can you share both site configuration? ... View more

Is this is a server ip192.168.0.44. and how come you can not ping this ip. seems you have a reach-ability issue from ASA to ip 192.168.0.44. if you cant reach this ip from ASA you no way you can reach from the site to site vpn. fix this issue first.    which interface 192.168.0.44 is residing? in dmz or at inside?    if possible share you configuration. ... View more

@Marvin Rhoads agree with you. ISP take time to get this done as you have to log a ticket with them and then chase this up. however, it also depends some ISP are very pro-active and it could be done in 2 day time but some take very long time almost week too.    ... View more

if it cisco the default timeout is 4 hours. from experience in term of deployment I have seen issue with connectivity in regards to firewall when inside going outside and when outside ip access the DMZ address.    if you have a change windows which i guess you will have than you can clear the arp entries. ... View more

Ok, But still why 3 SYN packets with the same source port ?   because the client server/pc is sending a syn to start communicate and sending SYN request as the Firewall is blocking it and drop the request. so the client server/pc have no idea that why its keep sending SYN.  ... View more

You can configure up to 8 bridge groups.   also depends how many vlan lic you have on the box. only if you want to sub-interface them in that case if you have more than 5 vlan than you have to make sure you have more vlan lic. ... View more

The issue can be with any VPN tunnel. The question is whether we can choose a certain root/intermediate certificate to be sent out for each tunnel, as currently we are sending all of the intermediate/root certificates in initial IKEv2 exchange for every tunnel and this approach is making a packet size bigger. The devices at the other end of tunnel which are not able to defragment (or may not even have option to do that) the tunnel is not coming up. the issue is not with the identity certificate; it is with the amount of intermediate and root certificates been presented on the tunnel.   I’m aware that we can get specific identity certificate (trustpoint) for a specific tunnel. However, it doesn’t help us keep the packet size lower due to the multiple intermediate/root certificates presentation during the initial IKEv2 exchange as mentioned in the key and certificate exchange sections in IKEv2 RFC standards. Let me try to clarify the issue further. Let’s say PEER A and PEER B wants to establish a VPN connection, which is certificate-based.   Now, to establish the VPN connection, from the PEER A point of view it will need PEER A’s identity certificate and PEER B’s root/intermediate certificate to be able to trust the certificate and establish the VPN.   Similarly, PEER B also needs its Identity certificate, and root/intermediate certificate of PEER A at its end to establish the VPN tunnel successfully.   After the VPN configurations, the PEER A and PEER B start exchanging IKE Auth and Identifier messages, and because they both trust each other’s certificate, the tunnel gets established successfully. The CRITICAL point here is that PEER A/PEER B (whoever is the initiator) in it’s initial IKEv2 Auth messages, will send all the trust points (root/intermediate) which exists/imported in the database of the Firewall and its identity certificate to another party to successfully establish the tunnel.   Now, trying again to explain the issue, if there are only PEER A and PEER B communication, that is no problem. However, we have more than 100 certificate VPN connections, and now we are getting at the stage wherein our initial messages for IKEV2 because the Firewall will always send all the trust points root/intermediate certificated (NOT talking about identity certificates here) for all other tunnels that the packet size is increasingly getting bigger.   It is a pretty generic behaviour of IKEV2 and accordingly explained in the process RFC standards of IKEv2. The question here is, in the light of RFC standards for IKEv2, is there a ‘hidden’ command or configuration which we can do that for the certificate-based VPN’s, we can not only choose which identity certificate we want to present. Also, critically important, can we select only one or two root/intermediate certificates for each tunnel (instead of the normal IKEv2 behaviour, i.e sending all the root/intermediate certificates for all the other tunnels)?   ... View more

you should be fine going to 9.1(6) to 9.8 here is the link here     and here is the cisco configuration guide to upgrade the ASA in HA pair here ! username admin password cisco privilege 15 aaa authentication serial console LOCAL aaa authentication enable console LOCAL ! ... View more

nat (outside,outside) dynamic interface   better put this rule in section 2   object network XXXXX      nat (outside,outside) dynamic interface   or you can put this rule in section 3 also. ... View more

actually I lab this up. where i configured a wrong pre-shared-key on my router vpn site. (router vpn 195.200.1.2 and ASA vpn 200.1.5.2)   here is my lab access-list access-list CP line 1 extended deny udp host 195.200.1.2 host 200.1.5.2 eq 4500 (hitcnt=0) 0x16d86c78 access-list CP line 2 extended deny udp host 195.200.1.2 host 200.1.5.2 eq isakmp (hitcnt=6) 0xe85a104b access-list CP line 3 extended deny esp host 195.200.1.2 host 200.1.5.2 (hitcnt=0) 0x08163e8f access-group CP in interface outside control-plan ! %ASA-4-106023: Deny udp src outside:195.200.1.2/500 dst identity:200.1.5.2/500 by access-group "CP" [0xe85a104b, 0x0] %ASA-7-710005: UDP request discarded from 195.200.1.2/500 to outside:200.1.5.2/500 %ASA-4-106023: Deny udp src outside:195.200.1.2/500 dst identity:200.1.5.2/500 by access-group "CP" [0xe85a104b, 0x0] %ASA-7-710005: UDP request discarded from 195.200.1.2/500 to outside:200.1.5.2/500 !       ====================================================================== you need to change the syntax on the firewall. let say your legitimate vpn is 12.12.12.12     access-list cp-out permit udp host 12.12.12.12 any eq 4500 access-list cp-out permit udp host 12.12.12.12 any eq 500 access-group cp-out in interface control-plan     control-plan syntax is to the traffic dest to the firewall. =============================================================   I also noted you get this message. Warning FW1 : Group = DefaultL2LGroup, IP = 10.10.10.10, ERROR, had problems decrypting packet, probably due to mismatched pre-shared key. Aborting   this mean you hitting the default-group policy. by default the group policy is as below in ASA ! tunnel-group DefaultL2LGroup type ipsec-l2l tunnel-group DefaultL2LGroup general-attributes default-group-policy DfltGrpPolicy tunnel-group DefaultL2LGroup ipsec-attributes no ikev1 pre-shared-key peer-id-validate req no chain no ikev1 trust-point isakmp keepalive threshold 10 retry 2 no ikev2 remote-authentication no ikev2 local-authentication ASA(config)# ASA(config)# show run all | i DfltGrpPolicy group-policy DfltGrpPolicy internal group-policy DfltGrpPolicy attributes default-group-policy DfltGrpPolicy default-group-policy DfltGrpPolicy default-group-policy DfltGrpPolicy     as there is no pre-share-key is configured that why you getting a mis-math pre-shared-key error. ... View more

I guess this is a difficult one. Is this just started this behavior recently any changes made on the network. Is there is download going on between these tunnels?   you using the firepower module on 5506-x. could be a good start to dig on layer 7 if you using the firepower. what software you running on 5506-X.   run wiresharke/ packet capture to check what is the behavour our your traffic. ... View more

I have simplified your config for other to help you.   also i noted you need to define a route in your ASA for ip address 192.168.53.3. can you ping this address from ASA 192.168.53.3. i think this is the problem you having. define a static route.     nat (INSIDE-DMZ,OUTSIDE) source static local-net local-net destination static remotes remotes no-proxy-arp route-lookup ! object-group network local-net network-object 192.168.30.10 255.255.255.255 network-object 10.10.1.101 255.255.255.255 ! object-group network remotes network-object host 192.168.53.3 network-object host 192.168.53.2 ! access-list 100 extended permit ip object-group local-net object remote-net access-list 100 extended permit ip object-group local-net object-group remote access-list 100 extended permit ip object-group local-net object net access-list 100 extended permit ip object-group local-net object-group remotes ! crypto map outside_map 20 match address 100 crypto map outside_map 20 set peer 154.72.194.50 crypto map outside_map 20 set ikev1 transform-set myset crypto map outside_map interface OUTSIDE ! tunnel-group 154.72.194.50 type ipsec-l2l tunnel-group 154.72.194.50 ipsec-attributes ikev1 pre-shared-key ***** ! crypto ipsec ikev1 transform-set phase2 esp-aes-256 esp-sha-hmac crypto ipsec ikev1 transform-set myset esp-aes-256 esp-sha-hmac crypto ipsec ikev2 ipsec-proposal DES protocol esp encryption des protocol esp integrity sha-1 md5 crypto ipsec ikev2 ipsec-proposal 3DES protocol esp encryption 3des protocol esp integrity sha-1 md5 crypto ipsec ikev2 ipsec-proposal AES protocol esp encryption aes protocol esp integrity sha-1 md5 crypto ipsec ikev2 ipsec-proposal AES192 protocol esp encryption aes-192 protocol esp integrity sha-1 md5 crypto ipsec ikev2 ipsec-proposal AES256 protocol esp encryption aes-256 protocol esp integrity sha-1 md5 crypto ipsec security-association pmtu-aging infinite ! crypto ikev2 policy 1 encryption aes-256 integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 policy 10 encryption aes-192 integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 policy 20 encryption aes integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 policy 30 encryption 3des integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 policy 40 encryption des integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev1 enable OUTSIDE crypto ikev1 policy 10 authentication pre-share encryption aes-256 hash sha group 2 lifetime 86400 crypto ikev1 policy 20 authentication rsa-sig encryption aes-256 hash sha group 2 lifetime 86400 crypto ikev1 policy 40 authentication pre-share encryption aes-192 hash sha group 2 lifetime 86400 crypto ikev1 policy 50 authentication rsa-sig encryption aes-192 hash sha group 2 lifetime 86400 crypto ikev1 policy 70 authentication pre-share encryption aes hash sha group 2 lifetime 86400 crypto ikev1 policy 80 authentication rsa-sig encryption aes hash sha group 2 lifetime 86400 crypto ikev1 policy 100 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 crypto ikev1 policy 110 authentication rsa-sig encryption 3des hash sha group 2 lifetime 86400 crypto ikev1 policy 130 authentication pre-share encryption des hash sha group 2 lifetime 86400 crypto ikev1 policy 140 authentication rsa-sig encryption des hash sha group 2 !       we need more information. show us ! show crypto ipsec sa ! also share your other site config if possible. ... View more