Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About femi.agboade
Stats
Member since
01-22-2009
157
Posts
0
Helpful
0
Solutions
11-17-2015
03:43 AM
Hello Richard,
Thanks for the feedback. All seems to be working just fine now. The routing issues were config related from the remote side.
I however do have another issue. As you may have noticed with the following commands, i access some web services on the 172.30.50.2 server:
object network UAT_CONN_35180 host 172.30.50.2 object network UAT_CONN_35160 host 172.30.50.2
object network UAT_CONN_35180 nat (UAT_CONN,Outside) static 5.5.5.6 service tcp 35180 35180 object network UAT_CONN_35160 nat (UAT_CONN,Outside) static 5.5.5.6 service tcp 35160 35160
But I can no longer access these services when i browse to the 5.5.5.6 IP. I have changed the public facing IP 5.5.5.6 to another and i am then able to access these services.
I need to be able to access these services on this 5.5.5.6 IP, so would appreciate if you can guide on what i may have done wrong with my config that has caused this issue.
Regards,
Femi
... View more
11-15-2015
09:16 AM
Hi Richard,
So i made some changes to my config and i can now successfully establish a VPN tunnel. However, i am unable to pass traffic but will take that up with the remote end admin tomorrow. Below are the changes i made:
Added:
object network UAT_CONN_NAT-host host 5.5.5.6 object network PROD_CONN-host host 172.19.205.31 object network PROD_CONN_NAT-host host 5.5.5.3 ! crypto map Outside_map 1 set ikev2 ipsec-proposal AES256_OPRS (dont think it affects the config in anyway as ikev2 is not used) crypto map Outside_map 1 set security-association lifetime kilobytes 4608000 ! crypto ikev2 enable Outside (just to enable ikev2 on the interface though its not used) !
Removed
tunnel-group 8.8.8.25 general-attributes default-group-policy OPRS_GroupPolicy1
Replaced object-group network To_OPRS network-object object PROD_CONN-nat network-object object UAT_CONN-nat With object-group network To_OPRS network-object object PROD_CONN_NAT-host network-object object UAT_CONN_NAT-host
Replaced access-list OPRS extended permit ip object UAT_CONN-host object OPRS_Test With access-list OPRS extended permit object-group IP_TCP_PROTOCOLS object-group To_OPRS object-group From_OPRS
Replaced nat (UAT_CONN,Outside) source static UAT_CONN-host UAT_CONN-host destination static OPRS_Test OPRS_Test no-proxy-arp route-lookup nat (UAT_CONN,Outside) source static UAT_CONN-nat UAT_CONN-nat destination static OPRS_Test OPRS_Test no-proxy-arp route-lookup nat (PROD_CONN,Outside) source static PROD_CONN-nat PROD_CONN-nat destination static OPRS_Live OPRS_Live no-proxy-arp route-lookup With nat (UAT_CONN,Outside) source static UAT_CONN-host UAT_CONN_NAT-host destination static OPRS_Test OPRS_Test nat (PROD_CONN,Outside) source static PROD_CONN-host PROD_CONN_NAT-host destination static OPRS_Live OPRS_Live
Replaced crypto ikev2 policy 1 lifetime seconds 1800 With crypto ikev2 policy 1 lifetime seconds 28800
Regards,
Femi
... View more
11-14-2015
02:54 PM
Hello Richard,
Thank you for your reply.
I will request from the service provider to see their side of the config on Monday and share same here as they arent available over the weekend.
As regards the interesting traffic to process, let me explain a little further. On my side, i have a local host IP as 172.30.50.2 and the remote host IP is 8.8.8.10. However, the remote side will only allow me to communicate with the remote server via a public IP, in this case 5.5.5.6, hence the reason i have the following commands for the static IP mapping:
object network OPRS_Test host 8.8.8.10 ! object network UAT_CONN-nat host 172.30.5.2 ! object network UAT_CONN-nat nat (UAT_CONN,Outside) static 5.5.5.6 ! nat (UAT_CONN,Outside) source static UAT_CONN-nat UAT_CONN-nat destination static OPRS_Test OPRS_Test no-proxy-arp route-lookup
I believe this is correct right?
As for the phase 2 lifetime of 1800 secs, it is included in the config, please see below:
crypto map Outside_map 1 set security-association lifetime seconds 1800
That is where it ought to be specified isnt it?
Again, thanks for taking a look at my post, would appreciate any additional feedback on my comments above.
Regards,
Femi
... View more
11-14-2015
06:14 AM
Hello,
I'm having some errors with setting up a site to site VPN between my ASA 5510 and a clients 3845 Router. I keep getting the behaviour such that the phase 1 of the VPN session stays established for about 32 seconds, disconnects and automatically reconnects again and this just goes on and on forever, without the Phase 2 ever really getting initiated. I have attached a screen shot of the errors that come up on the ASA's ASDM syslog interface and below is a snippet of the config i have applied on the ASA and the parameters provided by the service provider.
ASA Config
object network PROD_CONN-nat host 172.19.205.31 object network UAT_CONN_35180 host 172.30.50.2 object network UAT_CONN_35160 host 172.30.50.2 object network OPRS_Live host 7.7.7.7 object network OPRS_Test host 8.8.8.10 object network UAT_CONN-nat host 172.30.5.2 object network UAT_CONN_host host 172.30.50.2
object-group network From_OPRS network-object object OPRS_Live network-object object OPRS_Test object-group network To_OPRS network-object object PROD_CONN-nat network-object object UAT_CONN-nat object-group protocol IP_TCP_PROTOCOLS protocol-object ip protocol-object tcp
access-list OPRS extended permit ip object UAT_CONN_host object OPRS_Test
arp timeout 14400 no arp permit-nonconnected nat (UAT_CONN,Outside) source static UAT_CONN_host UAT_CONN_host destination static OPRS_Test OPRS_Test no-proxy-arp route-lookup nat (UAT_CONN,Outside) source static UAT_CONN-nat UAT_CONN-nat destination static OPRS_Test OPRS_Test no-proxy-arp route-lookup nat (PROD_CONN,Outside) source static PROD_CONN-nat PROD_CONN-nat destination static OPRS_Live OPRS_Live no-proxy-arp route-lookup !
object network PROD_CONN-nat nat (PROD_CONN,Outside) static 5.5.5.3 object network UAT_CONN_35180 nat (UAT_CONN,Outside) static 5.5.5.6 service tcp 35180 35180 object network UAT_CONN_35160 nat (UAT_CONN,Outside) static 5.5.5.6 service tcp 35160 35160 object network UAT_CONN-nat nat (UAT_CONN,Outside) static 5.5.5.6
access-group Outside_access_in in interface Outside
route Outside 0.0.0.0 0.0.0.0 5.5.5.1 1
dynamic-access-policy-record DfltAccessPolicy
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac crypto ipsec ikev2 ipsec-proposal DES protocol esp encryption des protocol esp integrity sha-1 md5 crypto ipsec ikev2 ipsec-proposal 3DES protocol esp encryption 3des protocol esp integrity sha-1 md5 crypto ipsec ikev2 ipsec-proposal AES protocol esp encryption aes protocol esp integrity sha-1 md5 crypto ipsec ikev2 ipsec-proposal AES192 protocol esp encryption aes-192 protocol esp integrity sha-1 md5 crypto ipsec ikev2 ipsec-proposal AES256 protocol esp encryption aes-256 protocol esp integrity sha-1 md5 crypto ipsec ikev2 ipsec-proposal AES256_OPRS protocol esp encryption aes-256 protocol esp integrity sha-1 crypto ipsec security-association pmtu-aging infinite crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5 crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime seconds 28800 crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime kilobytes 4608000 crypto map Outside_map 1 match address OPRS crypto map Outside_map 1 set pfs group5 crypto map Outside_map 1 set peer 8.8.8.25 crypto map Outside_map 1 set ikev1 transform-set ESP-AES-256-SHA crypto map Outside_map 1 set security-association lifetime seconds 1800 crypto map Outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP crypto map Outside_map interface Outside crypto ca trustpool policy crypto ikev2 policy 1 encryption aes-256 integrity sha group 5 prf sha lifetime seconds 1800 crypto ikev2 policy 2 encryption aes-256 integrity sha group 2 prf sha lifetime seconds 1880 crypto ikev2 policy 10 encryption aes-192 integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 policy 20 encryption aes integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 policy 30 encryption 3des integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 policy 40 encryption des integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev1 enable Outside crypto ikev1 policy 1 authentication pre-share encryption aes-256 hash sha group 5 lifetime 28800 crypto ikev1 policy 2 authentication pre-share encryption aes-256 hash sha group 2 lifetime 28800 crypto ikev1 policy 10 authentication crack encryption aes-256 hash sha group 2 lifetime 86400 crypto ikev1 policy 20 authentication rsa-sig encryption aes-256 hash sha group 2 lifetime 86400 crypto ikev1 policy 30 authentication pre-share encryption aes-256 hash sha group 2 lifetime 86400 crypto ikev1 policy 40 authentication crack encryption aes-192 hash sha group 2 lifetime 86400 crypto ikev1 policy 50 authentication rsa-sig encryption aes-192 hash sha group 2 lifetime 86400 crypto ikev1 policy 60 authentication pre-share encryption aes-192 hash sha group 2 lifetime 86400 crypto ikev1 policy 70 authentication crack encryption aes hash sha group 2 lifetime 86400 crypto ikev1 policy 80 authentication rsa-sig encryption aes hash sha group 2 lifetime 86400 crypto ikev1 policy 90 authentication pre-share encryption aes hash sha group 2 lifetime 86400 crypto ikev1 policy 100 authentication crack encryption 3des hash sha group 2 lifetime 86400 crypto ikev1 policy 110 authentication rsa-sig encryption 3des hash sha group 2 lifetime 86400 crypto ikev1 policy 120 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 crypto ikev1 policy 130 authentication crack encryption des hash sha group 2 lifetime 86400 crypto ikev1 policy 140 authentication rsa-sig encryption des hash sha group 2 lifetime 86400 crypto ikev1 policy 150 authentication pre-share encryption des hash sha group 2 lifetime 86400
group-policy DfltGrpPolicy attributes vpn-idle-timeout none
group-policy OPRS_GroupPolicy1 internal group-policy OPRS_GroupPolicy1 attributes vpn-filter value OPRS vpn-tunnel-protocol ikev1
tunnel-group 8.8.8.25 type ipsec-l2l tunnel-group 8.8.8.25 general-attributes default-group-policy OPRS_GroupPolicy1 tunnel-group 8.8.8.25 ipsec-attributes ikev1 pre-shared-key ***** ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp inspect ip-options inspect ctiqbe inspect http inspect icmp inspect icmp error inspect mgcp inspect snmp class class-default set connection decrement-ttl ! service-policy global_policy global
Config Parameters
IKE Parameters
IKE Encryption (DES, 3DES, AES)
AES 256
Authentication Method (MD5, SHA)
SHA
Diffie-Helman Group (1,2,5)
5
Security Association Lifetime (sec)
28800
Pre-Shared Secret (16 character/Cap Sensitive)
**********
IPSEC Parameters
IPSEC Encryption (DES, 3DES,AES)
AES 256
Authentication Method (MD5, SHA)
SHA
Diffle-Helman Group (1,2)
2
Security Association Lifetime (Sec)
1800
Perfect Forward Secrecy (Yes, No)
Yes
PFS Diffie-Helman Group (1,2,5)
5
I would be grateful for any assistance to help solve this riddle, i've been on it for the last 24 hours and its driving me crazy.
Regards,
Femi
... View more
Labels:
05-10-2015
10:11 AM
Hi Vibhor, Thanks for the pointer, it helped me figure out where i went off with my config as well. Cheers.
... View more
05-09-2015
09:16 AM
Hello Vibhor, Do these commands work on this version of IOS as this was the challenge i had with some of the commands i am used to? I can confirm that the workstations in the VLANs can reach the ASA. So after these nat commands, nothing else is needed? No access lists? Regards, Femi
... View more
Created by
femi.agboade
in Network Security
in Network Security
05-09-2015
12:03 AM
05-09-2015
12:03 AM
I have an ASA 5510 configured to manage 7 VLANs, some of these VLANs need access to the internet, others don't. One of these VLANs is a management VLAN and it needs internet access. The ASA is trunked to switch, which has different ports activated for the different VLANs. So far, I am unable to get the Data VLAN to access the internet and would like some help with my config, please see below: : ASA Version 9.1(6) ! ! interface Ethernet0/0 description Trunk Port for all VLANS no nameif no security-level no ip address ! interface Ethernet0/0.200 vlan 200 nameif Data security-level 100 ip address 172.16.0.1 255.255.255.0 ! interface Ethernet0/0.300 vlan 300 nameif UAT_DMZ security-level 100 ip address 192.168.100.1 255.255.255.0 ! interface Ethernet0/0.400 vlan 400 nameif UAT_SECURE security-level 100 ip address 10.135.17.1 255.255.255.0 ! interface Ethernet0/0.500 vlan 500 nameif UAT_INTCON security-level 100 ip address 172.30.50.1 255.255.255.0 ! interface Ethernet0/0.601 vlan 601 nameif PROD_DMZ security-level 100 ip address 192.168.255.1 255.255.255.0 ! interface Ethernet0/0.602 vlan 602 nameif PROD_SECURE security-level 100 ip address 10.149.57.1 255.255.255.0 ! interface Ethernet0/0.603 vlan 603 nameif PROD_INTCON security-level 100 ip address 172.19.205.1 255.255.255.0 ! interface Ethernet0/1 shutdown no nameif no security-level no ip address ! interface Ethernet0/2 shutdown no nameif no security-level no ip address ! interface Ethernet0/3 nameif Outside security-level 0 ip address x.x.x.2 255.255.255.248 ! interface Management0/0 management-only nameif management security-level 100 ip address 192.168.1.1 255.255.255.0 ! boot system disk0:/asa916-k8.bin ftp mode passive clock timezone WAT 1 dns domain-lookup Data dns domain-lookup UAT_DMZ dns domain-lookup UAT_SECURE dns domain-lookup UAT_INTCON dns domain-lookup PROD_DMZ dns domain-lookup PROD_SECURE dns domain-lookup PROD_INTCON dns domain-lookup Outside dns server-group DefaultDNS name-server 8.8.8.8 name-server 41.75.80.84 name-server 4.2.2.1 name-server 4.2.2.2 same-security-traffic permit inter-interface same-security-traffic permit intra-interface object network UAT_INTCON-nw subnet 172.30.50.0 255.255.255.0 object network UAT_DMZ-nw subnet 192.168.100.0 255.255.255.0 object network UAT_SECURE-nw subnet 10.135.17.0 255.255.255.0 object network PROD_DMZ-nw subnet 192.168.255.0 255.255.255.0 object network PROD_INTCON-nw subnet 172.19.205.0 255.255.255.0 object network PROD_SECURE-nw subnet 10.149.57.0 255.255.255.0 object network AnyNetwork subnet 0.0.0.0 0.0.0.0 description Any network object network Data-nw subnet 172.16.0.0 255.255.255.0 object-group network UAT-nw description UAT network-object object UAT_DMZ-nw network-object object UAT_INTCON-nw network-object object UAT_SECURE-nw object-group icmp-type ICMP-ALLOWED icmp-object echo-reply icmp-object time-exceeded object-group protocol DM_INLINE_PROTOCOL_1 protocol-object ip protocol-object tcp object-group protocol DM_INLINE_PROTOCOL_2 protocol-object ip protocol-object tcp access-list Inside_access_in extended permit object-group DM_INLINE_PROTOCOL_2 object Data-nw any4 access-list Outside_access_in extended permit icmp any4 any4 object-group ICMP-ALLOWED access-list Outside_access_in extended permit tcp any4 eq ssh any4 eq ssh access-list Data_access_out extended permit object-group DM_INLINE_PROTOCOL_1 172.16.0.0 255.255.255.0 any4 pager lines 24 logging enable logging asdm informational mtu Data 1500 mtu UAT_DMZ 1500 mtu UAT_SECURE 1500 mtu UAT_INTCON 1500 mtu PROD_DMZ 1500 mtu PROD_SECURE 1500 mtu PROD_INTCON 1500 mtu Outside 1500 mtu management 1500 icmp unreachable rate-limit 1 burst-size 1 asdm image disk0:/asdm-733.bin asdm history enable arp timeout 14400 no arp permit-nonconnected access-group Inside_access_in in interface Data access-group Data_access_out out interface Data access-group Outside_access_in in interface Outside route Outside 0.0.0.0 0.0.0.0 x.x.x.1 timeout xlate 3:00:00 timeout pat-xlate 0:00:30 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 dynamic-access-policy-record DfltAccessPolicy user-identity default-domain LOCAL aaa authentication enable console LOCAL aaa authentication http console LOCAL aaa authentication serial console LOCAL aaa authentication ssh console LOCAL aaa authentication telnet console LOCAL http server enable http 192.168.1.0 255.255.255.0 management no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart crypto ipsec security-association pmtu-aging infinite crypto ca trustpool policy telnet timeout 5 no ssh stricthostkeycheck ssh timeout 5 ssh key-exchange group dh-group1-sha1 console timeout 0 threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept username femiagboade password 8X0YakmhG.ZUnPIp encrypted ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp inspect ip-options ! service-policy global_policy global prompt hostname context no call-home reporting anonymous Cryptochecksum:dbbbb3db4af994e19705573ddf4930a3 : end Been on this for a while and would greatly appreciate any help I can get to get this to work.
... View more
Labels:
10-21-2014
08:36 AM
Hello Milan, Its ok, you've been quite helpful enough already. I'll put your suggestions together along with that from David and see if I can use this to come up with a solution. I'll let you know how it goes. Thanks again. Regards, Femi
... View more
10-21-2014
04:51 AM
Hello Milan, So again, thanks for your valuable input. What I really need right now is a validation of my HO Router and HO ASA configs, and possibly a sample config for the Remote ASA. Can you help with this please? ASA isn't a strong point for me so i am lacking a bit here. Regards, Femi
... View more
10-21-2014
04:08 AM
Hi David, Thanks for your comments. I'm not sure however that you realize that at the remote sites, I only have the ASAs, no routers. As a matter of fact, there already exists the site to site VPN between the remote sites and the HO, both HO and the remote sites all use ASAs. Its the introduction of managing the 3 ISPs at the HO that brought about the HO Router. So my concern really is how to configure the ASAs at the remote sites to work with the new HO Router and the 3 ISPs on the HO Router. So according to your comment, is my HO Router config displayed in previous post correct? I am not very good with ASAs, wouldn't mind if you can help with sample config on what is meant to be added as per your recommendation above on the 3 P2P protected GRE tunnels to be configured at each remote site, and all the associated OSPF config. I am not sure how to configure OSPF routing and metrics on the ASAs. Also, is my config on the HO ASA as shown above also correct considering my peculiar scenario where the HO ASA only manages all site to site traffic routing? Thanks as always. Femi
... View more
10-20-2014
08:24 AM
Hello Milan, Thanks again. I never knew "complicated" to be anywhere near pretty, and this definitely isn't looking pretty at all. If i understand you correctly, for all 5 remote sites, i may have up to 15 tunnels configured on the HO Router, 3 tunnels for each site? I honestly don't even know where to start with this configuration. I also don't know much about the metrics you mentioned. Would be nice if I can get sample configs to guide me. Regards, Femi
... View more
10-20-2014
02:57 AM
Hello Milan, Thanks for your response, I however didn't quite catch how your explanation would work. Do you mind being slightly more explicit, maybe with diagrams etc? Regards, Femi
... View more
10-17-2014
11:36 AM
Hello, So i have the following config for the HO Router, a little something i think for the HO ASA, but not a clue on what to do on the remote ASA to allow it monitor all three HO ISPs and know when to route traffic through a working ISP, any ideas please? : HO ROUTER service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname HO_Router ! boot-start-marker boot-end-marker ! no aaa new-model ip subnet-zero ip cef ! no ip domain lookup no ip dhcp use vrf connected ! ! ! no ipv6 cef ! ! multilink bundle-name authenticated ! ip audit po max-events 100 ! ! ! crypto isakmp policy 1 encr aes 256 authentication pre-share ! ! ! crypto ipsec transform-set AES256SHA esp-aes 256 esp-sha-hmac mode transport ! ! crypto keyring ISP1 pre-shared-key address 0.0.0.0 0.0.0.0 key tesTkey1 crypto keyring ISP2 pre-shared-key address 0.0.0.0 0.0.0.0 key tesTkey2 crypto keyring ISP3 pre-shared-key address 0.0.0.0 0.0.0.0 key tesTkey3 ! ! ! ! crypto isakmp profile ISP1 keyring ISP1 match identity address 0.0.0.0 ! ! crypto isakmp profile ISP2 keyring ISP2 match identity address 0.0.0.0 ! ! ! crypto isakmp profile ISP3 keyring ISP3 match identity address 0.0.0.0 ! ! ! ! crypto ipsec profile IpsecProf1 set transform-set AES256SHA set isakmp-profile ISP1 ! ! crypto ipsec profile IpsecProf2 set transform-set AES256SHA set isakmp-profile ISP2 ! ! crypto ipsec profile IpsecProf3 set transform-set AES256SHA set isakmp-profile ISP3 ! ! ! ! ! interface Tunnel1 bandwidth 2000 ip address 172.16.10.1 255.255.255.0 no ip redirects ip mtu 1400 ip nhrp authentication nhrpauth ip nhrp map multicast dynamic ip nhrp network-id 53 ip tcp adjust-mss 1360 ip ospf network point-to-multipoint ip ospf 1 area 0 delay 100 tunnel source GigabitEthernet0/1 tunnel mode gre multipoint tunnel key 1 tunnel protection ipsec profile IpsecProf1 ! interface Tunnel2 bandwidth 2000 ip address 172.16.20.1 255.255.255.0 no ip redirects ip mtu 1400 ip nhrp authentication nhrpaut2 ip nhrp map multicast dynamic ip nhrp network-id 54 ip tcp adjust-mss 1360 ip ospf network point-to-multipoint ip ospf 1 area 0 delay 100 tunnel source GigabitEthernet0/2 tunnel mode gre multipoint tunnel key 2 tunnel protection ipsec profile IpsecProf2 ! interface Tunnel3 bandwidth 2000 ip address 172.16.30.1 255.255.255.0 no ip redirects ip mtu 1400 ip nhrp authentication nhrpaut3 ip nhrp map multicast dynamic ip nhrp network-id 55 ip tcp adjust-mss 1360 ip ospf network point-to-multipoint ip ospf 1 area 0 delay 100 tunnel source FastEthernet0/0/0 tunnel mode gre multipoint tunnel key 3 tunnel protection ipsec profile IpsecProf3 ! ! ! ! interface GigabitEthernet0/0 desc To ASA ip address 10.0.1.1 255.255.255.0 ip nat inside ip ospf 1 area 0 ip ospf authentication message-digest ip ospf message-digest-key 1 md5 cisco123 duplex auto speed auto ! ! interface GigabitEthernet0/1 desc ISP1 ip address a.a.a.2 255.255.255.254 ip nat outside ip virtual-reassembly duplex auto speed auto ! ! ! interface GigabitEthernet0/2 desc ISP2 ip address b.b.b.2 255.255.255.254 ip nat outside ip virtual-reassembly duplex auto speed auto ! ! ! interface FastEthernet0/0/0 desc ISP3 ip address c.c.c.2 255.255.255.254 ip nat outside ip virtual-reassembly duplex auto speed auto ! ! router ospf 1 default-information originate always ! ip nat inside source route-map EXIT_ISP1 interface GigabitEthernet0/1 overload ip nat inside source route-map EXIT_ISP2 interface GigabitEthernet0/2 overload ip nat inside source route-map EXIT_ISP3 interface FastEthernet0/0/0 overload ip forward-protocol nd ip classless ! ! ip sla responder ! ! ip sla 1 icmp-echo a.a.a.1 ip sla schedule 1 life forever start-time now ip sla 2 icmp-echo b.b.b.1 ip sla schedule 2 life forever start-time now ip sla 3 icmp-echo c.c.c.1 ip sla schedule 3 life forever start-time now ! ! track 10 ip sla 1 reachability delay down 1 up 1 ! track 20 ip sla 2 reachability delay down 1 up 1 ! track 30 ip sla 3 reachability delay down 1 up 1 ! ! ! ! no ip http server no ip http secure-server ip route 0.0.0.0 0.0.0.0 a.a.a.1 track 10 ip route 0.0.0.0 0.0.0.0 b.b.b.1 track 20 ip route 0.0.0.0 0.0.0.0 c.c.c.1 track 30 ip route 172.16.10.0 255.255.255.0 a.a.a.1 ip route 172.16.20.0 255.255.255.0 b.b.b.1 ip route 172.16.30.0 255.255.255.0 c.c.c.1 ! ! ! ! access-list 110 permit ip 10.0.1.0 0.0.0.255 any ! route-map EXIT_ISP1 permit 10 match ip address 110 match interface GigabitEthernet0/1 ! route-map EXIT_ISP2 permit 10 match ip address 110 match interface GigabitEthernet0/2 ! route-map EXIT_ISP3 permit 10 match ip address 110 match interface FastEthernet0/0/0 ! ! ! ! ! control-pane ! ! line con 0 line aux 0 line vty 0 4 login ! end ************************************************************************************** HO ASA interface GigabitEthernet0/0 ip address 10.0.1.2 255.255.255.0 nameif outside security-level 0 ospf authentication message-digest ospf message-digest-key 1 md5 cisco123 speed auto duplex auto ! ! interface GigabitEthernet0/1 ip address 192.168.0.1 255.255.255.0 nameif inside security-level 100 ospf authentication message-digest ospf message-digest-key 1 md5 cisco123 speed auto duplex auto ! ! router ospf 1 network 10.0.1.0 255.255.255.0 area 0 network 192.168.0.1 255.255.255.0 area 0 ! ip route 0.0.0.0 0.0.0.0 10.0.1.1 ! ip forward-protocol nd access-group OUTSIDE-IN in interface outside ! !
... View more
10-17-2014
11:33 AM
Hello, So i have the following config for the HO Router, a little something i think for the HO ASA, but not a clue on what to do on the remote ASA to allow it monitor all three HO ISPs and know when to route traffic through a working ISP, any ideas please? : HO ROUTER service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname HO_Router ! boot-start-marker boot-end-marker ! no aaa new-model ip subnet-zero ip cef ! no ip domain lookup no ip dhcp use vrf connected ! ! ! no ipv6 cef ! ! multilink bundle-name authenticated ! ip audit po max-events 100 ! ! ! crypto isakmp policy 1 encr aes 256 authentication pre-share ! ! ! crypto ipsec transform-set AES256SHA esp-aes 256 esp-sha-hmac mode transport ! ! crypto keyring ISP1 pre-shared-key address 0.0.0.0 0.0.0.0 key tesTkey1 crypto keyring ISP2 pre-shared-key address 0.0.0.0 0.0.0.0 key tesTkey2 crypto keyring ISP3 pre-shared-key address 0.0.0.0 0.0.0.0 key tesTkey3 ! ! ! ! crypto isakmp profile ISP1 keyring ISP1 match identity address 0.0.0.0 ! ! crypto isakmp profile ISP2 keyring ISP2 match identity address 0.0.0.0 ! ! ! crypto isakmp profile ISP3 keyring ISP3 match identity address 0.0.0.0 ! ! ! ! crypto ipsec profile IpsecProf1 set transform-set AES256SHA set isakmp-profile ISP1 ! ! crypto ipsec profile IpsecProf2 set transform-set AES256SHA set isakmp-profile ISP2 ! ! crypto ipsec profile IpsecProf3 set transform-set AES256SHA set isakmp-profile ISP3 ! ! ! ! ! interface Tunnel1 bandwidth 2000 ip address 172.16.10.1 255.255.255.0 no ip redirects ip mtu 1400 ip nhrp authentication nhrpauth ip nhrp map multicast dynamic ip nhrp network-id 53 ip tcp adjust-mss 1360 ip ospf network point-to-multipoint ip ospf 1 area 0 delay 100 tunnel source GigabitEthernet0/1 tunnel mode gre multipoint tunnel key 1 tunnel protection ipsec profile IpsecProf1 ! interface Tunnel2 bandwidth 2000 ip address 172.16.20.1 255.255.255.0 no ip redirects ip mtu 1400 ip nhrp authentication nhrpaut2 ip nhrp map multicast dynamic ip nhrp network-id 54 ip tcp adjust-mss 1360 ip ospf network point-to-multipoint ip ospf 1 area 0 delay 100 tunnel source GigabitEthernet0/2 tunnel mode gre multipoint tunnel key 2 tunnel protection ipsec profile IpsecProf2 ! interface Tunnel3 bandwidth 2000 ip address 172.16.30.1 255.255.255.0 no ip redirects ip mtu 1400 ip nhrp authentication nhrpaut3 ip nhrp map multicast dynamic ip nhrp network-id 55 ip tcp adjust-mss 1360 ip ospf network point-to-multipoint ip ospf 1 area 0 delay 100 tunnel source FastEthernet0/0/0 tunnel mode gre multipoint tunnel key 3 tunnel protection ipsec profile IpsecProf3 ! ! ! ! interface GigabitEthernet0/0 desc To ASA ip address 10.0.1.1 255.255.255.0 ip nat inside ip ospf 1 area 0 ip ospf authentication message-digest ip ospf message-digest-key 1 md5 cisco123 duplex auto speed auto ! ! interface GigabitEthernet0/1 desc ISP1 ip address a.a.a.2 255.255.255.254 ip nat outside ip virtual-reassembly duplex auto speed auto ! ! ! interface GigabitEthernet0/2 desc ISP2 ip address b.b.b.2 255.255.255.254 ip nat outside ip virtual-reassembly duplex auto speed auto ! ! ! interface FastEthernet0/0/0 desc ISP3 ip address c.c.c.2 255.255.255.254 ip nat outside ip virtual-reassembly duplex auto speed auto ! ! router ospf 1 default-information originate always ! ip nat inside source route-map EXIT_ISP1 interface GigabitEthernet0/1 overload ip nat inside source route-map EXIT_ISP2 interface GigabitEthernet0/2 overload ip nat inside source route-map EXIT_ISP3 interface FastEthernet0/0/0 overload ip forward-protocol nd ip classless ! ! ip sla responder ! ! ip sla 1 icmp-echo a.a.a.1 ip sla schedule 1 life forever start-time now ip sla 2 icmp-echo b.b.b.1 ip sla schedule 2 life forever start-time now ip sla 3 icmp-echo c.c.c.1 ip sla schedule 3 life forever start-time now ! ! track 10 ip sla 1 reachability delay down 1 up 1 ! track 20 ip sla 2 reachability delay down 1 up 1 ! track 30 ip sla 3 reachability delay down 1 up 1 ! ! ! ! no ip http server no ip http secure-server ip route 0.0.0.0 0.0.0.0 a.a.a.1 track 10 ip route 0.0.0.0 0.0.0.0 b.b.b.1 track 20 ip route 0.0.0.0 0.0.0.0 c.c.c.1 track 30 ip route 172.16.10.0 255.255.255.0 a.a.a.1 ip route 172.16.20.0 255.255.255.0 b.b.b.1 ip route 172.16.30.0 255.255.255.0 c.c.c.1 ! ! ! ! access-list 110 permit ip 10.0.1.0 0.0.0.255 any ! route-map EXIT_ISP1 permit 10 match ip address 110 match interface GigabitEthernet0/1 ! route-map EXIT_ISP2 permit 10 match ip address 110 match interface GigabitEthernet0/2 ! route-map EXIT_ISP3 permit 10 match ip address 110 match interface FastEthernet0/0/0 ! ! ! ! ! control-pane ! ! line con 0 line aux 0 line vty 0 4 login ! end ************************************************************************************** HO ASA interface GigabitEthernet0/0 ip address 10.0.1.2 255.255.255.0 nameif outside security-level 0 ospf authentication message-digest ospf message-digest-key 1 md5 cisco123 speed auto duplex auto ! ! interface GigabitEthernet0/1 ip address 192.168.0.1 255.255.255.0 nameif inside security-level 100 ospf authentication message-digest ospf message-digest-key 1 md5 cisco123 speed auto duplex auto ! ! router ospf 1 network 10.0.1.0 255.255.255.0 area 0 network 192.168.0.1 255.255.255.0 area 0 ! ip route 0.0.0.0 0.0.0.0 10.0.1.1 ! ip forward-protocol nd access-group OUTSIDE-IN in interface outside ! !
... View more
10-16-2014
12:12 PM
Hi El, No we don't own the public IP on the HO ASA. All are ISP provided and therefore dependent on the ISPs. Regards, Femi
... View more
11-17-2015
Hello Richard, Thanks for the feedback. All seems to be working just
fine now. The routing issues we...
11-15-2015
Hi Richard, So i made some changes to my config and i can now
successfully establish a VPN tunnel. H...
11-14-2015
Hello Richard, Thank you for your reply. I will request from the service
provider to see their side ...
11-14-2015
Hello, I'm having some errors with setting up a site to site VPN between
my ASA 5510 and a clients 3...
05-10-2015
Hi Vibhor,Thanks for the pointer, it helped me figure out where i went
off with my config as well. C...
05-09-2015
Hello Vibhor,Do these commands work on this version of IOS as this was
the challenge i had with some...
Created by
femi.agboade
in Network Security
05-09-2015
05-09-2015
I have an ASA 5510 configured to manage 7 VLANs, some of these VLANs
need access to the internet, ot...
10-21-2014
Hello Milan,Its ok, you've been quite helpful enough already. I'll put
your suggestions together alo...
10-21-2014
Hello Milan,So again, thanks for your valuable input.What I really need
right now is a validation of...
10-21-2014
Hi David,Thanks for your comments.I'm not sure however that you realize
that at the remote sites, I ...
10-20-2014
Hello Milan,Thanks again. I never knew "complicated" to be anywhere near
pretty, and this definitely...
10-20-2014
Hello Milan,Thanks for your response, I however didn't quite catch how
your explanation would work. ...
10-17-2014
Hello,So i have the following config for the HO Router, a little
something i think for the HO ASA, b...
10-17-2014
Hello,So i have the following config for the HO Router, a little
something i think for the HO ASA, b...
Public Statistics
| Date Registered | 01-22-2009 09:19 AM |
| Date Last Visited | 05-31-2018 06:26 AM |
| Total Messages Posted | 157 |
