Easy vpn

[fmartos]

Hi all, first of all, sorry for my english. This is my problem: I have a cisco router 2821 and two cisco router 877W. I stablish two vpn (easy vpn) from 877 to 2821. After a time all protected traffic flow is deleted in cisco 2821, except one of them. Below I append the configuration relating to vpn:

2821 ROUTER

crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
!
crypto isakmp policy 2
authentication pre-share
group 2
crypto isakmp keepalive 10 periodic

crypto isakmp client configuration group Admon
key xxxxxx
pool Admon
acl 100
save-password

xxxxxxxxxxxxxxxxxxxxxx
!
crypto isakmp client configuration group Investigadores
key xxxxxxx
pool Investigadores
acl 100 
save-password

crypto ipsec transform-set REMOTOS esp-3des esp-sha-hmac
!        
crypto dynamic-map ACCESOS_REMOTOS 1
set transform-set REMOTOS
reverse-route
!        
xxxxxxxxxxxxxxxxxxxxxxxxxxxx      
crypto map REMOTOS client authentication list Remotos
crypto map REMOTOS isakmp authorization list Remotos
crypto map REMOTOS client configuration address respond
crypto map REMOTOS 1 ipsec-isakmp dynamic ACCESOS_REMOTOS
!

xxxxxxxxxxxxxxxxxxx

ip local pool Admon 10.14.81.233
ip local pool Investigadores 10.14.81.232

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

access-list 100 permit ip 10.14.81.0 0.0.0.255 any
access-list 100 permit ip 10.14.64.0 0.0.0.255 any
access-list 100 permit ip 10.14.65.0 0.0.0.255 any
access-list 100 permit ip 10.14.66.0 0.0.0.255 any
access-list 100 permit ip 10.14.67.0 0.0.0.255 any

xxxxxxxxxxxxxxxxxxxxxxxxx

Output relating protected traffic flow

#shoy crypto session (when the vpn tunnel has been risen)

Interface: ATM0/0/0
Username: investigadores
Group: Investigadores
Assigned address: 10.14.81.232
Session status: UP-ACTIVE    
Peer: 83.54.143.201 port 500
  IKE SA: local 80.24.37.182/500 remote 83.54.143.201/500 Active
   IPSEC FLOW: permit ip 10.14.64.0/255.255.255.0 host 10.14.81.232
        Active SAs: 2, origin: dynamic crypto map
  IPSEC FLOW: permit ip 10.14.65.0/255.255.255.0 host 10.14.81.232
        Active SAs: 2, origin: dynamic crypto map
  IPSEC FLOW: permit ip 10.14.66.0/255.255.255.0 host 10.14.81.232
        Active SAs: 2, origin: dynamic crypto map
  IPSEC FLOW: permit ip 10.14.67.0/255.255.255.0 host 10.14.81.232
        Active SAs: 2, origin: dynamic crypto map
  IPSEC FLOW: permit ip 10.14.81.0/255.255.255.0 host 10.14.81.232
        Active SAs: 2, origin: dynamic crypto map

#show crypto session (after loosing protected traffic)

Interface: ATM0/0/0
Username: investigadores
Group: Investigadores
Assigned address: 10.14.81.232
Session status: UP-ACTIVE    
Peer: 83.54.143.201 port 500
  IKE SA: local 80.24.37.182/500 remote 83.54.143.201/500 Active
  IPSEC FLOW: permit ip 10.14.81.0/255.255.255.0 192.168.1.0/255.255.255.0
        Active SAs: 2, origin: dynamic crypto map

877W ROUTER (both have the same configuration; groups, keys adn users are different)

xxxxxxxxxxxxxxxxxxxxxxxx

crypto isakmp keepalive 10
!        
!        
!        
!        
!        
crypto ipsec client ezvpn Investigadores
connect auto
group Investigadores key xxxxxxxxxxxxxx
mode network-plus
peer 80.24.37.182
username Investigadores password xxxxxxxxxxxxxxxxxxxx
xauth userid mode local

xxxxxxxxxxxxxxxxxxxxxxxxxxx

Any suggestion or comment will be well received. Thanks in advance.

[lginod]

Hello Francisco,

There can be multiple reasons why the sa's are removed like, sa timeout, or no interesting traffic flowing etc.

But i dont see a reason why this sa " IPSEC FLOW: permit ip 10.14.81.0/255.255.255.0 192.168.1.0/255.255.255.0 " is formed unless there is another tunnel running parallelly from the same device.

Please attach the running-config of the devices so that i can check that. Alternatively you can send me a mail using the CSC mail.

--

Gino

[fmartos]

Gino. Thanks for your reply. Below you cand find configurations reated to Cisco routers. I do not know why we see the protected network 10.14.81.0/255.255.255.0. Obviously this is our main network. The other ones doesn´t forward traffic (we are changing our addresing scheme).

Routers config
2821 router:
Outsider#sh run
Building configuration...

Current configuration : 13589 bytes
!
! Last configuration change at 13:35:51 MADRID Mon Jan 31 2011 by Admin
! NVRAM config last updated at 17:45:09 MADRID Thu Jan 27 2011 by Admin
!
version 12.4
parser config cache interface
parser config interface
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
service sequence-numbers
!
hostname Outsider
!
boot-start-marker
boot-end-marker
!
logging buffered 512000 warnings
!
aaa new-model
!
!
aaa authentication login Remotos local
aaa authorization exec default local
aaa authorization network Remotos local
!
!
aaa session-id common
clock timezone MADRID 1
clock summer-time MADRID recurring last Sun Mar 2:00 last Sun Oct 3:00
!
xxxxxxxxx
dot11 syslog
!
ip cef
!
no ip domain lookup
ip domain name yourdomain.com
!
multilink bundle-name authenticated
no mpls ip
!
voice-card 0
no dspfarm
!
xxxxxxxxxx
username Admon password 7 zzzzzzzzzzzzzzzzzzzzz
username Investigadores password 7 zzzzzzzzzzzzzzzzzzzzz
username ccccccccccc view SDM_Monitor password 7 cccccccccccc
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
!
crypto isakmp policy 2
authentication pre-share
group 2
crypto isakmp keepalive 10 periodic
!
crypto isakmp client configuration group Admon
key xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
pool Admon
acl 100
save-password
!
crypto isakmp client configuration group Investigadores
key xxxxxxxxxxxxxxxxxxxxxxxxxxxx
pool Investigadores
acl 100
save-password
!
crypto ipsec transform-set REMOTOS esp-3des esp-sha-hmac
!
crypto dynamic-map ACCESOS_REMOTOS 1
set transform-set REMOTOS
reverse-route
!
crypto map REMOTOS client authentication list Remotos
crypto map REMOTOS isakmp authorization list Remotos
crypto map REMOTOS client configuration address respond
crypto map REMOTOS 1 ipsec-isakmp dynamic ACCESOS_REMOTOS
!
archive
log config
  hidekeys
!
interface GigabitEthernet0/0
description Conexion con Firewall-Outsider
ip address 192.168.101.2 xxxxxxxxxxxxx
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
interface GigabitEthernet0/1
description $ES_LAN$
no ip address
shutdown
duplex auto
speed auto
!
interface ATM0/0/0
description CONEXION CON INTERNET
ip address  xxxxxxxxxxxxxxxxx
ip nbar protocol-discovery
ip nat outside
ip virtual-reassembly
no atm ilmi-keepalive
dsl operating-mode auto
crypto map REMOTOS
pvc telefonica 8/32
  protocol ip xxxxxxxxxxxxxxxxx
  encapsulation aal5snap
!
interface GigabitEthernet0/1/0
description CONEXION CON REDIRIS. FIBRA OPTICA
no ip address
ip virtual-reassembly
shutdown
negotiation auto
!
ip local pool Admon 10.14.81.233
ip local pool Investigadores 10.14.81.232
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 xxxxxxxxxxxxxxxx
ip route 10.14.64.0 255.255.255.0 192.168.101.2
ip route 10.14.65.0 255.255.255.0 192.168.101.2
ip route 10.14.66.0 255.255.255.0 192.168.101.2
ip route 10.14.67.0 255.255.255.0 192.168.101.2
ip route 10.14.81.0 255.255.255.0 192.168.101.2
!
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source static udp 10.14.67.200 49153 interface ATM0/0/0 49153
ip nat inside source static tcp 10.14.67.200 49153 interface ATM0/0/0 49153
ip nat inside source static udp 10.14.67.200 4672 interface ATM0/0/0 4672
ip nat inside source static tcp 10.14.67.200 4662 interface ATM0/0/0 4662
ip nat inside source static tcp 10.14.81.213 80 interface ATM0/0/0 80
ip nat inside source route-map NAT interface ATM0/0/0 overload
!
access-list 10 permit 10.14.81.1
access-list 20 permit 10.14.67.0 0.0.0.255
access-list 20 permit 10.14.81.0 0.0.0.255
access-list 23 permit 10.14.81.1
access-list 23 permit 10.14.67.200
access-list 100 permit ip 10.14.81.0 0.0.0.255 any
access-list 100 permit ip 10.14.64.0 0.0.0.255 any
access-list 100 permit ip 10.14.65.0 0.0.0.255 any
access-list 100 permit ip 10.14.66.0 0.0.0.255 any
access-list 100 permit ip 10.14.67.0 0.0.0.255 any
access-list 103 deny   ip 10.14.81.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 103 deny   ip 10.14.81.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 103 deny   ip 10.14.64.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 103 deny   ip 10.14.64.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 103 deny   ip 10.14.65.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 103 deny   ip 10.14.65.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 103 deny   ip 10.14.66.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 103 deny   ip 10.14.66.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 103 deny   ip 10.14.67.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 103 deny   ip 10.14.67.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 103 deny   ip 10.14.81.0 0.0.0.255 host 10.14.81.232
access-list 103 deny   ip 10.14.64.0 0.0.0.255 host 10.14.81.232
access-list 103 deny   ip 10.14.65.0 0.0.0.255 host 10.14.81.232
access-list 103 deny   ip 10.14.66.0 0.0.0.255 host 10.14.81.232
access-list 103 deny   ip 10.14.67.0 0.0.0.255 host 10.14.81.232
access-list 103 deny   ip 10.14.81.0 0.0.0.255 host 10.14.81.233
access-list 103 deny   ip 10.14.64.0 0.0.0.255 host 10.14.81.233
access-list 103 deny   ip 10.14.65.0 0.0.0.255 host 10.14.81.233
access-list 103 deny   ip 10.14.66.0 0.0.0.255 host 10.14.81.233
access-list 103 deny   ip 10.14.67.0 0.0.0.255 host 10.14.81.233
access-list 103 permit ip 10.14.81.0 0.0.0.255 any
access-list 103 permit ip 10.14.64.0 0.0.0.255 any
access-list 103 permit ip 10.14.65.0 0.0.0.255 any
access-list 103 permit ip 10.14.66.0 0.0.0.255 any
access-list 103 permit ip 10.14.67.0 0.0.0.255 any
snmp-server community public RO 10
snmp-server community private RW 10
!
route-map NAT permit 1
match ip address 103
!
control-plane
!
line con 0
line aux 0
line vty 0 4
access-class 20 in
exec-timeout 30 0
privilege level 15
transport input ssh
line vty 5 14
access-class 20 in
exec-timeout 30 0
privilege level 15
transport input ssh
line vty 15
access-class 20 in
privilege level 15
transport input ssh
parser view SDM_Monitor
secret 5 xxxxxxxxxxxxxxxxxxxxxxxxxxx
! Last configuration change at 13:35:51 MADRID Mon Jan 31 2011 by Admin
! NVRAM config last updated at 17:45:09 MADRID Thu Jan 27 2011 by Admin
!
commands configure include end
commands configure include all interface
commands exec include dir all-filesystems
commands exec include dir
commands exec include all crypto ipsec client ezvpn
commands exec include crypto ipsec client
commands exec include crypto ipsec
commands exec include crypto
commands exec include all ping ip
commands exec include ping
commands exec include configure terminal
commands exec include configure
commands exec include all show
commands exec include all debug appfw
commands exec include debug
commands exec include all clear
!
!
scheduler allocate 20000 1000
ntp clock-period 17180170
ntp master
ntp server 140.142.16.34
ntp server 150.214.94.5 prefer
!
end

Outsider#

877router:
Investigadores#sh run
Building configuration...

Current configuration : 6263 bytes
!
! Last configuration change at 14:30:18 MADRID Tue Feb 1 2011
! NVRAM config last updated at 12:08:30 MADRID Fri Jan 28 2011 by Admin
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname Investigadores
!
boot-start-marker
boot-end-marker
!
logging buffered 52000 debugging
enable secret 5 xxxxxxxxxxxxxxxxxxxxxxxxx
!
no aaa new-model
!
resource policy
!
clock timezone MADRID 1
clock summer-time MADRID recurring last Sun Mar 2:00 last Sun Oct 3:00
dot11 activity-timeout unknown default 10800
dot11 activity-timeout client default 10800
dot11 activity-timeout repeater default 50400
ip subnet-zero
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.1.1 192.168.1.40
ip dhcp excluded-address 192.168.1.254
!
ip dhcp pool DHCP
   import all
   network 192.168.1.0 255.255.255.0
   dns-server 10.14.81.213 80.58.61.250 80.58.61.254
   default-router 192.168.1.254
!
!
no ip bootp server
ip name-server 10.14.81.213
ip name-server 80.58.61.250
ip name-server 80.58.61.254
!
password encryption aes
!
xxxxxx
!
username root privilege 15 secret 5 xxxxxxxxxxxxxxxxxxx
username Admin privilege 15 secret 5 xxxxxxxxxxxxxxxxxxxxxxxx
username cepc privilege 7 secret 5 xxxxxxxxxxxxxxxxxxxxxxxxx
!
!
crypto isakmp keepalive 10
!
crypto ipsec client ezvpn Investigadores
connect auto
group Investigadores key xxxxxxxxxxxxxxxxxxxxxxxxx
mode network-plus
peer 80.24.37.182
username Investigadores password xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xauth userid mode local
!
!
bridge irb
!
!
interface Loopback0
no ip address
!
interface Loopback1
no ip address
!
interface Loopback2
no ip address
!
interface Loopback3
no ip address
!
interface Loopback4
ip address 10.14.81.232 255.255.255.255
!
interface Loopback5
no ip address
!
interface Loopback6
no ip address
!
interface Loopback7
no ip address
!
interface Loopback8
no ip address
!
interface Loopback9
no ip address
!
interface Loopback10
no ip address
!
interface Loopback11
no ip address
!
interface Loopback12
no ip address
!
interface Loopback13
no ip address
!
interface Loopback14
no ip address
!
interface Loopback15
no ip address
!
interface ATM0
no ip address
no atm ilmi-keepalive
dsl operating-mode auto
!
interface ATM0.1 point-to-point
pvc 8/32
  pppoe-client dial-pool-number 1
!
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Dot11Radio0
no ip address
ip virtual-reassembly
!
encryption mode ciphers tkip
!
ssid XXXXXXX
    authentication open
    authentication key-management wpa
    wpa-psk ascii 7 09644F104214021B5802297B39256E3D6534402B461214054D09005A5D4D3C455559594701
!
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
station-role root
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface Vlan1
no ip address
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1452
bridge-group 1
!
interface Dialer0
ip address negotiated
ip nat outside
ip virtual-reassembly max-reassemblies 32
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap callin
ppp chap hostname xxxxxxxxxxxxxxxxxxxxxxxxxxx
ppp chap password 7 xxxxxxxxxxxxxxxxx
crypto ipsec df-bit clear
crypto ipsec client ezvpn Investigadores
!
interface BVI1
ip address 192.168.1.254 255.255.255.0
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1452
crypto ipsec client ezvpn Investigadores inside
!
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer0
!
ip http server
ip http authentication local
ip http secure-server
ip nat inside source list 101 interface Dialer0 overload
!        
access-list 20 permit 10.14.67.0 0.0.0.255
access-list 20 permit 10.14.81.0 0.0.0.255
access-list 20 permit 192.168.1.0 0.0.0.255
access-list 101 deny   ip 192.168.1.0 0.0.0.255 10.14.81.0 0.0.0.255
access-list 101 deny   ip 192.168.1.0 0.0.0.255 10.14.64.0 0.0.0.255
access-list 101 deny   ip 192.168.1.0 0.0.0.255 10.14.65.0 0.0.0.255
access-list 101 deny   ip 192.168.1.0 0.0.0.255 10.14.66.0 0.0.0.255
access-list 101 deny   ip 192.168.1.0 0.0.0.255 10.14.67.0 0.0.0.255
access-list 101 permit ip 192.168.1.0 0.0.0.255 any
dialer-list 1 protocol ip permit
!
control-plane
!
bridge 1 protocol ieee
bridge 1 route ip
!
line con 0
no modem enable
line aux 0
login local
line vty 0 4
access-class 20 in
exec-timeout 30 0
login local
transport input ssh
!
scheduler max-task-time 5000
ntp clock-period 17175118
ntp server 140.142.16.34
end

Thanks in advance for your help