I’ve tried to perform a migration from a customer currently running a PIX that terminates 7 site to site VPNs to an ASA. On the attempt to migrate the customer one of the tunnels wouldn’t fully form. The peer would appear in the sho crypto isakmp sa command but a sho crypto ipsec sa was showing no packets being encrypted/ decrypted.
The unusual thing about the current configuration is that this particular VPN is comprises multiple (16 in total) tunnel groups for the same peer. Here’s some example config (peer IP address changed):
crypto map outside_map 300 match address outside_cryptomap_300
crypto map outside_map 300 set peer 1.1.1.1
crypto map outside_map 300 set transform-set ESP-AES-256-SHA
crypto map outside_map 320 ipsec-isakmp
crypto map outside_map 320 match address outside_cryptomap_320
crypto map outside_map 320 set peer 1.1.1.1
crypto map outside_map 320 set transform-set ESP-AES-256-SHA
crypto map outside_map 340 ipsec-isakmp
crypto map outside_map 340 match address outside_cryptomap_340
crypto map outside_map 340 set peer 1.1.1.1
crypto map outside_map 340 set transform-set ESP-AES-256-SHA
It seems to me that the administrator of the PIX had created a new tunnel for each individual subnet that was to be encrypted and sent down the tunnel rather than combining and adding the additional interesting traffic.
As there’s no equivalent tunnel-group statement in the PIX, the translated config for the ASA resolves to picking the access-list from first of set of crypto map statements and adds that to the tunnel group. So I then manually created a group to combine all of the interesting traffic into a single access-list statement and single crypto map policy and therefore single tunnel group. However the tunnel doesn’t properly establish and my thoughts are that this is because the encryption domain/ interesting traffic configuration at this end doesn’t match the configuration at the remote end. I tried enabling PFS and changing the DH group several other changes but to no avail. I even tried adding several tunnel group statements to the same peer but the ASA wouldn’t allow me to.
One of the biggest problems is that we don’t have access to the remote end which is provided by a large faceless service provider who will charge the customer for any changes and synchronising the changes at both ends is going to be pretty impossible. The ASA is running version 8.2.
Does anyone have any other ways around this and any thoughts I’m right on my assumption of why the tunnel isn’t coming up?
Thanks, Anish
