ASA vpn issue.. Please help

Rohit Mangotra · ‎06-18-2015

Hi,

I have got an issue where SPOKE1 and SPOKE 2 cannot communicate with each other. However, SPOKE1 and SPOKE 2 can communicate with HUB. Please see configuration below for spoke and hub. I'll really appreciate if anyone could please guide me in right direction.

SPOKE 1 (Cisco SRST881, v. 12.4)

SPOKE 2 (Cisco 887VA, v.12.4(22r)

HUB (ASA5525, v.8.6(1)2)

** Spoke 1 (Cisco SRST881, v. 12.4) **

crypto ikev2 proposal AES256-192-128-PROPOSAL
encryption aes-cbc-256 aes-cbc-192 aes-cbc-128
integrity sha1
group 2

crypto ikev2 policy IKEv2-Policy
proposal AES256-192-128-PROPOSAL

crypto ikev2 keyring VPN-KEYS
peer ASA-DC
address 200.200.200.1
pre-shared-key local 12345678
pre-shared-key remote 12345678

crypto ikev2 profile ASA-DC
match identity remote address 200.200.200.1 255.255.255.255
identity local address 50.50.50.1
authentication local pre-share
authentication remote pre-share
keyring VPN-KEYS

crypto ipsec transform-set ESP-AES256-SHA esp-aes 256 esp-sha-hmac

crypto map SPOKE1-ASA 10 ipsec-isakmp
set peer 200.200.200.1
set transform-set ESP-AES256-SHA
set ikev2-profile ASA-DC
match address SPOKE1-VPN-ACL

interface FastEthernet4
ip address dhcp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
crypto map SPOKE1-ASA

interface Vlan1
ip address 192.168.210.225 255.255.255.224
ip nat inside
ip virtual-reassembly in

ip nat inside source list NONAT interface FastEthernet4 overload
ip route 0.0.0.0 0.0.0.0 50.50.50.1

ip access-list extended NONAT
deny ip 192.168.210.64 0.0.0.31 172.16.0.0 0.0.255.255
permit ip 192.168.210.64 0.0.0.31 any

ip access-list extended SPOKE1-VPN-ACL
permit ip 192.168.210.224 0.0.0.31 172.16.0.0 0.0.255.255
permit ip 192.168.210.224 0.0.0.31 192.168.210.64 0.0.0.31
-----------------------------------------------------------------------------

** SPOKE2 (Cisco 887VA, v.12.4(22r) **

crypto ikev2 proposal AES256-192-128-PROPOSAL
encryption aes-cbc-256 aes-cbc-192 aes-cbc-128
integrity sha1
group 2

crypto ikev2 policy IKEv2-Policy
proposal AES256-192-128-PROPOSAL

crypto ikev2 keyring VPN-KEYS
peer ASA-DC
address 200.200.200.1
pre-shared-key local 12345678
pre-shared-key remote 12345678

crypto ikev2 profile ASA-DC
match identity remote address 200.200.200.1 255.255.255.255
identity local address 100.100.100.1
authentication local pre-share
authentication remote pre-share
keyring VPN-KEYS

crypto ipsec transform-set ESP-AES256-SHA esp-aes 256 esp-sha-hmac

crypto map SPOKE2-ASA 10 ipsec-isakmp
set peer 200.200.200.1
set transform-set ESP-AES256-SHA
set ikev2-profile ASA-DC
match address SPOKE2-VPN-ACL

interface Vlan1
ip address 192.168.210.65 255.255.255.224
ip helper-address 172.16.5.32
ip nat inside
ip virtual-reassembly in

interface Dialer1
ip address negotiated
ip nat outside
ip virtual-reassembly in
encapsulation ppp
dialer pool 1
ppp chap hostname zzz@zzz.com
ppp chap password 7 zzzzzzzzz
crypto map SPOKE2-ASA

ip nat inside source list NONAT interface Dialer1 overload
ip route 0.0.0.0 0.0.0.0 Dialer1

ip access-list extended SPOKE2-VPN-ACL
permit ip 192.168.210.64 0.0.0.31 172.16.0.0 0.0.255.255
permit ip 192.168.210.64 0.0.0.31 192.168.210.224 0.0.0.31

ip access-list extended NONAT
deny ip 192.168.210.64 0.0.0.31 172.16.0.0 0.0.255.255
permit ip 192.168.210.64 0.0.0.31 any
-----------------------------------------------------------------------------

** HUB (ASA5525, v.8.6(1)2) **

object network SPOKE1
subnet 192.168.210.224 255.255.255.224

object network SPOKE2
subnet 192.168.210.64 255.255.255.224

object-group network INSIDE-SUBNET
network-object 172.16.0.0 255.255.0.0

access-list VPN-SPOKE1 extended permit ip object-group INSIDE-SUBNET object SPOKE1
access-list VPN-SPOKE1 extended permit ip object SPOKE2 object SPOKE1
access-list VPN-SPOKE2 extended permit ip object-group INSIDE-SUBNET object SPOKE2
access-list VPN-SPOKE2 extended permit ip object SPOKE1 object SPOKE2

nat (inside,outside) source static inside-subnet-source INSIDE-SUBNET destination static SPOKE1 SPOKE1 no-proxy-arp route-lookup
nat (inside,outside) source static inside-subnet-source INSIDE-SUBNET destination static SPOKE2 SPOKE2 no-proxy-arp route-lookup
nat (any,outside) source static inside-subnet-source INSIDE-SUBNET destination static SPOKE1 SPOKE1 no-proxy-arp
nat (any,outside) source static inside-subnet-source INSIDE-SUBNET destination static SPOKE2 SPOKE2 no-proxy-arp

route outside 192.168.210.64 255.255.255.224 200.200.200.1 1
route outside 192.168.210.224 255.255.255.224 200.200.200.1 1

crypto ipsec ikev2 ipsec-proposal AES256-192-128-PROPOSAL
protocol esp encryption aes-256 aes-192 aes
protocol esp integrity sha-1

crypto map ASA-VPN-SITE 10 match address VPN-SPOKE1
crypto map ASA-VPN-SITE 10 set peer 50.50.50.1
crypto map ASA-VPN-SITE 20 set ikev2 ipsec-proposal AES256-192-128-PROPOSAL

crypto map ASA-VPN-SITE 20 match address VPN-SPOKE2
crypto map ASA-VPN-SITE 20 set peer 100.100.100.1
crypto map ASA-VPN-SITE 20 set ikev2 ipsec-proposal AES256-192-128-PROPOSAL

tunnel-group 50.50.50.1 type ipsec-l2l
tunnel-group 50.50.50.1 ipsec-attributes
ikev2 remote-authentication pre-shared-key *****
ikev2 local-authentication pre-shared-key *****

tunnel-group 100.100.100.1 type ipsec-l2l
tunnel-group 100.100.100.1 ipsec-attributes
ikev2 remote-authentication pre-shared-key *****
ikev2 local-authentication pre-shared-key *****

same-security-traffic permit intra-interface

-----------------------------------------------------------------------------

Thanks & Regards

Rohit Mangotra.
- See more at: https://supportforums.cisco.com/discussion/12535306/asa5525-v8612-spoke-1-2-not-communicating-each-other#sthash.ycTKQl6m.dpuf

Aref Alsouqi · ‎06-21-2015

Hi,

After a quick look at the configuration of both spokes, I think you need to modify/add the nat access lists on both spokes as follows:

On Spoke 1:

ip access-list extended NONAT
1 deny ip 192.168.210.224 0.0.0.31 192.168.210.64 0.0.0.31

2 deny ip 192.168.210.224 0.0.0.31 172.16.0.0 0.0.255.255

3 permit ip 192.168.210.224 0.0.0.31 any

On Spoke 2:

ip access-list extended NONAT
1 deny ip 192.168.210.64 0.0.0.31 192.168.210.224 0.0.0.31

2 deny ip 192.168.210.64 0.0.0.31 172.16.0.0 0.0.255.255

3 permit ip 192.168.210.64 0.0.0.31 any

Regards,

Aref

Rohit Mangotra · ‎06-22-2015

Hi Aref,

Thanks a lot for your reply. I tried the configuration you recommended but it did not work. Any other suggestions?

Thanks & Regards

Rohit.

Aref Alsouqi · ‎06-22-2015

You are welcome Rohit.

Please try to add the following:

nat (any,outside) source static SPOKE2 SPOKE2 destination static SPOKE1 SPOKE1

nat (any,outside) source static SPOKE1 SPOKE1 destination static SPOKE2 SPOKE2

May be they cannot reach each other because there was not nat exemption applied.

Regards,

Aref

Rohit Mangotra · ‎06-23-2015

Hi Aref,

Thanks a lot for the reply. I tested the configuration, but it is still not working. I checked it by pinging from Spoke 1 to Spoke 2. Any other suggestions that you could please recommend.

Thank You,

Kind Regards

Rohit.

Aref Alsouqi · ‎06-23-2015

You're welcome.

Would you clarify what host is the 200.200.200.1? Also please share your topology with ip address scheme according to the above configuration for review.

Regards | Aref.

Rohit Mangotra · ‎06-24-2015

Hi Aref,

Please see the topology with ip addressing that you asked. Please let me know if you want me to change anything.

Thank You,

Kind Regards

Rohit Mangotra.

Rohit Mangotra · ‎06-30-2015

Hi Aref,

Any more thoughts regarding this issue.

Thanks

Rohit

Rohit Mangotra · ‎07-09-2015

Thanks for all the help. The issue is resolved now. The problem was default NAT in ASA [nat (dmz,any) source static obj-192.168.1.0-nonatdmz obj-192.168.1.0-nonatdmz destination static obj-192.168.201.0-nonatdmz obj-192.168.201.0-nonatdmz no-proxy-arp].
so, we changed the ip address range [10.1.11.x/24, 10.1.12.x/24]of both spoke1 & Spoke 2. After the change its all working now.

Thank You
Kind Regards
Rohit