Site to Site VPN Configuration - Refresher

[Jackong]

Good day!
I've been trying to refresh and practicing site to site configuration but i have some issues which i still cannot ping Host B from Host A

below is my configuration from Router4 to R5-2, by the way in between R4 to R5-2 is connected thru OSPF

Router4

crypto isakmp policy 1
encr aes
authentication pre-share
group 5
!
crypto isakmp key jason address 172.16.60.2
!
!
!
crypto ipsec transform-set SITE_OFFICE esp-aes esp-sha-hmac
!
crypto map SITE_MAP 10 ipsec-isakmp
set peer 172.16.60.2
set transform-set SITE_OFFICE
match address NAT_LAN
!
!
spanning-tree mode pvst
!
interface GigabitEthernet0/0/0
ip address 172.16.10.2 255.255.255.252
ip nat outside
duplex auto
speed auto
crypto map SITE_MAP
!
interface GigabitEthernet0/0/1
ip address 10.10.10.1 255.255.255.0
ip nat inside
duplex auto
speed auto
!
interface GigabitEthernet0/0/2
no ip address
duplex auto
speed auto
shutdown
!
interface Vlan1
no ip address
shutdown
!
ip nat inside source list NAT_LAN interface GigabitEthernet0/0/0 overload
ip classless
ip route 0.0.0.0 0.0.0.0 172.16.10.1
!
ip flow-export version 9
!
!
ip access-list extended NAT_LAN
permit ip 10.10.10.0 0.0.0.255 20.20.20.0 0.0.0.255
permit ip 10.10.10.0 0.0.0.255 any

Router4#sh cry isa sa
IPv4 Crypto ISAKMP SA
dst src state conn-id slot status
172.16.60.2 172.16.10.2 QM_IDLE 1066 0 ACTIVE (deleted)

R5-2

crypto isakmp policy 1
encr aes
authentication pre-share
group 5
!
crypto isakmp key jason address 172.16.10.2
!
!
!
crypto ipsec transform-set HQ_OFFICE esp-aes esp-sha-hmac
!
crypto map HQ_MAP 10 ipsec-isakmp
set peer 172.16.10.2
set transform-set HQ_OFFICE
match address HQ_OFFICE
!
spanning-tree mode pvst
!
!
interface GigabitEthernet0/0/0
ip address 172.16.60.2 255.255.255.252
ip nat outside
duplex auto
speed auto
crypto map HQ_MAP
!
interface GigabitEthernet0/0/1
ip address 20.20.20.1 255.255.255.0
ip nat inside
duplex auto
speed auto
!
interface GigabitEthernet0/0/2
no ip address
duplex auto
speed auto
shutdown
!
interface Vlan1
no ip address
shutdown
!
ip nat inside source list HQ_OFFICE interface GigabitEthernet0/0/0 overload
ip classless
ip route 0.0.0.0 0.0.0.0 172.16.60.1
!
ip flow-export version 9
!
!
ip access-list extended HQ_OFFICE
permit ip 20.20.20.0 0.0.0.255 10.10.10.0 0.0.0.255
permit ip 20.20.20.0 0.0.0.255 any

R5-2#sh cry isa sa
IPv4 Crypto ISAKMP SA
dst src state conn-id slot status
172.16.10.2 172.16.60.2 QM_IDLE 1096 0 ACTIVE (deleted)

 

[marce1000]

 - The reason why you cannot ping Host B from Host A is because the IKEv2 SA is not active. The output of the sh cry isa sa command on both routers shows that the SAs are in the QM_IDLE state, which means that they have been created but not yet activated.

There are a few possible reasons why the SAs are not active:

The pre-shared key is incorrect.
The IP addresses of the routers are incorrect.
The NAT configurations are incorrect.
The OSPF configuration is incorrect.

To troubleshoot this issue, you can try the following:
         (check logs on both routers when vpn-connection attempt is made and or after link setup)

Verify the pre-shared key on both routers.
Verify the IP addresses of the routers.
Verify the NAT configurations on both routers.
Verify the OSPF configuration.

If you have verified all of these things and the SAs are still not active, then you can try restarting the IPSec process on both routers.

Here are the commands to restart the IPSec process on Router4:

crypto isakmp restart
crypto ipsec restart

And here are the commands to restart the IPSec process on R5-2:

crypto isakmp restart
crypto ipsec restart

Once you have restarted the IPSec process, the SAs should be activated and you should be able to ping Host B from Host A.

Here are some additional things to keep in mind:

The pre-shared key must be the same on both routers.
The IP addresses of the routers must be reachable from each other.
The NAT configurations must be correct for the traffic that you want to tunnel.
The OSPF configuration must be correct for the routers to be able to communicate with each other.

 M.

[Jackong]

I have changed some configuration from the Access List from both routers and got this result

Router4
ip access-list extended NAT_LAN
permit ip 10.10.10.0 0.0.0.255 20.20.20.0 0.0.0.255
deny ip host 10.10.10.0 any

R5
ip access-list extended HQ_OFFICE
permit ip 20.20.20.0 0.0.0.255 10.10.10.0 0.0.0.255
deny ip 20.20.20.0 0.0.0.255 any

Router4#sh cry isa sa
IPv4 Crypto ISAKMP SA
dst src state conn-id slot status
172.16.60.2 172.16.10.2 QM_IDLE 1044 0 ACTIVE (deleted) 

R5-2#sh cry isa sa
IPv4 Crypto ISAKMP SA
dst src state conn-id slot status
172.16.10.2 172.16.60.2 QM_IDLE 1022 0 ACTIVE (deleted)

but still i am not able to ping the Host B from Host A vice versa

[Rob Ingram · Accepted solution]

@Jackong you need to explictly deny the VPN traffic between the local network and the remote network in the NAT ACL, otherwise the traffic will be translated (overload) behind Gi0/0/0. Use separate ACL to match the NAT traffic and another for the crypto ACL to match the interesting traffic to be encrypted.

Mirror this configuration on the other router.

[Jackong]

Good day!

I already found what is the mistake with my config which previously I am using the same NAT traffic to crypto map. I've created separate ACL for NAT only and deny the traffic from host A to Host B then create ACL for VPN traffic only pointing from host A subnet to Host B subnet.

Thank you all for your suggestion