I have got the device to work

avnishvyas1976 · ‎04-07-2015

Hello Guys

Myself and my colleague have been hitting brick walls and could really do with your input.

Scenario

We have a single VPN, one side is a CIsco ASA 5505 and the otherside is a Juniper Netscreen SSG520. The Tunnel is showing as up but the local traffic will not pass through the tunnel!

cisco-test-spain# sh crypto ipsec stats

IPsec Global Statistics
-----------------------
Active tunnels: 0
Previous tunnels: 7043
Inbound
Bytes: 0
Decompressed bytes: 0
Packets: 0
Dropped packets: 0
Replay failures: 0
Authentications: 0
Authentication failures: 0
Decryptions: 0
Decryption failures: 0
Decapsulated fragments needing reassembly: 0
Outbound
Bytes: 0
Uncompressed bytes: 0
Packets: 0
Dropped packets: 0
Authentications: 0
Authentication failures: 0
Encryptions: 0
Encryption failures: 0
Fragmentation successes: 0
Pre-fragmentation successses: 0
Post-fragmentation successes: 0
Fragmentation failures: 0
Pre-fragmentation failures: 0
Post-fragmentation failures: 0
Fragments created: 0
PMTUs sent: 0
PMTUs rcvd: 0
Protocol failures: 0
Missing SA failures: 0
System capacity failures: 0

Vpn settings:

crypto map outside_map0 1 match address outside_cryptomap
crypto map outside_map0 1 set peer X.X.X.X
crypto map outside_map0 1 set transform-set ESP-3DES-SHA ESP-3DES-MD5
crypto map outside_map0 interface outside

crypto ipsec security-association lifetime seconds 28800

global (outside) 1 interface
nat (inside) 1 172.16.18.0 255.255.255.0
static (inside,outside) 192.168.0.99 172.16.18.3 netmask 255.255.255.255

route outside 0.0.0.0 0.0.0.0 192.168.0.99

172.16.18.x is the local device on the cisco lan and 192.168.0.x is the next hop router,

would the natting be correct as we see the traffic on the next hop router but not as a vpn packet?

rizwanr74 · ‎04-07-2015

Hi avnishvyas1976,

Create a new ACL nonat

Find out what is permitted on this ACL: outside_cryptomap and copy one-to-one exact match into ACL nonat from outside_cryptomap.

Now map the ACL nonat to your inside interface, so that that particular traffic will not be subject to nat.

nat (inside) 0 access-list nonat

Let me know, if that helps.

thanks

avnishvyas1976 · ‎04-08-2015

Hi Rizwanr74

Thanks for taking a look, and I followed your advice which has improved the situation but not resolved the problem. Im still not seeing any traffic going down the tunnel. I am however seeing authentication on the VPN which is an improvement to the status before we added the NO NAT statement

cisco-test-spain#sh ipsec stats

IPsec Global Statistics
-----------------------
Active tunnels: 1
Previous tunnels: 20
Inbound
Bytes: 0
Decompressed bytes: 0
Packets: 0
Dropped packets: 0
Replay failures: 0
Authentications: 0
Authentication failures: 0
Decryptions: 0
Decryption failures: 0
Decapsulated fragments needing reassembly: 0
Outbound
Bytes: 0
Uncompressed bytes: 0
Packets: 20
Dropped packets: 0
Authentications: 20
Authentication failures: 0
Encryptions: 20
Encryption failures: 0
Fragmentation successes: 0
Pre-fragmentation successses: 0
Post-fragmentation successes: 0
Fragmentation failures: 0
Pre-fragmentation failures: 0
Post-fragmentation failures: 0
Fragments created: 0
PMTUs sent: 0
PMTUs rcvd: 0
Protocol failures: 0
Missing SA failures: 0
System capacity failures: 0

cisco-test-spain#

I have run a packet-tracer command and can see the packet tracer output is showing a good working VPN, But we are not seeing any traffic.

ommited output#

Phase: 11
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 65, packet dispatched to next module
Module information for forward flow ...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_tcp_normalizer
snp_fp_translate
snp_fp_adjacency
snp_fp_encrypt
snp_fp_fragment
snp_ifc_stat

Module information for reverse flow ...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_ipsec_tunnel_flow
snp_fp_translate
snp_fp_tcp_normalizer
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: allow

rizwanr74 · ‎04-08-2015

It is much easier to trouble shoot if you post your running config.

Secondly, please make sure have needed static routes are in place, on your inside switch and on the ASA itself in order for tunnel to be establish.

thanks

avnishvyas1976 · ‎04-08-2015

Hi rizwanr74

The tunnel is up, the only issue seems to be that the traffic is not being sent through the tunnel. Below is the configuration.

ASA Version 8.2(5)
!
names
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7

!
interface Vlan1
nameif inside
security-level 100
ip address 172.16.18.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 192.168.0.1 255.255.255.0
!
!
ftp mode passive
object-group protocol DM_INLINE_PROTOCOL_1
protocol-object ip
protocol-object icmp
access-list outside_cryptomap extended permit ip 172.16.18.0 255.255.255.248 172.16.0.0 255.240.0.0
access-list NO-NAT extended permit ip 172.16.18.0 255.255.255.248 172.16.0.0 255.240.0.0
access-list outside_access_in extended permit ip 172.16.0.0 255.240.0.0 172.16.18.0 255.255.255.248
access-list inside_access_in extended permit ip any 172.16.0.0 255.240.0.0
pager lines 24
logging enable
logging asdm debugging
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-731.bin.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list NO-NAT
nat (inside) 1 172.16.18.0 255.255.255.0
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 192.168.0.99 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 192.168.1.0 255.255.255.0 inside
http 172.16.18.0 255.255.255.0 inside
http X.X.X.X 255.255.255.255 outside
http X.X.X.X 255.255.255.255 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA-TRANS mode transport
crypto ipsec transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
crypto ipsec transform-set ESP-AES-128-MD5-TRANS mode transport
crypto ipsec transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA-TRANS mode transport
crypto ipsec transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5-TRANS mode transport
crypto ipsec transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-SHA-TRANS mode transport
crypto ipsec transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-MD5-TRANS mode transport
crypto ipsec transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac

crypto ipsec transform-set ESP-3DES-SHA-TRANS mode transport
crypto ipsec transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5-TRANS mode transport
crypto ipsec transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-SHA-TRANS mode transport
crypto ipsec transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
crypto ipsec transform-set ESP-DES-MD5-TRANS mode transport
crypto ipsec transform-set Test esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map outside_map0 1 match address outside_cryptomap
crypto map outside_map0 1 set peer X.X.X.X
crypto map outside_map0 1 set transform-set ESP-3DES-SHA ESP-3DES-MD5
crypto map outside_map0 interface outside
crypto ca trustpoint _SmartCallHome_ServerCA
crl configure
!
quit
crypto isakmp enable outside
crypto isakmp policy 10
authentication crack
encryption aes-256
hash sha

group 2
lifetime 28800
crypto isakmp policy 20
authentication rsa-sig
encryption aes-256
hash sha
group 2
lifetime 28800
crypto isakmp policy 30
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400
crypto isakmp policy 40
authentication crack
encryption aes-192
hash sha
group 2
lifetime 86400
crypto isakmp policy 50
authentication rsa-sig
encryption aes-192
hash sha

group 2
lifetime 86400
crypto isakmp policy 60
authentication pre-share
encryption aes-192
hash sha
group 2
lifetime 86400
crypto isakmp policy 70
authentication crack
encryption aes
hash sha
group 2
lifetime 86400
crypto isakmp policy 80
authentication rsa-sig
encryption aes
hash sha
group 2
lifetime 86400
crypto isakmp policy 90
authentication pre-share
encryption aes
hash sha

group 2
lifetime 86400
crypto isakmp policy 100
authentication crack
encryption 3des
hash sha
group 2
lifetime 28800
crypto isakmp policy 110
authentication rsa-sig
encryption 3des
hash sha
group 2
lifetime 28800
crypto isakmp policy 120
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 28800
crypto isakmp policy 130
authentication crack
encryption des
hash sha

group 2
lifetime 86400
crypto isakmp policy 140
authentication rsa-sig
encryption des
hash sha
group 2
lifetime 86400
crypto isakmp policy 150
authentication pre-share
encryption des
hash sha
group 2
lifetime 86400
!
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!
dhcpd address 172.16.18.2-172.16.18.33 inside
dhcpd enable inside
!

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ssl encryption 3des-sha1
webvpn
group-policy GroupPolicy1 internal
group-policy GroupPolicy1 attributes
vpn-tunnel-protocol IPSec
username cisco password 111111111 encrypted
tunnel-group X.X.X.X type ipsec-l2l
tunnel-group X.X.X.X ipsec-attributes
pre-shared-key *****
tunnel-group X.X.X.X type ipsec-l2l
tunnel-group X.X.X.X ipsec-attributes
pre-shared-key *****
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512

policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous

rizwanr74 · ‎04-08-2015

Your tunnel config looks fine.

Can you make sure on your inside network switch (assuming it is a L3 switch) there is a default or static route in placed to push to firewall as shown below.

ip route 172.16.0.0 255.240.0.0 172.16.18.1

burleyman · ‎04-08-2015

Try adding this command

crypto map outside_map0 1 set reverse-route

Hope that helps.

Mike

avnishvyas1976 · ‎04-10-2015

I have got the device to work, the issue was with the next hop 3g router device.

SHIBI V DEV · ‎04-07-2015

Hi Avnish,

Yo need to exempt VPN traffic from NAT and and verify your match address ACL should be exactly mirror in both side

VPN up but not seeing encrypted traffic passing on ASA 5505