ASA 5505 site to site VPN from a device 7.2 to a device 8.2

Marco Grazioli · ‎02-14-2014

I'm trying to make some test with two ASA 5505; one has software version 7.2(4) the other 8.2.

I would like to make a sit to site VPN from the two device.

I followed the VPN site to site wizard on both machine with the correct parameters, but it does'n work.

Is it possible to make this kind of VPN between devices with different Software version? Or I should upg the older with 7.2 to 8.2 before ?

Thank for your help.

Marco

Soeren Rosiak · ‎02-14-2014

Hi Marco.

Yes it is possible to form a L2L VPN between devices on different software versions.

Please provide us with both of your configs.

Regards,

Søren

Marco Grazioli · ‎02-17-2014

Tks Soeren for your help, these are some info about my test:

Cisco 1 (7.2) Ext 192.168.0.1

Int 192.168.11.50

Cisco 2 (8.2) Ext 192.168.0.2

Int 192.168.10.254

Common gateway 192.168.0.254

Both Ext interface of Cisco 1 & Cisco 2 are on a common switch, like the gateway.

These are SH run:

Cisco 1

ASA Version 7.2(4)

!

hostname DigiASA

domain-name ************

enable password ************* encrypted

passwd *************** encrypted

names

name 192.168.10.0 REMOTE-LAN

!

interface Vlan1

nameif inside

security-level 100

ip address 192.168.11.150 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address 192.168.0.1 255.255.255.0

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

ftp mode passive

dns server-group DefaultDNS

domain-name *************

access-list acl_outbound extended permit tcp any host 192.168.0.1 eq ftp-data

access-list acl_outbound extended permit tcp any host 192.168.0.1 eq ftp

access-list acl_outbound extended permit tcp any host 192.168.0.1 eq https

access-list acl_outbound extended permit tcp any host 192.168.0.1 eq pop3

access-list acl_outbound extended permit tcp any host 192.168.0.1 eq www

access-list acl_inbound extended permit tcp 192.168.11.0 255.255.255.0 any eq www

access-list acl_inbound extended permit tcp 192.168.11.0 255.255.255.0 any eq ftp

access-list acl_inbound extended permit tcp 192.168.11.0 255.255.255.0 any eq ftp-data

access-list acl_inbound extended permit tcp 192.168.11.0 255.255.255.0 any eq smtp

access-list acl_inbound extended deny tcp any any eq www

access-list acl_inbound extended deny tcp any any eq ftp

access-list acl_inbound extended deny tcp any any eq ftp-data

access-list acl_inbound extended deny tcp any any eq smtp

access-list acl_inbound extended deny udp any eq tftp any

access-list acl_inbound extended deny tcp any eq 135 any

access-list acl_inbound extended deny udp any eq 135 any

access-list acl_inbound extended deny tcp any eq 137 any

access-list acl_inbound extended deny udp any eq netbios-ns any

access-list acl_inbound extended deny tcp any eq 138 any

access-list acl_inbound extended deny udp any eq netbios-dgm any

access-list acl_inbound extended deny tcp any eq netbios-ssn any

access-list acl_inbound extended deny udp any eq 139 any

access-list acl_inbound extended deny udp any eq 1080 any

access-list acl_inbound extended deny tcp any eq 445 any

access-list acl_inbound extended deny tcp any eq 593 any

access-list acl_inbound extended deny tcp any eq 3067 any

access-list acl_inbound extended deny tcp any eq 3127 any

access-list acl_inbound extended deny tcp any eq 4444 any

access-list acl_inbound extended deny tcp any eq 5554 any

access-list acl_inbound extended deny tcp any eq 9996 any

access-list acl_inbound extended deny tcp any eq 36794 any

access-list acl_inbound extended permit ip any any

access-list VPN extended permit ip 192.168.11.0 255.255.255.0 host 192.168.11.230

access-list VPN extended permit ip 192.168.11.0 255.255.255.0 host 192.168.11.231

access-list VPN extended permit ip 192.168.11.0 255.255.255.0 host 192.168.11.232

access-list VPN extended permit ip 192.168.11.0 255.255.255.0 host 192.168.11.233

access-list VPN extended permit ip 192.168.11.0 255.255.255.0 host 192.168.11.234

access-list VPN extended permit ip 192.168.11.0 255.255.255.0 host 192.168.11.235

access-list VPN extended permit ip 192.168.11.0 255.255.255.0 host 192.168.11.236

access-list VPN extended permit ip 192.168.11.0 255.255.255.0 host 192.168.11.237

access-list VPN extended permit ip 192.168.11.0 255.255.255.0 host 192.168.11.238

access-list VPN extended permit ip 192.168.11.0 255.255.255.0 host 192.168.11.239

access-list VPN extended permit ip 192.168.11.0 255.255.255.0 host 192.168.11.240

access-list inside_nat0_outbound extended permit ip 192.168.11.0 255.255.255.0 REMOTE-LAN 255.255.255.0

access-list SplitTunnelNets standard permit 192.168.11.0 255.255.255.0

access-list outside_1_cryptomap extended permit ip 192.168.11.0 255.255.255.0 REMOTE-LAN 255.255.255.0

pager lines 24

logging asdm informational

mtu inside 1500

mtu outside 1500

ip local pool Ext-IP 192.168.11.230-192.168.11.240 mask 255.255.255.0

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-524.bin

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list inside_nat0_outbound

nat (inside) 1 0.0.0.0 0.0.0.0

static (inside,outside) tcp interface www 192.168.11.11 www netmask 255.255.255.255

static (inside,outside) tcp interface ftp 192.168.11.11 ftp netmask 255.255.255.255

static (inside,outside) tcp interface https 192.168.11.10 https netmask 255.255.255.255

access-group acl_inbound in interface inside

access-group acl_outbound in interface outside

route outside 0.0.0.0 0.0.0.0 192.168.0.254 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

http server enable

http 192.168.1.0 255.255.255.0 inside

http 192.168.11.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto dynamic-map outside_dyn_map 20 set pfs group1

crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA

crypto map outside_map 1 match address outside_1_cryptomap

crypto map outside_map 1 set pfs group1

crypto map outside_map 1 set peer 192.168.0.2

crypto map outside_map 1 set transform-set ESP-3DES-SHA

crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map

crypto map outside_map interface outside

crypto isakmp enable outside

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

crypto isakmp nat-traversal 20

telnet 192.168.11.0 255.255.255.0 inside

telnet timeout 5

ssh timeout 5

console timeout 0

dhcpd auto_config outside

!

group-policy DIGI internal

group-policy DIGI attributes

dns-server value 192.168.11.1 213.140.2.21

vpn-tunnel-protocol IPSec

split-tunnel-policy tunnelspecified

split-tunnel-network-list value SplitTunnelNets

default-domain value DIGI

username Marco password ***************** encrypted privilege 15

username Marco attributes

vpn-group-policy DIGI

tunnel-group DIGI type ipsec-ra

tunnel-group DIGI general-attributes

address-pool Ext-IP

default-group-policy DIGI

tunnel-group DIGI ipsec-attributes

pre-shared-key *

tunnel-group DIGIVPN type ipsec-l2l

tunnel-group DIGIVPN ipsec-attributes

pre-shared-key *

!

class-map inspection_default

match default-inspection-traffic

!

policy-map type inspect dns preset_dns_map

parameters

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

!

service-policy global_policy global

prompt hostname context

Cisco 2

ASA Version 8.2(1)

!

hostname XFASA

domain-name ****************

enable password ***************** encrypted

passwd ***************** encrypted

names

name 192.168.11.0 REMOTE-LAN

!

interface Vlan1

nameif inside

security-level 100

ip address 192.168.10.254 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address 192.168.0.2 255.255.255.0

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

ftp mode passive

dns server-group DefaultDNS

domain-name **************

access-list acl_outbound extended permit tcp any host 192.168.0.2 eq ftp-data

access-list acl_outbound extended permit tcp any host 192.168.0.2 eq ftp

access-list acl_outbound extended permit tcp any host 192.168.0.2 eq https

access-list acl_outbound extended permit tcp any host 192.168.0.2 eq pop3

access-list acl_outbound extended permit tcp any host 192.168.0.2 eq www

access-list acl_inbound extended permit tcp 192.168.10.0 255.255.255.0 any eq www

access-list acl_inbound extended permit tcp 192.168.10.0 255.255.255.0 any eq ftp

access-list acl_inbound extended permit tcp 192.168.10.0 255.255.255.0 any eq ftp-data

access-list acl_inbound extended permit tcp 192.168.10.0 255.255.255.0 any eq smtp

access-list acl_inbound extended deny tcp any any eq www

access-list acl_inbound extended deny tcp any any eq ftp

access-list acl_inbound extended deny tcp any any eq ftp-data

access-list acl_inbound extended deny tcp any any eq smtp

access-list acl_inbound extended deny udp any eq tftp any

access-list acl_inbound extended deny tcp any eq 135 any

access-list acl_inbound extended deny udp any eq 135 any

access-list acl_inbound extended deny tcp any eq 137 any

access-list acl_inbound extended deny udp any eq netbios-ns any

access-list acl_inbound extended deny tcp any eq 138 any

access-list acl_inbound extended deny udp any eq netbios-dgm any

access-list acl_inbound extended deny tcp any eq netbios-ssn any

access-list acl_inbound extended deny udp any eq 139 any

access-list acl_inbound extended deny udp any eq 1080 any

access-list acl_inbound extended deny tcp any eq 445 any

access-list acl_inbound extended deny tcp any eq 593 any

access-list acl_inbound extended deny tcp any eq 3067 any

access-list acl_inbound extended deny tcp any eq 3127 any

access-list acl_inbound extended deny tcp any eq 4444 any

access-list acl_inbound extended deny tcp any eq 5554 any

access-list acl_inbound extended deny tcp any eq 9996 any

access-list acl_inbound extended deny tcp any eq 36794 any

access-list acl_inbound extended permit ip any any

access-list SplitTunnelNets standard permit 192.168.10.0 255.255.255.0

access-list VPN extended permit ip 192.168.10.0 255.255.255.0 host 192.168.10.230

access-list VPN extended permit ip 192.168.10.0 255.255.255.0 host 192.168.10.231

access-list VPN extended permit ip 192.168.10.0 255.255.255.0 host 192.168.10.232

access-list VPN extended permit ip 192.168.10.0 255.255.255.0 host 192.168.10.233

access-list VPN extended permit ip 192.168.10.0 255.255.255.0 host 192.168.10.234

access-list VPN extended permit ip 192.168.10.0 255.255.255.0 host 192.168.10.235

access-list VPN extended permit ip 192.168.10.0 255.255.255.0 host 192.168.10.236

access-list VPN extended permit ip 192.168.10.0 255.255.255.0 host 192.168.10.237

access-list VPN extended permit ip 192.168.10.0 255.255.255.0 host 192.168.10.238

access-list VPN extended permit ip 192.168.10.0 255.255.255.0 host 192.168.10.239

access-list VPN extended permit ip 192.168.10.0 255.255.255.0 host 192.168.10.240

access-list outside_1_cryptomap extended permit ip 192.168.10.0 255.255.255.0 REMOTE-LAN 255.255.255.0

access-list inside_nat0_outbound extended permit ip 192.168.10.0 255.255.255.0 REMOTE-LAN 255.255.255.0

pager lines 24

logging asdm informational

mtu inside 1500

mtu outside 1500

ip local pool Ext-IP 192.168.10.230-192.168.10.240 mask 255.255.255.0

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-621.bin

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list inside_nat0_outbound

nat (inside) 1 0.0.0.0 0.0.0.0

access-group acl_inbound in interface inside

access-group acl_outbound in interface outside

route outside 0.0.0.0 0.0.0.0 192.168.0.254 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-record DfltAccessPolicy

http server enable

http 192.168.1.0 255.255.255.0 inside

http 192.168.10.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto dynamic-map outside_dyn_map 20 set pfs group1

crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA

crypto map outside_map 1 match address outside_1_cryptomap

crypto map outside_map 1 set pfs group1

crypto map outside_map 1 set peer 192.168.0.1

crypto map outside_map 1 set transform-set ESP-3DES-SHA

crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map

crypto map outside_map interface outside

crypto isakmp enable outside

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

telnet 192.168.10.0 255.255.255.0 inside

telnet timeout 5

ssh timeout 5

console timeout 0

dhcpd auto_config outside

!

dhcpd address 192.168.10.50-192.168.10.150 inside

dhcpd dns 85.18.200.200 89.97.140.140 interface inside

dhcpd domain XFACTOR interface inside

dhcpd enable inside

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

group-policy XFA internal

group-policy XFA attributes

dns-server value 85.18.200.200

vpn-tunnel-protocol IPSec

split-tunnel-policy tunnelspecified

split-tunnel-network-list value SplitTunnelNets

default-domain value XFDMN

username Marco password ************* encrypted privilege 15

username Marco attributes

vpn-group-policy XFA

username xfa password ************* encrypted privilege 0

username xfa attributes

vpn-group-policy XFA

tunnel-group XFA type remote-access

tunnel-group XFA general-attributes

address-pool Ext-IP

default-group-policy XFA

tunnel-group XFA ipsec-attributes

pre-shared-key *

tunnel-group DIGIVPN type ipsec-l2l

tunnel-group DIGIVPN ipsec-attributes

pre-shared-key *

!

class-map inspection_default

match default-inspection-traffic

!

policy-map type inspect dns preset_dns_map

parameters

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

!

service-policy global_policy global

prompt hostname context

I hope you can find anything wrong, because I ddidn't find.

Thanks again

Marco