Hi guys,
I have an issue with hub and spoke vpn connectivity.
My connection is like the following
------ ISP1 (Static IP) ----
SPOKE (Branch)-| |---------------- INTERNET ------------- HUB with Static IP (HQ)
----- ISP2 (Dynamic IP) ----
To achieve vpn fail over for the branch I configured Dynamic to Static L2L with DefaultL2LGroup on HQ
HQ uses ASA 5540 with 8.4(3) and branch runs ASA 5520 with 8.2(2)
HQ Config
tunnel-group DefaultL2LGroup ipsec-attributes
ikev1 pre-shared-key *****
crypto ipsec transform-set myset esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map mydyn 10 set transform-set myset
crypto map mymap 60000 ipsec-isakmp dynamic mydyn
crypto map mymap interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
Branch Config
access-list ISPBackup_1_cryptomap extended permit ip 192.168.x.x 255.255.255.0 172.16.x.x 255.255.255.0
access-list outside_1_cryptomap extended permit ip 192.168.x.x 255.255.255.0 172.16.x.x 255.255.255.0
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set peer x.x.x.x
crypto map outside_map 1 set transform-set ESP-3DES-SHA
crypto map outside_map 1 set reverse-route
crypto map outside_map interface outside
crypto map ISPBackup_map 1 match address ISPBackup_1_cryptomap
crypto map ISPBackup_map 1 set peer x.x.x.x
crypto map ISPBackup_map 1 set transform-set ESP-3DES-SHA
crypto map ISPBackup_map 1 set reverse-route
crypto map ISPBackup_map interface ISPBackup
crypto isakmp enable outside
crypto isakmp enable ISPBackup
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 30
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 3600
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
The default route on Branch is tracked one, always taking priority with the ISP1.
My concern is whenever an interesting traffic hits the brach ASA, it initiates a vpn to HQ, and I am getting Phase 1 completed. But always getting Phase 2 error.
When I check the debug on HQ ASA, what I see is, the HQ ASA after phase 1 checks for each STATIC crypto map and then gives the message as the connection is pointing to dynamic map. But never checks any of my dynamic crypto map, Instead on next log ASA will complain that All IPSec proposals found unacceptable. then it will cut the phase1.
I know that phase2 error can be because of transform sets, pfs, interesting traffic etc mismatch, I tried all the combinations making everything look exact mirror, without any luck. I will stand around the same problem.
The interesting fact is that, it was working perfect, with the setup but before I upgrade to 8.4(3)
Any idea, what to do now?
