Hi Guys,
Some background:
- trying to establish site-to-site IPsec tunnel between ASA and Juniper (I have no access to Juniper).
- in a week of trial and error we got the tunnel established, however no trafffic is flowing, through.
- main issue prior was to get phase 2 going. After changing proxy-id on Juniper to public IPs, instead of local IP's, phase 2 succeded.
Please have a look at running config (irrelevant outut ommited):
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
switchport access vlan 3
!
interface Ethernet0/3
switchport access vlan 4
!
interface Ethernet0/4
switchport access vlan 5
!
interface Ethernet0/5
switchport access vlan 5
!
interface Ethernet0/6
switchport access vlan 5
!
interface Ethernet0/7
switchport access vlan 5
!
interface Vlan1
nameif inside
security-level 100
ip address q.q.q.q 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
access-list inside_nat0_outbound extended permit ip 192.168.15.0 255.255.255.0 Solon_192_Net 255.255.255.0
access-list inside_nat0_outbound extended permit ip 192.168.15.0 255.255.255.0 172.16.160.0 255.255.255.0
access-list split-tunnel standard permit 192.168.15.0 255.255.255.0
access-list Default_splitTunnelAcl standard permit 192.168.15.0 255.255.255.0
access-list outside_3_cryptomap extended permit ip 192.168.15.0 255.255.255.0 object-group DM_INLINE_NETWORK_1
pager lines 24
logging enable
logging buffer-size 50000
logging buffered debugging
logging asdm informational
mtu inside 1500
mtu outside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
route outside 172.16.160.0 255.255.255.0 x.x.x.x
route outside Solon_192_Net 255.255.255.0 x.x.x.x
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record SslVPN
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 3 match address outside_3_cryptomap
crypto map outside_map 3 set pfs
crypto map outside_map 3 set connection-type originate-only
crypto map outside_map 3 set peer y.y.y.y
crypto map outside_map 3 set transform-set ESP-AES-128-SHA
crypto map outside_map interface outside
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 1
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 30
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
vpn-idle-timeout none
vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
split-tunnel-policy tunnelspecified
split-tunnel-network-list value split-tunnel
group-policy solonVPN internal
group-policy solonVPN attributes
vpn-filter value outside_3_cryptomap
vpn-tunnel-protocol IPSec l2tp-ipsec
vpn-tunnel-protocol IPSec svc
split-tunnel-policy tunnelspecified
split-tunnel-network-list value split-tunnel
tunnel-group y.y.y.y type ipsec-l2l
tunnel-group y.y.y.y general-attributes
default-group-policy solonVPN
tunnel-group y.y.y.y ipsec-attributes
pre-shared-key *****
Also output of: show ipsec sa peer y.y.y.y
peer address: y.y.y.y
Crypto map tag: outside_map, seq num: 3, local addr: x.x.x.x
access-list OO_temp_outside_map3 extended permit ip host x.x.x.x host y.y.y.y
local ident (addr/mask/prot/port): (x.x.x.x/255.255.255.255/0/0)
remote ident (addr/mask/prot/port): (y.y.y.y/255.255.255.255/0/0)
current_peer: y.y.y.y
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: x.x.x.x, remote crypto endpt.: y.y.y.y
path mtu 1492, ipsec overhead 74, media mtu 1500
current outbound spi: 2457BF99
current inbound spi : 09A6FF7A
inbound esp sas:
spi: 0x09A6FF7A (161939322)
transform: esp-aes esp-sha-hmac no compression
in use settings ={L2L, Tunnel, PFS Group 2, }
slot: 0, conn_id: 24576, crypto-map: outside_map
sa timing: remaining key lifetime (sec): 3494
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
outbound esp sas:
spi: 0x2457BF99 (609730457)
transform: esp-aes esp-sha-hmac no compression
in use settings ={L2L, Tunnel, PFS Group 2, }
slot: 0, conn_id: 24576, crypto-map: outside_map
sa timing: remaining key lifetime (sec): 3494
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
Any help much appreciated....
