site to site between ASA 5510 (8.4(2)) w/ static IP and Dlink DIR130 w/ dynamic IP.

[sean.a.murphy]

I'm trying to set up a site to site VPN link between the ASA5510 that we use exclusively as a VPN endpoint on campus and a D-Link DIR130 VPN Router off campus, at a local business with a dynamically assigned IP.  We currently use the ASA for remote access users who use the Cisco VPN client on mobile devices, as well as for a single site to site link to our telecom provider for the purposes of monitoring telecom equipment remotely.

We are looking for a way to cheaply deploy secure VPN connections to local businesses to allow them to use point of sale devices which connect back to systems on campus, so students can use their meal cards at local restaurants, similarly to how they use them at the on-campus cafeteria.

I have experience configuring Cisco switches, APs and routers, but this ASA device absolutely baffles me.  I've futzed around with the ASDM 6.4 gui config and tried to match up configurations between the DIR130 and the ASA, but I can never get a VPN connection to come up.  Anyone who can point me to an example, or provide me with help on this would be appreciated.  I've google searched and found very little that, with my limited experience in ASA configuration, I can apply to my scenario.

[sean.a.murphy]

The host behind the dlink has IP 192.168.5.100. 

Pardon my ignorance, but I am only used to dealing with VPN remote access clients, not site to site..  I know that remote-access clients (those using the Cisco VPN client) get assigned an ip from our pool of 131.162.64.0/24 (the VPN subnet), but I have no idea how site to site works in terms of routing and IPs assigned.

We use a Cisco 6509 as our internet facing router on campus, will I need to add configuration to that router to allow traffic to flow through this site to site?  I know that when Bell Aliant set up the other site to site we have on the ASA, they did not need to touch the 6509 to complete their configuration, so I assumed we wouldn't for this project, either.

Thank you for your patience in helping me with this. 

[Jennifer Halim · Accepted solution]

You would need to configure static route on the 6509 for 192.168.5.0/24 towards the ASA inside interface:

ip route 192.168.5.0 255.255.255.0 131.162.160.2

Assuming that 131.162.160.1 is your 6509

[sean.a.murphy]

well dog my cats.  there it goes.  Spectacular!

I can now access stuff on campus from behind the DLINK.  I have created a small web page on an on-campus server that spits out the IP you are coming from and it returns:

Your IP is: 192.168.5.100

Awesome.  Now, since they will ask, is there any way to absolutely ensure that this traffic is encrypted?

[Jennifer Halim · Accepted solution]

Excellent...

Yes, just check the output of "show cry ipsec sa peer ", and if you see the encrypts and decrypts counters increasing, you are all good.

[sean.a.murphy]

This has been one heck of a learning experience after a whole week of me bashing my head against the wall.. Thank you so much.

[Jennifer Halim]

No problem.. Thanks for the ratings

[sean.a.murphy]

One final question: 

If I wanted to set up a second DLINK elsewhere, can I just do:

object network remote-VPN<-incrementing-number>

  subnet 192.168..0 255.255.255.0

nat (inside,outside) source static local-VPN local-VPN destination static remote-VPN<-number> remote-VPN<-number>

and add another line on the 6509:

ip route 192.168..0 255.255.255.0 131.162.160.2

Then duplicate the config from this DLINK box to another one, changing only the private network number to match the new lines of config?

[Jennifer Halim · Accepted solution]

You got it, spot on!!

[sean.a.murphy]

perfect.  If you're not a cisco trainer, you should be.

[sean.a.murphy]

You thought you were done with me, I bet!

One really final question.. The connection between the DLINK and our ASA seems to not stay up permanently.  The point of sale equipment on the DLINK side will lose connection, and i have to restart it, or try a few transactions that fail, and then link will eventually come back up.

Is there a way on the ASA side to force it to stay up, or some such thing?  The Dead Peer Detection and Keepalives on the dlink side don't appear enough, or else I have to enable it on the ASA side as well.

[Jennifer Halim]

Since keepalive between different third party product is not supported, pls turn off keepalive on both end.

On your DLINK, choose None for Keepalive/DPD.

Also, your lifetime is set to 3600 seconds, so if you want to lengthen it on both end, it can stay longer, or alternatively you can run continous ping to keep the VPN tunnel up all the time. There needs to be traffic through the tunnel after the lifetime expired to keep the tunnel up and reset the timer, otherwise, after 3600 seconds, if there is no traffic, it will tear down the vpn tunnel until you initiate the tunnel again.

[sean.a.murphy]

I've disabled keepalives on both ends..  I've increased the lifetime on the dlink to 7200 (the max it allows).  Can you give me some tips on how to change it on the ASA? 

Can I have something on-campus set up to ping the off campus Point of Sale devices behind their dlink ends to keep the tunnels up? 

[Jennifer Halim]

On the ASA, pls configure the following:

no crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime seconds 28800

no crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime kilobytes 4608000

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime seconds 7200

Yes, you can setup ping from your campus towards the POS devices, however, the VPN tunnel needs to be initiated from the DLINK end. Once the tunnel is established, ping from campus towards POS will keep the tunnel up.

[sean.a.murphy]

Are you sure?  The DLINK has settings for both IKE Lifetime (28800) and IPSec Lifetime (7200).  When I ran those commands the tunnel went down and hasn't come back up.

[sean.a.murphy]

disregard, it just came back up.. but please confirm that those settings change the correct lifetime.