Solved: Site-to-Site VPN between ASA 5510 and ASA5505 Configuration

Vihren Todorov · ‎04-19-2013

Hello Team,

I would like to ask for some assistance. Unfortunately, I am not very experienced with Cisco networking.

Here is the situation.

Site A - headquarters 192.168.1.x

Site B - remote office 192.168.20.x

Site C - remote office 192.168.30.x

Site A - ASA 5510

Site B - ASA 5505

Site C - ASA 5505

Site-to-site VPN is established and works between A and B, A and C.

Users would like to establish a tunnel between B and C to work on a common project and the data is on Site B.

I tried configuring the S2S VPN with pre-shared keys on both firewalls at sites B and C but in the end it is not established (I cannot ping either side). I used the Wizard interface multiple times and one time the CLI. I generally followed the settings chosen between the headquarter and the individual remote sites and tried to replicate them. Obviously I have made a mistake somewhere.

Could anyone recommend how can I start troubleshooting where the issue is?

Could there be any limitation on the ASA 5505 in terms of licensing and the number of S2S tunnels? Hope not.

Thanks in advance.

Vihren

Jouni Forss · ‎04-19-2013

Hi,

Notice that I DONT want you to remove this

object network LAN_BiH

subnet 192.168.30.0 255.255.255.0

nat (any,outside) dynamic interface

This seems to be the Dynamic PAT configuration for Site C Internet traffic.

BUT notice this configuration

nat (inside,outside) source dynamic any interface

It also seems to be a Dynamic PAT configuration for the "inside" users Internet traffic. No reason to have 2 configurations that do the same thing?

Thats why I would suggest issuing this command

no nat (inside,outside) source dynamic any interface

With regards to the Site C and Site A L2L VPN Connection. Notice the order of NAT configurations (removed description from one so its easier to read)

nat (inside,outside) source static LAN_BiH LAN_BiH destination static LAN_Muenchen LAN_Muenchen

nat (inside,outside) source dynamic any interface

nat (inside,outside) source static LAN_BiH LAN_BiH destination static LAN_Puchheim LAN_Puchheim

The NAT configuration for Site A to Site C L2L VPN connection is at the very top. Therefore it gets ALWAYS matched first. And that is atleast one reason why the Site A to Site C L2L VPN connection is not expiriencing any problems.

Now notice that the NAT configurations that I suggest you remove is the next in order. Notice also that this NAT configuration would match to the traffic that is supposed to leave UN-NATed because the source address is defined as "any". So any traffic leaving Site C for Site B gets matched to the wrong NAT rule.

If you dont want to remove the NAT configuration I am suggesting there one other option.

First remove the NAT0 / NAT Exempt configuration for the Site C to Site B L2L VPN connection and insert it again with a line number so it goes before the rule I suggest removing.

no nat (inside,outside) source static LAN_BiH LAN_BiH destination static LAN_Puchheim LAN_Puchheim
nat (inside,outside) 2 source static LAN_BiH LAN_BiH destination static LAN_Puchheim LAN_Puchheim

Hope I made sense

- Jouni

View solution in original post

Jouni Forss · ‎04-19-2013

Hi,

Well naturally if you can share the configurations on Site B and Site C we could look through the configurations and see if we could correct those.

There is also an option to tunnel the connections from Site B through Site A to Site C. But with that situation you would naturally be "eating up" the bandwith on Site A also.

But as I said, if we could see the Site B and Site C ASA configurations then we could go through them.

- Jouni

Vihren Todorov · ‎04-19-2013

Hi Jouni,

thanks for the quick reply.

Maybe it would be useful to test the s2s via Site A. How is this called?

Here is Site B ASA Configuration:

: Saved

:

ASA Version 8.4(1)

!

hostname fwpuchheim

domain-name elatec.com

enable password XXXXXXXXXXX encrypted

passwd

XXXXXXXXXXX

encrypted

names

!

interface Vlan1

nameif inside

security-level 100

ip address replaced for security reasons 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

replaced for security

ip address pppoe setroute

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

boot system disk0:/asa841-k8.bin

ftp mode passive

dns server-group DefaultDNS

domain-name replaced for security

object network LAN_Puchheim

subnet 192.168.20.0 255.255.255.0

object network LAN_Muenchen

subnet 192.168.1.0 255.255.255.0

object network LAN_Bosnia

subnet 192.168.30.0 255.255.255.0

description Lan Bosnia

object network NETWORK_OBJ_192.168.30.0_24

subnet 192.168.30.0 255.255.255.0

object service 1723

service tcp destination eq pptp

object service 4500

service udp destination eq 4500

object service 50

service esp

object service 500

service udp destination eq isakmp

object service 51

service ah

object-group service User-Zugriff-Puchheim

description Zugriff der User Puchheim

service-object icmp echo

service-object tcp destination eq ftp

service-object tcp destination eq www

service-object tcp destination eq https

service-object udp destination eq domain

service-object tcp destination eq pop3

service-object tcp destination eq smtp

service-object tcp destination eq ssh

service-object tcp destination eq telnet

service-object tcp destination eq whois

access-list inside_access_in remark Zugriff auf Muenchen ueber VPN

access-list inside_access_in extended permit ip object LAN_Puchheim object LAN_Muenchen

access-list inside_access_in remark User-Protokolle fuer Internet-Zugriff

access-list inside_access_in extended permit object-group User-Zugriff-Puchheim object LAN_Puchheim any inactive

access-list inside_access_in extended permit ip object LAN_Puchheim any

access-list inside_access_in extended permit ip object LAN_Puchheim object LAN_Bosnia

access-list outside_cryptomap extended permit ip object LAN_Puchheim object LAN_Muenchen

access-list outside_access_in extended permit ip object LAN_Muenchen object LAN_Puchheim

access-list outside_access_in extended permit ip object LAN_Bosnia object LAN_Puchheim

access-list outside_cryptomap_1 extended permit ip object LAN_Puchheim object LAN_Bosnia

access-list inside_nat0_outbound extended permit ip 192.168.20.0 255.255.255.0 192.168.30.0 255.255.255.0

access-list split-tunnel standard permit 192.168.20.0 255.255.255.0

pager lines 24

logging enable

logging asdm informational

mtu inside 1500

mtu outside 1500

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-641.bin

no asdm history enable

arp timeout 14400

nat (inside,outside) source static LAN_Puchheim LAN_Puchheim destination static LAN_Muenchen LAN_Muenchen description kein NAT fuer Zugriff auf NW Muenchen

nat (inside,outside) source static LAN_Puchheim LAN_Puchheim destination static LAN_Bosnia LAN_Bosnia

!

object network LAN_Puchheim

nat (any,outside) dynamic interface

access-group inside_access_in in interface inside

access-group outside_access_in in interface outside

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-record DfltAccessPolicy

aaa authentication http console LOCAL

aaa authentication telnet console LOCAL

aaa authentication ssh console LOCAL

http server enable

http 192.168.20.0 255.255.255.0 inside

http replaced for security
255.255.255.248 outside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec ikev2 ipsec-proposal DES

protocol esp encryption des