One way encryption, decrypting not encrypting ASA5505

Alan Herriman · ‎10-30-2012

Hello All,

I've been troubleshooting this issue and was hoping to get some more feed back and maybe point out an error if I'm not seeing it. I recently setup a remote access VPN on Cisco ASA 5505. Everything appeared to work at first and the IPsec client connect. However if you look at the packets being encrypted an decrypted on the Client side only the encrypted counter is incrementing and the decrypted stays at 0. The opposite is true on the ASA side the decrypted continures to increment and the encrypted stays at zero. My first thought was maybe a mis configured NAT 0 statement or not defining the correct Split tunnel ACL but I have verified that. I will post my config so maybe someone can point on the error. The asa version 8.2(5), I'll also list a packet-tracer I did from an inside host to VPN IP.

-----

Any help will be greatly appreacted, thanks in advance!

-----

ASA Version 8.2(5)

!

terminal width 511

hostname xyz

domain-name xyz.local

no names

dns-guard

!

interface Ethernet0/0

description ISP Connection

switchport access vlan 900

!

interface Ethernet0/1

switchport access vlan 10

!

interface Ethernet0/2

switchport access vlan 20

!

interface Ethernet0/3

switchport access vlan 30

!

interface Ethernet0/4

switchport access vlan 40

!

interface Ethernet0/5

switchport access vlan 50

switchport trunk allowed vlan 10,20,30,40,350

switchport trunk native vlan 10

switchport mode trunk

!

interface Ethernet0/6

switchport trunk allowed vlan 10,20,30,40,350

switchport trunk native vlan 10

switchport mode trunk

!

interface Ethernet0/7

description WAP

switchport trunk allowed vlan 10,20,30,40,350

switchport trunk native vlan 10

switchport mode trunk

!

interface Vlan10

description LAN

nameif inside

security-level 100

ip address 10.10.254.1 255.255.0.0

!

interface Vlan20

description LAN

nameif inside20

security-level 100

ip address 10.20.254.1 255.255.0.0

!

interface Vlan30

description LAN

nameif inside30

security-level 100

ip address 10.30.254.1 255.255.0.0

!

interface Vlan40

description LAN

nameif inside40

security-level 100

ip address 10.40.254.1 255.255.0.0

!

interface Vlan350

description Guest LAN

nameif guest

security-level 50

ip address 10.3.50.254 255.255.255.0

!

interface Vlan900

description ISP Connection

nameif outside

security-level 0

ip address x.x.x.x 255.255.255.252

boot system disk0:/asa825-k8.bin

ftp mode passive

dns server-group DefaultDNS

domain-name xyz.local

same-security-traffic permit intra-interface

access-list OUTSIDE-IN remark :

access-list OUTSIDE-IN remark : Allow OUTSIDE to inside

access-list OUTSIDE-IN remark :

access-list OUTSIDE-IN remark Allow ICMP Replies

access-list OUTSIDE-IN extended permit icmp any any echo-reply

access-list OUTSIDE-IN extended permit icmp any any time-exceeded

access-list OUTSIDE-IN extended permit icmp any any unreachable

access-list NAT-0-INSIDE remark :

access-list NAT-0-INSIDE remark : Do not NAT this traffic

access-list NAT-0-INSIDE remark :

access-list NAT-0-INSIDE remark Allow LAN to VPN Users

access-list NAT-0-INSIDE extended permit ip 10.10.0.0 255.255.0.0 172.16.10.0 255.255.255.0

access-list NAT-0-INSIDE extended permit ip 10.20.0.0 255.255.0.0 172.16.10.0 255.255.255.0

access-list NAT-0-INSIDE extended permit ip 10.40.0.0 255.255.0.0 172.16.10.0 255.255.255.0

access-list NAT-0-INSIDE extended permit ip 10.30.0.0 255.255.0.0 172.16.10.0 255.255.255.0

access-list NAT-0-INSIDE extended permit ip 10.3.0.0 255.255.255.0 172.16.10.0 255.255.255.0

access-list NAT-10-INSIDE remark :

access-list NAT-10-INSIDE remark : Allow LAN NAT

access-list NAT-10-INSIDE remark :

access-list NAT-10-INSIDE extended permit ip 10.0.0.0 255.0.0.0 any

access-list VPN-SPLIT-TUNNEL remark :

access-list VPN-SPLIT-TUNNEL remark : Add Routes for these networks to the VPN clients

access-list VPN-SPLIT-TUNNEL remark :

access-list VPN-SPLIT-TUNNEL extended permit ip 10.10.0.0 255.255.0.0 any

access-list VPN-SPLIT-TUNNEL extended permit ip 10.20.0.0 255.255.0.0 any

access-list VPN-SPLIT-TUNNEL extended permit ip 10.30.0.0 255.255.0.0 any

access-list VPN-SPLIT-TUNNEL extended permit ip 10.40.0.0 255.255.0.0 any

access-list VPN-SPLIT-TUNNEL extended permit ip 10.3.0.0 255.255.255.0 any

pager lines 40

logging enable

logging timestamp

logging buffer-size 16384

logging buffered debugging

logging trap informational

logging history errors

logging asdm informational

mtu inside 1500

mtu inside20 1500

mtu inside30 1500

mtu inside40 1500

mtu guest 1500

mtu outside 1500

ip local pool VPN-POOL 172.16.10.1-172.16.10.99 mask 255.255.255.0

ip audit name IDSATTACK attack action alarm drop reset

ip audit interface inside IDSATTACK

ip audit interface inside20 IDSATTACK

ip audit interface inside30 IDSATTACK

ip audit interface inside40 IDSATTACK

ip audit interface guest IDSATTACK

ip audit interface outside IDSATTACK

ip audit attack action alarm drop reset

ip audit signature 2000 disable

ip audit signature 2001 disable

ip audit signature 2004 disable

no failover

icmp unreachable rate-limit 1 burst-size 1

icmp permit any inside

icmp permit any inside20

icmp permit any inside30

icmp permit any inside40

icmp permit any guest

icmp permit any outside

asdm image disk0:/asdm-649.bin

asdm history enable

arp timeout 14400

global (outside) 10 interface

nat (inside) 0 access-list NAT-0-INSIDE

nat (inside) 10 access-list NAT-10-INSIDE

nat (inside20) 0 access-list NAT-0-INSIDE

nat (inside20) 10 access-list NAT-10-INSIDE

nat (inside30) 0 access-list NAT-0-INSIDE

nat (inside30) 10 access-list NAT-10-INSIDE

nat (inside40) 0 access-list NAT-0-INSIDE

nat (inside40) 10 access-list NAT-10-INSIDE

nat (guest) 0 access-list NAT-0-INSIDE

nat (guest) 10 access-list NAT-10-INSIDE

access-group OUTSIDE-IN in interface outside

route outside 0.0.0.0 0.0.0.0 x.x.x.y 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server RADIUS-AUTH protocol radius

aaa authentication serial console LOCAL

aaa authentication telnet console LOCAL

aaa authentication ssh console LOCAL

aaa authentication http console LOCAL

aaa authentication enable console LOCAL

aaa authentication secure-http-client

http server enable 444

http 0.0.0.0 0.0.0.0 outside

http 0.0.0.0 0.0.0.0 inside

sysopt noproxyarp inside

sysopt noproxyarp inside20

sysopt noproxyarp inside30

sysopt noproxyarp inside40

crypto ipsec transform-set AES-256-SHA-ENCRYPT esp-aes-256 esp-sha-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto dynamic-map VPN-DYN-MAP 1 set transform-set AES-256-SHA-ENCRYPT

crypto dynamic-map VPN-DYN-MAP 1 set security-association lifetime seconds 28800

crypto dynamic-map VPN-DYN-MAP 1 set security-association lifetime kilobytes 4608000

crypto map OUTSIDE-MAP 65535 ipsec-isakmp dynamic VPN-DYN-MAP

crypto map OUTSIDE-MAP interface outside

crypto isakmp identity hostname

crypto isakmp enable outside

crypto isakmp policy 10

authentication pre-share

encryption aes-256

hash sha

group 2

lifetime 86400

telnet 0.0.0.0 0.0.0.0 inside

telnet 0.0.0.0 0.0.0.0 outside

telnet timeout 20

ssh 0.0.0.0 0.0.0.0 inside

ssh 0.0.0.0 0.0.0.0 outside

ssh timeout 20

console timeout 0

dhcpd ping_timeout 750

!

dhcpd address 10.10.1.1-10.10.1.99 inside

dhcpd dns 4.2.2.2 interface inside

dhcpd domain xyz.local interface inside

dhcpd enable inside

!

dhcpd address 10.20.1.1-10.20.1.99 inside20

dhcpd dns 4.2.2.2 interface inside20

dhcpd enable inside20

!

dhcpd address 10.30.1.1-10.30.1.99 inside30

dhcpd dns 4.2.2.2 interface inside30

dhcpd enable inside30

!

dhcpd address 10.40.1.1-10.40.1.99 inside40

dhcpd dns 4.2.2.2 interface inside40

dhcpd enable inside40

!

dhcpd address 10.3.50.1-10.3.50.99 guest

dhcpd dns 4.2.2.2 interface guest

dhcpd enable guest

!

threat-detection basic-threat

threat-detection statistics host

threat-detection statistics access-list

threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200

tunnel-group-list enable

group-policy VPN-POLICY internal

group-policy VPN-POLICY attributes

vpn-simultaneous-logins 20

vpn-idle-timeout 3600

vpn-session-timeout 1440

vpn-tunnel-protocol IPSec svc webvpn

split-tunnel-policy tunnelspecified

split-tunnel-network-list value VPN-SPLIT-TUNNEL

default-domain value xyz.local

split-dns value xyz.local

tunnel-group secant type remote-access

tunnel-group secant general-attributes

address-pool VPN-POOL

authentication-server-group (outside) LOCAL

default-group-policy VPN-POLICY

tunnel-group secant ipsec-attributes

pre-shared-key *****

!

class-map INSPECTION-DEFAULT

description Complete Protocol Inspection List Class Map

match default-inspection-traffic

!

policy-map type inspect dns INSPECT-DNS-MAP

parameters

message-length maximum client auto

message-length maximum 4096

policy-map GLOBAL-INSPECTION-POLICY

description Global Inspection Policy

class INSPECTION-DEFAULT

inspect ftp

inspect netbios

inspect rsh

inspect rtsp

inspect skinny

inspect sqlnet

inspect sunrpc

inspect tftp

inspect sip

inspect xdmcp

inspect http

inspect ils

inspect pptp

inspect ipsec-pass-thru

inspect icmp

inspect dns INSPECT-DNS-MAP

inspect ctiqbe

inspect dcerpc

inspect mgcp

inspect icmp error

inspect snmp

inspect waas

inspect h323 h225

inspect h323 ras

!

service-policy GLOBAL-INSPECTION-POLICY global

A5505-1# packet-tracer input inside icmp 10.10.253.1 1 1 172.16.10.1 detailed

Phase: 1

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in 172.16.10.1 255.255.255.255 outside

Phase: 2

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Forward Flow based lookup yields rule:

in id=0xc96adb20, priority=0, domain=inspect-ip-options, deny=true

hits=69511, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0

src ip=0.0.0.0, mask=0.0.0.0, port=0

dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 3

Type: INSPECT

Subtype: np-inspect

Result: ALLOW

Config:

class-map INSPECTION-DEFAULT

description Complete Protocol Inspection List Class Map

match default-inspection-traffic

policy-map GLOBAL-INSPECTION-POLICY

description Global Inspection Policy

class INSPECTION-DEFAULT

inspect icmp

service-policy GLOBAL-INSPECTION-POLICY global

Additional Information:

Forward Flow based lookup yields rule:

in id=0xcc510638, priority=70, domain=inspect-icmp, deny=false

hits=10388, user_data=0xcc510438, cs_id=0x0, use_real_addr, flags=0x0, protocol=1

src ip=0.0.0.0, mask=0.0.0.0, port=0

dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 4

Type: INSPECT

Subtype: np-inspect

Result: ALLOW

Config:

Additional Information:

Forward Flow based lookup yields rule:

in id=0xcc51dbb8, priority=70, domain=inspect-icmp-error, deny=false

hits=10388, user_data=0xcc51d9b8, cs_id=0x0, use_real_addr, flags=0x0, protocol=1

src ip=0.0.0.0, mask=0.0.0.0, port=0

dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 5

Type: DEBUG-ICMP

Subtype:

Result: ALLOW

Config:

Additional Information:

Forward Flow based lookup yields rule:

in id=0xc97e7e30, priority=12, domain=debug-icmp-trace, deny=false

hits=16500, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=1

src ip=0.0.0.0, mask=0.0.0.0, port=0

dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 6

Type: NAT-EXEMPT

Subtype:

Result: ALLOW

Config:

match ip inside 10.10.0.0 255.255.0.0 outside 172.16.10.0 255.255.255.0

NAT exempt

translate_hits = 5, untranslate_hits = 796

Additional Information:

Forward Flow based lookup yields rule:

in id=0xc97b1d40, priority=6, domain=nat-exempt, deny=false

hits=5, user_data=0xc9840640, cs_id=0x0, use_real_addr, flags=0x0, protocol=0

src ip=10.10.0.0, mask=255.255.0.0, port=0

dst ip=172.16.10.0, mask=255.255.255.0, port=0, dscp=0x0

Phase: 7

Type: NAT

Subtype:

Result: ALLOW

Config:

nat (inside) 10 access-list NAT-10-INSIDE

match ip inside 10.0.0.0 255.0.0.0 outside any

dynamic translation to pool 10 (x.x.x.x [Interface PAT])

translate_hits = 61470, untranslate_hits = 8513

Additional Information:

Forward Flow based lookup yields rule:

in id=0xc9950080, priority=2, domain=nat, deny=false

hits=61604, user_data=0xc994ffc0, cs_id=0x0, flags=0x0, protocol=0

src ip=10.0.0.0, mask=255.0.0.0, port=0

dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 8

Type: NAT

Subtype: host-limits

Result: ALLOW

Config:

nat (inside) 10 access-list NAT-10-INSIDE

match ip inside 10.0.0.0 255.0.0.0 inside any

dynamic translation to pool 10 (No matching global)

translate_hits = 0, untranslate_hits = 0

Additional Information:

Forward Flow based lookup yields rule:

in id=0xc994d1e0, priority=2, domain=host, deny=false

hits=69627, user_data=0xc994cdc8, cs_id=0x0, reverse, flags=0x0, protocol=0

src ip=10.0.0.0, mask=255.0.0.0, port=0

dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 9

Type: VPN

Subtype: encrypt

Result: ALLOW

Config:

Additional Information:

Forward Flow based lookup yields rule:

out id=0xc983d570, priority=70, domain=encrypt, deny=false

hits=777, user_data=0x4c2e4, cs_id=0x0, reverse, flags=0x0, protocol=0

src ip=0.0.0.0, mask=0.0.0.0, port=0

dst ip=172.16.10.1, mask=255.255.255.255, port=0, dscp=0x0

Phase: 10

Type: FLOW-CREATION

Subtype:

Result: ALLOW

Config:

Additional Information:

New flow created with id 102356, packet dispatched to next module

Module information for forward flow ...

snp_fp_tracer_drop

snp_fp_inspect_ip_options

snp_fp_inspect_icmp

snp_fp_dbg_icmp

snp_fp_adjacency

snp_fp_encrypt

snp_fp_fragment

snp_ifc_stat

Module information for reverse flow ...

Result:

input-interface: inside

input-status: up

input-line-status: up

output-interface: outside

output-status: up

output-line-status: up

Action: allow

Javier Portuguez · ‎10-30-2012

Hi Alan,

Please make the following changes:

access-list VPN_SPLIT_ACL remark :

access-list VPN_SPLIT_ACL remark : Add Routes for these networks to the VPN clients

access-list VPN_SPLIT_ACL remark :

access-list VPN_SPLIT_ACL permit 10.10.0.0 255.255.0.0

access-list VPN_SPLIT_ACL permit 10.20.0.0 255.255.0.0

access-list VPN_SPLIT_ACL permit 10.30.0.0 255.255.0.0

access-list VPN_SPLIT_ACL permit 10.40.0.0 255.255.0.0

access-list VPN_SPLIT_ACL permit 10.3.0.0 255.255.255.0

!

group-policy VPN-POLICY attributes

split-tunnel-network-list value VPN_SPLIT_ACL

!

crypto isakmp nat-traversal 30

!

capture capin interface inside match ip 10.10.0.0 255.255.0.0 172.16.10.0 255.255.255.0

Then connect and try to ping any IP within the 10.10.0.0 /16 range.

Once done, issue:

show capture capin

HTH.

Portu.

Please rate any helpful posts