Route another sub-net traffic via Site-to-Site VPN on ASA 5500

atishin · ‎05-08-2012

I have a functioning site-to-site VPN between two ASA 5505 appiances. Sub-net on one side is 192.168.20.0/24 (inside I/F) and on the other side is 192.168.30.0/24 (inside I/F). VPN is built over public Internet (outside I/Fs of those two ASAs).

Now I connected another subnet on 192.168.30.0/24 - e.g. 192.168.35.0/24. Traffic from 192.168.30.0 subnet is routed to 192.168.35.0 via Gateway at 192.168.30.250 IP.

My task is to make packets from 192.168.20.0 subnet to go to 192.168.35.0 subnet and vice versa.

I setup a static route on 20.0 ASA's Inside interface as 192.168.35.0 255.255.255.0 to 192.168.30.250. I also created NAT examptions for outbound packets from 20.0 to 35.0 and inbound as well. I also added destination network of 35.0 to VPN cryptomap traffic selection (on both ASAs).

Still packets are not going through

Any help with the setup would be highly appreciated. Thanks!

Marvin Rhoads · ‎05-08-2012

Packet-tracer is your friend here. Plug in your source and destination IPs and it will show you the steps the packet takes through the ASA and where they are being dropped. You can access it either via the ASDM GUI or via the cli.

If you want to follow a more detailed path you can always "show cry ipsec sa" and make sure the source and destination networks have formed IPsec SAs properly at both ends. If not, you can "debug crypto ipsec 7" at both ends and look for errors in the cryptomaps. If you have more than one site-site VPN you may want to add "debug crypto condition peer ". (You have a working VPN so "debug crypro isakmp 7" would be overkill.)

The static shouldn't be necessary if your default gateway is on the outside interface. The packets should come into the ASA, be NAT-exempted, hit the cryptomap access-list on interface outside, and be put into an IPsec SA on the site-site VPN.

atishin · ‎05-09-2012

Thank you for reply! It seems that based on a packet-tracer info ICMP packets should be going fine (see below), but when I do "ping 192.168.35.3" from 20.0 network - I get "Request timed out".

asa-office# packet-tracer input inside icmp 192.168.20.12 8 0 192.168.35.3 det$

Phase: 1

Type: ACCESS-LIST

Subtype:

Result: ALLOW

Config:

Implicit Rule

Additional Information:

Forward Flow based lookup yields rule:

in id=0xd8134868, priority=1, domain=permit, deny=false

hits=590132413, user_data=0x0, cs_id=0x0, l3_type=0x8

src mac=0000.0000.0000, mask=0000.0000.0000

dst mac=0000.0000.0000, mask=0100.0000.0000

Phase: 2

Type: FLOW-LOOKUP

Subtype:

Result: ALLOW

Config:

Additional Information:

Found no matching flow, creating a new flow

Phase: 3

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in 0.0.0.0 0.0.0.0 outside

Phase: 4

Type: ACCESS-LIST

Subtype: log

Result: ALLOW

Config:

access-group inside_access_in in interface inside

access-list inside_access_in extended permit object-group DM_INLINE_PROTOCOL_2 INT_NET_US 255.255.255.0 any

object-group protocol DM_INLINE_PROTOCOL_2

protocol-object ip

protocol-object icmp

protocol-object udp

protocol-object tcp

Additional Information:

Forward Flow based lookup yields rule:

in id=0xd81d35b8, priority=12, domain=permit, deny=false

hits=18792771, user_data=0xd64d25a0, cs_id=0x0, flags=0x0, protocol=0

src ip=INT_NET_US, mask=255.255.255.0, port=0

dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 5

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Forward Flow based lookup yields rule:

in id=0xd8136fa0, priority=0, domain=inspect-ip-options, deny=true

hits=40604213, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0

src ip=0.0.0.0, mask=0.0.0.0, port=0

dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 6

Type: INSPECT

Subtype: np-inspect

Result: ALLOW

Config:

class-map global-class1

match any

policy-map global-policy-netflow

class global-class1

inspect http

service-policy global-policy-netflow global

Additional Information:

Forward Flow based lookup yields rule:

in id=0xd881a8e0, priority=70, domain=inspect-http, deny=false

hits=30199129, user_data=0xd881a728, cs_id=0x0, flags=0x0, protocol=0

src ip=0.0.0.0, mask=0.0.0.0, port=0

dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 7

Type: INSPECT

Subtype: np-inspect

Result: ALLOW

Config:

Additional Information:

Forward Flow based lookup yields rule:

in id=0xd8136c18, priority=66, domain=inspect-icmp-error, deny=false

hits=1215301, user_data=0xd8136b00, cs_id=0x0, use_real_addr, flags=0x0, protocol=1

src ip=0.0.0.0, mask=0.0.0.0, port=0

dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 8

Type:

Subtype:

Result: ALLOW

Config:

Additional Information:

Forward Flow based lookup yields rule:

in id=0xd881b3b8, priority=17, domain=flow-export, deny=false

hits=34923104, user_data=0xd88189d0, cs_id=0x0, flags=0x0, protocol=0

src ip=0.0.0.0, mask=0.0.0.0, port=0

dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 9

Type: NAT-EXEMPT

Subtype:

Result: ALLOW

Config:

match ip inside INT_NET_US 255.255.255.0 outside 192.168.35.0 255.255.255.0

NAT exempt

translate_hits = 74, untranslate_hits = 0

Additional Information:

Forward Flow based lookup yields rule:

in id=0xda0f5700, priority=6, domain=nat-exempt, deny=false

hits=74, user_data=0xd932f938, cs_id=0x0, use_real_addr, flags=0x0, protocol=0

src ip=INT_NET_US, mask=255.255.255.0, port=0

dst ip=192.168.35.0, mask=255.255.255.0, port=0, dscp=0x0

Phase: 10

Type: NAT-EXEMPT

Subtype: rpf-check

Result: ALLOW

Config:

Additional Information:

Forward Flow based lookup yields rule:

in id=0xd8127c88, priority=6, domain=nat-exempt-reverse, deny=false

hits=25, user_data=0xd8a32840, cs_id=0x0, use_real_addr, flags=0x0, protocol=0

src ip=INT_NET_US, mask=255.255.255.0, port=0

dst ip=192.168.35.0, mask=255.255.255.0, port=0, dscp=0x0

Phase: 11

Type: NAT

Subtype:

Result: ALLOW

Config:

static (inside,outside) APU_E APU_I netmask 255.255.255.255

match ip inside host APU_I outside any

static translation to APU_E

translate_hits = 73421, untranslate_hits = 1248268

Additional Information:

Forward Flow based lookup yields rule:

in id=0xd81cec08, priority=5, domain=nat, deny=false

hits=458056, user_data=0xd81ce360, cs_id=0x0, flags=0x0, protocol=0

src ip=APU_I, mask=255.255.255.255, port=0

dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 12

Type: NAT

Subtype: host-limits

Result: ALLOW

Config:

static (inside,outside) APU_E APU_I netmask 255.255.255.255

match ip inside host APU_I outside any

static translation to APU_E

translate_hits = 73421, untranslate_hits = 1248268

Additional Information:

Forward Flow based lookup yields rule:

in id=0xd81cef60, priority=5, domain=host, deny=false

hits=1593063, user_data=0xd81ce360, cs_id=0x0, reverse, flags=0x0, protocol=0

src ip=APU_I, mask=255.255.255.255, port=0

dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 13

Type: HOST-LIMIT

Subtype:

Result: ALLOW

Config:

Additional Information:

Forward Flow based lookup yields rule:

in id=0xd8188f98, priority=0, domain=host-limit, deny=false

hits=30198109, user_data=0x0, cs_id=0x0, flags=0x0, protocol=0

src ip=0.0.0.0, mask=0.0.0.0, port=0

dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 14

Type: VPN

Subtype: encrypt

Result: ALLOW

Config:

Additional Information:

Forward Flow based lookup yields rule:

out id=0xd93e0748, priority=70, domain=encrypt, deny=false

hits=1, user_data=0xa6ad18c, cs_id=0xd8798648, reverse, flags=0x0, protocol=0

src ip=INT_NET_US, mask=255.255.255.0, port=0

dst ip=192.168.35.0, mask=255.255.255.0, port=0, dscp=0x0

Phase: 15

Type: FLOW-CREATION

Subtype:

Result: ALLOW

Config:

Additional Information:

New flow created with id 42393361, packet dispatched to next module

Module information for forward flow ...

snp_fp_tracer_drop

snp_fp_inspect_ip_options

snp_fp_inspect_http

snp_fp_adjacency

snp_fp_encrypt

snp_fp_fragment

snp_ifc_stat

Module information for reverse flow ...

Result:

input-interface: inside

input-status: up

input-line-status: up

output-interface: outside

output-status: up

output-line-status: up

Action: allow

############################ Below is the portion of sho cry ipsec command #############################

asa-office# show cry ipsec sa

interface: outside

Crypto map tag: outside_map, seq num: 1, local addr: AAA.AAA.AAA.AAA

access-list outside_1_cryptomap extended permit ip 192.168.20.0 255.255.255.0 192.168.30.0 255.255.255.0

local ident (addr/mask/prot/port): (INT_NET_US/255.255.255.0/0/0)

remote ident (addr/mask/prot/port): (INT_NET_COLO/255.255.255.0/0/0)

current_peer: BBB.BBB.BBB.BBB

#pkts encaps: 1029637, #pkts encrypt: 1029637, #pkts digest: 1029637

#pkts decaps: 1295803, #pkts decrypt: 1295803, #pkts verify: 1295803

#pkts compressed: 0, #pkts decompressed: 0

#pkts not compressed: 1029637, #pkts comp failed: 0, #pkts decomp failed: 0

#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0

#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0

#send errors: 0, #recv errors: 0

local crypto endpt.:AAA.AAA.AAA.AAA, remote crypto endpt.: BBB.BBB.BBB.BBB

path mtu 1500, ipsec overhead 58, media mtu 1500

current outbound spi: DCB91573

current inbound spi : 28863050

inbound esp sas:

spi: 0x28863050 (679882832)

transform: esp-3des esp-md5-hmac no compression

in use settings ={L2L, Tunnel, }

slot: 0, conn_id: 2609152, crypto-map: outside_map

sa timing: remaining key lifetime (kB/sec): (3828550/12552)

IV size: 8 bytes

replay detection support: Y

Anti replay bitmap:

0xFFFFFFFF 0xFFFFFFFF

outbound esp sas:

spi: 0xDCB91573 (3703117171)

transform: esp-3des esp-md5-hmac no compression

in use settings ={L2L, Tunnel, }

slot: 0, conn_id: 2609152, crypto-map: outside_map

sa timing: remaining key lifetime (kB/sec): (3874748/12552)

IV size: 8 bytes

replay detection support: Y

Anti replay bitmap:

0x00000000 0x00000001

Crypto map tag: outside_map, seq num: 1, local addr: AAA.AAA.AAA.AAA

access-list outside_1_cryptomap extended permit ip 192.168.20.0 255.255.255.0 192.168.35.0 255.255.255.0

local ident (addr/mask/prot/port): (INT_NET_US/255.255.255.0/0/0)

remote ident (addr/mask/prot/port): (192.168.35.0/255.255.255.0/0/0)

current_peer: BBB.BBB.BBB.BBB

#pkts encaps: 10, #pkts encrypt: 10, #pkts digest: 10

#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0

#pkts compressed: 0, #pkts decompressed: 0

#pkts not compressed: 10, #pkts comp failed: 0, #pkts decomp failed: 0

#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0

#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0

#send errors: 0, #recv errors: 0

local crypto endpt.: AAA.AAA.AAA.AAA, remote crypto endpt.: BBB.BBB.BBB.BBB

path mtu 1500, ipsec overhead 58, media mtu 1500

current outbound spi: 8156359C

current inbound spi : EB153CB4

inbound esp sas:

spi: 0xEB153CB4 (3944037556)

transform: esp-3des esp-md5-hmac no compression

in use settings ={L2L, Tunnel, }

slot: 0, conn_id: 2609152, crypto-map: outside_map

sa timing: remaining key lifetime (kB/sec): (3915000/27325)

IV size: 8 bytes

replay detection support: Y

Anti replay bitmap:

0x00000000 0x00000001

outbound esp sas:

spi: 0x8156359C (2169910684)

transform: esp-3des esp-md5-hmac no compression

in use settings ={L2L, Tunnel, }

slot: 0, conn_id: 2609152, crypto-map: outside_map

sa timing: remaining key lifetime (kB/sec): (3914999/27322)

IV size: 8 bytes

replay detection support: Y

Anti replay bitmap:

0x00000000 0x00000001