L2L tunnel and show connection addess

[mahesh18]

Hi Everyone,

ASA 5505 has L2L tunnel to 5520.

Tunnel is up and running.

5505# sh crypto isakmp sa

IKEv1 SAs:

   Active SA: 1
    Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1

1   IKE Peer: 10.31.2.30
    Type    : L2L             Role    : initiator
    Rekey   : no              State   : MM_ACTIVE

There are no IKEv2 SAs

sh crypto ipsec sa
interface: Visitor_Edge
    Crypto map tag: D_Traffic_Crypto, seq num: 1, local addr: 10.31.2.20

When i do sh conn  address 10.31.2.20 all
5 in use, 9316 most used
ESP Visitor 10.31.2.30 NP Identity Ifc  10.31.2.20, idle 0:00:00, bytes 9912, flags------------1
UDP Visitor  10.31.2.30:500 NP Identity Ifc  10.31.2.20:500, idle 0:00:09, bytes 3365216, flags -------------2
ESP Visitor 10.31.2.30 NP Identity Ifc  10.31.2.20, idle 0:00:00, bytes 3816, flags-------------3

Need to understand connections 1 and 3 are used for what purpose and why they have no port info?

As connection 2 is tunnel connection using port 500.But connections 1 and 3 have no port numbers why?

Regards

Mahesh

[David_Che · Accepted solution]

Connection 1 and 3 represent outgoing and incoming ESP traffic, which are sitting directly on IP header, so there are no port info.

Connection 2 represent IKE message which is exchanging message on UDP port 500.

[mahesh18]

Hi David,

Can you please explain me in more detail about --  "Connection 1 and 3 represent outgoing and incoming ESP traffic, which are sitting directly on IP header, so there are no port info"

Is this tunnel traffic that is uses to keep tunnel up between 2 ASA's?

Regards

MAhesh

[David Johan Castro Fernandez · Accepted solution]

Hi David,

The main job of ESP is to provide the privacy we seek for IP datagrams by encrypting them. An encryption algorithm combines the data in the datagram with a key to transform it into an encrypted form. ESP also supports its own authentication scheme like that used in AH, or can be used in conjunction with AH.

Encapsulating Security Payload Fields

ESP has several fields, but packages its fields in a very different way. Instead of having just a header, it divides its fields into three components:

• ESP Header: This contains two fields, the SPI and Sequence Number, and comes before the encrypted data. Its placement depends on whether ESP is used in transport mode or tunnel mode, as explained in the topic on IPSec modes. 
• ESP Trailer: This section is placed after the encrypted data. It contains padding that is used to align the encrypted data, through a Padding and Pad Lengthfield. Interestingly, it also contains the Next Header field for ESP. 
   
• ESP Authentication Data: This field contains an Integrity Check Value (ICV), computed in a manner similar to how the AH protocol works, for when ESP's optional authentication feature is used.

Regarding your question, the ESP protocol is to maintain the data with confidentiality, to maintain the tunnel up, you can use the ISAKMP keepalives within the tunnel group configuration.

If you have another question please let us know!

Please don´t forget to rate and mark as correct the helpful Post!

David Castro,

Regards,

[mahesh18]

Many thanks David for explaining so well.

Regards

MAhesh