Remote Access VPN and Site to Site VPN Issue...

[Janardhan Meesala]

Hi ,

I have ASA 5505 with base license and IOS version is 7.2(4).  I configured both site to site vpn and Remote Access VPN. Site to Site VPN is working fine and also Remote access vpn tunnel came up, remote user got IP address from the firewall.

But the problem is remote user unable to ping the local users.

While watcing the logs it shows: " IKE initiator unable to find the policy: Src "

Below i am attaching the configuration of my firewall.

your response was appreciated....

Regards,

Janardhan

[Janardhan Meesala]

Hi Anisha,

Thanks for your reply.

I done what u said.

Here i am attaching the output of the Packet tracer command.

Regards,

Janardhan

On Fri, Feb 4, 2011 at 8:35 PM, andamani <

[Janardhan Meesala]

HI Anisha,

Finally i got the result..

Below is the configuration i modified..

access-list crypto_one extended permit ip 192.168.8.0 255.255.255.0

192.168.0.0 255.255.252.0

Then change :-

crypto map abcmap 1 match address nonat

crypto map abcmap 1 set peer X.X.X.X

crypto map abcmap 1 set transform-set FirstSet

to :-

crypto map abcmap 1 match address crypto_one

crypto map abcmap 1 set peer X.X.X.X

crypto map abcmap 1 set transform-set FirstSet

Now both VPNs are working fine..

Thanks for your support..

Regards,

Janardhan

On Fri, Feb 4, 2011 at 7:05 AM, andamani <

[andamani]

Hi Janardhan,

Glad to hear that. sorry i did not check the outputs before. i don't work at nights. NIce to hear the issue is resolved. Please mark this thread as resolved so that other can find this helpful if they get stuck at the same problem.

Regards,

Anisha

[Janardhan Meesala]

HI Anisha,

Definitely Anisha...

Finally once again Thanks to you...

Finally i had one query,

Here is the scenario,

I have two sites A and B

Site A having local IPs : 192.168.0.0/24 and Remote Pool for Remote access

VPN: 10.10.20.0/24

Site B having local IPs : 192.168.8.0/24 and Remote Pool for Remote access

VPN: 10.10.10.0/24

As i connecting to Site 'A' through the VPN client, i was able to access the

my local IPs : 192.168.0.0/24

Here i want access site 'B' addresses(192.168.8.0/24) also. how can I????

I configured below statements:

Site A:

same-security-traffic permit intra-interface

access-list nonat extended permit ip 10.10.20.0 255.255.255.0 192.168.8.0

255.255.255.0

access-list crypto_one extended permit ip 10.10.20.0 255.255.255.0

192.168.8.0 255.255.255.0

Site B:

same-security-traffic permit intra-interface

access-list nonat extended permit ip 192.168.8.0 255.255.255.0 10.10.20.0

255.255.255.0

access-list crypto_one extended permit ip 192.168.8.0 255.255.255.0

10.10.20.0 255.255.255.0

Regards,

Janardhan

On Sat, Feb 5, 2011 at 4:07 AM, andamani <

[andamani]

Hi Janardhan,

Could you please post your topology below. Please explain which network wants to access which network.

Also i would suggest please roll a new thread for this issue.

Regards,

Anisha

[Janardhan Meesala]

Hi Anisha,

I will send my topology..

Regards,

janardhan

On Sat, Feb 5, 2011 at 5:22 AM, andamani <

[Janardhan Meesala]

Hi Manish,

Here i am attaching Debug output of : debug crypto isakmp sa

and

sh cry ipsec sa

sh cry isakmp sa outputs after connecting form Remote client.

may be these outpts will give some help to know the issue.

Regards,

Janardhan

[Janardhan Meesala]

Hi Manish

Here i am attaching outputs of

debug cry ipsec sa

debug cry isakmp sa

sh cry ipsec sa

sh cry isakmp sa

Regards,

Janardhan

On Thu, Feb 3, 2011 at 11:36 AM, manisharora111 <

[Janardhan Meesala]

HI Manish,

Is there any update????

Regards,

Janardhan

[manish arora]

Hi Janardhan,

sorry for a late reply .... don't work at night

Can you please paste you lastest config  ? , i will edit it for you.

Manish

[Janardhan Meesala]

Hi Manish,

Thanks for your reply.

Here i am attaching latest config of my ASA5505

Regards,

Janardhan

On Fri, Feb 4, 2011 at 11:36 PM, manisharora111 <

[manish arora · Accepted solution]

Hi Janardhan,

Create an access list for site to site crypto traffic :-

access-list crypto_one extended permit ip 192.168.8.0 255.255.255.0 192.168.0.0 255.255.252.0

Then change :-

crypto map abcmap 1 match address nonat
crypto map abcmap 1 set peer X.X.X.X
crypto map abcmap 1 set transform-set FirstSet

to :-

crypto map abcmap 1 match address crypto_one
crypto map abcmap 1 set peer X.X.X.X
crypto map abcmap 1 set transform-set FirstSet

reply the crypto Map , this will cause a little blip in the site to site , so make sure you do it with little downtime.

Keep everything else the same and Let us know if this works for you.

Manish

[Janardhan Meesala]

HI Manish,

Is you want me do create seperate ACLs for Site to Site and Remote Access

VPN????

And need to apply Site to Site ACL to Crypto map statement???

And Remote Access VPN ACL to nat (inside) 0 Statement????

Regards,

Janardhan

On Sat, Feb 5, 2011 at 12:39 AM, manisharora111 <

[manish arora · Accepted solution]

Hi ,

Create an access list for site to site crypto traffic :-

access-list crypto_one extended permit ip 192.168.8.0 255.255.255.0 192.168.0.0 255.255.252.0

Then change :-

crypto map abcmap 1 match address nonat
crypto map abcmap 1 set peer X.X.X.X
crypto map abcmap 1 set transform-set FirstSet

to :-

crypto map abcmap 1 match address crypto_one
crypto map abcmap 1 set peer X.X.X.X
crypto map abcmap 1 set transform-set FirstSet

You will keep everything as it is in you configuration, then add the Access list mentioned above and make that minor change in the crypto map. Then remove and reapply the crypto map.

As mentioned earlier in the post that the packets are not leaving the asa , that was because the return traffic for remote vpn was getting qualified as L2L , that is the reason I have created a seprate ACL for identify the SITE to SITE traffic and doesnot mix it with RVPN.

Manish

[Janardhan Meesala]

Hi Manish,

As you said, I done the same thing.

While doing this, i found problem with Site to Site VPN.

Site to Site VPN showing up but from 'A; to from Site 'B' is not pinging.

Here i have a query whic ACL i need to apply to the nat (inside) 0 command

i.e whether site to site VPN ACL or remote access VPN.

Regards,

Janardhan

On Sat, Feb 5, 2011 at 12:09 AM, manisharora111 <