10-23-2014 06:11 AM
Hello all
I'm very new to VPN configurations.
I am trying to configure a site to site VPN connection between a Cisco ASA 5505 and a Westermo DR-270 router.(http://www.westermo.co.uk/web/web_en_idc_com.nsf/AllDocuments/C9CFF9CF2339026BC1257BF300222A3F)
The ASA is connected on LAN 0 to a BT Voyager ADSL router (192.168.1.1) - http://business.bt.com/pdf/BT_Voyager_tech_spec.pdf
The DR-270 is connected to another BT Voyager (172.16.201.1)
Both BT routers have Dynamic IP addresses.
The outside IP address on the ASA is 192.168.1.3 and 172.16.201.2 on the DR-270.
ASA 5505 (192.168.1.3) - - - - BT Voyager(192.168.1.1) - - - - - - - -
INTERNET
DR-270 (172.16.201.2) - - - - - BT Voyager (172.16.201.1) - - - - - - -
These devices are all in one location and its basically a lab setup for me. All I want to achieve is a VPN/tunnel connection between the two devices.
I turned on logging and it seems phase 1 of Ikve1 is failing. I've checked that the settings are the same on both devices but the tunnel wont come up.
Section of log from the DR-270:
14:49:00, 16 Oct 2014,(743) IKE SA Removed. Peer: ,Negotiation Failure
14:49:00, 16 Oct 2014,(743) IKE Negotiation Failed. Peer: ,Retries Exceeded
14:48:50, 16 Oct 2014,IKE Request Received From Eroute 0
14:48:45, 16 Oct 2014,PPP 1 down,Max negotiation time
14:48:40, 16 Oct 2014,IKE Request Received From Eroute 0
14:48:30, 16 Oct 2014,(743) New Phase 1 IKE Session 192.168.1.3,Initiator
Please could you have a look at the ASA running config below and let me know if anything obvious is missing or needs adjusting?
ciscoasa(config)# show run
: Saved
:
ASA Version 8.4(2)
!
hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
shutdown
!
interface Ethernet0/3
shutdown
!
interface Ethernet0/4
shutdown
!
interface Ethernet0/5
<--- More --->
shutdown
!
interface Ethernet0/6
shutdown
!
interface Ethernet0/7
shutdown
!
interface Vlan1
nameif inside
security-level 100
ip address 10.0.0.3 255.0.0.0
!
interface Vlan2
nameif outside
security-level 0
ip address 192.168.1.3 255.255.255.0
!
ftp mode passive
object-group network Westermo
network-object 172.16.0.0 255.255.0.0
object-group network CiscoASA
network-object 192.168.0.0 255.255.255.0
access-list VPN_Westermo extended permit ip object-group CiscoASA object-group Westermo
<--- More --->
access-list filter_Westermo extended permit tcp object-group Westermo eq 500 object-group CiscoASA eq 500
access-list filter_Westermo extended permit tcp object-group Westermo eq 1701 object-group CiscoASA eq 1701
access-list filter_Westermo extended permit tcp object-group Westermo eq 4500 object-group CiscoASA eq 4500
pager lines 24
mtu outside 1500
mtu inside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
nat (inside,outside) source static CiscoASA CiscoASA destination static Westermo Westermo
route outside 0.0.0.0 0.0.0.0 192.168.1.3 tunneled
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
<--- More --->
crypto dynamic-map outside_map 1 match address VPN_Westermo
crypto dynamic-map outside_map 1 set peer 172.16.201.2
crypto dynamic-map outside_map 1 set ikev1 transform-set ESP-DES-MD5
crypto dynamic-map outside_map 1 set security-association lifetime seconds 86400
crypto dynamic-map outside_map 1 set reverse-route
crypto map outside_map 1 set ikev1 phase1-mode aggressive
crypto map outside_map interface outside
crypto ikev1 enable outside
crypto ikev1 policy 65535
authentication pre-share
encryption des
hash md5
group 2
lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
group-policy grp_Westermo internal
group-policy grp_Westermo attributes
vpn-filter value filter_Westermo
<--- More --->
tunnel-group 0.0.0.0 type ipsec-l2l
tunnel-group 0.0.0.0 ipsec-attributes
ikev1 pre-shared-key *****
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
<--- More --->
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:24a3cb7677d6a8fb075460a45351089b
: end
Many thanks in advance!
10-24-2014 04:11 AM
So traffic goes to the internet before it reaches the remote site? If that is the case where is NAT happening (I am assuming on the BT router)?
Please verify how the traffic flows between the two routers (since you say they are both located at the same site).
--
Please remember to select a correct answer and rate helpful posts
10-30-2014 02:49 AM
Hi there
Sorry for the late reply!
I have since abandoned this setup to use a VPN concentrator in one of our test labs instead.
The setup is easier and I'm working on it now.
Thanks for your help.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide