Buy or Renew
Buy or Renew
NEW! Stay up-to-date on Cisco Secure Access: Software Release Notes and Announcements
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
1068
Views
0
Helpful
5
Replies

Remote access VPN access across LAN-to-LAN VPN

timothy.lewis
Level 1
Level 1

‎09-09-2011 10:39 AM - edited ‎02-21-2020 05:34 PM

I have two sites (site 1 & site 2) connected by a LAN-to-LAN VPN.  At site 1, users connect with a remote access VPN and need to be able to access resources at site 2.

Labels:
0 Helpful
5 Replies 5

Jennifer Halim
Cisco Employee
Cisco Employee

‎09-09-2011 08:42 PM

Here is the requirements for your scenario:

1) If you have split tunnel configured for your remote access VPN, you would need to add site 2 subnet as well.

2) On the crypto ACL between site 1 and site 2, you would need to add the remote access VPN pool subnet:

Site 1: access-list permit ip

Site 2: access-list permit ip

3) If you have NAT exemption on site 2 for the LAN-to-LAN subnet, you would also need to configure the NAT exemption between site 2 LAN and vpn pool subnet.

Hope this helps.

0 Helpful

timothy.lewis
Level 1
Level 1
In response to Jennifer Halim

‎09-11-2011 06:53 PM

That's what I tried but it does not appear to be working.

Here is my pertinent information.  Site 1 is where remote access users connect.  Site 2 is the other network where remote users need access.

Site 1:

object-group network SG

network-object 192.168.0.0 255.255.192.0

network-object 10.1.10.0 255.255.255.0

object-group network NM

network-object 192.168.100.0 255.255.255.0

network-object 192.168.111.0 255.255.255.0

network-object 192.168.112.0 255.255.240.0

network-object 192.168.128.0 255.255.224.0

nat (inside) 0 access-list NATExempt

nat (inside) 2 10.1.1.0 255.255.255.0

nat (inside) 1 0.0.0.0 0.0.0.0

access-list SplitTunnel standard permit 10.1.2.0 255.255.255.0

access-list SplitTunnel standard permit 192.168.0.0 255.255.192.0

access-list SplitTunnel standard permit 192.168.100.0 255.255.255.0

access-list SplitTunnel standard permit 192.168.111.0 255.255.255.0

access-list SplitTunnel standard permit 192.168.112.0 255.255.240.0

access-list SplitTunnel standard permit 192.168.128.0 255.255.224.0

split-tunnel-policy tunnelspecified

split-tunnel-network-list value SplitTunnel

access-list nonat extended permit ip 192.168.100.0 255.255.255.0 192.168.0.0 255.255.192.0

access-list nonat extended permit ip 192.168.111.0 255.255.255.0 192.168.0.0 255.255.192.0

access-list nonat extended permit ip 192.168.112.0 255.255.240.0 192.168.0.0 255.255.192.0

access-list nonat extended permit ip 192.168.128.0 255.255.224.0 192.168.0.0 255.255.192.0

access-list nonat extended permit ip 192.168.100.0 255.255.255.0 10.1.10.0 255.255.255.0

access-list nonat extended permit ip 192.168.111.0 255.255.255.0 10.1.10.0 255.255.255.0

access-list nonat extended permit ip 192.168.112.0 255.255.240.0 10.1.10.0 255.255.255.0

access-list nonat extended permit ip 192.168.128.0 255.255.224.0 10.1.10.0 255.255.255.0

access-list sg-vpn extended permit ip 192.168.100.0 255.255.255.0 192.168.0.0 255.255.192.0

access-list sg-vpn extended permit ip 192.168.111.0 255.255.255.0 192.168.0.0 255.255.192.0

access-list sg-vpn extended permit ip 192.168.112.0 255.255.240.0 192.168.0.0 255.255.192.0

access-list sg-vpn extended permit ip 192.168.128.0 255.255.224.0 192.168.0.0 255.255.192.0

access-list sg-vpn extended permit ip 192.168.100.0 255.255.255.0 10.1.10.0 255.255.255.0

access-list sg-vpn extended permit ip 192.168.111.0 255.255.255.0 10.1.10.0 255.255.255.0

access-list sg-vpn extended permit ip 192.168.112.0 255.255.240.0 10.1.10.0 255.255.255.0

access-list sg-vpn extended permit ip 192.168.128.0 255.255.224.0 10.1.10.0 255.255.255.0access-list NATExempt extended permit ip object-group SG object-group NM

access-list outside_2_cryptomap extended permit ip object-group SG object-group NM

ip local pool RAVPNpool 10.1.10.1-10.1.10.254 mask 255.255.255.0

nat (inside) 0 access-list NATExempt
nat (inside) 2 10.1.1.0 255.255.255.0
nat (inside) 1 0.0.0.0 0.0.0.0

split-tunnel-policy tunnelspecified
split-tunnel-network-list value SplitTunnel

address-pool RAVPNpool

Site 2:

access-list nonat extended permit ip 192.168.100.0 255.255.255.0 192.168.0.0 255.255.192.0
access-list nonat extended permit ip 192.168.111.0 255.255.255.0 192.168.0.0 255.255.192.0
access-list nonat extended permit ip 192.168.112.0 255.255.240.0 192.168.0.0 255.255.192.0
access-list nonat extended permit ip 192.168.128.0 255.255.224.0 192.168.0.0 255.255.192.0

access-list nonat extended permit ip 192.168.100.0 255.255.255.0 10.1.10.0 255.255.255.0
access-list nonat extended permit ip 192.168.111.0 255.255.255.0 10.1.10.0 255.255.255.0
access-list nonat extended permit ip 192.168.112.0 255.255.240.0 10.1.10.0 255.255.255.0
access-list nonat extended permit ip 192.168.128.0 255.255.224.0 10.1.10.0 255.255.255.0

access-list sg-vpn extended permit ip 192.168.100.0 255.255.255.0 192.168.0.0 255.255.192.0
access-list sg-vpn extended permit ip 192.168.111.0 255.255.255.0 192.168.0.0 255.255.192.0
access-list sg-vpn extended permit ip 192.168.112.0 255.255.240.0 192.168.0.0 255.255.192.0
access-list sg-vpn extended permit ip 192.168.128.0 255.255.224.0 192.168.0.0 255.255.192.0
access-list sg-vpn extended permit ip 192.168.100.0 255.255.255.0 10.1.10.0 255.255.255.0
access-list sg-vpn extended permit ip 192.168.111.0 255.255.255.0 10.1.10.0 255.255.255.0
access-list sg-vpn extended permit ip 192.168.112.0 255.255.240.0 10.1.10.0 255.255.255.0
access-list sg-vpn extended permit ip 192.168.128.0 255.255.224.0 10.1.10.0 255.255.255.0

0 Helpful

Jennifer Halim
Cisco Employee
Cisco Employee
In response to timothy.lewis

‎09-11-2011 07:01 PM

On Site 1, you would also need to add "same-security-traffic permit intra-interface"

Clear the VPN tunnel - "clear cry ipsec sa" and "clear cry isa sa" from both sites, and try the access again.

If it still doesn't work, please share the output of :

show cry isa sa

show cry ipsec sa

0 Helpful

timothy.lewis
Level 1
Level 1
In response to Jennifer Halim

‎09-14-2011 06:28 AM

I started out with same-security-traffic intra-interface configured.

Here is the output from both ASAs:

NM-ASA# show crypto isakmp sa

   Active SA: 6
    Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 6

1   IKE Peer: 3.3.3.3
    Type    : L2L             Role    : initiator
    Rekey   : no              State   : MM_ACTIVE
2   IKE Peer: 74.138.171.237
    Type    : user            Role    : responder
    Rekey   : no              State   : AM_ACTIVE
3   IKE Peer: 96.28.201.133
    Type    : user            Role    : responder
    Rekey   : no              State   : AM_ACTIVE
4   IKE Peer: 1.1.1.1
    Type    : L2L             Role    : initiator
    Rekey   : no              State   : MM_ACTIVE
5   IKE Peer: 74.138.126.195
    Type    : user            Role    : responder
    Rekey   : no              State   : AM_ACTIVE
6   IKE Peer: 96.28.201.133
    Type    : user            Role    : responder
    Rekey   : no              State   : AM_ACTIVE
NM-ASA# 


NM-ASA# sho crypto ipsec sa
interface: outside
    Crypto map tag: SYSTEM_DEFAULT_CRYPTO_MAP, seq num: 65535, local addr: 2.2.2.2

      local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
      remote ident (addr/mask/prot/port): (10.1.20.5/255.255.255.255/0/0)
      current_peer: 96.28.201.133, username: joneal
      dynamic allocated peer ip: 10.1.20.5

      #pkts encaps: 50, #pkts encrypt: 50, #pkts digest: 50
      #pkts decaps: 33, #pkts decrypt: 33, #pkts verify: 33
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 50, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 2.2.2.2, remote crypto endpt.: 96.28.201.133

      path mtu 1500, ipsec overhead 74, media mtu 1500
      current outbound spi: 5E0D76C9

    inbound esp sas:
      spi: 0x969790AD (2526515373)
         transform: esp-aes esp-sha-hmac no compression
         in use settings ={RA, Tunnel, }
         slot: 0, conn_id: 315392, crypto-map: SYSTEM_DEFAULT_CRYPTO_MAP
         sa timing: remaining key lifetime (sec): 28618
         IV size: 16 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000003 0xFFFFFFFF
    outbound esp sas:
      spi: 0x5E0D76C9 (1577940681)
         transform: esp-aes esp-sha-hmac no compression
         in use settings ={RA, Tunnel, }
         slot: 0, conn_id: 315392, crypto-map: SYSTEM_DEFAULT_CRYPTO_MAP
         sa timing: remaining key lifetime (sec): 28618
         IV size: 16 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x00000001

    Crypto map tag: SYSTEM_DEFAULT_CRYPTO_MAP, seq num: 65535, local addr: 2.2.2.2

      local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
      remote ident (addr/mask/prot/port): (10.1.20.6/255.255.255.255/0/0)
      current_peer: 96.28.201.133, username: joneal
      dynamic allocated peer ip: 10.1.20.6

      #pkts encaps: 1368, #pkts encrypt: 1368, #pkts digest: 1368
      #pkts decaps: 945, #pkts decrypt: 945, #pkts verify: 945
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 1368, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 2.2.2.2, remote crypto endpt.: 96.28.201.133

      path mtu 1500, ipsec overhead 74, media mtu 1500
      current outbound spi: 968FF103

    inbound esp sas:
      spi: 0xA49C8920 (2761722144)
         transform: esp-aes esp-sha-hmac no compression
         in use settings ={RA, Tunnel, }
         slot: 0, conn_id: 331776, crypto-map: SYSTEM_DEFAULT_CRYPTO_MAP
         sa timing: remaining key lifetime (sec): 28703
         IV size: 16 bytes
         replay detection support: Y
Anti replay bitmap:
        0xFFFFFFFF 0xFFFFFFFF
    outbound esp sas:
      spi: 0x968FF103 (2526015747)
         transform: esp-aes esp-sha-hmac no compression
         in use settings ={RA, Tunnel, }
         slot: 0, conn_id: 331776, crypto-map: SYSTEM_DEFAULT_CRYPTO_MAP
         sa timing: remaining key lifetime (sec): 28702
         IV size: 16 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x00000001

    Crypto map tag: vpnmap, seq num: 20, local addr: 2.2.2.2

      access-list peak10-vpn permit ip 192.168.100.0 255.255.255.0 172.16.0.0 255.255.255.0
      local ident (addr/mask/prot/port): (192.168.100.0/255.255.255.0/0/0)
      remote ident (addr/mask/prot/port): (172.16.0.0/255.255.255.0/0/0)
      current_peer: 3.3.3.3

      #pkts encaps: 352, #pkts encrypt: 352, #pkts digest: 352
      #pkts decaps: 270, #pkts decrypt: 270, #pkts verify: 270
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 352, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0
             
      local crypto endpt.: 2.2.2.2, remote crypto endpt.: 3.3.3.3

      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: 773AB6C7

    inbound esp sas:
      spi: 0xD34E0435 (3545105461)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 303104, crypto-map: vpnmap
         sa timing: remaining key lifetime (kB/sec): (3914940/28605)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0xFFFFFFFF 0xFFFFFFFF
    outbound esp sas:
      spi: 0x773AB6C7 (2000336583)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 303104, crypto-map: vpnmap
         sa timing: remaining key lifetime (kB/sec): (3914941/28605)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x00000001

    Crypto map tag: vpnmap, seq num: 20, local addr: 2.2.2.2

      access-list peak10-vpn permit ip 192.168.128.0 255.255.224.0 172.16.0.0 255.255.255.0
      local ident (addr/mask/prot/port): (192.168.128.0/255.255.224.0/0/0)
      remote ident (addr/mask/prot/port): (172.16.0.0/255.255.255.0/0/0)
      current_peer: 3.3.3.3

      #pkts encaps: 26, #pkts encrypt: 26, #pkts digest: 26
      #pkts decaps: 24, #pkts decrypt: 24, #pkts verify: 24
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 26, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 2.2.2.2, remote crypto endpt.: 3.3.3.3

      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: 66CD02A3

    inbound esp sas:
      spi: 0x531B430A (1394295562)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 303104, crypto-map: vpnmap
         sa timing: remaining key lifetime (kB/sec): (3914990/28666)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x01FFFFFF
    outbound esp sas:
      spi: 0x66CD02A3 (1724711587)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 303104, crypto-map: vpnmap
         sa timing: remaining key lifetime (kB/sec): (3914990/28666)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x00000001

    Crypto map tag: SYSTEM_DEFAULT_CRYPTO_MAP, seq num: 65535, local addr: 2.2.2.2

      local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
      remote ident (addr/mask/prot/port): (10.1.20.7/255.255.255.255/0/0)
      current_peer: 74.138.126.195, username: jnord
      dynamic allocated peer ip: 10.1.20.7

      #pkts encaps: 990, #pkts encrypt: 990, #pkts digest: 990
      #pkts decaps: 1429, #pkts decrypt: 1429, #pkts verify: 1429
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 990, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 3

      local crypto endpt.: 2.2.2.2, remote crypto endpt.: 74.138.126.195

      path mtu 1500, ipsec overhead 74, media mtu 1500
      current outbound spi: 62241B76

    inbound esp sas:
      spi: 0xB1F2F97B (2985490811)
         transform: esp-aes esp-sha-hmac no compression
         in use settings ={RA, Tunnel, }
         slot: 0, conn_id: 327680, crypto-map: SYSTEM_DEFAULT_CRYPTO_MAP
         sa timing: remaining key lifetime (sec): 28674
         IV size: 16 bytes
         replay detection support: Y
Anti replay bitmap:
        0xFFFFFFFF 0xFFFFFFFF
    outbound esp sas:
      spi: 0x62241B76 (1646533494)
         transform: esp-aes esp-sha-hmac no compression
         in use settings ={RA, Tunnel, }
         slot: 0, conn_id: 327680, crypto-map: SYSTEM_DEFAULT_CRYPTO_MAP
         sa timing: remaining key lifetime (sec): 28674
         IV size: 16 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x00000001

    Crypto map tag: SYSTEM_DEFAULT_CRYPTO_MAP, seq num: 65535, local addr: 2.2.2.2

      local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
      remote ident (addr/mask/prot/port): (10.1.20.4/255.255.255.255/0/0)
      current_peer: 74.138.171.237, username: cbulmahn
      dynamic allocated peer ip: 10.1.20.4

      #pkts encaps: 832, #pkts encrypt: 832, #pkts digest: 832
      #pkts decaps: 620, #pkts decrypt: 620, #pkts verify: 620
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 832, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 2.2.2.2, remote crypto endpt.: 74.138.171.237

      path mtu 1500, ipsec overhead 74, media mtu 1500
      current outbound spi: 64CD5FBE

    inbound esp sas:
      spi: 0xCDFCE528 (3455903016)
         transform: esp-aes esp-sha-hmac no compression
         in use settings ={RA, Tunnel, }
         slot: 0, conn_id: 311296, crypto-map: SYSTEM_DEFAULT_CRYPTO_MAP
         sa timing: remaining key lifetime (sec): 28613
         IV size: 16 bytes
         replay detection support: Y
Anti replay bitmap:
        0xFFFFFFFF 0xFFFFFFFF
    outbound esp sas:
      spi: 0x64CD5FBE (1691180990)
         transform: esp-aes esp-sha-hmac no compression
         in use settings ={RA, Tunnel, }
         slot: 0, conn_id: 311296, crypto-map: SYSTEM_DEFAULT_CRYPTO_MAP
         sa timing: remaining key lifetime (sec): 28613
         IV size: 16 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x00000001

    Crypto map tag: vpnmap, seq num: 10, local addr: 2.2.2.2

      access-list sg-vpn permit ip 192.168.100.0 255.255.255.0 192.168.0.0 255.255.192.0
      local ident (addr/mask/prot/port): (192.168.100.0/255.255.255.0/0/0)
      remote ident (addr/mask/prot/port): (192.168.0.0/255.255.192.0/0/0)
      current_peer: 1.1.1.1

      #pkts encaps: 5228, #pkts encrypt: 5228, #pkts digest: 5228
      #pkts decaps: 5246, #pkts decrypt: 5246, #pkts verify: 5246
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 5229, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 2.2.2.2, remote crypto endpt.: 1.1.1.1

      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: 3200F1CB

    inbound esp sas:
      spi: 0x10DEE5CE (283043278)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 319488, crypto-map: vpnmap
         sa timing: remaining key lifetime (kB/sec): (4373446/28613)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0xFFFFFFFF 0xFFFFFFFF
    outbound esp sas:
      spi: 0x3200F1CB (838922699)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 319488, crypto-map: vpnmap
         sa timing: remaining key lifetime (kB/sec): (4373496/28613)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x00000001

    Crypto map tag: vpnmap, seq num: 10, local addr: 2.2.2.2
             
      access-list sg-vpn permit ip 192.168.111.0 255.255.255.0 192.168.0.0 255.255.192.0
      local ident (addr/mask/prot/port): (192.168.111.0/255.255.255.0/0/0)
      remote ident (addr/mask/prot/port): (192.168.0.0/255.255.192.0/0/0)
      current_peer: 1.1.1.1

      #pkts encaps: 321, #pkts encrypt: 321, #pkts digest: 321
      #pkts decaps: 296, #pkts decrypt: 296, #pkts verify: 296
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 321, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 2.2.2.2, remote crypto endpt.: 1.1.1.1

      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: EC77AF32

    inbound esp sas:
      spi: 0x16C7E578 (382199160)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 319488, crypto-map: vpnmap
         sa timing: remaining key lifetime (kB/sec): (4373950/28636)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0xFFFFFFFF 0xFFFFFFFF
    outbound esp sas:
      spi: 0xEC77AF32 (3967266610)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 319488, crypto-map: vpnmap
         sa timing: remaining key lifetime (kB/sec): (4373936/28636)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x00000001

    Crypto map tag: vpnmap, seq num: 10, local addr: 2.2.2.2

      access-list sg-vpn permit ip 192.168.112.0 255.255.240.0 192.168.0.0 255.255.192.0
      local ident (addr/mask/prot/port): (192.168.112.0/255.255.240.0/0/0)
      remote ident (addr/mask/prot/port): (192.168.0.0/255.255.192.0/0/0)
      current_peer: 1.1.1.1

      #pkts encaps: 2910, #pkts encrypt: 2910, #pkts digest: 2910
      #pkts decaps: 3794, #pkts decrypt: 3794, #pkts verify: 3794
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 2996, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 2.2.2.2, remote crypto endpt.: 1.1.1.1

      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: EEDD3278

    inbound esp sas:
      spi: 0x9FAA12E6 (2678723302)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 319488, crypto-map: vpnmap
         sa timing: remaining key lifetime (kB/sec): (4370659/28610)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0xFFFFFFFF 0xFFFFFFFF
    outbound esp sas:
      spi: 0xEEDD3278 (4007473784)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 319488, crypto-map: vpnmap
         sa timing: remaining key lifetime (kB/sec): (4373556/28610)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x00000001

    Crypto map tag: vpnmap, seq num: 10, local addr: 2.2.2.2

      access-list sg-vpn permit ip 192.168.128.0 255.255.224.0 192.168.0.0 255.255.192.0
      local ident (addr/mask/prot/port): (192.168.128.0/255.255.224.0/0/0)
      remote ident (addr/mask/prot/port): (192.168.0.0/255.255.192.0/0/0)
      current_peer: 1.1.1.1

      #pkts encaps: 3034, #pkts encrypt: 3034, #pkts digest: 3034
      #pkts decaps: 3748, #pkts decrypt: 3748, #pkts verify: 3748
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 3034, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 2.2.2.2, remote crypto endpt.: 1.1.1.1

      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: D1F3CBED

    inbound esp sas:
      spi: 0x7C688B5D (2087226205)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 319488, crypto-map: vpnmap
         sa timing: remaining key lifetime (kB/sec): (4370712/28609)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0xFFFFFFFF 0xFFFFFFFF
    outbound esp sas:
      spi: 0xD1F3CBED (3522415597)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 319488, crypto-map: vpnmap
         sa timing: remaining key lifetime (kB/sec): (4373429/28609)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x00000001

NM-ASA#

QSRCORPFW# sho crypto isakmp sa

   Active SA: 2
    Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 2

1   IKE Peer: 3.3.3.3
    Type    : L2L             Role    : initiator
    Rekey   : no              State   : MM_ACTIVE
2   IKE Peer: 2.2.2.2
    Type    : L2L             Role    : responder
    Rekey   : no              State   : MM_ACTIVE

QSRCORPFW# sho crypto ipsec sa
interface: WAN
    Crypto map tag: outside_map, seq num: 1, local addr: 1.1.1.1

      access-list PEAK10VPN permit ip 192.168.0.0 255.255.192.0 172.16.0.0 255.255.255.0
      local ident (addr/mask/prot/port): (192.168.0.0/255.255.192.0/0/0)
      remote ident (addr/mask/prot/port): (172.16.0.0/255.255.255.0/0/0)
      current_peer: 3.3.3.3

      #pkts encaps: 2162, #pkts encrypt: 2162, #pkts digest: 2162
      #pkts decaps: 1761, #pkts decrypt: 1761, #pkts verify: 1761
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 2162, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 1.1.1.1, remote crypto endpt.: 3.3.3.3

      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: BDC6A8EE

    inbound esp sas:
      spi: 0x966B78C0 (2523625664)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 6328320, crypto-map: outside_map
         sa timing: remaining key lifetime (kB/sec): (3914547/28485)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0xFFFFFFFF 0xFFFFFFFF
    outbound esp sas:
      spi: 0xBDC6A8EE (3183913198)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 6328320, crypto-map: outside_map
         sa timing: remaining key lifetime (kB/sec): (3914652/28485)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x00000001

    Crypto map tag: outside_dyn_map, seq num: 20, local addr: 1.1.1.1

      local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
      remote ident (addr/mask/prot/port): (10.1.10.6/255.255.255.255/0/0)
      current_peer: 74.128.145.69, username: administrator
      dynamic allocated peer ip: 10.1.10.6

      #pkts encaps: 10, #pkts encrypt: 10, #pkts digest: 10
      #pkts decaps: 16, #pkts decrypt: 16, #pkts verify: 16
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 10, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 1.1.1.1, remote crypto endpt.: 74.128.145.69

      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: 0ED4D561

    inbound esp sas:
      spi: 0x70133356 (1880306518)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={RA, Tunnel, }
         slot: 0, conn_id: 6332416, crypto-map: outside_dyn_map
         sa timing: remaining key lifetime (sec): 28521
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x0001FFFF
    outbound esp sas:
      spi: 0x0ED4D561 (248829281)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={RA, Tunnel, }
         slot: 0, conn_id: 6332416, crypto-map: outside_dyn_map
         sa timing: remaining key lifetime (sec): 28508
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x00000001

    Crypto map tag: outside_map, seq num: 2, local addr: 1.1.1.1

      access-list outside_2_cryptomap permit ip 192.168.0.0 255.255.192.0 192.168.111.0 255.255.255.0
      local ident (addr/mask/prot/port): (192.168.0.0/255.255.192.0/0/0)
      remote ident (addr/mask/prot/port): (192.168.111.0/255.255.255.0/0/0)
      current_peer: 2.2.2.2

      #pkts encaps: 350, #pkts encrypt: 350, #pkts digest: 350
      #pkts decaps: 379, #pkts decrypt: 379, #pkts verify: 379
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 350, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0
             
      local crypto endpt.: 1.1.1.1, remote crypto endpt.: 2.2.2.2

      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: 16C7E578

    inbound esp sas:
      spi: 0xEC77AF32 (3967266610)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 6324224, crypto-map: outside_map
         sa timing: remaining key lifetime (kB/sec): (3914923/28493)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0xFFFFFFFF 0xFFFFFFFF
    outbound esp sas:
      spi: 0x16C7E578 (382199160)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 6324224, crypto-map: outside_map
         sa timing: remaining key lifetime (kB/sec): (3914939/28493)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x00000001

    Crypto map tag: outside_map, seq num: 2, local addr: 1.1.1.1

      access-list outside_2_cryptomap permit ip 192.168.0.0 255.255.192.0 192.168.112.0 255.255.240.0
      local ident (addr/mask/prot/port): (192.168.0.0/255.255.192.0/0/0)
      remote ident (addr/mask/prot/port): (192.168.112.0/255.255.240.0/0/0)
      current_peer: 2.2.2.2

      #pkts encaps: 5270, #pkts encrypt: 5270, #pkts digest: 5270
      #pkts decaps: 4314, #pkts decrypt: 4314, #pkts verify: 4314
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 5270, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 1.1.1.1, remote crypto endpt.: 2.2.2.2

      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: 9FAA12E6

    inbound esp sas:
      spi: 0xEEDD3278 (4007473784)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 6324224, crypto-map: outside_map
         sa timing: remaining key lifetime (kB/sec): (3914358/28463)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0xFFFFFFFF 0xFFFFFFFF
    outbound esp sas:
      spi: 0x9FAA12E6 (2678723302)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 6324224, crypto-map: outside_map
         sa timing: remaining key lifetime (kB/sec): (3911355/28463)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x00000001

    Crypto map tag: outside_map, seq num: 2, local addr: 1.1.1.1

      access-list outside_2_cryptomap permit ip 192.168.0.0 255.255.192.0 192.168.100.0 255.255.255.0
      local ident (addr/mask/prot/port): (192.168.0.0/255.255.192.0/0/0)
      remote ident (addr/mask/prot/port): (192.168.100.0/255.255.255.0/0/0)
      current_peer: 2.2.2.2

      #pkts encaps: 11323, #pkts encrypt: 11323, #pkts digest: 11323
      #pkts decaps: 11262, #pkts decrypt: 11262, #pkts verify: 11262
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 11323, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 1.1.1.1, remote crypto endpt.: 2.2.2.2

      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: 10DEE5CE

    inbound esp sas:
      spi: 0x3200F1CB (838922699)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 6324224, crypto-map: outside_map
         sa timing: remaining key lifetime (kB/sec): (3914033/28461)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0xFFFFFFFF 0xFFFFFFFF
    outbound esp sas:
      spi: 0x10DEE5CE (283043278)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 6324224, crypto-map: outside_map
         sa timing: remaining key lifetime (kB/sec): (3913939/28459)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x00000001

    Crypto map tag: outside_map, seq num: 2, local addr: 1.1.1.1

      access-list outside_2_cryptomap permit ip 192.168.0.0 255.255.192.0 192.168.128.0 255.255.224.0
      local ident (addr/mask/prot/port): (192.168.0.0/255.255.192.0/0/0)
      remote ident (addr/mask/prot/port): (192.168.128.0/255.255.224.0/0/0)
      current_peer: 2.2.2.2

      #pkts encaps: 4206, #pkts encrypt: 4206, #pkts digest: 4206
      #pkts decaps: 3490, #pkts decrypt: 3490, #pkts verify: 3490
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 4206, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 1.1.1.1, remote crypto endpt.: 2.2.2.2

      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: 7C688B5D

    inbound esp sas:
      spi: 0xD1F3CBED (3522415597)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 6324224, crypto-map: outside_map
         sa timing: remaining key lifetime (kB/sec): (3914326/28457)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0xFFFFFFFF 0xFFFFFFFF
    outbound esp sas:
      spi: 0x7C688B5D (2087226205)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 6324224, crypto-map: outside_map
         sa timing: remaining key lifetime (kB/sec): (3911559/28457)
         IV size: 8 bytes
         replay detection support: Y
Anti replay bitmap:
        0x00000000 0x00000001

QSRCORPFW#




0 Helpful

Mohammad Alhyari
Cisco Employee
Cisco Employee

‎09-10-2011 01:13 PM

Hey ,

jennifer have explained everything , and if you have anything like :

nat (outside) 1 0.0.0.0 0.0.0.0 or nat (outside) 1 remote access-pool

then you need to add this :

access-;ist ra-l2l permit ip vpn-pool [subnets behined the remote l2l subnets]

static(outside,outside) vpn-pool access-list ra-l2l

cheers!

0 Helpful
Customers Also Viewed These Support Documents