IPSec ASA 5505 + CP1100

dmitrty_nx · ‎02-19-2015

I need help. I have this topology:

After configuration endpoints can ping each other. But 10.10.1.5 cant ping 192.168.3.1 and 10.10.2.7 cant ping 10.10.1.1

Next I need do VPN IPSec S-t-S

ASA Version 8.2(1)
!
hostname 5505
enable password NuLKvvWGg.x9HEKO encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
name 10.10.2.0 remote-net
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 10.10.1.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 192.168.3.1 255.255.255.252
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
<...>
access-list WORK extended permit ip any any
access-list WORK extended permit icmp any any
access-list L2LACL extended permit ip 10.10.1.0 255.255.255.0 remote-net 255.255.255.0
access-list NO-NAT extended permit ip 10.10.1.0 255.255.255.0 remote-net 255.255.255.0
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-645.bin
no asdm history enable
arp timeout 14400
nat (inside) 0 access-list NO-NAT
access-group WORK in interface inside
access-group WORK in interface outside
route outside 0.0.0.0 0.0.0.0 192.168.3.2 1
timeout <...>
dynamic-access-policy-record DfltAccessPolicy
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map TEST_MAP 10 match address L2LACL
crypto map TEST_MAP 10 set peer 192.168.3.2
crypto map TEST_MAP 10 set transform-set ESP-DES-SHA
crypto map TEST_MAP 10 set reverse-route
crypto map TEST_MAP interface outside
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption des
 hash sha
 group 2
 lifetime 86400
no crypto isakmp nat-traversal
telnet timeout 5
ssh timeout 5
console timeout 0

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
username admin password F8uRMM5EGcslxoe/ encrypted privilege 15
tunnel-group 192.168.3.2 type ipsec-l2l
tunnel-group 192.168.3.2 ipsec-attributes
 pre-shared-key *
tunnel-group-map default-group 192.168.3.2
<...>
: end

And CP:

But I havent VPN connect

Log ASA after ping 10.10.2.7 - 192.168.3.1

RECV PACKET from 192.168.3.2
ISAKMP Header
  Initiator COOKIE: aa ac cb 21 bc 9b 63 95
  Responder COOKIE: 00 00 00 00 00 00 00 00
  Next Payload: Security Association
  Version: 1.0
  Exchange Type: Identity Protection (Main Mode)
  Flags: (none)
  MessageID: 00000000
  Length: 148
  Payload Security Association
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 56
    DOI: IPsec
    Situation:(SIT_IDENTITY_ONLY)
    Payload Proposal
      Next Payload: None
      Reserved: 00
      Payload Length: 44
      Proposal #: 1
      Protocol-Id: PROTO_ISAKMP
      SPI Size: 0
      # of transforms: 1
      Payload Transform
        Next Payload: None
        Reserved: 00
        Payload Length: 36
        Transform #: 1
        Transform-Id: KEY_IKE
        Reserved2: 0000
        Encryption Algorithm: DES-CBC
        Hash Algorithm: SHA1
        Authentication Method: Preshared key
        Group Description: Group 2
        Life Type: seconds
        Life Duration (Hex): 00 01 51 80
  Payload Vendor ID
    Next Payload: Vendor ID
    Reserved: 00
    Payload Length: 20
    Data (In Hex):
      4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f
  Payload Vendor ID
    Next Payload: None
    Reserved: 00
    Payload Length: 44
    Data (In Hex):
      f4 ed 19 e0 c1 14 eb 51 6f aa ac 0e e3 7d af 28
      07 b4 38 1f 00 00 00 01 00 00 13 8d 54 e4 c3 38
      00 00 00 00 18 20 00 00
Feb 18 05:09:31 [IKEv1]: IP = 192.168.3.2, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 148
Feb 18 05:09:31 [IKEv1 DEBUG]: IP = 192.168.3.2, processing SA payload
Feb 18 05:09:31 [IKEv1]: IP = 192.168.3.2, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + NOTIFY (11) + NONE (0) total length : 96

ISAKMP Header
  Initiator COOKIE: aa ac cb 21 bc 9b 63 95
  Responder COOKIE: 91 74 00 b6 1a eb de 7e
  Next Payload: Notification
  Version: 1.0
  Exchange Type: Informational
  Flags: (none)
  MessageID: 00000000
  Length: 96
  Payload Notification
    Next Payload: None
    Reserved: 00
    Payload Length: 68
    DOI: IPsec
    Protocol-ID: Reserved
    Spi Size: 0
    Notify Type: NO_PROPOSAL_CHOSEN
    Data:
      0d 00 00 38 00 00 00 01 00 00 00 01 00 00 00 2c
      01 01 00 01 00 00 00 24 01 01 00 00 80 01 00 01
      80 02 00 02 80 03 00 01 80 04 00 02 80 0b 00 01
      00 0c 00 04 00 01 51 80
Feb 18 05:09:31 [IKEv1 DEBUG]: IP = 192.168.3.2, All SA proposals found unacceptable
Feb 18 05:09:31 [IKEv1]: IP = 192.168.3.2, Error processing payload: Payload ID: 1
Feb 18 05:09:31 [IKEv1 DEBUG]: IP = 192.168.3.2, IKE MM Responder FSM error history (struct &0xc9d40338)  <state>, <event>:  MM_DONE, EV_ERROR-->MM_START, EV_RCV_MSG-->MM_START, EV_START_MM-->MM_START, EV_START_MM-->MM_START, EV_START_MM-->MM_START, EV_START_MM-->MM_START, EV_START_MM-->MM_START, EV_START_MM
Feb 18 05:09:31 [IKEv1 DEBUG]: IP = 192.168.3.2, IKE SA MM:b6007491 terminating:  flags 0x01000002, refcnt 0, tuncnt 0
Feb 18 05:09:31 [IKEv1 DEBUG]: IP = 192.168.3.2, sending delete/delete with reason message
Feb 18 05:09:31 [IKEv1]: IP = 192.168.3.2, Removing peer from peer table failed, no match!
Feb 18 05:09:31 [IKEv1]: IP = 192.168.3.2, Error: Unable to remove PeerTblEntry

# sh crypto isakmp sa
There are no isakmp sas

# sh crypto isakmp sa
There are no isakmp sas

dmitrty_nx · ‎02-20-2015

Havent any ideas?(

dmitrty_nx · ‎02-23-2015

Connected is up, but dont work

packet-tracer input inside icmp 10.10.1.5 1 1 10.10.2.7 detail

Phase: 6
Type: VPN
Subtype: encrypt
Result: ALLOW
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 out id=0xc9bf9b68, priority=70, domain=encrypt, deny=false
        hits=3, user_data=0x6d86c, cs_id=0xc6b83d30, reverse, flags=0x0, protocol=0
        src ip=10.10.1.0, mask=255.255.255.0, port=0
        dst ip=10.10.2.0, mask=255.255.255.0, port=0, dscp=0x0

packet-tracer input outside icmp 10.10.2.7 1 1 10.10.1.5 detail
Phase: 5
Type: VPN
Subtype: ipsec-tunnel-flow
Result: DROP
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0xc9e13988, priority=69, domain=ipsec-tunnel-flow, deny=false
        hits=1, user_data=0x9cee4, cs_id=0x0, reverse, flags=0x0, protocol=0
        src ip=10.10.2.0, mask=255.255.255.0, port=0
        dst ip=10.10.1.0, mask=255.255.255.0, port=0, dscp=0x0

# sh crypto isakmp sa
   Active SA: 1
    Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1

1   IKE Peer: 192.168.3.2
    Type    : L2L             Role    : initiator
    Rekey   : no              State   : MM_ACTIVE

Edited code:

!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 10.10.1.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 192.168.3.1 255.255.255.252
access-list outside_1_cryptomap extended permit ip 10.10.1.0 255.255.255.0 10.10
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set pfs
crypto map outside_map 1 set peer 192.168.3.2
crypto map outside_map 1 set transform-set ESP-DES-SHA
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption des
 hash sha
 group 2
 lifetime 86400