Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About RJI
RJI
.jpg){kind=icon}
VIP Advocate
IT contractor based in the UK, specialising in design and implementation of network/security solutions. CCDA, CCNP (Security and Routing & Switching)
Awards
1
Cisco Designated VIPs 2019 VPN, Policy and Access, Firewalls
Recent Badges
Stats
Member since
12-05-2010
1986
Posts
2482
Helpful
311
Solutions
08-23-2019
12:43 AM
Hi, If the VPN is established and with active IPSec SA then removing the proposals should not break the connection. You should double check the active SA "show crypto ipsec sa" and confirm the algorithms in use and just make sure they match prop3. As with any change in production, do it in a change window and have a roll back plan. HTH
... View more
08-22-2019
12:54 PM
Yes, order is fine. The static NATs in Section 2 will always be processed before the dynamic NAT. If you add any new static NAT rules, they would also be added to Section 2.
... View more
08-22-2019
12:43 PM
I have a newer ASA version, try this "nat (INSIDE,OUTSIDE) after-auto source dynamic any interface"
... View more
08-22-2019
12:40 PM
Perhaps you don't have the rights to view the entire output. Perhaps get full rights and run the command again, the "show" command will not mess anything up. If you have permissions to run a debug, you could run "debug crypto isakmp" or "debug crypto ikev1" and observe the establishment of an IKE SA, if it has MM_ACTIVE, MM_WAIT_MSG or MM_KEY_EXCH in the output then the VPN is being established with Main Mode. If you don't have "crypto ikev1 am-disable" in the running configuration, then it's likely aggressive mode is enabled. It's also likely that main mode is used for the VPNs. HTH
... View more
08-22-2019
11:42 AM
Hi,
The command "crypto ikev1 am-disable" disables aggressive mode, if you don't see this command in your configuration then aggressive mode is enabled. To enable it you use "no crypto ikev1 am-disable" < this is on by default, it is NOT displayed in the configuration.
Use "show crypto isakmp sa" and check the state, which is probably MM_ACTIVE - which means it used Main Mode. If not using Main Mode, it would start AM_ for aggressive mode.
ASA-2(config-tunnel-ipsec)# show crypto isakmp sa IKEv1 SAs: Active SA: 1 Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey) Total IKE SA: 1 1 IKE Peer: 1.1.1.1 Type : L2L Role : initiator Rekey : no State : MM_ACTIVE
... View more
08-22-2019
11:22 AM
Hi, I think you miss understood, your ACL was correct first time. You need to reference the real (private) IP address of the server e.g. 10.1.252.249 not the NATTED IP address in the ACL.
Yes, remove "object network obj_any" and add the example I provided. Use the command "show nat" to confirm that the new static NAT entries are above this new dynamic NAT rule, used for general outbound traffic (internet).
You can add a description under the object, e.g.
object network WebServerIIS80 host 10.1.252.249 description Windows Server 2012 (93)
... View more
08-22-2019
02:30 AM
Hi,
This example will nat behing the IP address assigned to the outside interface:-
object network SVR-HTTP host 10.1.252.249 nat (inside,outside) static interface service tcp 80 80 object network SVR-HTTPS host 10.1.252.249 nat (inside,outside) static interface service tcp 443 443
If you had multiple IP addresses you would replace "interface" with the IP address, e.g.
object network SVR host 10.1.252.249 nat (inside,outside) static 12.43.6.9x
Your existing NAT rule might take precedence, so might be worth removing your existing dynamic nat with the following rule (This is global and not defined under an object.):-
nat (inside,outside) after-auto dynamic interface
Your ACL looks correct, it needs to reference the real IP address rather than the NATTED address.
HTH
... View more
08-21-2019
12:03 PM
Hi,
Can you ping the default gateway (upstream ISP router) from the ASA itself? If that works can you traceroute to 8.8.8.8 and see where it stops.
Your ACL on the outside interface should be configured in the "in" direction, the ACL "OUTSIDE-IN" you appear to have defined does not exist.
access-list INSIDE_IN extended permit ip any any access-list INSIDE_IN extended permit icmp any any access-list OUTSIDE_OUT extended permit ip any any access-list OUTSIDE_OUT extended permit icmp any any
access-group OUTSIDE-IN in interface outside
Also the packer-tracer you ran from outside to inside would not work. You have a dynamic nat not a static 121 nat.
HTH
... View more
08-21-2019
04:25 AM
No I don't see that is possible. You cannot connect through one ASA interface (outside) to another ASA interface, that's by design. I quickly labbed the scenrario you described above and received the following error, which I believe confirms my initial thoughts. %ASA-6-110002: Failed to locate egress interface for UDP from OUTSIDE:3.3.3.1/500 to 11.11.11.1/500 The scenario you are describing is possible on IOS routers, where you could define a loopback. As mentioned previously ASA's don't support loopback interfaces. I can think of a few alternative options for you. Place a router in front of the ASA using the IP address of the current ASA interfaces', re-ip address the ASA with the new IP addresses and then terminate the VPN's. Or alternatively place a router or another ASA in a DMZ interface of the current ASA and utilise the new ip address range. HTH
... View more
08-20-2019
01:17 PM
Hi, You don't appear to have NAT configured on the ASA, I cannot determine from the masked IP addresses if they are public IP addresses and are routable - I assume not? You have "inspect icmp" so icmp replies should be permitted. HTH
... View more
Created by
RJI
in VPN and AnyConnect
RJI
in VPN and AnyConnect
08-20-2019
10:21 AM
08-20-2019
10:21 AM
Can you re-run the packet-tracer again, twice and upload the output. NOTE the icmp type is 8 instead of 0
packet-tracer input outSIDE-0 icmp 192.168.0.50 8 0 10.10.1.5
Can you also provide the configuration - crypto map, ACL, objects (obj_PALMDALE-HQ-RAVPN_net and
azure-networks)
... View more
08-20-2019
08:10 AM
From the debug "IKEv2-PROTO-2: A supplied parameter is incorrect" implies a mis-configured parameter in the IKEv2 Policy. Are you able to confirm exactly what is configured in AWS, rather than what is supported? I've never used AWS, so I assume you define which parameters you wish to use?
... View more
08-20-2019
05:51 AM
It is the same command for both IKEv1 and IKEv2. Agreed, I much prefer VPNs on IOS routers also.
... View more
08-20-2019
05:10 AM
Hi, I think it's enabled as default for L2L and RA VPNs on the ASA. It's configured under the tunnel-group tunnel-group XXXXX ipsec-attributes isakmp keepalive threshold X retry X HTH
... View more
08-20-2019
03:00 AM
Hi, IKEv1/IKEv2 is enabled on the interface of the ASA, unfortunately this means you can only terminate a VPN connection on the IP address assigned to the ASA's interface. You would need to re-IP address the ASA if you wanted to utilise the new IP addresses. HTH
... View more
08-22-2019
Yes, order is fine. The static NATs in Section 2 will always be
processed before the dynamic NAT. If...
08-22-2019
I have a newer ASA version, try this "nat (INSIDE,OUTSIDE) after-auto
source dynamic any interface"
08-22-2019
Perhaps you don't have the rights to view the entire output. Perhaps get
full rights and run the com...
08-22-2019
Hi, The command "crypto ikev1 am-disable" disables aggressive mode, if
you don't see this command in...
08-22-2019
Hi,I think you miss understood, your ACL was correct first time. You
need to reference the real (pri...
08-22-2019
Hi, This example will nat behing the IP address assigned to the outside
interface:- object network S...
08-21-2019
Hi, Can you ping the default gateway (upstream ISP router) from the ASA
itself? If that works can yo...
08-21-2019
No I don't see that is possible. You cannot connect through one ASA
interface (outside) to another A...
08-20-2019
Hi,You don't appear to have NAT configured on the ASA, I cannot
determine from the masked IP address...
08-20-2019
Can you re-run the packet-tracer again, twice and upload the output.
NOTE the icmp type is 8 instead...
08-20-2019
From the debug "IKEv2-PROTO-2: A supplied parameter is incorrect"
implies a mis-configured parameter...
08-20-2019
It is the same command for both IKEv1 and IKEv2. Agreed, I much prefer
VPNs on IOS routers also.
08-20-2019
Hi,I think it's enabled as default for L2L and RA VPNs on the ASA. It's
configured under the tunnel-...
Public Statistics
| Date Registered | 12-05-2010 06:35 AM |
| Date Last Visited | |
| Total Messages Posted | 1,986 |
| Total Helpful Votes Received | 2482 |
Helpful Votes Given To
Helpful Votes From
| User | Helpful Count |
|---|---|
| 25 | |
| 10 | |
| 10 | |
| 10 | |
| 220 |
Awards
Cisco Designated VIPs
2019 VPN, Policy and Access, Firewalls
