Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About pkupisie
Stats
Member since
10-01-2012
30
Posts
48
Helpful
3
Solutions
Created by
pkupisie
in VPN and AnyConnect
in VPN and AnyConnect
11-13-2012
06:44 AM
11-13-2012
06:44 AM
I am also not an expert in EEM, but I think google and some labs will help. There was similar issue, but don't know if it will work: https://supportforums.cisco.com/thread/2163577
... View more
11-13-2012
06:31 AM
Yeah, that's what I would check if possible. Just run some FTP server on one side and try to download some file through it to see exact performance. It would let us know if the problem is VPN or the database application. You are saying that there is a delay about 10ms - for some databases it is already a lot. If the client is doing multiple queries it is more sensitive to delay rather then to throughput problems. Another test would be to set-up static NAT and put this database application through Internet without VPN. Obviously it can be security issue, so it is up to you if this solution is possible. After that tests the next step would be to do captures and analyze the data, but before that I would go with above basic tests. Cheers!
... View more
Created by
pkupisie
in VPN and AnyConnect
in VPN and AnyConnect
11-13-2012
06:13 AM
11-13-2012
06:13 AM
You basically wouldn't need to have two Internet connections, but two external IP addressess in two different subnets. I know that this is really not easy to achieve, but I don't think there is other option. Of course manual option would work, at least your network would be always up. In this case you shouldn't have preempt on HSRP (not to have situation in which on ADSL line you have tunnel up, but active HSRP router is the second one). You could try to use EEM (embeded event manager) to try to capture HSRP events and just shut down ADSL interface when the main link is up (HSRP active is the main router). If any of these advices were helpfull for you feel free to rate that posts. Thanks,
... View more
11-13-2012
06:07 AM
Hello Lajja, Please compare encaps/decaps counters in "show crypto ipsec sa" on both ends to see if any packets on the way are being dropped. You can clear this counters before comparison to have good picture. By slow performance what exactly do you mean? You are saying 80mbit/s in pure Internet, can you measure it through VPN?
... View more
Created by
pkupisie
in VPN and AnyConnect
in VPN and AnyConnect
11-12-2012
10:13 AM
11-12-2012
10:13 AM
Hello, I don't think GRE tunnel that you could set up on the switch behind ASA would be really helpfull. Still site-2-site tunnel you want to establish between ASA and some routers, but still it is ASA which needs to make decision about which peer to connect to. Possible solution would be to do HSRP between both routers on LAN side and with two independent tunnels/crypto maps (one on each of them). On ASA you would need to set up two hosts in set peer. Problem of this solution is that if one router at side B is going to go down and second ADSL line will take over ASA will not do preempt after you main Internet connection is up again. This would happen after ADSL Internet connection will be down. Solution to that would be to assign two different public IP addressess on two different interfaces of ASA. Then you attach two crypto maps to both interfaces and by using sla monitor (let's say icmp to main router, if it does not respond then you change routing for remote LAN to second interface) you are selecting which crypto map (with one peer this time) should be used. I hope what I wrote makes some sense.
... View more
11-12-2012
01:05 AM
[toc:faq] 1. Introduction Purpose of this blog post is to have one point at wchich you will find information about what is going in which packet of IKEv2 negotation. IKEv2 establishing contains three main phases: - IKE_SA_INIT - IKE_AUTH - CREATE_CHILD_SA First two are known as Phase 1 and they usually contains for messages and CREATE_CHILD_SA is called Phase 2. Notation used later (from RFC 4306): AUTH Authentication CERT Certificate CERTREQ Certificate Request CP Configuration D Delete E Encrypted EAP Extensible Authentication HDR IKE Header IDi Identification - Initiator IDr Identification - Responder KE Key Exchange Ni, Nr Nonce N Notify SA Security Association TSi Traffic Selector - Initiator TSr Traffic Selector - Responder V Vendor ID Phase 1 Message 1 HDR, SAi1, KEi, Ni --> From RFC 4306: HDR contains the Security Parameter Indexes (SPIs), version numbers, and flags of various sorts. The SAi1 payload states the cryptographic algorithms the initiator supports for the IKE_SA. The KE payload sends the initiator's Diffie-Hellman value. Ni is the initiator's nonce. We can see the difference between IKEv1 main-mode in which DH KE and Nonce were sent in packets 3 and 4. Message 2 <-- HDR, SAr1, KEr, Nr, [CERTREQ] From RFC 4306: The responder chooses a cryptographic suite from the initiator's offered choices and expresses that choice in the SAr1 payload, completes the Diffie-Hellman exchange with the KEr payload, and sends its nonce in the Nr payload Message 3 HDR, SK {IDi, [CERT,] [CERTREQ,] [IDr,] AUTH, SAi2, TSi, TSr} --> SK { ... } is the indicator that data has been encrypted by keys derived from DH. From RFC 4306: The initiator asserts its identity with the IDi payload, proves knowledge of the secret corresponding to IDi and integrity protects the contents of the first message using the AUTH payload. It might also send its certificate(s) in CERT payload(s) and a list of its trust anchors in CERTREQ payload(s). If any CERT payloads are included, the first certificate provided MUST contain the public key used to verify the AUTH field. The optional payload IDr enables the initiator to specify which of the responder's identities it wants to talk to. This is useful when the machine on which the responder is running is hosting multiple identities at the same IP address. The initiator begins negotiation of a CHILD_SA using the SAi2 payload. Message 4 <-- HDR, SK {IDr, [CERT,] AUTH, SAr2, TSi, TSr} From RFC 4306: The responder asserts its identity with the IDr payload, optionally sends one or more certificates (again with the certificate containing the public key used to verify AUTH listed first), authenticates its identity and protects the integrity of the second message with the AUTH payload, and completes negotiation of a CHILD_SA with the additional fields described below in the CREATE_CHILD_SA exchange. The recipients of messages 3 and 4 MUST verify that all signatures and MACs are computed correctly and that the names in the ID payloads correspond to the keys used to generate the AUTH payload. Phase 2 Since this phase can be initiated by different side that Phase 1 please take it considaration here that initiator maybe different host that for Phase1. Request: HDR, SK {[N], SA, Ni, [KEi], [TSi, TSr]} --> From RFC 4306: The initiator sends SA offer(s) in the SA payload, a nonce in the Ni payload, optionally a Diffie-Hellman value in the KEi payload, and the proposed traffic selectors in the TSi and TSr payloads. Response: <-- HDR, SK {SA, Nr, [KEr], [TSi, TSr]} From RFC 4306: The responder replies (using the same Message ID to respond) with the accepted offer in an SA payload, and a Diffie-Hellman value in the KEr payload if KEi was included in the request and the selected cryptographic suite includes that group IOS Debugs Let's take a look how it looks on IOS (from initiator perspective). I am using debug crypto ikev2 packets Message1 *Nov 12 07:59:59.896: IKEv2:% Getting preshared key from profile keyring KEY *Nov 12 07:59:59.896: IKEv2:% Matched peer block 'R2' *Nov 12 07:59:59.896: IKEv2:Searching Policy with fvrf 0, local address 172.16.1.1 *Nov 12 07:59:59.896: IKEv2:Found Policy '10' *Nov 12 07:59:59.896: IKEv2:(SA ID = 1):[IKEv2 -> Crypto Engine] Computing DH public key, DH Group 2 *Nov 12 07:59:59.896: IKEv2:(SA ID = 1):[Crypto Engine -> IKEv2] DH key Computation PASSED *Nov 12 07:59:59.896: IKEv2:(SA ID = 1):Request queued for computation of DH key *Nov 12 07:59:59.896: IKEv2:IKEv2 initiator - no config data to send in IKE_SA_INIT exch *Nov 12 07:59:59.896: IKEv2:(SA ID = 1):Generating IKE_SA_INIT message *Nov 12 07:59:59.896: IKEv2:(SA ID = 1):IKE Proposal: 1, SPI size: 0 (initial negotiation), Num. transforms: 4 3DES MD5 MD596 DH_GROUP_1024_MODP/Group 2 *Nov 12 07:59:59.896: IKEv2:(SA ID = 1):Sending Packet [To 172.16.1.2:500/From 172.16.1.1:500/VRF i0:f0] Initiator SPI : C34ACEF58BA75985 - Responder SPI : 0000000000000000 Message id: 0 IKEv2 IKE_SA_INIT Exchange REQUEST *Nov 12 07:59:59.896: IKEv2:(SA ID = 1):Next payload: SA, version: 2.0 Exchange type: IKE_SA_INIT, flags: INITIATOR Message id: 0, length: 332 Payload contents: SA Next payload: KE, reserved: 0x0, length: 44 last proposal: 0x0, reserved: 0x0, length: 40 Proposal: 1, Protocol id: IKE, SPI size: 0, #trans: 4 last transform: 0x3, reserved: 0x0: length: 8 type: 1, reserved: 0x0, id: 3DES last transform: 0x3, reserved: 0x0: length: 8 type: 2, reserved: 0x0, id: MD5 last transform: 0x3, reserved: 0x0: length: 8 type: 3, reserved: 0x0, id: MD596 last transform: 0x0, reserved: 0x0: length: 8 type: 4, reserved: 0x0, id: DH_GROUP_1024_MODP/Group 2 KE Next payload: N, reserved: 0x0, length: 136 DH group: 2, Reserved: 0x0 N Next payload: VID, reserved: 0x0, length: 24 VID Next payload: VID, reserved: 0x0, length: 23 VID Next payload: NOTIFY, reserved: 0x0, length: 21 NOTIFY(NAT_DETECTION_SOURCE_IP) Next payload: NOTIFY, reserved: 0x0, length: 28 Security protocol id: IKE, spi size: 0, type: NAT_DETECTION_SOURCE_IP NOTIFY(NAT_DETECTION_DESTINATION_IP) Next payload: NONE, reserved: 0x0, length: 28 Security protocol id: IKE, spi size: 0, type: NAT_DETECTION_DESTINATION_IP *Nov 12 07:59:59.897: IKEv2:(SA ID = 1):Insert SA
Message2 *Nov 12 07:59:59.905: IKEv2:(SA ID = 1):Received Packet [From 172.16.1.2:500/To 172.16.1.1:500/VRF i0:f0] Initiator SPI : C34ACEF58BA75985 - Responder SPI : 15E76A8BBE820A0C Message id: 0 IKEv2 IKE_SA_INIT Exchange RESPONSE *Nov 12 07:59:59.905: IKEv2:(SA ID = 1):Next payload: SA, version: 2.0 Exchange type: IKE_SA_INIT, flags: RESPONDER MSG-RESPONSE Message id: 0, length: 445 Payload contents: SA Next payload: KE, reserved: 0x0, length: 44 last proposal: 0x0, reserved: 0x0, length: 40 Proposal: 1, Protocol id: IKE, SPI size: 0, #trans: 4 last transform: 0x3, reserved: 0x0: length: 8 type: 1, reserved: 0x0, id: 3DES last transform: 0x3, reserved: 0x0: length: 8 type: 2, reserved: 0x0, id: MD5 last transform: 0x3, reserved: 0x0: length: 8 type: 3, reserved: 0x0, id: MD596 last transform: 0x0, reserved: 0x0: length: 8 type: 4, reserved: 0x0, id: DH_GROUP_1024_MODP/Group 2 KE Next payload: N, reserved: 0x0, length: 136 DH group: 2, Reserved: 0x0 N Next payload: VID, reserved: 0x0, length: 24 VID Next payload: VID, reserved: 0x0, length: 23 VID Next payload: NOTIFY, reserved: 0x0, length: 21 NOTIFY(NAT_DETECTION_SOURCE_IP) Next payload: NOTIFY, reserved: 0x0, length: 28 Security protocol id: IKE, spi size: 0, type: NAT_DETECTION_SOURCE_IP NOTIFY(NAT_DETECTION_DESTINATION_IP) Next payload: CERTREQ, reserved: 0x0, length: 28 Security protocol id: IKE, spi size: 0, type: NAT_DETECTION_DESTINATION_IP CERTREQ Next payload: NOTIFY, reserved: 0x0, length: 105 Cert encoding Hash and URL of PKIX NOTIFY(HTTP_CERT_LOOKUP_SUPPORTED) Next payload: NONE, reserved: 0x0, length: 8 Security protocol id: IKE, spi size: 0, type: HTTP_CERT_LOOKUP_SUPPORTED *Nov 12 07:59:59.905: IKEv2:(SA ID = 1):Processing IKE_SA_INIT message *Nov 12 07:59:59.905: IKEv2:(SA ID = 1):Verify SA init message *Nov 12 07:59:59.905: IKEv2:(SA ID = 1):Processing IKE_SA_INIT message *Nov 12 07:59:59.905: IKEv2:(SA ID = 1):Checking NAT discovery *Nov 12 07:59:59.905: IKEv2:(SA ID = 1):NAT not found *Nov 12 07:59:59.905: IKEv2:(SA ID = 1):[IKEv2 -> Crypto Engine] Computing DH secret key, DH Group 2 *Nov 12 07:59:59.911: IKEv2:(SA ID = 1):[Crypto Engine -> IKEv2] DH key Computation PASSED *Nov 12 07:59:59.912: IKEv2:(SA ID = 1):Request queued for computation of DH secret *Nov 12 07:59:59.912: IKEv2:(SA ID = 1):[IKEv2 -> Crypto Engine] Calculate SKEYSEED and create rekeyed IKEv2 SA *Nov 12 07:59:59.912: IKEv2:(SA ID = 1):[Crypto Engine -> IKEv2] SKEYSEED calculation and creation of rekeyed IKEv2 SA PASSED *Nov 12 07:59:59.912: IKEv2:(SA ID = 1):Completed SA init exchange *Nov 12 07:59:59.912: IKEv2:(SA ID = 1):Check for EAP exchange Message 3 *Nov 12 07:59:59.912: IKEv2:(SA ID = 1):Generate my authentication data *Nov 12 07:59:59.912: IKEv2:(SA ID = 1):Use preshared key for id 172.16.1.1, key len 5 *Nov 12 07:59:59.912: IKEv2:[IKEv2 -> Crypto Engine] Generate IKEv2 authentication data *Nov 12 07:59:59.912: IKEv2:[Crypto Engine -> IKEv2] IKEv2 authentication data generation PASSED *Nov 12 07:59:59.912: IKEv2:(SA ID = 1):Get my authentication method *Nov 12 07:59:59.912: IKEv2:(SA ID = 1):My authentication method is 'PSK' *Nov 12 07:59:59.912: IKEv2:(SA ID = 1):Check for EAP exchange *Nov 12 07:59:59.912: IKEv2:(SA ID = 1):Generating IKE_AUTH message *Nov 12 07:59:59.912: IKEv2:(SA ID = 1):Constructing IDi payload: '172.16.1.1' of type 'IPv4 address' *Nov 12 07:59:59.912: IKEv2:(SA ID = 1):ESP Proposal: 1, SPI size: 4 (IPSec negotiation), Num. transforms: 3 AES-CBC SHA96 Don't use ESN *Nov 12 07:59:59.912: IKEv2:(SA ID = 1):Building packet for encryption. Payload contents: VID Next payload: IDi, reserved: 0x0, length: 20 IDi Next payload: AUTH, reserved: 0x0, length: 12 Id type: IPv4 address, Reserved: 0x0 0x0 AUTH Next payload: SA, reserved: 0x0, length: 24 Auth method PSK, reserved: 0x0, reserved 0x0 SA Next payload: TSi, reserved: 0x0, length: 44 last proposal: 0x0, reserved: 0x0, length: 40 Proposal: 1, Protocol id: ESP, SPI size: 4, #trans: 3 last transform: 0x3, reserved: 0x0: length: 12 type: 1, reserved: 0x0, id: AES-CBC last transform: 0x3, reserved: 0x0: length: 8 type: 3, reserved: 0x0, id: SHA96 last transform: 0x0, reserved: 0x0: length: 8 type: 5, reserved: 0x0, id: Don't use ESN TSi Next payload: TSr, reserved: 0x0, length: 40 Num of TSs: 2, reserved 0x0, reserved 0x0 TS type: TS_IPV4_ADDR_RANGE, proto id: 1, length: 16 start port: 0, end port: 65535 start addr: 1.1.1.1, end addr: 1.1.1.1 TS type: TS_IPV4_ADDR_RANGE, proto id: 0, length: 16 start port: 0, end port: 65535 start addr: 1.1.1.1, end addr: 1.1.1.1 TSr Next payload: NOTIFY, reserved: 0x0, length: 40 Num of TSs: 2, reserved 0x0, reserved 0x0 TS type: TS_IPV4_ADDR_RANGE, proto id: 1, length: 16 start port: 0, end port: 65535 start addr: 2.2.2.2, end addr: 2.2.2.2 TS type: TS_IPV4_ADDR_RANGE, proto id: 0, length: 16 start port: 0, end port: 65535 start addr: 2.2.2.2, end addr: 2.2.2.2 NOTIFY(INITIAL_CONTACT) Next payload: NOTIFY, reserved: 0x0, length: 8 Security protocol id: IKE, spi size: 0, type: INITIAL_CONTACT NOTIFY(SET_WINDOW_SIZE) Next payload: NOTIFY, reserved: 0x0, length: 12 Security protocol id: IKE, spi size: 0, type: SET_WINDOW_SIZE NOTIFY(ESP_TFC_NO_SUPPORT) Next payload: NOTIFY, reserved: 0x0, length: 8 Security protocol id: IKE, spi size: 0, type: ESP_TFC_NO_SUPPORT NOTIFY(NON_FIRST_FRAGS) Next payload: NONE, reserved: 0x0, length: 8 Security protocol id: IKE, spi size: 0, type: NON_FIRST_FRAGS *Nov 12 07:59:59.913: IKEv2:(SA ID = 1):Sending Packet [To 172.16.1.2:500/From 172.16.1.1:500/VRF i0:f0] Initiator SPI : C34ACEF58BA75985 - Responder SPI : 15E76A8BBE820A0C Message id: 1 IKEv2 IKE_AUTH Exchange REQUEST *Nov 12 07:59:59.913: IKEv2:(SA ID = 1):Next payload: ENCR, version: 2.0 Exchange type: IKE_AUTH, flags: INITIATOR Message id: 1, length: 276 Payload contents: ENCR Next payload: VID, reserved: 0x0, length: 248 Message 4 *Nov 12 07:59:59.916: IKEv2:(SA ID = 1):Received Packet [From 172.16.1.2:500/To 172.16.1.1:500/VRF i0:f0] Initiator SPI : C34ACEF58BA75985 - Responder SPI : 15E76A8BBE820A0C Message id: 1 IKEv2 IKE_AUTH Exchange RESPONSE *Nov 12 07:59:59.916: IKEv2:(SA ID = 1):Next payload: ENCR, version: 2.0 Exchange type: IKE_AUTH, flags: RESPONDER MSG-RESPONSE Message id: 1, length: 236 Payload contents: VID Next payload: IDr, reserved: 0x0, length: 20 IDr Next payload: AUTH, reserved: 0x0, length: 12 Id type: IPv4 address, Reserved: 0x0 0x0 AUTH Next payload: SA, reserved: 0x0, length: 24 Auth method PSK, reserved: 0x0, reserved 0x0 SA Next payload: TSi, reserved: 0x0, length: 44 last proposal: 0x0, reserved: 0x0, length: 40 Proposal: 1, Protocol id: ESP, SPI size: 4, #trans: 3 last transform: 0x3, reserved: 0x0: length: 12 type: 1, reserved: 0x0, id: AES-CBC last transform: 0x3, reserved: 0x0: length: 8 type: 3, reserved: 0x0, id: SHA96 last transform: 0x0, reserved: 0x0: length: 8 type: 5, reserved: 0x0, id: Don't use ESN TSi Next payload: TSr, reserved: 0x0, length: 24 Num of TSs: 1, reserved 0x0, reserved 0x0 TS type: TS_IPV4_ADDR_RANGE, proto id: 0, length: 16 start port: 0, end port: 65535 start addr: 1.1.1.1, end addr: 1.1.1.1 TSr Next payload: NOTIFY, reserved: 0x0, length: 24 Num of TSs: 1, reserved 0x0, reserved 0x0 TS type: TS_IPV4_ADDR_RANGE, proto id: 0, length: 16 start port: 0, end port: 65535 start addr: 2.2.2.2, end addr: 2.2.2.2 NOTIFY(SET_WINDOW_SIZE) Next payload: NOTIFY, reserved: 0x0, length: 12 Security protocol id: IKE, spi size: 0, type: SET_WINDOW_SIZE NOTIFY(ESP_TFC_NO_SUPPORT) Next payload: NOTIFY, reserved: 0x0, length: 8 Security protocol id: IKE, spi size: 0, type: ESP_TFC_NO_SUPPORT NOTIFY(NON_FIRST_FRAGS) Next payload: NONE, reserved: 0x0, length: 8 Security protocol id: IKE, spi size: 0, type: NON_FIRST_FRAGS *Nov 12 07:59:59.920: IKEv2:(SA ID = 1):Process auth response notify *Nov 12 07:59:59.920: IKEv2:(SA ID = 1):Searching policy based on peer's identity '172.16.1.2' of type 'IPv4 address' *Nov 12 07:59:59.920: IKEv2:Searching Policy with fvrf 0, local address 172.16.1.1 *Nov 12 07:59:59.920: IKEv2:Found Policy '10' *Nov 12 07:59:59.920: IKEv2:(SA ID = 1):Verify peer's policy *Nov 12 07:59:59.920: IKEv2:(SA ID = 1):Peer's policy verified *Nov 12 07:59:59.920: IKEv2:(SA ID = 1):Get peer's authentication method *Nov 12 07:59:59.920: IKEv2:(SA ID = 1):Peer's authentication method is 'PSK' *Nov 12 07:59:59.920: IKEv2:(SA ID = 1):Get peer's preshared key for 172.16.1.2 *Nov 12 07:59:59.920: IKEv2:(SA ID = 1):Verify peer's authentication data *Nov 12 07:59:59.920: IKEv2:(SA ID = 1):Use preshared key for id 172.16.1.2, key len 5 *Nov 12 07:59:59.920: IKEv2:[IKEv2 -> Crypto Engine] Generate IKEv2 authentication data *Nov 12 07:59:59.920: IKEv2:[Crypto Engine -> IKEv2] IKEv2 authentication data generation PASSED *Nov 12 07:59:59.920: IKEv2:(SA ID = 1):Verification of peer's authenctication data PASSED *Nov 12 07:59:59.920: IKEv2:(SA ID = 1):Check for EAP exchange *Nov 12 07:59:59.921: IKEv2:(SA ID = 1):Processing IKE_AUTH message *Nov 12 07:59:59.921: IKEv2:KMI/verify policy/sending to IPSec: prot: 3 txfm: 12 hmac 2 flags 8177 keysize 128 IDB 0x0 *Nov 12 07:59:59.921: IKEv2:(SA ID = 1):IKEV2 SA created; inserting SA into database. SA lifetime timer (86400 sec) started *Nov 12 07:59:59.921: IKEv2:(SA ID = 1):Session with IKE ID PAIR (172.16.1.2, 172.16.1.1) is UP *Nov 12 07:59:59.921: IKEv2:IKEv2 MIB tunnel started, tunnel index 1 *Nov 12 07:59:59.921: IKEv2:(SA ID = 1):Load IPSEC key material *Nov 12 07:59:59.921: IKEv2:(SA ID = 1):[IKEv2 -> IPsec] Create IPsec SA into IPsec database *Nov 12 07:59:59.921: IKEv2:(SA ID = 1):Asynchronous request queued *Nov 12 07:59:59.921: IKEv2:(SA ID = 1): *Nov 12 07:59:59.922: IKEv2:(SA ID = 1):[IPsec -> IKEv2] Creation of IPsec SA into IPsec database PASSED *Nov 12 07:59:59.926: IKEv2:(SA ID = 1):Checking for duplicate IKEv2 SA *Nov 12 07:59:59.926: IKEv2:(SA ID = 1):No duplicate IKEv2 SA found. R eferences RFC 4306 - Internet Key Exchange (IKEv2) Protocol: http://tools.ietf.org/html/rfc4306
... View more
Labels:
11-11-2012
11:04 PM
Few things that it would be nice to have attached: 1) Crypto part of the configuration (show runn crypto) 2) show crypto isakmp sa 3) show crypto ipsec sa 4) What is the exact version of the box? If possible please use attachements instead pasting into the posts. If your problem is urgent please create a TAC case, so you will have imidiate somebody to assist you.
... View more
Created by
pkupisie
in VPN and AnyConnect
in VPN and AnyConnect
11-11-2012
12:41 PM
11-11-2012
12:41 PM
Thanks Matt, From the first glance your configuration seem ok, you have even identity nat for that traffic. With the packet-tracer problem was that you were using ASA inside interface in it. You should use any other IP from 192.168.1.0/24 network. Anyway we can some encapsulations in that particular tunnel. I would do the following 1) Verify with packet tracer that there is nothing wrong and packet is going through VPN encrpt step (99% it will) 2) Check what is going on on the second side (Windows). Can you see the packet transmitted by ASA on that machine? If yes what is happening with the response packet. For the moment we see 3 encaps, 0 decaps meaning that most probably no packets are received on ASA. 3) Captures of ESP traffic on outside interfaces of ASA and Windows can be good to use if you are sure that packets are being sent from each of the peer, but not received on other side.
... View more
Created by
pkupisie
in VPN and AnyConnect
in VPN and AnyConnect
11-11-2012
12:28 PM
11-11-2012
12:28 PM
Great to hear Joseph that it worked! Feel free to rate any posts that you found helpful. Have a great afternoon:)
... View more
Created by
pkupisie
in VPN and AnyConnect
in VPN and AnyConnect
11-11-2012
07:45 AM
11-11-2012
07:45 AM
I am a little bit confused with the IP addressess that you put above, since you mixed probably 192.168 with 172.16. Anway you didn't have 172.16.0.0/24 network at all meaning the traffic between for instance 172.16.40.5 and 192.168.0.5 will not establish the tunnel since it doesn't match crypto acl. You can check that it is the issue by looking at show access-list. You will see probably no hit count. After you modify access-list properly than this hit counts will go start to go up and then if the tunnel is still not up we are having some isakmp phase 1 problems. If you need further help please say exactly from where to and to what you are intiaiting traffic (exact IPs) and your current crypto ACl configuration (if you changed anything). Routing we already have.
... View more
Created by
pkupisie
in VPN and AnyConnect
in VPN and AnyConnect
11-11-2012
02:43 AM
11-11-2012
02:43 AM
Hello Matt, Can you please share some part of your configuration regarding to VPN on ASA? Crypto map, ACL, interfaces and routing. You can obviously change the external IPs to something. Please also attach output of command: show crypto ipsec sa while the tunnel is up. It would be nice to look at encaps/decaps statistics to understand what exactly is going on. In regards to the spoofing it is really strange. If you could please also paste "show ip route" output. It could be helpfull. Thanks,
... View more
Created by
pkupisie
in VPN and AnyConnect
in VPN and AnyConnect
11-11-2012
02:30 AM
11-11-2012
02:30 AM
I cannot see on any of the router 172.16.0.0/24, only 172.16.0.0/16 and I think this is the issue. In Crypto ACL you have on branch router: ! ip access-list extended S2S-VPN-TRAFFIC permit ip 192.168.0.0 0.0.0.255 172.16.0.0 0.0.0.255 shouldn't it be: ! ip access-list extended S2S-VPN-TRAFFIC permit ip 192.168.0.0 0.0.0.255 172.16.0.0 0.0.255.255 and of coursed mirrored on the the main router. If this is not the case you are saying that some ping between 192.168.0.x and 172.16.0.x is going ok. Can you please point exactly which one? I could see that you attached some packet tracer, but I couldn't open it.
... View more
Created by
pkupisie
in VPN and AnyConnect
in VPN and AnyConnect
11-10-2012
02:21 AM
11-10-2012
02:21 AM
Can you explain us how 172.16.0.0 is reachable on main router? I cannot see it directly connected, but I can see that you are setting up ospf for that network. We need to be sure that we are going to this network through interface fast 0/0. 'show ip route' output from both routers would be helpfull.
... View more
Created by
pkupisie
in VPN and AnyConnect
in VPN and AnyConnect
10-25-2012
11:32 AM
10-25-2012
11:32 AM
Hello Adrian, Don't know if this is the cause of your issue, but I was thinking about scenario in which after your ISP interface is doing DOWN and UP your IP address is being changed. IOS itself is not deleting isakmp SA because the interface on which you have crypto map attached is down, so the SA will be still up on IOS. On ASA itself since you have default configuration you have DPD (dead peer detection) turned on probably after 10 seconds crypto sa will go down since no DPD reply received. IOS will continue to send encrypted traffic towards ASA, but for ASA tunnel is dead and it will ignore these packets (there should be something in logs), but router will never know it since it has DPDs turned off. It could also happen if you are getting the same IP address from you ISP, but Internet outages are longer than 30seconds. Solution would be to turn on DPDs on IOS: crypto isakmp keepalives TIME_IN_SECONDS periodic Defailts about DPDs: https://supportforums.cisco.com/docs/DOC-8554 Regards,
... View more
Created by
pkupisie
in Security Documents
in Security Documents
10-01-2012
01:54 AM
10-01-2012
01:54 AM
Additional thing regarding multiple contexts. SNMP ENTITY-MIB is not working for non-admin contexts. It is logical, but couldn't find any official reference to it (maybe good to add it to this great DOC): iso.3.6.1.2.1.47.1.1.1.1.11 = No Such Instance currently exists at this OID
... View more
- « Previous
-
- 1
- 2
- Next »
Created by
pkupisie
in VPN and AnyConnect
11-13-2012
11-13-2012
I am also not an expert in EEM, but I think google and some labs will
help.There was similar issue, ...
11-13-2012
Yeah, that's what I would check if possible. Just run some FTP server on
one side and try to downloa...
Created by
pkupisie
in VPN and AnyConnect
11-13-2012
11-13-2012
You basically wouldn't need to have two Internet connections, but two
external IP addressess in two ...
11-13-2012
Hello Lajja,Please compare encaps/decaps counters in "show crypto ipsec
sa" on both ends to see if a...
Created by
pkupisie
in VPN and AnyConnect
11-12-2012
11-12-2012
Hello,I don't think GRE tunnel that you could set up on the switch
behind ASA would be really helpfu...
11-12-2012
[toc:faq]1. IntroductionPurpose of this blog post is to have one point
at wchich you will find infor...
11-11-2012
Few things that it would be nice to have attached:1) Crypto part of the
configuration (show runn cry...
Created by
pkupisie
in VPN and AnyConnect
11-11-2012
11-11-2012
Thanks Matt,From the first glance your configuration seem ok, you have
even identity nat for that tr...
Created by
pkupisie
in VPN and AnyConnect
11-11-2012
11-11-2012
Great to hear Joseph that it worked!Feel free to rate any posts that you
found helpful.Have a great ...
Created by
pkupisie
in VPN and AnyConnect
11-11-2012
11-11-2012
I am a little bit confused with the IP addressess that you put above,
since you mixed probably 192.1...
Created by
pkupisie
in VPN and AnyConnect
11-11-2012
11-11-2012
Hello Matt,Can you please share some part of your configuration
regarding to VPN on ASA?Crypto map, ...
Created by
pkupisie
in VPN and AnyConnect
11-11-2012
11-11-2012
I cannot see on any of the router 172.16.0.0/24, only 172.16.0.0/16 and
I think this is the issue.In...
Created by
pkupisie
in VPN and AnyConnect
11-10-2012
11-10-2012
Can you explain us how 172.16.0.0 is reachable on main router? I cannot
see it directly connected, b...
Created by
pkupisie
in VPN and AnyConnect
10-25-2012
10-25-2012
Hello Adrian,Don't know if this is the cause of your issue, but I was
thinking about scenario in whi...
Created by
pkupisie
in Security Documents
10-01-2012
10-01-2012
Additional thing regarding multiple contexts. SNMP ENTITY-MIB is not
working for non-admin contexts....
- « Previous
-
- 1
- 2
- Next »
Public Statistics
| Date Registered | 10-01-2012 01:52 AM |
| Date Last Visited | 09-09-2019 01:34 AM |
| Total Messages Posted | 30 |
| Total Helpful Votes Received | 48 |
Helpful Votes From
