Site to site VPN issues ASA 8.2(5)

ACiavolino · ‎04-15-2020

So I am having much difficulty with a VPN connection.

I have a site-to-site connection to IP 204.90.187.158, the tunnel is down and I cannot ping it.

I also have an access list "101" that pertains to the connection.

Is it possible to apply an acl list only to a specific VPN connection??

I had a recent issue with not being able to ping the LAN from the anyconnect VPN and have since corrected that, but somehow broke the site to site connection in the process. I am not sure how to correct this issue. Please help?

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2020.04.15 10:11:59 =~=~=~=~=~=~=~=~=~=~=~=
show running-config
: Saved
:
ASA Version 8.2(5) 
!
hostname XtremeV3
domain-name default.domain.invalid
enable password *** encrypted
passwd *** encrypted
multicast-routing
names
name 10.102.1.49 FTP-Server
name 198.133.250.19 GSX-INTERNAL description GSX-INTERNAL
name 10.102.1.84 DVR_Camera
name 10.102.1.52 ERP description MANMAN
name 10.103.1.0 VPN_Network_Range
ddns update method 65.32.1.70
 ddns both
 interval maximum 1 0 0 0
!
ddns update method 65.32.1.65
 ddns both
 interval maximum 1 0 0 0
!
!
interface Ethernet0/0
            
 switchport access vlan 2
!
interface Ethernet0/1
 switchport trunk allowed vlan 1,5
 switchport trunk native vlan 1
 switchport mode trunk
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 10.102.1.1 255.255.255.0 
 ospf cost 10
              
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 67.78.158.186 255.255.255.248 
 igmp forward interface inside
 ospf cost 10
!
interface Vlan5
 nameif Guest-VLAN
 security-level 10
 ip address 10.0.0.1 255.255.255.0 
!
boot system disk0:/asa825-k8.bin
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns domain-lookup inside
dns domain-lookup outside
dns server-group DefaultDNS
 name-server 208.67.222.222
 name-server 208.67.220.220
 name-server 65.32.1.65
 name-server 65.32.1.70
              
 domain-name default.domain.invalid
dns server-group OpenDNS
 name-server 208.67.222.222
 name-server 208.67.220.220
 domain-name default.domain.invalid
same-security-traffic permit intra-interface
object-group service Reflection tcp
 port-object eq 1570
object-group network STATIC-PAT
object-group service NVRCamera tcp
 description NVR access
 port-object eq 7443
object-group service HTTP_camera tcp
 port-object eq 7080
object-group service RDP tcp
 port-object eq 3389
object-group network VPN
access-list inside_nat0_outbound extended permit ip any 10.102.1.16 255.255.255.240 
access-list outside_access_in extended permit ip any any inactive 
access-list outside_access_in extended permit tcp any 67.78.158.184 255.255.255.248 object-group NVRCamera 
access-list outside_access_in extended permit tcp any interface outside object-group HTTP_camera 
access-list inside_outbound_nat0_acl extended permit ip host 10.102.1.10 host GSX-INTERNAL 
access-list inside_outbound_nat0_acl extended permit ip host 10.102.1.10 host 198.133.250.39 
access-list inside_outbound_nat0_acl extended permit ip host 67.78.158.187 host GSX-INTERNAL 
<--- More --->
              
access-list inside_outbound_nat0_acl extended permit ip host 67.78.158.187 host 198.133.250.39 
access-list inside_outbound_nat0_acl extended permit ip 10.102.1.0 255.255.255.0 67.78.158.184 255.255.255.248 
access-list inside_outbound_nat0_acl extended permit ip 10.102.1.0 255.255.255.0 VPN_Network_Range 255.255.255.0 
access-list Locan_lan_access remark VNP client local lan access
access-list Locan_lan_access standard permit host 0.0.0.0 
access-list Locan_lan_access remark VNP client local lan access
access-list Locan_lan_access remark VNP client local lan access
access-list Locan_lan_access remark VNP client local lan access
access-list Locan_lan_access remark VNP client local lan access
access-list Locan_lan_access remark VNP client local lan access
access-list outside_1_cryptomap extended permit ip host 10.102.1.10 host GSX-INTERNAL 
access-list outside_1_cryptomap extended permit ip host 10.102.1.10 host 198.133.250.39 
access-list outside_1_cryptomap extended permit ip host 67.78.158.187 host GSX-INTERNAL 
access-list outside_1_cryptomap extended permit ip host 67.78.158.187 host 198.133.250.39 
access-list 101 extended permit ip host GSX-INTERNAL host ERP 
access-list 101 extended permit ip host 204.90.187.158 host ERP 
access-list 101 extended permit esp host GSX-INTERNAL host ERP 
access-list 101 extended permit esp host 204.90.187.158 host ERP 
access-list 101 extended permit tcp host GSX-INTERNAL host ERP 
access-list 101 extended permit tcp host 204.90.187.158 host ERP 
access-list 101 extended permit tcp host GSX-INTERNAL host 67.78.158.186 
access-list 101 extended permit tcp host 204.90.187.158 host 67.78.158.186 
access-list 101 extended permit ip host 198.133.250.39 host ERP 
access-list 101 extended permit esp host 198.133.250.39 host ERP 
         
access-list 101 extended permit tcp host 198.133.250.39 host ERP 
access-list 101 extended permit tcp host 198.133.250.39 host 67.78.158.186 
access-list 101 extended permit ip host 198.133.250.39 host 10.102.1.10 
access-list 101 extended permit esp host 198.133.250.39 host 10.102.1.10 
access-list 101 extended permit tcp host 198.133.250.39 host 10.102.1.10 
access-list 101 extended permit ip host GSX-INTERNAL host 10.102.1.10 
access-list 101 extended permit esp host GSX-INTERNAL host 10.102.1.10 
access-list 101 extended permit tcp host GSX-INTERNAL host 10.102.1.10 
access-list 101 extended permit ip host GSX-INTERNAL host 67.78.158.187 
access-list 101 extended permit ip host 204.90.187.158 host 67.78.158.187 
access-list 101 extended permit esp host GSX-INTERNAL host 67.78.158.187 
access-list 101 extended permit esp host 204.90.187.158 host 67.78.158.187 
access-list 101 extended permit tcp host GSX-INTERNAL host 67.78.158.187 
access-list 101 extended permit tcp host 204.90.187.158 host 67.78.158.187 
access-list 101 extended permit ip host 198.133.250.39 host 67.78.158.187 
access-list 101 extended permit esp host 198.133.250.39 host 67.78.158.187 
access-list 101 extended permit tcp host 198.133.250.39 host 67.78.158.187 
access-list 101 extended permit ip host 65.182.161.9 any 
access-list Split_Tunnel_List remark Network behind the ASA Firewall.
access-list Split_Tunnel_List standard permit 10.102.1.16 255.255.255.240 
access-list Split_Tunnel_List standard permit host FTP-Server 
access-list Split_Tunnel_List standard permit host ERP 
access-list Split_Tunnel_List standard permit host 10.102.1.10 
access-list Split_Tunnel_List standard permit 10.102.1.0 255.255.255.0 
              
access-list inside_access_in extended permit ip any any 
access-list inside_access_in extended deny tcp any any eq smtp 
access-list inside_nat0_outbound_1 extended permit ip any VPN_Network_Range 255.255.255.0 
access-list vpn-dflt-access extended permit ip 10.102.1.0 255.255.255.0 VPN_Network_Range 255.255.255.0 
access-list vpn-dflt-access extended permit ip VPN_Network_Range 255.255.255.0 10.102.1.0 255.255.255.0 
access-list split-acl standard permit 10.102.1.0 255.255.255.0 
access-list NONAT extended permit ip 10.102.1.0 255.255.255.0 VPN_Network_Range 255.255.255.0 
access-list Split-Tunnel standard permit 10.102.1.0 255.255.255.0 
access-list Split-Tunnel standard permit VPN_Network_Range 255.255.255.0 
access-list SPLIT_TUNNEL standard permit 10.102.1.0 255.255.255.0 
pager lines 24
logging enable
logging list VPNLogging level informational class vpn
logging buffer-size 16384
logging buffered informational
logging trap informational
logging asdm informational
logging class auth asdm informational 
mtu inside 1500
mtu outside 1500
mtu Guest-VLAN 1500
ip local pool xtremv3 10.103.1.31-10.103.1.80 mask 255.255.255.0
no failover
icmp unreachable rate-limit 1 burst-size 1
              
icmp deny any outside
asdm image disk0:/asdm-649-103.bin
no asdm history enable
arp timeout 14400
nat-control
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0
nat (Guest-VLAN) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp interface 7443 DVR_Camera 7443 netmask 255.255.255.255 
static (inside,outside) tcp interface 7080 DVR_Camera 7080 netmask 255.255.255.255 
static (inside,outside) 67.78.158.187 ERP netmask 255.255.255.255 
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 67.78.158.185 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
nac-policy DfltGrpPolicy-nac-framework-create nac-framework
              
 reval-period 36000
 sq-period 300
aaa authentication enable console LOCAL 
aaa authentication http console LOCAL 
aaa authentication ssh console LOCAL 
aaa authentication telnet console LOCAL 
aaa authorization command LOCAL 
http server enable
http 65.182.161.9 255.255.255.255 outside
http 10.102.1.0 255.255.255.0 inside
http 67.78.158.190 255.255.255.255 outside
http 65.182.188.212 255.255.255.255 outside
http 202.164.41.226 255.255.255.255 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac 
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac 
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac 
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac 
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac 
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac 
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac 
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac 
              
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac 
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac 
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto ipsec fragmentation after-encryption inside
crypto ipsec fragmentation after-encryption outside
crypto dynamic-map outside_dyn_map 20 set pfs 
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set peer 204.90.187.158 
crypto map outside_map 1 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto ca certificate map DefaultCertificateMap 10
crypto isakmp enable inside
crypto isakmp enable outside
crypto isakmp policy 1
 authentication pre-share
 encryption 3des
 hash md5
 group 2
 lifetime 3600
crypto isakmp policy 10
 authentication pre-share
<--- More --->
              
 encryption 3des
 hash md5
 group 2
 lifetime 28800
crypto isakmp policy 30
 authentication crack
 encryption 3des
 hash md5
 group 2
 lifetime 86400
crypto isakmp nat-traversal 100
no vpn-addr-assign aaa
no vpn-addr-assign dhcp
vpn-addr-assign local reuse-delay 5
telnet 10.102.1.90 255.255.255.255 inside
telnet ERP 255.255.255.255 inside
telnet 10.102.1.70 255.255.255.255 inside
telnet timeout 5
ssh timeout 5
console timeout 0
management-access inside
dhcp-client update dns server both
dhcpd auto_config outside
!
              
dhcpd address 10.0.0.100-10.0.0.254 Guest-VLAN
dhcpd dns 8.8.8.8 8.8.4.4 interface Guest-VLAN
dhcpd lease 11520 interface Guest-VLAN
dhcpd enable Guest-VLAN
!

threat-detection basic-threat
threat-detection statistics host
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 129.6.15.28 source outside
webvpn
 enable inside
 enable outside
 anyconnect-essentials
 svc image disk0:/anyconnect-win-2.4.1012-k9.pkg 1
 svc image disk0:/anyconnect-macosx-i386-2.5.6005-k9.pkg 2
 svc enable
 tunnel-group-list enable
group-policy DfltGrpPolicy attributes
 dns-server value 208.67.222.222 208.67.220.220
 vpn-simultaneous-logins 10
 vpn-filter value vpn-dflt-access
 vpn-tunnel-protocol IPSec l2tp-ipsec svc 
              
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value Split_Tunnel_List
 default-domain value default.domain.invalid
 nac-settings value DfltGrpPolicy-nac-framework-create
 address-pools value xtremv3
 webvpn
  svc keepalive none
  svc rekey method ssl
  svc dpd-interval client none
  svc dpd-interval gateway none
  svc compression deflate
  customization value DfltCustomization
group-policy vthree-na internal
group-policy vthree-na attributes
 wins-server none
 dns-server value 208.67.222.222 208.67.220.220
 vpn-idle-timeout 47
 vpn-tunnel-protocol IPSec l2tp-ipsec svc 
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value SPLIT_TUNNEL
 default-domain value default.domain.invalid
 address-pools value xtremv3
tunnel-group DefaultL2LGroup general-attributes
 default-group-policy vthree-na
tunnel-group DefaultL2LGroup ipsec-attributes
 pre-shared-key *****
tunnel-group DefaultRAGroup general-attributes
              
 address-pool xtremv3
 authorization-server-group LOCAL
 default-group-policy vthree-na
tunnel-group DefaultRAGroup ipsec-attributes
 pre-shared-key *****
 peer-id-validate nocheck
 isakmp ikev1-user-authentication none
tunnel-group DefaultRAGroup ppp-attributes
 authentication pap
 authentication ms-chap-v2
 authentication eap-proxy
tunnel-group DefaultWEBVPNGroup general-attributes
 address-pool xtremv3
 default-group-policy vthree-na
 password-management password-expire-in-days 5
tunnel-group vthree-na type remote-access
tunnel-group vthree-na general-attributes
 address-pool (inside) xtremv3
 address-pool xtremv3
 authorization-server-group LOCAL
 default-group-policy vthree-na
 username-from-certificate use-entire-name
tunnel-group vthree-na ipsec-attributes
 pre-shared-key *****
              
 peer-id-validate nocheck
 isakmp ikev1-user-authentication none
tunnel-group cisco type remote-access
tunnel-group cisco general-attributes
 address-pool xtremv3
 default-group-policy vthree-na
tunnel-group cisco ipsec-attributes
 pre-shared-key *****
tunnel-group 204.90.187.158 type ipsec-l2l
tunnel-group 204.90.187.158 general-attributes
 default-group-policy vthree-na
tunnel-group 204.90.187.158 ipsec-attributes
 pre-shared-key *****
tunnel-group-map enable rules
tunnel-group-map default-group vthree-na
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
              
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect esmtp 
  inspect sqlnet 
  inspect skinny  
  inspect sunrpc 
  inspect xdmcp 
  inspect sip  
  inspect netbios 
  inspect tftp 
  inspect ip-options 
!
service-policy global_policy global
prompt hostname context 
no compression svc http-comp
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
              
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:
: end

XtremeV3(config)#

Georg Pauwen · ‎04-15-2020

Hello,

you need to have a crypto map that matches access list 101. The only map I see is this:

crypto map outside_map 1 match address outside_1_cryptomap

Do you have the configuration of the other side as well ?

ACiavolino · ‎04-15-2020

Hi George,

I do not have control over the other side of the tunnel. So I am unsure of all the configs there.

Richard Burts · ‎04-15-2020

You ask this question "Is it possible to apply an acl list only to a specific VPN connection". I am not clear exactly what you are getting at. There are multiple ways that an access list can be used. The most common use is to filter traffic as it goes in or out through an interface. But an access list can also be used to define interesting traffic for a VPN. In the context of defining interesting traffic then it is certainly possible to apply an access list only to a specific VPN connection. In the context of filtering traffic on an interface it is difficult to see how you would apply an acl only to a specific VPN connection.

You mention access list 101 and I do see that access list in the configuration. But I do not see that this acl is applied to anything. Can you clarify what this access list is intended for?

You mention site to site vpn and also remote access vpn. Can you clarify if the site to site used to work and then in making changes for the remote access vpn that the site to site stopped working? If so can you tell us what issue you were working on for remote access vpn and what you changed?

HTH

Rick

ACiavolino · ‎04-15-2020

Hi Rick,

I'll try and answer your questions as best as I can as I am a novice with Cisco.

The connect vpn was having issues after I changed the VPN pool range to include more IP addresses. No one could ping any of the LAN resources from the remote access VPN after I modified the pool.

The VPN remote access connections were changed to use NONAT and they are working now, but the rules for the "101" are no longer applied in the access list (which is why you don't see them applied)

However, If I do try to apply them, the LAN is no longer pingable from the VPN.

Ok, so I wanted to know if I could apply 101 ONLY to the site-to-site VPN as a separate rule set. Is that possible?

ACiavolino · ‎04-15-2020

Or will I have to modify all the rules and remove the NONAT?

Georg Pauwen · ‎04-15-2020

Hello,

follow the guide below. It is for Anyconnect SSL, but it should work for any remote access VPN:

https://grumpy-networkers-journal.readthedocs.io/en/latest/NETWORKING/VPNS/SSL/SSLVPNACASA8x.html

Richard Burts · ‎04-15-2020

I would not think that increasing the size of the address pool for remote access vpn should impact site to site vpn. And I am not clear how implementing no nat would fix the problem with size of the pool. But I can imaging that implementing no nat for remote access vpn might impact the site to site.

I am not clear how access list 101 was applied before. Perhaps you can clarify that?

You talk about applying an access to a single vpn and I am not clear exactly what you mean. In the crypto map is a statement that specifies an access list to identify traffic to be encrypted. Currently your config uses access list outside_1_cryptomap for this. Are you suggesting using 101 instead? Or are you suggesting something else instead.

In terms of why the site to site vpn is not coming up as a first step can you verify that the ASA is able to access the IP address of the peer? It might help identify the problem is you would run debug crypto isakmp, try to send some traffic through the vpn, and post any debug output.

HTH

Rick

ACiavolino · ‎04-15-2020

I am wondering if using cryptomap pointing to "101" access list may fix the issue since those are all the rules pertaining to the site-to-site, but I am not an expert. As of right now I cannot ping the peer address (204.90.187.158) of the VPN and the ASDM shows no IPSec active connection.

Richard Burts · ‎04-16-2020

You ask if using acl 101 in the crypto map might fix the problem. While I am still not clear what was the intention of acl 101 I am pretty sure that using it in the crypto map will not fix the problem. I would expect that the acl used in the crypto map would specify inside addresses as the source and outside addresses as the destination, but acl 101 consistently uses outside addresses as the source and inside addresses as the destination.

I wondered if changes you made for nat0 for remote access vpn might have impacted the site to site vpn. But in looking at the nat0 rules it does include the site to site addresses. So I do not believe this is the issue.

If you are not able to ping the remote peer address that would be a problem for bringing up the vpn. I think we should focus on this issue. Where are you doing the ping from?

HTH

Rick

ACiavolino · ‎04-16-2020

I tried to ping it from inside the ASDM. The connection does not show up in the Monitoring>VPN statistics> Sessions window like it did before. It there a way to try to restart the tunnel?

Richard Burts · ‎04-16-2020

Just to check, are you able to ping something on the Internet by IP address using ASDM?

The best way to restart the tunnel is to have one of the two hosts in your network that are specified for the vpn to access one of the two destination hosts that are specified for the vpn. It might be helpful if you run debug crypto isakmp, attempt the access, and post any debug output. This should give us some insight into what is not working.

HTH

Rick

ACiavolino · ‎04-16-2020

What is the command to display the debug info?

Richard Burts · ‎04-16-2020

In CLI use show logging. There is also an option in ASDM to view log messages

HTH

Rick

ACiavolino · ‎04-16-2020

XtremeV3# show crypto debug

Crypto conditional debug is turned OFF
IKE debug context unmatched flag: OFF
IPSec debug context unmatched flag: OFF
IKE debug context error flag: OFF
IPSec debug context error flag: OFF

I imagine these will need to be turned on? How do I change the flags?