Packet tracer output- what ACL is dropping this L2L VPN traffic? - Page 2

jmaxwellUSAF · ‎01-25-2023

Hello. Please view below packet tracer output...

ASA1120# packet-tracer input inside icmp (!! ip of my inside_in interface !!) 8 0 (!! ip of remote inside interface through L2L tunnel !!) $

Phase: 1
Type: UN-NAT
Subtype: static
Result: ALLOW
Elapsed time: 37888 ns
Config:
nat (inside,outside) source static MY-LAN-NETWORK-1 MY-LAN-NETWORK-1 destination static VENDOR1-LAN-NETWORK-1 VENDOR1-LAN-NETWORK-1
Additional Information:
NAT divert to egress interface outside
Untranslate (!! ip of my inside_in interface !!)/0 to (!! ip of remote inside interface through L2L tunnel !!)/0

Phase: 2
Type: ACCESS-LIST
Subtype:
Result: DROP
Elapsed time: 9344 ns
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7f3e3daff3c0, priority=501, domain=permit, deny=true
hits=3, user_data=0x7, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip/id=(!! ip of my inside_in interface !!), mask=255.255.255.255, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0, nsg_id=none
input_ifc=inside, output_ifc=any

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: drop
Time Taken: 47232 ns
Drop-reason: (acl-drop) Flow is denied by configured rule, Drop-location: frame 0x0000562a86cf3817 flow (NA)/NA

Below is the inside_in ACL, verified attached to the inside interface, AFTER packet tracer execution (hitcnt=0)...

access-list inside_in line 1 remark THIS ALLOWS TRAFFIC FROM SUBNET TO VENDOR1 SUBNET VIA L2L TUNNEL
access-list inside_in line 2 extended permit ip 172.16.1.0 255.255.255.0 172.16.8.0 255.255.255.0 (hitcnt=0) 0xedf8ec93

Possibly relevant (?)-- snippet from VPN config...
==========
8. Configure the ACL for VENDOR1_VPN_FILTER_ACL-1.
#access-list VENDOR1_VPN_FILTER_ACL-1 extended
#10 permit ip 172.16.8.0 255.255.255.0 172.16.1.0 255.255.255.0 (!! This seems to imply remote to local traffic. !!)

10. Configure Internal Group Policy & attributes.
#group-policy 2.2.2.2 internal
#group-policy 2.2.2.2 attributes
#vpn-filter VENDOR1_VPN_FILTER_ACL-1
#vpn-tunnel-protocol ikev2
#pfs enable
==========

Very relevant: Below data suggests/confirms that only 2 access lists are applied on this ASA,-- ACL inside_in on the inside interface, and ACL outside_in on the relevant outside1 interface.

ASA1120# sh run | inc access-group

access-group inside_in in interface inside
access-group outside_in in interface outside1

It seems the traffic is being dropped because it is first referencing a different ACL? What ACL would this be?

Thank you.

jmaxwellUSAF · ‎01-26-2023

Below is the exact (obfuscated) VPN code in the ASA5525

!! Configure the crypto map. !!
#crypto map VENDOR1-cryptomap-1 interface outside1
#crypto map VENDOR1-cryptomap-1 1 match address outside_in
#crypto map VENDOR1-cryptomap-1 1 set peer 2.2.2.2
#crypto map VENDOR1-cryptomap-1 1 set ikev2 ipsec-proposal VENDOR1-PROPOSAL-1

____

Now, please view below log...

%ASA-4-750003: Local:1.1.1.1:500 Remote:2.2.2.2:500 Username:2.2.2.2 IKEv2 Negotiation aborted due to ERROR: Maximum number of retransmissions reached
%ASA-4-752012: IKEv2 was unsuccessful at setting up a tunnel. Map Tag = VENDOR1-cryptomap-1. Map Sequence Number = 1.
%ASA-3-752015: Tunnel Manager has failed to establish an L2L SA. All configured IKE versions failed to establish the tunnel. Map Tag= VENDOR1-cryptomap-1. Map Sequence Number = 1.

%ASA-5-752003: Tunnel Manager dispatching a KEY_ACQUIRE message to IKEv2. Map Tag = VENDOR1-cryptomap-1. Map Sequence Number = 1.
%.3.3.3.3/12996 to 4.4.4.4/389 flags SYN on interface outside1

Questions:

1. Does it matter the order of four commands as listed in the VENDOR1 cryptomap?

2. Why is VENDOR1-Cryptomap-1 associating with unrelated "3.3.3.3/12996 to 4.4.4.4/389"??

Thank you.

jmaxwellUSAF · ‎01-26-2023

Also, this ACL outside_in from "crypto map VENDOR1-cryptomap-1 1 match address outside_in"-- Should this be the same main ACL attached to interface outside1 that protects the enterprise from the www?

MHM Cisco World · ‎01-26-2023

#crypto map VENDOR1-cryptomap-1 1 set ikev2 ipsec-proposal VENDOR1-PROPOSAL-1 <<- this issue here why you use IKEv2 not IKEv1 ??

jmaxwellUSAF · ‎01-26-2023

Enterprise VPN requirement is IKEv2. I followed config template from Cisco book "Cisco ASA, Third Edition"

There is mistake here?

jmaxwellUSAF · ‎01-26-2023

I think I'm figuring out the root cause + solution.

Please tell me...

#crypto map VENDOR1-cryptomap-1 interface outside1
#crypto map VENDOR1-cryptomap-1 1 match address outside_in
#crypto map VENDOR1-cryptomap-1 1 set peer 2.2.2.2
#crypto map VENDOR1-cryptomap-1 1 set ikev2 ipsec-proposal VENDOR1-PROPOSAL-1

Should ACL "outside_in" be attached to interface "outside1" in, or should ACL "outside_in" be attached to nothing ?

Rob Ingram · ‎01-26-2023

@jmaxwellUSAF IMO, the ACL "outside_in" is poorly named if you are using this for the crypto ACL. This should ideally be named appropriately in relation to what it is used for, "VPN-TO-BRANCH" would be better. This ACL is then referenced under the crypto map sequence.

The crypto ACL is not attached to the interface, that is a separate and dedicated ACL.

Please can you turn on the IKEv2 debugs, attempt to establish a tunnel and then provide the full debug as an attachment rather than paste the full output in the body of the email.

jmaxwellUSAF · ‎01-26-2023

Please, how do I remove an ACL from an interface on ASA1120?

Rob Ingram · ‎01-26-2023

@jmaxwellUSAF you remove an ACL on an interface using "no access-group <NAME> in interface <INTERFACENAME>" (replace "in" with "out" if outbound).

Bear in mind you can only have one ACL per direction per interface. So are you sure this ACL is not actually in use on the interface?

jmaxwellUSAF · ‎01-26-2023

to create a route through the tunnel to the remote network, what do I place in the below template?

route <interface> 172.16.8.0 255.255.255.0 <next-hop>

Thank you.

Rob Ingram · ‎01-26-2023

@jmaxwellUSAF is there not a default route via the outside1 interface? I'd so you don't need a specific route for this destination.

Unless you've got multiple outside interfaces? In which case is the vpn communicating using the correct interface?

Provide your configuration?

jmaxwellUSAF · ‎01-27-2023

Hello tech gods.

May you please answer following questions about below complete L2L VPN code, and current logs?...

__________

1. Enable IKE processing on the outside interface "outside1" 1.1.1.1 /24
#crypto ikev2 enable outside1

2. Create the ISAKMP policy
#crypto ikev2 policy 100
#encryption aes-256
#integrity sha-256
#group 14
#prf sha-256
#lifetime seconds 86400

3. Set tunnel group and tunnel type
#tunnel-group 2.2.2.2 type ipsec-l2l
#tunnel group 2.2.2.2 ipsec-attributes
#ikev2 local-authentication pre-shared-key KeY12345
#ikev2 remote-authentication pre-shared-key KeY12345

4. Define the IPsec policy
#crypto ipsec ikev2 ipsec-proposal VENDOR1-PROPOSAL-1
#protocol esp encryption aes-256
#protocol esp integrity sha-512

5. Append the existing crypto map ACL
#access-list VENDOR1-Cryptomap-ACL remark >>ACL REFERENCED BY CRYPTO-MAP<<
#access-list VENDOR1-Cryptomap-ACL extended permit ip 172.16.1.0 255.255.255.0 172.16.8.0 255.255.255.0

6. Configure the crypto map.
#crypto map VENDOR1-cryptomap-1 interface outside1
#crypto map VENDOR1-cryptomap-1 1 match address VENDOR1-Cryptomap-ACL
#crypto map VENDOR1-cryptomap-1 1 set peer 2.2.2.2
#crypto map VENDOR1-cryptomap-1 1 set ikev2 ipsec-proposal VENDOR1-PROPOSAL-1

7. Bypass NAT
#object network MY-LAN-NETWORK-1
#subnet 172.16.1.0 255.255.255.0
#object network VENDOR1-LAN-NETWORK-1
#subnet 172.16.8.0 255.255.255.0
#exit
#nat (inside,outside1) source static MY-LAN-NETWORK-1 MY-LAN-NETWORK-1 destination static VENDOR1-LAN-NETWORK-1 VENDOR1-LAN-NETWORK-1

8. Configure Internal Group Policy & attributes.
#group-policy 2.2.2.2 internal
#group-policy 2.2.2.2 attributes
#vpn-tunnel-protocol ikev2
#pfs enable
---&&&&&&&&&---

%ASA-5-750001: Local:1.1.1.1:500 Remote:2.2.2.2:500 Username:Unknown IKEv2 Received request to establish an IPsec tunnel; local traffic selector = Address Range: 1.1.1.1-1.1.1.1 Protocol: 0 Port Range: 0-65535; remote traffic selector = Address Range: 224.0.0.10-224.0.0.10 Protocol: 0 Port Range: 0-65535

%ASA-5-750001: Local:1.1.1.1:500 Remote:2.2.2.2:500 Username:Unknown IKEv2 Received request to establish an IPsec tunnel; local traffic selector = Address Range: 1.1.1.1-1.1.1.1 Protocol: 0 Port Range: 0-65535; remote traffic selector = Address Range: 3.3.3.3-3.3.3.3 Protocol: 0 Port Range: 0-65535

%ASA-5-752003: Tunnel Manager dispatching a KEY_ACQUIRE message to IKEv2. Map Tag = VENDOR1-cryptomap-1. Map Sequence Number = 1.
%ASA-4-752011: IKEv1 Doesn't have a transform set specified.
%ASA-4-752012: IKEv2 was unsuccessful at setting up a tunnel. Map Tag = VENDOR1-cryptomap-1. Map Sequence Number = 1.
%ASA-3-752015: Tunnel Manager has failed to establish an L2L SA. All configured IKE versions failed to establish the tunnel. Map Tag= VENDOR1-cryptomap-1. Map Sequence Number = 1.
---&&&&&&&&&---

QUESTIONS:
1. "%ASA-4-752011: IKEv1 Doesn't have a transform set specified." -My config only has IKEv2. Why is this referring to IKEv1?

2. "All configured IKE versions failed to establish the tunnel." - there exist not only my specific and verified...
"crypto ikev2 policy 100
encryption aes-256
integrity sha256
group 14
prf sha256
lifetime seconds 86400"
... but also about ten other preceding IKE policies. Does this symptom mean the remote peer IKE config doesn't match?

3. "remote traffic selector = Address Range: 3.3.3.3-3.3.3.3" I don't recognize public IP 3.3.3.3. This IP is not in "show run | inc 3.3.3.3" From where might originate this injection of data "3.3.3.3"?

Thank you.

Rob Ingram · ‎01-27-2023

@jmaxwellUSAF The IKE (v1 or v2) are defined globally and not tied to a specific tunnel. All IKE policies would be sent and selected on a match.

Do you control the other side of the VPN tunnel? If not, have they mirrored your crypto ACL? They should source traffic from 172.16.8.0/24 to 172.16.1.0/24. Have they mis-configured their NAT, of 3.3.3.3 < or whatever the real IP address is?

Can you provide the full debug information please?

Can you provide the full configuration? Change the public IP address and sensitive information.

jmaxwellUSAF · ‎01-27-2023

Thank you for your response.

I do not have access to the remote vendor network.

I will ask the vendor...
1. if they have mirrored my crypto ACL
2. are they sourcing traffic from 172.16.8.0/24 to 172.16.1.0/24
3. Have they mis-configured their NAT regarding 3.3.3.3

What debug commands shall I execute now?
In my last response was the full VPN config. What do you mean by "provide full config"?

Rob Ingram · ‎01-27-2023

@jmaxwellUSAF run the IKEv2 debug commands, attempt to establish the VPN and provide the full output.

debug crypto ikev2 protocol 127
debug crypto ikev2 platform 127

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/115935-asa-ikev2-debugs.html

I wanted to see the rest of the ASA configuration to determine whether something might be conflicting or unintentially causing an issue with these VPN.

jmaxwellUSAF · ‎01-27-2023

Before I email the vendor with above three questions, please view below config data already told to me by vendor...

!! This VENDOR1 device is a V1000 router !!
=====

ip access-list extended ENTERPRISE1
10 permit ip 172.16.8.0 0.0.0.255 172.16.1.0 0.0.0.255

crypto ikev2 keyring ENTERPRISE1
peer 1.1.1.1
address 1.1.1.1
pre-shared-key KeY12345
!
crypto ikev2 profile ENTERPRISE1
match address local 10.0.0.4
match identity remote address 1.1.1.1 255.255.255.255
authentication remote pre-share
authentication local pre-share
keyring local ENTERPRISE1
!

crypto map ipsec-map 24 ipsec-isakmp
description ENTERPRISE1
set peer 1.1.1.1
set security-association lifetime seconds 28800

!
set transform-set aes256-sha
set pfs group2
set ikev2-profile ENTERPRISE1
match address ENTERPRISE1

Are you now able to determine the source of the failing tunnel?

(For convenience, below is my recent reply with full VPN config, and also logs and questions.)...

__________

!! ENTERPRISE1 VPN config !!...