Tengo el siguiente escenario:
LAN LAN
Voice and Data ---------ASA5505---------Internet-----------Cisco2600 CME----------Voice and Data
CME
Hay una VPN configurada entre el ASA5505 y el router Cisco 2600 que esta funcionando correctamente, el problema es que no se puede realizar una llamada desde la red del router 2600 al Call Manager detras del ASA5505, pero si se puede realizar una llamada desde el el Call Manager detras del ASA5505 pero cuando contestan en la red del Cisco2600 se escucha la voz de los que estan detras del ASA pero ellos ni pueden escuchar nada a los que estan detras del Cisco2600. Se que me debe faltar alguna configuración.
La VPN esta confiurada correctamente y funcionando hay ping entre las redes e incluso los telefonos.
Gracias de antemano.
Pongo la configuración de mi ASA5505
ASA Version 8.0(2)
!
hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface Vlan1
nameif inside
security-level 100
ip address 10.60.0.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 67.XXX.103.194 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
access-list FOR-VPN extended permit ip 10.60.0.0 255.255.255.0 172.16.100.0 255.255.255.0
access-list NONAT extended permit ip 10.60.0.0 255.255.255.0 172.16.100.0 255.255.255.0
access-list 100 extended permit tcp 172.16.100.0 255.255.255.0 10.60.0.0 255.255.255.0 eq 2000
access-list 105 extended permit tcp 192.168.2.0 255.255.255.0 172.16.100.0 255.255.255.0 eq 2000
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-602.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list NONAT
nat (inside) 1 0.0.0.0 0.0.0.0
access-group 100 in interface outside
route outside 0.0.0.0 0.0.0.0 XXX.87.103.193 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set MYTRANS esp-aes-256 esp-sha-hmac
crypto map IPSEC 10 match address FOR-VPN
crypto map IPSEC 10 set pfs group5
crypto map IPSEC 10 set peer 190.XXX.103.195
crypto map IPSEC 10 set transform-set MYTRANS
crypto map IPSEC interface outside
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption aes-256
hash sha
group 5
lifetime 86400
no crypto isakmp nat-traversal
telnet timeout 5
ssh timeout 5
console timeout 0
priority-queue outside
threat-detection basic-threat
threat-detection statistics access-list
!
class-map inspection_default
match default-inspection-traffic
class-map Voice-OUT
match access-list 105
class-map Voice-IN
match access-list 100
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
policy-map Voicepolicy
class Voice-IN
class Voice-OUT
priority
!
service-policy global_policy global
service-policy Voicepolicy interface outside
tunnel-group 190.XXX.103.195 type ipsec-l2l
tunnel-group 190.XXX.103.195 ipsec-attributes
pre-shared-key *
isakmp keepalive threshold 30 retry 5
prompt hostname context
Cryptochecksum:8daeee5c7d38a18f0ccd341b24730059
: end
