.80.0 0.0.0.255
access-list 110 deny ip 172.20.85.0 0.0.0.255 192.168.105.0 0.0.0.255
access-list 110 deny ip 172.20.85.0 0.0.0.255 192.168.112.0 0.0.0.255
access-list 110 deny ip 172.20.85.0 0.0.0.255 192.168.116.0 0.0.0.255
access-list 110 deny ip 172.20.85.0 0.0.0.255 192.168.120.0 0.0.0.255
access-list 110 permit ip 172.20.85.0 0.0.0.255 0.0.0.255 any
access-list 110 permit ip any any
no cdp run
!
!
route-map nonat permit 10
match ip address 110
!
La LAN del tunel y previamente nateada en el firewall es la correspondiente a la VLAN2, 172.20.85.2 255.255.255.0
Al hacer un show crypto isamkp sa, no me muestra nada.
Hago un ping desde la red interna hacia la IP LAN del NAT configurada en el router, y responde.
Realmente me gustaria confirmar que a nivel de configuracion esta bien, ya que no entiendo porque no se crear el tunel.
