IPSEC packets not encrypted

Kris McCormick · ‎11-01-2012

Greetings,

We have an issue with a previously working VPN that is now not working. To our knowledge, nothing was changed but I'm not sure what could explain this VPN suddenly stopping.

Output of sho crypto isakmp sa:

Active SA: 1

Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)

Total IKE SA: 1

1 IKE Peer: xx.xx.xx.98

Type : L2L Role : responder

Rekey : no State : MM_ACTIVE

Output of sho crypto ipsec sa. As you can see, packets are decrypted but not encrypted.

interface: outside

Crypto map tag: outside_map, seq num: 1, local addr: xx.xx.xx.150

access-list outside_1_cryptomap extended permit ip 10.10.10.0 255.255.255.0 10.20.27.0 255.255.255.0

local ident (addr/mask/prot/port): (10.10.10.0/255.255.255.0/0/0)

remote ident (addr/mask/prot/port): (CompanyLAN/255.255.255.0/0/0)

current_peer: xx.xx.xx.98

#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0

#pkts decaps: 2840, #pkts decrypt: 2840, #pkts verify: 2840

#pkts compressed: 0, #pkts decompressed: 0

#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0

#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0

#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0

#send errors: 0, #recv errors: 0

local crypto endpt.: xx.xx.xx.150, remote crypto endpt.: xx.xx.xx.98

path mtu 1500, ipsec overhead 58, media mtu 1500

current outbound spi: 1C7D07C2

current inbound spi : DD907A48

inbound esp sas:

spi: 0xDD907A48 (3717233224)

transform: esp-3des esp-sha-hmac no compression

in use settings ={L2L, Tunnel, PFS Group 2, }

slot: 0, conn_id: 811008, crypto-map: outside_map

sa timing: remaining key lifetime (sec): 24872

IV size: 8 bytes

replay detection support: Y

Anti replay bitmap:

0xFFFFFFFF 0xFFFFFFFF

outbound esp sas:

spi: 0x1C7D07C2 (477956034)

transform: esp-3des esp-sha-hmac no compression

in use settings ={L2L, Tunnel, PFS Group 2, }

slot: 0, conn_id: 811008, crypto-map: outside_map

sa timing: remaining key lifetime (sec): 24872

IV size: 8 bytes

replay detection support: Y

Anti replay bitmap:

0x00000000 0x00000001

Crypto map tag: outside_map, seq num: 1, local addr: xx.xx.xx.150

access-list outside_1_cryptomap extended permit ip 10.10.12.0 255.255.255.0 10.20.27.0 255.255.255.0

local ident (addr/mask/prot/port): (10.10.12.0/255.255.255.0/0/0)

remote ident (addr/mask/prot/port): (CompanyLAN/255.255.255.0/0/0)

current_peer: xx.xx.xx.98

#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0

#pkts decaps: 3685, #pkts decrypt: 3685, #pkts verify: 3685

#pkts compressed: 0, #pkts decompressed: 0

#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0

#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0

#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0

#send errors: 0, #recv errors: 0

local crypto endpt.:xx.xx.xx.150, remote crypto endpt.: xx.xx.xx.98

path mtu 1500, ipsec overhead 58, media mtu 1500

current outbound spi: 1C7D07C1

current inbound spi : 16B92403

inbound esp sas:

spi: 0x16B92403 (381232131)

transform: esp-3des esp-sha-hmac no compression

in use settings ={L2L, Tunnel, PFS Group 2, }

slot: 0, conn_id: 811008, crypto-map: outside_map

sa timing: remaining key lifetime (sec): 24871

IV size: 8 bytes

replay detection support: Y

Anti replay bitmap:

0xFFFFFFFF 0xFFFFFFFF

outbound esp sas:

spi: 0x1C7D07C1 (477956033)

transform: esp-3des esp-sha-hmac no compression

in use settings ={L2L, Tunnel, PFS Group 2, }

slot: 0, conn_id: 811008, crypto-map: outside_map

sa timing: remaining key lifetime (sec): 24870

IV size: 8 bytes

replay detection support: Y

Anti replay bitmap:

0x00000000 0x00000001

Crypto map tag: outside_map, seq num: 1, local addr: xx.xx.xx.150

access-list outside_1_cryptomap extended permit ip 10.10.14.0 255.255.255.0 10.20.27.0 255.255.255.0

local ident (addr/mask/prot/port): (10.10.14.0/255.255.255.0/0/0)

remote ident (addr/mask/prot/port): (CompanyLAN/255.255.255.0/0/0)

current_peer: xx.xx.xx.98

#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0

#pkts decaps: 1035, #pkts decrypt: 1035, #pkts verify: 1035

#pkts compressed: 0, #pkts decompressed: 0

#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0

#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0

#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0

#send errors: 0, #recv errors: 0

local crypto endpt.: xx.xx.xx.150, remote crypto endpt.: xx.xx.xx.98

path mtu 1500, ipsec overhead 58, media mtu 1500

current outbound spi: 1C7D07C3

current inbound spi : 64B9A673

inbound esp sas:

spi: 0x64B9A673 (1689888371)

transform: esp-3des esp-sha-hmac no compression

in use settings ={L2L, Tunnel, PFS Group 2, }

slot: 0, conn_id: 811008, crypto-map: outside_map

sa timing: remaining key lifetime (sec): 24878

IV size: 8 bytes

replay detection support: Y

Anti replay bitmap:

0xFFFFFFFF 0xFFFFFFFF

outbound esp sas:

spi: 0x1C7D07C3 (477956035)

transform: esp-3des esp-sha-hmac no compression

in use settings ={L2L, Tunnel, PFS Group 2, }

slot: 0, conn_id: 811008, crypto-map: outside_map

sa timing: remaining key lifetime (sec): 24878

IV size: 8 bytes

replay detection support: Y

Anti replay bitmap:

0x00000000 0x00000001

Crypto map tag: outside_map, seq num: 1, local addr: xx.xx.xx.150

access-list outside_1_cryptomap extended permit ip 10.10.16.0 255.255.255.0 10.20.27.0 255.255.255.0

local ident (addr/mask/prot/port): (10.10.16.0/255.255.255.0/0/0)

remote ident (addr/mask/prot/port): (CompanyLAN/255.255.255.0/0/0)

current_peer: xx.xx.xx.98

#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0

#pkts decaps: 1566, #pkts decrypt: 1566, #pkts verify: 1566

#pkts compressed: 0, #pkts decompressed: 0

#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0

#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0

#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0

#send errors: 0, #recv errors: 0

local crypto endpt.: xx.xx.xx.150, remote crypto endpt.: xx.xx.xx.98

path mtu 1500, ipsec overhead 58, media mtu 1500

current outbound spi: 1C7D07C4

current inbound spi : A6446E56

inbound esp sas:

spi: 0xA6446E56 (2789502550)

transform: esp-3des esp-sha-hmac no compression

in use settings ={L2L, Tunnel, PFS Group 2, }

slot: 0, conn_id: 811008, crypto-map: outside_map

sa timing: remaining key lifetime (sec): 24893

IV size: 8 bytes

replay detection support: Y

Anti replay bitmap:

0xFFFFFFFF 0xFFFFFFFF

outbound esp sas:

spi: 0x1C7D07C4 (477956036)

transform: esp-3des esp-sha-hmac no compression

in use settings ={L2L, Tunnel, PFS Group 2, }

slot: 0, conn_id: 811008, crypto-map: outside_map

sa timing: remaining key lifetime (sec): 24893

IV size: 8 bytes

replay detection support: Y

Anti replay bitmap:

0x00000000 0x00000001

Config from the ASA

: Saved

: Written by enable_15 at 19:38:10.199 PDT Thu Nov 1 2012

!

ASA Version 8.0(5)

!

hostname ciscoasa

domain-name default.domain.invalid

enable password *** encrypted

passwd *** encrypted

names

name 10.20.27.0 CompanyLAN

dns-guard

!

interface Ethernet0/0

nameif outside

security-level 0

ip address xx.xx.xx.150 255.255.255.252

!

interface Ethernet0/1

nameif inside

security-level 100

ip address 10.10.10.3 255.255.255.0

!

interface Ethernet0/2

shutdown

no nameif

no security-level

no ip address

!

interface Ethernet0/3

shutdown

no nameif

no security-level

no ip address

!

interface Management0/0

shutdown

nameif management

security-level 100

ip address 192.168.1.1 255.255.255.0

management-only

!

ftp mode passive

clock timezone PST -8

clock summer-time PDT recurring

dns server-group DefaultDNS

domain-name default.domain.invalid

object-group service VPN

service-object gre

service-object esp

service-object ah

service-object udp eq 4500

service-object udp eq isakmp

object-group network OtherNetworks

network-object 10.10.10.0 255.255.255.0

network-object 10.10.12.0 255.255.255.0

network-object 10.10.14.0 255.255.255.0

network-object 10.10.16.0 255.255.255.0

access-list Public_access_in extended permit object-group VPN any any

access-list Public_access_in extended permit icmp any any echo-reply

access-list Public_access_in extended permit icmp any any time-exceeded

access-list Public_access_in extended permit icmp any any unreachable

access-list Public_access_in extended permit tcp any any eq ssh

access-list Public_access_in extended permit tcp any any eq https

access-list outside_1_cryptomap extended permit ip object-group OtherNetworks CompanyLAN 255.255.255.0

access-list inside_nat0_outbound extended permit ip object-group OtherNetworks CompanyLAN 255.255.255.0

pager lines 24

logging enable

logging asdm informational

mtu outside 1500

mtu inside 1500

mtu management 1500

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-643.bin

no asdm history enable

arp timeout 14400

nat-control

global (outside) 1 interface

nat (inside) 0 access-list inside_nat0_outbound

nat (inside) 1 0.0.0.0 0.0.0.0

access-group Public_access_in in interface outside

!

router rip

version 2

!

route outside 0.0.0.0 0.0.0.0 207.145.119.149 1

route inside 10.10.12.0 255.255.255.0 10.10.10.254 1

route inside 10.10.14.0 255.255.255.0 10.10.10.254 1

route inside 10.10.16.0 255.255.255.0 10.10.10.254 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-record DfltAccessPolicy

aaa authentication ssh console LOCAL

aaa authentication http console LOCAL

aaa authentication serial console LOCAL

aaa authentication telnet console LOCAL

aaa authorization command LOCAL

http server enable

http 0.0.0.0 0.0.0.0 outside

http 192.168.1.0 255.255.255.0 management

http 0.0.0.0 0.0.0.0 inside

snmp-server host inside 10.10.10.7 community *****

snmp-server location xxx

snmp-server contact xxx

snmp-server community *****

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec transform-set Company esp-3des esp-sha-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto map outside_map 1 match address outside_1_cryptomap

crypto map outside_map 1 set pfs

crypto map outside_map 1 set peer xx.xx.xx.98

crypto map outside_map 1 set transform-set Company

crypto map outside_map interface outside

crypto isakmp identity address

crypto isakmp enable outside

crypto isakmp policy 1

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 28800

no crypto isakmp nat-traversal

telnet timeout 5

ssh 0.0.0.0 0.0.0.0 outside

ssh 0.0.0.0 0.0.0.0 inside

ssh 0.0.0.0 0.0.0.0 management

ssh timeout 5

console timeout 0

dhcpd address 192.168.1.2-192.168.1.254 management

dhcpd enable management

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

group-policy GroupPolicy2 internal

group-policy GroupPolicy2 attributes

vpn-tunnel-protocol IPSec

username admin password Yd.1OZbsxJ0s.vYg encrypted privilege 15

tunnel-group xx.xx.xx.98 type ipsec-l2l

tunnel-group xx.xx.xx.98 general-attributes

default-group-policy GroupPolicy2

tunnel-group xx.xx.xx.98 ipsec-attributes

pre-shared-key *

!

class-map inspection_default

match default-inspection-traffic

!

policy-map type inspect dns migrated_dns_map_1

parameters

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns migrated_dns_map_1

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

inspect pptp

!

service-policy global_policy global

prompt hostname context

Cryptochecksum:d19d1b1b79fd0b0c4328ffe54a7d22f8

Does anything stand out as obviously wrong?

Thanks

Harish Balakrishnan · ‎11-01-2012

Hello Kris,

The VPN config looks good. and it seems to be a routing issue to me. Just a question.. are your networks comes under ;OtherNetworks' able to access internet ? .. is something changed on their reverse routing back to company LAN subnet ?.. looks like you are receiving packet from company lan but not replying back..

regards

Harish

Kris McCormick · ‎11-02-2012

Thanks for the reply Harish,

As it turned out, the LAN interface (Ethernet0/1) of the ASA was plugged into a bad switch port. The switch port had a link light (so the interface was up and up) but no traffic was passing. We sent someone onsite to move the cable to an adjacent swiotch port and the VPN came right up.

Thanks for taking a look.