Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About jrnetipsec
02-01-2019
jrnetipsec
Member since
11-02-2017
Beginner
01-15-2019
10:07 AM
Hi everyone, Eventually, we figured it out. The issue was not with the routing as I have checked ASA can ping internal network and other VPN tunnel working great only issue with this site is that there was another NAT & ACL present which overlap the new VPN tunnel and that is why traffic was not passing through it. After removing it and re configuring the ACL's & NAT traffic is now flowing smoothly into the VPN tunnel. Thanks for the support.
... View more
01-11-2019
08:33 AM
Which traffic is not reaching dc (lan) to asa or from site 1 (lan) to dc asa ? there is managed switch but very little config. nothing important.
... View more
01-11-2019
08:18 AM
I have changed the object to same as site1. But the issue is same. There is no router or switch. between asa.
... View more
01-11-2019
08:05 AM
Can you elaborate please ? following is only routing in dc side: route outside 0.0.0.0 0.0.0.0 x.x.x.x 1 route inside 10.55.1.0 255.255.255.0 10.1.20.1 1
... View more
01-11-2019
07:54 AM
Continuous ping is running from 10.55.1.x to 10.184.2.x. I observed the same packets are not encap/decap. Here is the output. Site1: #pkts encaps: 516, #pkts encrypt: 516, #pkts digest: 516 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 460, #pkts comp failed: 0, #pkts decomp failed: 0 #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0 #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0 #TFC rcvd: 0, #TFC sent: 0 #Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0 #send errors: 0, #recv errors: 0 DC: #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 #pkts decaps: 516, #pkts decrypt: 516, #pkts verify: 516 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0 #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0 #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0 #TFC rcvd: 0, #TFC sent: 0 #Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0 #send errors: 0, #recv errors: 0
... View more
01-11-2019
07:34 AM
Hi Community, I am stuck in here as, VPN is successfully established between DC & Site1 but traffic (icmp or any other) is not flowing. Kindly help. Below are the two site IKV1 configuration. Site 1: object-group network Datacenter_nw network-object 192.168.20.0 255.255.255.0 network-object 10.55.1.0 255.255.255.0 object network LAN subnet 10.184.2.0 255.255.255.0 access-list SEATFWtoDatacenter extended permit ip object LAN object-group Datacenter_nw nat (inside_1,outside) source static LAN LAN destination static Datacenter_nw Datacenter_nw no-proxy-arp route-lookup crypto ikev1 policy 10 authentication pre-share encryption aes-256 hash sha group 2 lifetime 28800 crypto ikev1 enable outside crypto isakmp identity address tunnel-group x.x.x.x type ipsec-l2l tunnel-group x.x.x.x ipsec-attributes ikev1 pre-shared-key ***** crypto ipsec ikev1 transform-set myvpnset esp-aes-256 esp-sha-hmac crypto map SEATVPN 1 match address SEATFWtoDatacenter crypto map SEATVPN 1 set peer x.x.x.x crypto map SEATVPN 1 set ikev1 transform-set myvpnset IKEv1 SAs: Active SA: 1 Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey) Total IKE SA: 1 1 IKE Peer: x.x.x.x Type : L2L Role : initiator Rekey : no State : MM_ACTIVE Encrypt : aes-256 Hash : SHA Auth : preshared Lifetime: 28800 Lifetime Remaining: 27848 There are no IKEv2 SAs NATTr. 1 (inside_1) to (outside) source static LAN LAN destination static Datacenter_nw Datacenter_nw no-proxy-arp route-lookup translate_hits = 7618, untranslate_hits = 7618 access-list SEATFWtoDatacenter; 10 elements; name hash: 0xbf70aa0c access-list SEATFWtoDatacenter line 1 extended permit ip object LAN object-group Datacenter_nw (hitcnt=42) 0xf67bb5c9 access-list SEATFWtoDatacenter line 1 extended permit ip 10.184.2.0 255.255.255.0 10.55.1.0 255.255.255.0 (hitcnt=39943) 0x862fb856 DC : object-group network Datacenter_lan network-object 192.168.20.0 255.255.255.0 network-object 10.0.0.0 255.0.0.0 object-group network SeattleFW_lan network-object 10.184.2.0 255.255.255.0 access-list DatacentertoSEATFW extended permit ip object-group Datacenter_lan object-group SeattleFW_lan nat (inside,outside) 1 source static Datacenter_lan Datacenter_lan destination static SeattleFW_lan SeattleFW_lan no-proxy-arp route-lookup crypto ikev1 policy 10 authentication pre-share encryption aes-256 hash sha group 2 lifetime 28800 crypto ikev1 enable outside crypto isakmp identity address tunnel-group x.x.x.x type ipsec-l2l tunnel-group x.x.x.x ipsec-attributes ikev1 pre-shared-key ***** crypto ipsec ikev1 transform-set myvpnset esp-aes-256 esp-sha-hmac crypto map outside_map2 60 match address DatacentertoSEATFW crypto map outside_map2 60 set peer x.x.x.x crypto map outside_map2 60 set ikev1 transform-set myvpnset 30 IKE Peer: 96.79.192.233 Type : L2L Role : responder Rekey : no State : MM_ACTIVE Encrypt : aes-256 Hash : SHA Auth : preshared Lifetime: 28800 Lifetime Remaining: 27770 NAT Tr. 1 (inside) to (outside) source static Datacenter_lan Datacenter_lan destination static SeattleFW_lan SeattleFW_lan no-proxy-arp route-lookup translate_hits = 11, untranslate_hits = 11 Access List- access-list DatacentertoSEATFW; 2 elements; name hash: 0x6a9b85c7 access-list DatacentertoSEATFW line 1 extended permit ip object-group Datacenter_lan object-group SeattleFW_lan (hitcnt=0) 0x1cf33b31 access-list DatacentertoSEATFW line 1 extended permit ip 10.0.0.0 255.0.0.0 10.184.2.0 255.255.255.0 (hitcnt=32) 0x4bb5c8a0 Thanks in advance.
... View more
01-09-2019
07:01 AM
Yes. Issue is on WAN side, asa is connected to comcast modem and dhcp was enable and double nat creating problem so internal devices not able to connect internet. Currently working on the WAN Side.
... View more
01-08-2019
03:32 PM
ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cores) Version 9.8(2). Today itself it rebooted.
... View more
01-08-2019
03:14 PM
In past when I entered nameif command in Bvi firewall crashed. So What is the issue with that ? What if it happen again.
... View more
01-08-2019
03:06 PM
If switch is the issue. Then can I connect those four servers directly in firewall interface and can act as one (subnet using Bvi) ?
... View more
01-08-2019
02:54 PM
Firewall LAN side port is connected to cisco switch sg 220 and then users. currently checking the issue with switch if any.
... View more
01-08-2019
02:47 PM
Hi, please refer to this link for the output. https://pastebin.com/0PtkVBMN
... View more
01-08-2019
02:30 PM
Yes the devices on lan is on subnet 10.184.2.x /24. As per above configuration NAT allowed is correct or not ?
... View more
Created by
jrnetipsec
in Firewalls
01-15-2019 10:07 AM
01-15-2019 10:07 AM
Hi everyone, Eventually, we figured it out. The issue was not with the
routing as I have checked ASA...
Created by
jrnetipsec
in Firewalls
01-11-2019 08:33 AM
01-11-2019 08:33 AM
Which traffic is not reaching dc (lan) to asa or from site 1 (lan) to dc
asa ? there is managed swit...
Created by
jrnetipsec
in Firewalls
01-11-2019 08:18 AM
01-11-2019 08:18 AM
I have changed the object to same as site1. But the issue is same. There
is no router or switch. bet...
Created by
jrnetipsec
in Firewalls
01-11-2019 08:05 AM
01-11-2019 08:05 AM
Can you elaborate please ? following is only routing in dc side:route
outside 0.0.0.0 0.0.0.0 x.x.x....
Created by
jrnetipsec
in Firewalls
01-11-2019 08:00 AM
01-11-2019 08:00 AM
logging monitor debug. Command is not working ASA5506.
Created by
jrnetipsec
in Firewalls
01-11-2019 07:54 AM
01-11-2019 07:54 AM
Continuous ping is running from 10.55.1.x to 10.184.2.x.I observed the
same packets are not encap/de...
Created by
jrnetipsec
in Firewalls
01-11-2019 07:34 AM
01-11-2019 07:34 AM
Hi Community, I am stuck in here as, VPN is successfully established
between DC & Site1 but traffic ...
Created by
jrnetipsec
in Firewalls
01-09-2019 07:01 AM
01-09-2019 07:01 AM
Yes. Issue is on WAN side, asa is connected to comcast modem and dhcp
was enable and double nat crea...
Created by
jrnetipsec
in Firewalls
01-08-2019 03:32 PM
01-08-2019 03:32 PM
ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4
cores)Version 9.8(2). Today itself it...
Created by
jrnetipsec
in Firewalls
01-08-2019 03:14 PM
01-08-2019 03:14 PM
In past when I entered nameif command in Bvi firewall crashed. So What
is the issue with that ? What...
Created by
jrnetipsec
in Firewalls
01-08-2019 03:06 PM
01-08-2019 03:06 PM
If switch is the issue. Then can I connect those four servers directly
in firewall interface and can...
Created by
jrnetipsec
in Firewalls
01-08-2019 02:54 PM
01-08-2019 02:54 PM
Firewall LAN side port is connected to cisco switch sg 220 and then
users. currently checking the is...
Created by
jrnetipsec
in Firewalls
01-08-2019 02:47 PM
01-08-2019 02:47 PM
Hi, please refer to this link for the output.
https://pastebin.com/0PtkVBMN
Created by
jrnetipsec
in Firewalls
01-08-2019 02:33 PM
01-08-2019 02:33 PM
Done. Still the problem persist. Even changed the firewall.
Created by
jrnetipsec
in Firewalls
01-08-2019 02:30 PM
01-08-2019 02:30 PM
Yes the devices on lan is on subnet 10.184.2.x /24. As per above
configuration NAT allowed is correc...
Public Statistics
| Date Registered | 11-02-2017 05:53 AM |
| Date Last Visited | 02-01-2019 04:30 AM |
| Total Messages Posted | 18 |
.jpg "VIP Advocate"){kind=icon}
