Solved: I cant establish the VPN Site-To-Site, ASA 5506

mick_george2003 · ‎05-09-2019

# show crypto isakmp sa

There are no IKEv1 SAs

There are no IKEv2 SAs

# show run

:

!
interface GigabitEthernet1/1
nameif outside
security-level 0
ip address 64.4.x.x 255.255.255.248
!
interface GigabitEthernet1/2
nameif inside
security-level 100
ip address 172.16.1.1 255.255.255.0
!
interface GigabitEthernet1/2.1
vlan 99
nameif vlan99
security-level 100
ip address 192.168.49.1 255.255.255.0
!
interface GigabitEthernet1/2.2
vlan 5
nameif vlan5
security-level 100
ip address 10.8.48.1 255.255.255.0
!
interface GigabitEthernet1/3
bridge-group 1
nameif inside_2
security-level 100
!
interface GigabitEthernet1/4
bridge-group 1
nameif inside_3
security-level 100
!
interface GigabitEthernet1/5
bridge-group 1
nameif inside_4
security-level 100
!
interface GigabitEthernet1/6
bridge-group 1
nameif inside_5
security-level 100
!
interface GigabitEthernet1/7
bridge-group 1
nameif inside_6
security-level 100
!
interface GigabitEthernet1/8
bridge-group 1
nameif inside_7
security-level 100
!
interface Management1/1
management-only
no nameif
no security-level
no ip address
!
interface BVI1
no nameif
security-level 100
ip address 192.168.1.1 255.255.255.0
!
banner login #Unauthorized access to this device is prohibited!#
ftp mode passive
clock timezone CST -6
clock summer-time CDT recurring
dns domain-lookup outside
dns server-group DefaultDNS
name-server 8.8.8.8
domain-name kleysen.net
same-security-traffic permit inter-interface
object network obj_any1
subnet 0.0.0.0 0.0.0.0
object network obj_any2
subnet 0.0.0.0 0.0.0.0
object network obj_any3
subnet 0.0.0.0 0.0.0.0
object network obj_any4
subnet 0.0.0.0 0.0.0.0
object network obj_any5
subnet 0.0.0.0 0.0.0.0
object network obj_any6
subnet 0.0.0.0 0.0.0.0
object network obj_any7
subnet 0.0.0.0 0.0.0.0
object network obj-local
subnet 192.168.49.0 255.255.255.0
object network obj-remotewpg
subnet 192.168.248.0 255.255.255.0
object network NETWORK_OBJ_192.168.49.0_24
subnet 192.168.49.0 255.255.255.0
object network NETWORK_OBJ_192.168.248.0_24
subnet 192.168.248.0 255.255.255.0
access-list outside_cryptomap_1 extended permit ip 192.168.49.0 255.255.255.0 object obj-remotewpg
access-list 100 extended permit ip object obj-local object obj-remotewpg
access-list 1 extended permit ip 192.168.49.0 255.255.255.0 192.168.248.0 255.255.255.0
pager lines 24
logging enable
logging console debugging
logging buffered debugging
logging asdm informational
logging flash-bufferwrap
mtu outside 1500
mtu inside 1500
mtu vlan99 1500
mtu vlan5 1500
mtu inside_2 1500
mtu inside_3 1500
mtu inside_4 1500
mtu inside_5 1500
mtu inside_6 1500
mtu inside_7 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
nat (vlan5,outside) source static any interface
nat (vlan99,outside) source static any interface
nat (vlan99,outside) source static obj-local obj-local destination static obj-remotewpg obj-remotewpg no-proxy-arp route-lookup
nat (vlan99,outside) source dynamic obj-local interface
nat (vlan99,outside) source static NETWORK_OBJ_192.168.49.0_24 NETWORK_OBJ_192.168.49.0_24 destination static obj-remotewpg obj-remotewpg no-proxy-arp route-lookup
nat (inside,outside) source static NETWORK_OBJ_192.168.49.0_24 NETWORK_OBJ_192.168.49.0_24 destination static NETWORK_OBJ_192.168.248.0_24 NETWORK_OBJ_192.168.248.0_24 no-proxy-arp route-lookup
!
object network obj_any2
nat (inside_2,outside) dynamic interface
object network obj_any3
nat (inside_3,outside) dynamic interface
object network obj_any4
nat (inside_4,outside) dynamic interface
object network obj_any5
nat (inside_5,outside) dynamic interface
object network obj_any6
nat (inside_6,outside) dynamic interface
object network obj_any7
nat (inside_7,outside) dynamic interface
route outside 0.0.0.0 0.0.0.0 64.4.x.x 1
route outside 192.168.248.0 255.255.255.0 67.215.x.x 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
aaa authentication login-history
http server enable
http 192.168.1.0 255.255.255.0 inside_2
http 192.168.1.0 255.255.255.0 inside_3
http 192.168.1.0 255.255.255.0 inside_4
http 192.168.1.0 255.255.255.0 inside_5
http 192.168.1.0 255.255.255.0 inside_6
http 192.168.1.0 255.255.255.0 inside_7
http 192.168.49.0 255.255.255.0 vlan99
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec ikev1 transform-set ipsec-vpn esp-3des esp-sha-hmac
crypto ipsec security-association pmtu-aging infinite
crypto map SASKATOON 10 match address 1
crypto map SASKATOON 10 set pfs
crypto map SASKATOON 10 set peer 67.215.x.x
crypto map SASKATOON 10 set ikev1 transform-set ipsec-vpn
crypto map SASKATOON interface outside
crypto ca trustpool policy
crypto ikev2 policy 1
encryption aes-256
integrity sha
group 5
prf sha
lifetime seconds 86400
crypto ikev2 enable outside
crypto ikev1 enable outside
crypto ikev1 policy 2
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh stricthostkeycheck
ssh 192.168.49.0 255.255.255.0 vlan99
ssh timeout 60
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 0

dhcpd dns 8.8.8.8
dhcpd auto_config outside
!
dhcpd address 192.168.49.20-192.168.49.250 vlan99
dhcpd enable vlan99
!
dhcpd address 10.8.48.50-10.8.48.250 vlan5
dhcpd enable vlan5
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
group-policy DfltGrpPolicy attributes
vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-clientless
group-policy GroupPolicy_67.215.x.x internal
group-policy GroupPolicy_67.215.x.x attributes
vpn-tunnel-protocol ikev1 ikev2
dynamic-access-policy-record DfltAccessPolicy
username admin password $sha512$5000$qrv4EyfWlK/ynw3uYrO6rQ==$uWFJJSAYbiWH4UdMXDvfkQ== pbkdf2 privilege 15
tunnel-group 67.215.x.x type ipsec-l2l
tunnel-group 67.215.x.xipsec-attributes
ikev1 pre-shared-key *****
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
no tcp-inspection
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect icmp
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
password encryption aes
Cryptochecksum:5aaa76ebd63816bac07daf17e292c0cf
: end

Rob Ingram · ‎05-09-2019

Your IPSec Transform Set's are different

ASA1

crypto ipsec ikev1 transform-set ipsec-vpn esp-3des esp-sha-hmac

ASA2

crypto ipsec ikev1 transform-set ipsec-vpn esp-aes esp-sha-hmac

Use AES on ASA1, it's more secure than 3DES.

View solution in original post

Rob Ingram · ‎05-09-2019

Hi,

Your internal interface for network 192.168.49.x network is named vlan99, however you've got a no-nat/nat exemption rule with a source of inside.

nat (inside,outside) source static NETWORK_OBJ_192.168.49.0_24 NETWORK_OBJ_192.168.49.0_24 destination static NETWORK_OBJ_192.168.248.0_24 NETWORK_OBJ_192.168.248.0_24 no-proxy-arp route-lookup

You should change inside to vlan99 to reflect the correct source interface.

Also you should ensure this no-nat/nat exemption rule is above the other less specific nat rules, to ensure it is not natted by the wrong rule.

HTH

mick_george2003 · ‎05-09-2019

Thank you for the reply. I tried that but still no luck.

Here is my configs with the suggested fix on both routers

Router 1
--------------------------------------------------------

SASKATOON(config)# show run
: Saved

:
: Serial Number: JAD22510HJT
: Hardware: ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cores)
:
ASA Version 9.8(2)
!
hostname SASKATOON
domain-name kleysen.net
enable password $sha512$5000$FXpbgt0ceKcdLzisoTvRYQ==$KSWi+ugfM6VgWMC8pakhkw== pbkdf2
names

!
interface GigabitEthernet1/1
nameif outside
security-level 0
ip address 64.4.x.x 255.255.255.248
!
interface GigabitEthernet1/2
nameif inside
security-level 100
ip address 172.16.1.1 255.255.255.0
!
interface GigabitEthernet1/2.1
vlan 99
nameif vlan99
security-level 100
ip address 192.168.49.1 255.255.255.0
!
interface GigabitEthernet1/2.2
vlan 5
nameif vlan5
security-level 100
ip address 10.8.48.1 255.255.255.0
!
interface GigabitEthernet1/3
bridge-group 1
nameif inside_2
security-level 100
!
interface GigabitEthernet1/4
bridge-group 1
nameif inside_3
security-level 100
!
interface GigabitEthernet1/5
bridge-group 1
nameif inside_4
security-level 100
!
interface GigabitEthernet1/6
bridge-group 1
nameif inside_5
security-level 100
!
interface GigabitEthernet1/7
bridge-group 1
nameif inside_6
security-level 100
!
interface GigabitEthernet1/8
bridge-group 1
nameif inside_7
security-level 100
!
interface Management1/1
management-only
no nameif
no security-level
no ip address
!
interface BVI1
no nameif
security-level 100
ip address 192.168.1.1 255.255.255.0
!
banner login #Unauthorized access to this device is prohibited!#
ftp mode passive
clock timezone CST -6
clock summer-time CDT recurring
dns domain-lookup outside
dns server-group DefaultDNS
name-server 8.8.8.8
domain-name kleysen.net
same-security-traffic permit inter-interface
object network obj_any1
subnet 0.0.0.0 0.0.0.0
object network obj_any2
subnet 0.0.0.0 0.0.0.0
object network obj_any3
subnet 0.0.0.0 0.0.0.0
object network obj_any4
subnet 0.0.0.0 0.0.0.0
object network obj_any5
subnet 0.0.0.0 0.0.0.0
object network obj_any6
subnet 0.0.0.0 0.0.0.0
object network obj_any7
subnet 0.0.0.0 0.0.0.0
object network obj-local
subnet 192.168.49.0 255.255.255.0
object network obj-remotewpg
subnet 192.168.248.0 255.255.255.0
object network NETWORK_OBJ_192.168.49.0_24
subnet 192.168.49.0 255.255.255.0
object network NETWORK_OBJ_192.168.248.0_24
subnet 192.168.248.0 255.255.255.0
access-list outside_cryptomap_1 extended permit ip 192.168.49.0 255.255.255.0 object obj-remotewpg
access-list 100 extended permit ip object obj-local object obj-remotewpg
access-list 1 extended permit ip 192.168.49.0 255.255.255.0 192.168.248.0 255.255.255.0
pager lines 24
logging enable
logging console debugging
logging buffered debugging
logging asdm informational
logging flash-bufferwrap
mtu outside 1500
mtu inside 1500
mtu vlan99 1500
mtu vlan5 1500
mtu inside_2 1500
mtu inside_3 1500
mtu inside_4 1500
mtu inside_5 1500
mtu inside_6 1500
mtu inside_7 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
nat (vlan5,outside) source static any interface
nat (vlan99,outside) source static any interface
nat (vlan99,outside) source static NETWORK_OBJ_192.168.49.0_24 NETWORK_OBJ_192.168.49.0_24 destination static NETWORK_OBJ_192.168.248.0_24 NETWORK_OBJ_192.168.248.0_24 no-proxy-arp route-lookup
!
object network obj_any2
nat (inside_2,outside) dynamic interface
object network obj_any3
nat (inside_3,outside) dynamic interface
object network obj_any4
nat (inside_4,outside) dynamic interface
object network obj_any5
nat (inside_5,outside) dynamic interface
object network obj_any6
nat (inside_6,outside) dynamic interface
object network obj_any7
nat (inside_7,outside) dynamic interface
route outside 0.0.0.0 0.0.0.0 64.4.85.217 1
route outside 192.168.248.0 255.255.255.0 67.215.x.x 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
aaa authentication login-history
http server enable
http 192.168.1.0 255.255.255.0 inside_2
http 192.168.1.0 255.255.255.0 inside_3
http 192.168.1.0 255.255.255.0 inside_4
http 192.168.1.0 255.255.255.0 inside_5
http 192.168.1.0 255.255.255.0 inside_6
http 192.168.1.0 255.255.255.0 inside_7
http 192.168.49.0 255.255.255.0 vlan99
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec ikev1 transform-set ipsec-vpn esp-3des esp-sha-hmac
crypto ipsec security-association pmtu-aging infinite
crypto map SASKATOON 10 match address 1
crypto map SASKATOON 10 set pfs
crypto map SASKATOON 10 set peer 67.215.x.x
crypto map SASKATOON 10 set ikev1 transform-set ipsec-vpn
crypto map SASKATOON interface outside
crypto ca trustpool policy
crypto ikev2 policy 1
encryption aes-256
integrity sha
group 5
prf sha
lifetime seconds 86400
crypto ikev2 enable outside
crypto ikev1 enable outside
crypto ikev1 policy 2
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh stricthostkeycheck
ssh 192.168.49.0 255.255.255.0 vlan99
ssh timeout 60
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 0

dhcpd dns 8.8.8.8
dhcpd auto_config outside
!
dhcpd address 192.168.49.20-192.168.49.250 vlan99
dhcpd enable vlan99
!
dhcpd address 10.8.48.50-10.8.48.250 vlan5
dhcpd enable vlan5
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
group-policy DfltGrpPolicy attributes
vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-clientless
group-policy GroupPolicy_67.215.x.x internal
group-policy GroupPolicy_67.215.x.x attributes
vpn-tunnel-protocol ikev1 ikev2
dynamic-access-policy-record DfltAccessPolicy
username admin password $sha512$5000$qrv4EyfWlK/ynw3uYrO6rQ==$uWFJJSAYbiWH4UdMXDvfkQ== pbkdf2 privilege 15
tunnel-group 67.215.x.x type ipsec-l2l
tunnel-group 67.215.x.x ipsec-attributes
ikev1 pre-shared-key *****
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
no tcp-inspection
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect icmp
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
password encryption aes
Cryptochecksum:f6e1884cc46729f51df8acda7e83f915
: end

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Router 2
--------------------------------------------------------------------------------------------------------

!
interface GigabitEthernet1/1
nameif outside
security-level 0
ip address 67.215.60.26 255.255.255.248
!
interface GigabitEthernet1/2
nameif lan
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface GigabitEthernet1/2.1
vlan 99
nameif vlan99
security-level 100
ip address 192.168.248.1 255.255.255.0
!
interface GigabitEthernet1/2.2
no vlan
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/3
bridge-group 1
nameif inside_2
security-level 100
!
interface GigabitEthernet1/4
bridge-group 1
nameif inside_3
security-level 100
!
interface GigabitEthernet1/5
bridge-group 1
nameif inside_4
security-level 100
!
interface GigabitEthernet1/6
bridge-group 1
nameif inside_5
security-level 100
!
interface GigabitEthernet1/7
bridge-group 1
nameif inside_6
security-level 100
!
interface GigabitEthernet1/8
bridge-group 1
nameif inside_7
security-level 100
!
interface Management1/1
management-only
no nameif
no security-level
no ip address
!
interface BVI1
no nameif
security-level 100
no ip address
!
ftp mode passive
clock timezone CST -6
clock summer-time CDT recurring
dns domain-lookup outside
dns domain-lookup lan
dns domain-lookup vlan99
dns server-group DefaultDNS
name-server 8.8.8.8
domain-name kleysen.net
same-security-traffic permit inter-interface
object network obj_any1
subnet 0.0.0.0 0.0.0.0
object network obj_any2
subnet 0.0.0.0 0.0.0.0
object network obj_any3
subnet 0.0.0.0 0.0.0.0
object network obj_any4
subnet 0.0.0.0 0.0.0.0
object network obj_any5
subnet 0.0.0.0 0.0.0.0
object network obj_any6
subnet 0.0.0.0 0.0.0.0
object network obj_any7
subnet 0.0.0.0 0.0.0.0
object network NETWORK_OBJ_192.168.49.0_24
subnet 192.168.49.0 255.255.255.0
object network NETWORK_OBJ_192.168.248.0_24
subnet 192.168.248.0 255.255.255.0
access-list outside_cryptomap_1 extended permit ip object NETWORK_OBJ_192.168.248.0_24 object NETWORK_OBJ_192.168.49.0_24
access-list 1 extended permit ip 192.168.248.0 255.255.255.0 192.168.49.0 255.255.255.0
pager lines 24
logging enable
logging asdm informational
logging flash-bufferwrap
mtu outside 1500
mtu lan 1500
mtu vlan99 1500
mtu inside_2 1500
mtu inside_3 1500
mtu inside_4 1500
mtu inside_5 1500
mtu inside_6 1500
mtu inside_7 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
nat (lan,outside) source static any interface
nat (vlan99,outside) source static any interface
nat (vlan99,outside) source static NETWORK_OBJ_192.168.248.0_24 NETWORK_OBJ_192.168.248.0_24 destination static NETWORK_OBJ_192.168.49.0_24 NETWORK_OBJ_192.168.49.0_24 no-proxy-arp route-lookup
!
object network obj_any2
nat (inside_2,outside) dynamic interface
object network obj_any3
nat (inside_3,outside) dynamic interface
object network obj_any4
nat (inside_4,outside) dynamic interface
object network obj_any5
nat (inside_5,outside) dynamic interface
object network obj_any6
nat (inside_6,outside) dynamic interface
object network obj_any7
nat (inside_7,outside) dynamic interface
route outside 0.0.0.0 0.0.0.0 67.215.60.25 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
aaa authentication login-history
http server enable
http 192.168.1.0 255.255.255.0 inside_2
http 192.168.1.0 255.255.255.0 inside_3
http 192.168.1.0 255.255.255.0 inside_4
http 192.168.1.0 255.255.255.0 inside_5
http 192.168.1.0 255.255.255.0 inside_6
http 192.168.1.0 255.255.255.0 inside_7
http 192.168.1.0 255.255.255.0 lan
http 192.168.248.0 255.255.255.0 vlan99
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec ikev1 transform-set ipsec-vpn esp-aes esp-sha-hmac
crypto ipsec security-association pmtu-aging infinite
crypto map WINNIPEG 10 match address 1
crypto map WINNIPEG 10 set pfs
crypto map WINNIPEG 10 set peer 64.4.85.220
crypto map WINNIPEG 10 set ikev1 transform-set ipsec-vpn
crypto map WINNIPEG interface outside
crypto ca trustpool policy
crypto ikev2 policy 1
encryption aes-256
integrity sha
group 5
prf sha
lifetime seconds 86400
crypto ikev2 enable outside
crypto ikev1 enable outside
crypto ikev1 policy 2
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh stricthostkeycheck
ssh 67.215.60.24 255.255.255.248 outside
ssh 192.168.1.0 255.255.255.0 lan
ssh 192.168.49.0 255.255.255.0 vlan99
ssh 192.168.248.0 255.255.255.0 vlan99
ssh timeout 60
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 0

dhcpd dns 8.8.8.8
dhcpd auto_config outside
!
dhcpd address 192.168.1.10-192.168.1.30 lan
dhcpd enable lan
!
dhcpd address 192.168.248.20-192.168.248.250 vlan99
dhcpd enable vlan99
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
group-policy DfltGrpPolicy attributes
vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-clientless
group-policy GroupPolicy_64.4.85.220 internal
group-policy GroupPolicy_64.4.85.220 attributes
vpn-tunnel-protocol ikev1 ikev2
dynamic-access-policy-record DfltAccessPolicy
username admin password $sha512$5000$SwoYrPR4gBv5dHDonxafnw==$hWtL0tdxL/meq/YMSVmj0Q== pbkdf2 privilege 15
tunnel-group 64.4.85.220 type ipsec-l2l
tunnel-group 64.4.85.220 ipsec-attributes
ikev1 pre-shared-key *****
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
inspect icmp
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:74134f2b40f06e8735b578ff6184bc89
: end
WINNIPEG# show run na
WINNIPEG# show run nat
nat (lan,outside) source static any interface
nat (vlan99,outside) source static any interface
nat (vlan99,outside) source static NETWORK_OBJ_192.168.248.0_24 NETWORK_OBJ_192.168.248.0_24 destination static NETWORK_OBJ_192.168.49.0_24 NETWORK_OBJ_192.168.49.0_24 no-proxy-arp route-lookup
!
object network obj_any2
nat (inside_2,outside) dynamic interface
object network obj_any3
nat (inside_3,outside) dynamic interface
object network obj_any4
nat (inside_4,outside) dynamic interface
object network obj_any5
nat (inside_5,outside) dynamic interface
object network obj_any6
nat (inside_6,outside) dynamic interface
object network obj_any7

Rob Ingram · ‎05-09-2019

What is the order of your nat rules? show nat

This rule nat (vlan99,outside) source static any interface appears in the running-configuration above your no-nat/nat exemption rule. Therefore traffic for the VPN could well be natted behind the outside interface. Move that rule below the no-nat/nat exemption rule.

mick_george2003 · ‎05-09-2019

show nat
Manual NAT Policies (Section 1)
1 (vlan5) to (outside) source static any interface
translate_hits = 68, untranslate_hits = 6332
2 (vlan99) to (outside) source static any interface
translate_hits = 9518, untranslate_hits = 0
3 (vlan99) to (outside) source static NETWORK_OBJ_192.168.49.0_24 NETWORK_OBJ_19 2.168.49.0_24 destination static NETWORK_OBJ_192.168.248.0_24 NETWORK_OBJ_192.1 68.248.0_24 no-proxy-arp route-lookup
translate_hits = 0, untranslate_hits = 0

Auto NAT Policies (Section 2)
1 (inside_2) to (outside) source dynamic obj_any2 interface
translate_hits = 0, untranslate_hits = 0
2 (inside_3) to (outside) source dynamic obj_any3 interface
translate_hits = 0, untranslate_hits = 0
3 (inside_4) to (outside) source dynamic obj_any4 interface
translate_hits = 0, untranslate_hits = 0
4 (inside_5) to (outside) source dynamic obj_any5 interface
translate_hits = 0, untranslate_hits = 0
5 (inside_6) to (outside) source dynamic obj_any6 interface
translate_hits = 0, untranslate_hits = 0
6 (inside_7) to (outside) source dynamic obj_any7 interface
translate_hits = 0, untranslate_hits = 0

can you please tell me how to do this?

This rule nat (vlan99,outside) source static any interface appears in the running-configuration above your no-nat/nat exemption rule. Therefore traffic for the VPN could well be natted behind the outside interface. Move that rule below the no-nat/nat exemption rule.

Rob Ingram · ‎05-09-2019

If you just remove the nat entry and re-add, it should position it below the no-nat/nat exemption rule.

no nat (vlan99,outside) source static any interface
nat (vlan99,outside) source static any interface

Re-run "show nat" to confirm it is number 3 on the Manual NAT Policy list

mick_george2003 · ‎05-09-2019

This is my show nat now but still no luck

Manual NAT Policies (Section 1)
1 (vlan5) to (outside) source static any interface
translate_hits = 68, untranslate_hits = 6480
2 (vlan99) to (outside) source static NETWORK_OBJ_192.168.49.0_24 NETWORK_OBJ_192.168.49.0_24 destination static NETWORK_OBJ_192.168.248.0_24 NETWORK_OBJ_192.168.248.0_24 no-proxy-arp route-lookup
translate_hits = 0, untranslate_hits = 0
3 (vlan99) to (outside) source static any interface
translate_hits = 14, untranslate_hits = 0

Auto NAT Policies (Section 2)
1 (inside_2) to (outside) source dynamic obj_any2 interface
translate_hits = 0, untranslate_hits = 0
2 (inside_3) to (outside) source dynamic obj_any3 interface
translate_hits = 0, untranslate_hits = 0
3 (inside_4) to (outside) source dynamic obj_any4 interface
translate_hits = 0, untranslate_hits = 0
4 (inside_5) to (outside) source dynamic obj_any5 interface
translate_hits = 0, untranslate_hits = 0
5 (inside_6) to (outside) source dynamic obj_any6 interface
translate_hits = 0, untranslate_hits = 0
6 (inside_7) to (outside) source dynamic obj_any7 interface
translate_hits = 0, untranslate_hits = 0

Rob Ingram · ‎05-09-2019

Have you made the nat modifications on both ASAs?

What are you doing to generate traffic? Are you pinging from a VLAN99 ip address to the remote network private IP address? When you do ping don't do this to/from the ASA, do it from a workstation.

Run packet-tracer from the command line and upload the output.

mick_george2003 · ‎05-09-2019

Yes I did on both routers. I did ping from a pc on on network to the vlan99 router on other side.

packet tracer shows

packet-tracer input vlan99 icmp 192.168.248.24 0 0 192.168.49.1

Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list

Phase: 2
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop 67.215.x.x using egress ifc outside

Phase: 3
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
nat (vlan99,outside) source static NETWORK_OBJ_192.168.248.0_24 NETWORK_OBJ_192.168.248.0_24 destination static NETWORK_OBJ_192.168.49.0_24 NETWORK_OBJ_192.168.49.0_24 no-proxy-arp route-lookup
Additional Information:
NAT divert to egress interface outside
Untranslate 192.168.49.1/0 to 192.168.49.1/0

Phase: 4
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (vlan99,outside) source static NETWORK_OBJ_192.168.248.0_24 NETWORK_OBJ_192.168.248.0_24 destination static NETWORK_OBJ_192.168.49.0_24 NETWORK_OBJ_192.168.49.0_24 no-proxy-arp route-lookup
Additional Information:
Static translate 192.168.248.24/0 to 192.168.248.24/0

Phase: 5
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 6
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 7
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
class-map inspection_default
match default-inspection-traffic
policy-map global_policy
class inspection_default
inspect icmp
service-policy global_policy global
Additional Information:

Phase: 8
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
Additional Information:

Phase: 9
Type: VPN
Subtype: encrypt
Result: DROP
Config:
Additional Information:

Result:
input-interface: vlan99
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

Rob Ingram · ‎05-09-2019

Can you ping something other than the remote ASA's inside interface, also note source icmp 8 not 0. E.g:-

packet-tracer input vlan99 icmp 192.168.248.24 8 0 192.168.49.x

Run the packet-tracer twice, the first attempt would attempt to bring up the tunnel and drop, the second should be accurate.

mick_george2003 · ‎05-09-2019

result on second time

packet-tracer input vlan99 icmp 192.168.248.24 8 0 192.168.49.1

Phase: 1
Type: CAPTURE
Subtype:
Result: ALLOW
Config:
Additional Information:
MAC Access list

Phase: 2
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list

Phase: 3
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop 67.215.60.25 using egress ifc outside

Phase: 4
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
nat (vlan99,outside) source static NETWORK_OBJ_192.168.248.0_24 NETWORK_OBJ_192.168.248.0_24 destination static NETWORK_OBJ_192.168.49.0_24 NETWORK_OBJ_192.168.49.0_24 no-proxy-arp route-lookup
Additional Information:
NAT divert to egress interface outside
Untranslate 192.168.49.1/0 to 192.168.49.1/0

Phase: 5
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (vlan99,outside) source static NETWORK_OBJ_192.168.248.0_24 NETWORK_OBJ_192.168.248.0_24 destination static NETWORK_OBJ_192.168.49.0_24 NETWORK_OBJ_192.168.49.0_24 no-proxy-arp route-lookup
Additional Information:
Static translate 192.168.248.24/0 to 192.168.248.24/0

Phase: 6
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 7
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 8
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
class-map inspection_default
match default-inspection-traffic
policy-map global_policy
class inspection_default
inspect icmp
service-policy global_policy global
Additional Information:

Phase: 9
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
Additional Information:

Phase: 10
Type: VPN
Subtype: encrypt
Result: DROP
Config:
Additional Information: