Here you have Cisco ASA config file. I have previous experience with IOS only, no ASA
so maybe not everything is OK. Any comment or advice is welcome (not only to the issue)!
ASA Version 8.0(3)
!
hostname asa
domain-name company.local
enable password ***** encrypted
names
!
interface Vlan1
nameif inside
security-level 100
ip address 172.27.0.1 255.255.240.0
!
interface Vlan2
nameif outside
security-level 0
ip address 1.1.1.1 255.255.255.248
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd ***** encrypted
boot system disk0:/asa803-k8.bin
boot system disk0:/asa803-19-k8.bin
ftp mode passive
clock timezone CET 1
clock summer-time CEST recurring last Sun Mar 2:00 last Sun Oct 3:00
dns domain-lookup inside
dns server-group DefaultDNS
name-server 172.27.1.1
domain-name company.local
same-security-traffic permit intra-interface
object-group icmp-type og_icmp_permit
icmp-object echo-reply
icmp-object unreachable
icmp-object source-quench
icmp-object time-exceeded
icmp-object parameter-problem
access-list acl_encrypt extended permit ip 172.27.0.0 255.255.240.0 172.27.128.0 255.255.240.0
access-list acl_encrypt extended permit ip host 1.1.1.1 172.27.128.0 255.255.240.0
access-list acl_inbound_outside extended permit icmp any any object-group og_icmp_permit
access-list acl_no_nat_inside extended permit ip 172.27.0.0 255.255.240.0 172.27.112.0 255.255.255.0
access-list acl_no_nat_inside extended permit ip 172.27.0.0 255.255.240.0 172.27.128.0 255.255.240.0
access-list acl_no_nat_inside extended permit ip host 1.1.1.1 172.27.112.0 255.255.255.0
access-list acl_no_nat_inside extended permit ip host 1.1.1.1 172.27.128.0 255.255.240.0
access-list acl_tunnel_ra_users extended permit ip 172.27.0.0 255.255.240.0 any
access-list acl_tunnel_ra_users extended permit ip 172.27.112.0 255.255.255.0 any
pager lines 24
logging enable
logging timestamp
logging buffered informational
logging asdm informational
mtu inside 1500
mtu outside 1500
ip local pool iplp_ra_users 172.27.112.1-172.27.112.254 mask 255.255.255.0
no failover
icmp unreachable rate-limit 3 burst-size 3
icmp permit any inside
asdm image disk0:/asdm-603.bin
no asdm history enable
arp timeout 14400
nat-control
global (outside) 1 interface
nat (inside) 0 access-list acl_no_nat_inside
nat (inside) 1 0.0.0.0 0.0.0.0
access-group acl_inbound_outside in interface outside
route outside 0.0.0.0 0.0.0.0 1.1.1.2 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
aaa-server as_ias_group protocol radius
reactivation-mode timed
max-failed-attempts 5
aaa-server as_ias_group host 172.27.1.1
key *****
aaa-server as_ias_group host 172.27.1.2
key *****
aaa authentication telnet console LOCAL
aaa authentication ssh console LOCAL
aaa authentication serial console LOCAL
http server enable
http ***** 255.255.255.255 inside
http ***** 255.255.255.255 inside
http redirect inside 80
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ts_esp_aes_256_sha esp-aes-256 esp-sha-hmac
crypto dynamic-map cdm_outside 10 set pfs group5
crypto dynamic-map cdm_outside 10 set transform-set ts_esp_aes_256_sha
crypto dynamic-map cdm_outside 10 set security-association lifetime seconds 3600
crypto dynamic-map cdm_outside 10 set security-association lifetime kilobytes 1048576
crypto map cm_outside 10 match address acl_encrypt
crypto map cm_outside 10 set pfs group5
crypto map cm_outside 10 set peer 2.2.2.2
crypto map cm_outside 10 set transform-set ts_esp_aes_256_sha
crypto map cm_outside 10 set security-association lifetime seconds 3600
crypto map cm_outside 10 set security-association lifetime kilobytes 1048576
crypto map cm_outside 65535 ipsec-isakmp dynamic cdm_outside
crypto map cm_outside interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption aes-256
hash sha
group 5
lifetime 3600
crypto isakmp policy 20
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 3600
crypto isakmp nat-traversal 60
telnet timeout 3
ssh ***** 255.255.255.255 inside
ssh ***** 255.255.255.255 inside
ssh ***** 255.255.255.255 outside
ssh ***** 255.255.255.255 outside
ssh timeout 10
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
ntp server 172.27.1.1 prefer
ntp server 195.113.144.201
ntp server 195.113.144.238
group-policy gp_ra_users internal
group-policy gp_ra_users attributes
dns-server value 172.27.1.1 172.27.1.2
vpn-tunnel-protocol IPSec
pfs enable
split-tunnel-policy tunnelspecified
split-tunnel-network-list value acl_tunnel_ra_users
default-domain value company.local
username ***** password ***** encrypted
username ***** password ***** encrypted
username ***** password ***** encrypted
username ***** password ***** encrypted
username ***** password ***** encrypted
tunnel-group 2.2.2.2 type ipsec-l2l
tunnel-group 2.2.2.2 ipsec-attributes
pre-shared-key *****
tunnel-group tg_ra_users_01 type remote-access
tunnel-group tg_ra_users_01 general-attributes
address-pool iplp_ra_users
authentication-server-group as_ias_group
default-group-policy gp_ra_users
password-management
tunnel-group tg_ra_users_01 ipsec-attributes
pre-shared-key *****
tunnel-group tg_ra_users_01 ppp-attributes
no authentication chap
no authentication ms-chap-v1
authentication ms-chap-v2
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect icmp
inspect pptp
inspect icmp error
class class-default
set connection decrement-ttl
!
service-policy global_policy global
prompt hostname context
: end
Here is IPsec SAs details:
peer address: 2.2.2.2
Crypto map tag: cdm_outside, seq num: 10, local addr: 1.1.1.1
local ident (addr/mask/prot/port): (172.27.0.0/255.255.240.0/0/0)
remote ident (addr/mask/prot/port): (2.2.2.2/255.255.255.255/0/0)
current_peer: 2.2.2.2
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 3391, #pkts decrypt: 3391, #pkts verify: 3391
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#pkts no sa (send): 0, #pkts invalid sa (rcv): 0
#pkts encaps failed (send): 0, #pkts decaps failed (rcv): 0
#pkts invalid prot (rcv): 0, #pkts verify failed: 0
#pkts invalid identity (rcv): 0, #pkts invalid len (rcv): 0
#pkts replay rollover (send): 0, #pkts replay rollover (rcv): 0
#pkts replay failed (rcv): 0
#pkts min mtu frag failed (send): 0, #pkts bad frag offset (rcv): 0
#pkts internal err (send): 0, #pkts internal err (rcv): 0
local crypto endpt.: 1.1.1.1, remote crypto endpt.: 2.2.2.2
path mtu 1500, ipsec overhead 74, media mtu 1500
current outbound spi: 03DF2B4E
inbound esp sas:
spi: 0xEDA33A35 (3986897461)
transform: esp-aes-256 esp-sha-hmac none
in use settings ={L2L, Tunnel, PFS Group 5, }
slot: 0, conn_id: 4452352, crypto-map: cdm_outside
sa timing: remaining key lifetime (sec): 2003
IV size: 16 bytes
replay detection support: Y
outbound esp sas:
spi: 0x03DF2B4E (64957262)
transform: esp-aes-256 esp-sha-hmac none
in use settings ={L2L, Tunnel, PFS Group 5, }
slot: 0, conn_id: 4452352, crypto-map: cdm_outside
sa timing: remaining key lifetime (sec): 2003
IV size: 16 bytes
replay detection support: Y
Crypto map tag: cm_outside, seq num: 10, local addr: 1.1.1.1
access-list acl_encrypt permit ip 172.27.0.0 255.255.240.0 172.27.128.0 255.255.240.0
local ident (addr/mask/prot/port): (172.27.0.0/255.255.240.0/0/0)
remote ident (addr/mask/prot/port): (172.27.128.0/255.255.240.0/0/0)
current_peer: 2.2.2.2
#pkts encaps: 78205, #pkts encrypt: 78205, #pkts digest: 78205
#pkts decaps: 114536, #pkts decrypt: 114536, #pkts verify: 114536
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 78205, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#pkts no sa (send): 0, #pkts invalid sa (rcv): 0
#pkts encaps failed (send): 0, #pkts decaps failed (rcv): 0
#pkts invalid prot (rcv): 0, #pkts verify failed: 0
#pkts invalid identity (rcv): 0, #pkts invalid len (rcv): 0
#pkts replay rollover (send): 0, #pkts replay rollover (rcv): 0
#pkts replay failed (rcv): 0
#pkts min mtu frag failed (send): 0, #pkts bad frag offset (rcv): 0
#pkts internal err (send): 0, #pkts internal err (rcv): 0
local crypto endpt.: 1.1.1.1, remote crypto endpt.: 2.2.2.2
path mtu 1500, ipsec overhead 74, media mtu 1500
current outbound spi: 074F3BCD
inbound esp sas:
spi: 0x1D2DB776 (489535350)
transform: esp-aes-256 esp-sha-hmac none
in use settings ={L2L, Tunnel, PFS Group 5, }
slot: 0, conn_id: 4452352, crypto-map: cm_outside
sa timing: remaining key lifetime (sec): 1994
IV size: 16 bytes
replay detection support: Y
outbound esp sas:
spi: 0x074F3BCD (122633165)
transform: esp-aes-256 esp-sha-hmac none
in use settings ={L2L, Tunnel, PFS Group 5, }
slot: 0, conn_id: 4452352, crypto-map: cm_outside
sa timing: remaining key lifetime (sec): 1994
IV size: 16 bytes
replay detection support: Y
I know there will be some simple "stupid" issue but I watch it again and again
but I am blind to it already...
Thank you for your help in advance!
