Hi Daniel,
thank you for your replay.
Yes, there is traffic in the tunnel. When the ASA makes the connection. From the RV side is it atm impossible to make a connection. Why? That's the question.
1- Pings are ok.
2- Step 1 is ok. I did ping -t from both sides to each other server. No Problem and no Interuption.
3- Gateway is correct. Clients from both sides can go to the internet.With VPN and without.
4- Client Firewalls may not be the problem. On the ASA site is everthing the same as before.
5- wireshark can I run, when I'm at the customer again.
Fact is, that the old config with ASA-VPN-ASA is still running. Outlook on the branch site makes no troubles. And, with RV215-VPN-ASA seems also all ok. Eg. RDP from one server to the other over VPN. Except that the Outlook 2003 on the branch site cannot connect to the Exchange Server on the main site throug the tunnel.
The only thing that I had found now is that the ASA clock had a difference for several hours. I changed that. Now I have to test this week. Or is this not so important for the VPN tunnel?
Here is the config of the Branch-ASA:
: Saved
: Written by oneit at 02:01:54.772 UTC Mon Aug 26 2013
!
ASA Version 7.2(4)
!
hostname procxx
domain-name default.domain.invalid
enable password xxxxxxxxxxxxxxxx encrypted
passwd xxxxxxxxxxxxx encrypted
names
!
interface Vlan2
nameif outside
security-level 0
ip address 80.122.xxx.xxx 255.255.255.0
!
interface Vlan3
nameif inside
security-level 100
ip address 10.15.2.1 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
switchport access vlan 3
!
interface Ethernet0/2
switchport access vlan 3
!
interface Ethernet0/3
switchport access vlan 3
!
interface Ethernet0/4
switchport access vlan 3
!
interface Ethernet0/5
switchport access vlan 3
!
interface Ethernet0/6
switchport access vlan 3
!
interface Ethernet0/7
switchport access vlan 3
!
ftp mode passive
dns server-group DefaultDNS
domain-name default.domain.invalid
same-security-traffic permit inter-interface
access-list outside_in extended permit icmp any any echo-reply
access-list outside_in extended permit icmp any any unreachable
access-list outside_in extended permit icmp any any time-exceeded
access-list outside_in extended permit icmp any any source-quench
access-list NO_NAT extended permit ip 10.15.2.0 255.255.255.0 10.15.1.0 255.255.255.0
access-list NO_NAT extended permit ip 10.15.2.0 255.255.255.0 10.15.4.0 255.255.255.0
access-list VPN-SplitT extended permit ip 10.15.2.0 255.255.255.0 10.15.1.0 255.255.255.0
access-list VPN-SplitT-RemotE extended permit ip 10.15.2.0 255.255.255.0 10.15.4.0 255.255.255.0
access-list hotel extended permit ip 10.15.4.0 255.255.255.0 host 10.15.2.11
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu inside 1500
ip local pool canti-pool 10.15.4.1-10.15.4.254 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list NO_NAT
nat (inside) 1 0.0.0.0 0.0.0.0
access-group outside_in in interface outside
route outside 0.0.0.0 0.0.0.0 80.122.183.213 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
aaa authentication ssh console LOCAL
aaa authentication enable console LOCAL
http server enable
http 10.15.0.0 255.255.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set CAN2PRO esp-3des esp-sha-hmac
crypto ipsec transform-set CaN2RemotE esp-aes esp-sha-hmac
crypto dynamic-map vpn-client-map 9999 set transform-set CaN2RemotE
crypto map canti 10 match address VPN-SplitT
crypto map canti 10 set peer 88.116.109.110
crypto map canti 10 set transform-set CAN2PRO
crypto map canti 9999 ipsec-isakmp dynamic vpn-client-map
crypto map canti interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 5
lifetime 86400
crypto isakmp policy 9999
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
crypto isakmp nat-traversal 10
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 20
console timeout 0
management-access inside
dhcpd dns 10.15.1.50 195.3.96.67
dhcpd domain ca.priv
!
dhcpd address 10.15.2.10-10.15.2.20 inside
dhcpd enable inside
!
tftp-server inside 10.15.2.60 ASA
group-policy vpn internal
group-policy vpn attributes
dns-server value 10.15.1.60
split-tunnel-policy tunnelspecified
split-tunnel-network-list value VPN-SplitT-RemotE
username xxxx
vpn-simultaneous-logins 0
username hotel password YjfZM08Zw6m4BWFa encrypted
username hotel attributes
vpn-filter value hotel
tunnel-group 88.116.109.xxx type ipsec-l2l
tunnel-group 88.116.109.xxx ipsec-attributes
pre-shared-key qxxxxxxxx
tunnel-group ProcRemotE type ipsec-ra
tunnel-group ProcRemotE general-attributes
address-pool canti-pool
default-group-policy vpn
tunnel-group ProcRemotE ipsec-attributes
pre-shared-key @m35@d5KuW5idH!:!@procacci!
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:8ee2aad25429bdf747fd78f08f91ec80
: end
ATM I dont have Screenshots from the RV config. For that I have to change it with the ASA on the Main Site. Maybe I can post this this week.
Thank you for your help
Chris
