Site to Site VPN - ACL required

[GRANT3779]

Hi All,

I've configured a S2S VPN and created the ACL for the "interesting traffic".

So, on my VPN router, do I need another access list - or if I try to reach the "interesting" subnets is the Crypto ACL automatically called/used? I've done all the crypto stuff but unsure as what is required ACL wise, ontop of my "interesting" ACL.

If I do a trace to one of my "interesting" subnets, it looks to be going through my default gateway, instead of trying to use the PEER address.

Am I missing something?

Thanks

[sb1mpo]

You have a NAT issue.  You have to have another ACL which doesn't NAT the interesting traffic range.

Simon

[GRANT3779]

Hi,

I don't actually have NAT setup as the interface is just for the S2S VPN, not using NAT at all... or do I need to enable NAT for the VPN to work?

Also, unsure if I need an incoming access list to allow the remote subnet into my Outside interface. If I don't have this,will it be allowed by default? e.g, if no incoming ACL is applied, does this mean all/any traffic can enter?

[sb1mpo]

Ok, what is doing the VPN?

Router/ASA?

Can you paste all the crypto config (except passwords) and any NAT config and the relevant ACL's for me?

Jill

[Andrew Phirsov · Accepted solution]

 I've done all the crypto stuff but unsure as what is required ACL wise, ontop of my "interesting" ACL.

ACL wise nothing else is required. IKE exchange will be triggered as soon as traffic falls into crypto-ACL list (wich, I assume, u've defined). As for routing, u should have a route towards the remote subnet (second part of your proxy-acl), through the interface on wich you've got crypto-map applied. That might be the default route, or some specific one for the remote subnet.

[GRANT3779]

Hi Guys,

Below is the crypto config.

crypto isakmp policy 5

encr aes 256

hash md5

authentication pre-share

group 2

crypto isakmp key testvpn address 2.2.2.2

!

!

crypto ipsec transform-set TestTS esp-3des esp-md5-hmac

!

crypto map TestCMAP 5 ipsec-isakmp

set peer 2.2.2.2
set transform-set TestTS

match address interestingtraffic

ip access-list extended interestingtraffic

permit ip 10.10.10.0 0.0.0.255 20.20.20.0 0.0.0.255

I have the following routes setup.

ip route 0.0.0.0 0.0.0.0 10.10.10.1

ip route 2.2.2.2 255.255.255.255 1.1.1.1

1.1.1.1 - is my outside interface. I have Inside interface on 10.10.10.0 network..

[sb1mpo]

1.1.1.1 is your outside interface? 

Pls change this IP to the next hop IP.  Can you send me a show int for the outside and inside pls?

[GRANT3779]

Yeah 1.1.1.1 is my outside int (i've just amended addresses to mask real ones).

Sorry, for the ip route I have

ip route 2.2.2.2 255.255.255.255 1.1.1.2

interface FastEthernet0/0

description ***Outside***

ip address 1.1.1.1 255.255.255.0

duplex auto

speed auto

crypto map TestCMAP

interface FastEthernet0/1

ip address 10.10.10.2 255.255.255.0

duplex auto

speed auto

[sb1mpo]

Ok it all looks good to me, whats your problem? can you give a trace to a host on 20.20.20.0 from a client on 10.10.10.0.

What trace are you referring to?  A trace on from your router, you need to specifiy the source address as the inside if thats what your doing!

Simon

[Rudy Sanjoko · Accepted solution]

Is 20.x.x.x network located in your inside network or is it a remote/external network? This ip route 0.0.0.0 0.0.0.0 10.10.10.1 command will tell the router if you try to reach 20.x.x.x network, use 10.10.10.1 as your next hop ip which is your "inside" network.

[GRANT3779]

20.x.x.x is the other end of the VPN. I want to go from Site A (10.10.10.0 network) to Site B (20.20.20.0 network). Traffic should go over IPSEC tunnel.

So does my Default Gateway get used before the Crypto ACL?

I thought I need this Default Gateway, so I can route my non VPN traffic elsewhere? Any ideas where I'm going wrong?

When tracing route to the subnet on opposite end of VPN it goes to my Default Gateway instead of using VPN tunnel see below.

Protocol [ip]:

Target IP address: 20.20.20.20

Source address: 10.10.10.2

Numeric display [n]:

Timeout in seconds [3]:

Probe count [3]:

Minimum Time to Live [1]:

Maximum Time to Live [30]:

Port Number [33434]:

Loose, Strict, Record, Timestamp, Verbose[none]:

Type escape sequence to abort.

Tracing the route to 20.20.20.20

  1 10.10.10.1 44 msec 8 msec 0 msec

[GRANT3779]

Hi Rudy,

What should I have in place of this then? I need anything trying to get to the 20.20.20.0 network to use the VPN..

[Rudy Sanjoko]

try following command instead: ip route 0.0.0.0 0.0.0.0 1.1.1.2

Don't forget to configure the other side and mirror the "interesting traffic" access list to make sure you have traffic coming back from the other side.

To make things easier, try to check your basic connectivity between two sites before configuring the vpn then you know it is not a vpn issue.

[sb1mpo · Accepted solution]

Rudy is correct, the order of operations on an interface is as follows;

• If IPSec, then check input access list
  
• Decryption—for Cisco Encryption Technology (CET) or IPSec
  
• Check input access list
  
• Check input rate limits
  
• Input accounting
  
• Policy routing
  
• Routing
  
• Redirect to Web cache
  
• NAT inside to outside (local to global translation)
  
• Crypto (check map and mark for encryption)
  
• Check output access list
  
• Inspect context-based access control (CBAC)
  
• TCP intercept
  
• Encryption
  

To me it looks as though your packet is being routed out of the inside interface by the ASA before it can continue processing down the list. 

You could try a recursive lookup with the following;

ip route 20.20.20.0 255.255.255.255 2.2.2.2

This will lookup the route for 2.2.2.2 on your ASA and point to the next hop of 1.1.1.2

Try it!

[sb1mpo]

Should have read;

Ip route 20.20.20.0 255.255.255.0 2.2.2.2

Jill