Site to site VPN issues

[adleveritt]

Hello, I am having an issue with my VPN setup. I have two locations each with it's own subnett. I have a site to site VPN between the two locations. The site to site VPN is up and fully functional with no issues. Now if I am away from work and connect with the VPN client to site A, I cannot ping or connect to anything at site B. Or if I am connected to site B through a VPN I cannot ping or connect to anything at site A. 

Hopefully this makes sense but I will be glad to give further details on the setup if necessary.

[matthewceroni]

Would need more information / configuration details. It could be ACLs, NAT rules, many many things. My guess would be a NAT identity / exempt rule. Since VPN clients connect from the outside, to get to site B they have to hairpin (so ensure that is enabled on the outside interface) and go right back out the outside interface.

If you have a general NAT rule for outside interface then you want to identity NAT that VPN client traffic so that it doesn't get NATed.

You also have to ensure you have your cryto maps setup correctly to allow VPN client traffic to traverse the VPN tunnel.

Lots of areas to look at.

[adleveritt]

Here is a copy of my config file from the ASA.

SiteAasa# show run

: Saved

:

ASA Version 8.4(4)5

!

hostname SiteAasa

domain-name domain.local

enable password encrypted

passwd encrypted

names

name 192.168.10.0 SiteB

!

interface Ethernet0/0

description Comcast MetroE

speed 1000

duplex full

nameif outside

security-level 0

ip address 90.160.254.60 255.255.255.0

!

interface Ethernet0/1

nameif inside

security-level 100

ip address 192.168.166.1 255.255.255.252

!

interface Ethernet0/2

description DSL

nameif secondary

security-level 0

ip address 10.10.10.1 255.255.255.252

!

interface Ethernet0/3

shutdown

no nameif

no security-level

no ip address

!

interface Management0/0

nameif management

security-level 100

ip address 192.168.1.1 255.255.255.0

management-only

!

regex domainblock "facebook\.com"

banner login This system is for the use of authorized users only.

banner login Individuals using this computer system without authority, or in

banner login excess of their authority, are subject to having all of their

banner login activities on this system monitored and recorded by system personnel.

banner login

banner login In the course of monitoring individuals improperly using this

banner login system, or in the course of system maintenance, the activities

banner login of authorized users may also be monitored.

banner login

banner login Anyone using this system expressly consents to such monitoring

banner login and is advised that if such monitoring reveals possible

banner login evidence of criminal activity, system personnel may provide the

banner login evidence of such monitoring to law enforcement officials.

banner asdm This system is for the use of authorized users only.

banner asdm Individuals using this computer system without authority, or in

banner asdm excess of their authority, are subject to having all of their

banner asdm activities on this system monitored and recorded by system personnel.

banner asdm

banner asdm In the course of monitoring individuals improperly using this

banner asdm system, or in the course of system maintenance, the activities

banner asdm of authorized users may also be monitored.

banner asdm

banner asdm Anyone using this system expressly consents to such monitoring

banner asdm and is advised that if such monitoring reveals possible

banner asdm evidence of criminal activity, system personnel may provide the

banner asdm evidence of such monitoring to law enforcement officials.

boot system disk0:/asa844-5-k8.bin

ftp mode passive

clock timezone EST -5

clock summer-time EDT recurring

dns domain-lookup outside

dns domain-lookup inside

dns server-group DefaultDNS

name-server 192.168.16.18

name-server 192.168.16.19

name-server 192.168.16.10

domain-name domain.local

dns server-group Internet

name-server 209.221.42.253

name-server 209.82.185.253

name-server 4.2.2.2

dns server-group Metro

name-server 209.221.42.253

name-server 209.82.185.253

same-security-traffic permit inter-interface

object network SITEB_Subnet_192.168.10.0

subnet 192.168.10.0 255.255.255.0

object network SITEB_VPN_USERS_Subnet_10.10.99.0

subnet 10.10.99.0 255.255.255.0

object network SITEA_VPN_USERS_Subnet_10.10.98.0

subnet 10.10.98.0 255.255.255.0

object network SITEC_Subnet_192.168.14.0

subnet 192.168.14.0 255.255.255.0

object network NETWORK_OBJ_10.10.98.0_25

subnet 10.10.98.0 255.255.255.128

object network NETWORK_OBJ_192.168.16.0_24

subnet 192.168.0.0 255.255.0.0

object network SITEA_OUTSIDE_INTERFACE

host 90.160.254.60

object network SITEA_Outlook_192.168.16.12

host 192.168.16.12

object service https

service tcp source eq https destination eq https

object network SITEA_192.168.16.14

host 192.168.16.14

object service smtp

service tcp source eq smtp destination eq smtp

object network SITEA_Subnet_192.168.16.0

subnet 192.168.16.0 255.255.255.0

object network 192.168.144.0

subnet 192.168.144.0 255.255.255.0

object network 192.168.166.0

subnet 192.168.166.0 255.255.255.0

object network OBJ-interface

object network OBJ-tcp

object network obj-192.168.16.12

host 192.168.16.12

object network obj-192.168.16.14

host 192.168.16.14

object network obj-any

subnet 0.0.0.0 0.0.0.0

object network 192.168.100.0

subnet 192.168.100.0 255.255.255.0

object network NETWORK_OBJ_192.168.10.0_24

subnet 192.168.10.0 255.255.255.0

object network VNET_192.168.20.0

subnet 192.168.20.0 255.255.255.0

object network WirelessSubnet_10.55.77.0

subnet 10.55.77.0 255.255.255.0

object network SiteCGRE

host 192.168.144.2

object network ISCSI_SiteB_10.1.100.0

subnet 10.1.100.0 255.255.255.0

object network ISCSI_SiteA_10.1.21.0

subnet 10.1.21.0 255.255.255.0

object-group network DM_INLINE_NETWORK_1

network-object 192.168.16.0 255.255.255.0

network-object object SITEA_VPN_USERS_Subnet_10.10.98.0

network-object object 192.168.144.0

network-object object 192.168.166.0

network-object object WirelessSubnet_10.55.77.0

network-object object SITEC_Subnet_192.168.14.0

network-object object VNET_192.168.20.0

network-object object ISCSI_SiteA_10.1.21.0

object-group network DM_INLINE_NETWORK_2

network-object object SITEB_Subnet_192.168.10.0

network-object object SITEB_VPN_USERS_Subnet_10.10.99.0

network-object object 192.168.100.0

network-object object ISCSI_SiteB_10.1.100.0

object-group network DM_INLINE_NETWORK_3

network-object 192.168.16.0 255.255.255.0

network-object object SITEB_Subnet_192.168.10.0

network-object object SITEB_VPN_USERS_Subnet_10.10.99.0

network-object object SITEA_Subnet_192.168.16.0

network-object object SITEA_VPN_USERS_Subnet_10.10.98.0

object-group service DM_INLINE_UDP_1 udp

port-object eq snmp

port-object eq snmptrap

object-group service DM_INLINE_UDP_2 udp

port-object eq snmp

port-object eq snmptrap

object-group service DM_INLINE_SERVICE_1

service-object object smtp

service-object tcp destination eq smtp

object-group network GRETunnel

network-object host 192.168.144.2

object-group network GRETunnelLocal

network-object host 192.168.166.2

object-group network GRETunnelSiteB

network-object host 192.168.100.2

access-list outside_cryptomap extended permit ip object-group DM_INLINE_NETWORK_1 object-group DM_IN

LINE_NETWORK_2

access-list vpndomain_splitTunnelAcl standard permit 192.168.16.0 255.255.255.0

access-list vpndomain_splitTunnelAcl standard permit 192.168.0.0 255.255.0.0

access-list vpndomain_splitTunnelAcl standard permit 10.0.0.0 255.0.0.0

access-list vpndomain_splitTunnelAcl standard permit 192.168.14.0 255.255.255.0

access-list outside_cryptomap_10 extended permit ip object-group GRETunnelLocal object-group GRETunn

el

access-list outside_cryptomap_10 extended permit gre object-group GRETunnelLocal object-group GRETun

nel

access-list inside_access_in extended permit ip any any

access-list inside_access_in extended permit ip any 192.168.0.0 255.255.0.0

access-list inside_access_in extended permit ip any 10.0.0.0 255.0.0.0

access-list inside_access_in extended permit udp any any object-group DM_INLINE_UDP_1

access-list inside_access_in extended permit tcp any any eq smtp

access-list inside_access_in extended permit icmp any any

access-list inside_access_in extended permit icmp any any unreachable

access-list inside_access_in extended permit icmp any any time-exceeded

access-list inside_access_in extended permit ospf interface inside host 192.168.166.2

access-list outside_access_in extended permit tcp any host 192.168.16.14 eq smtp

access-list outside_access_in extended permit tcp any host 192.168.16.12 eq https

access-list outside_access_in extended permit ip any any

access-list outside_access_in extended permit icmp any any

access-list outside_access_in extended permit ip any 192.168.0.0 255.255.0.0

access-list outside_access_in extended permit ip any 10.0.0.0 255.0.0.0

access-list outside_access_in extended permit udp any any object-group DM_INLINE_UDP_2

access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any any

access-list outside_access_in extended permit icmp any any time-exceeded

access-list outside_access_in extended permit icmp any any unreachable

access-list outside_access_in extended permit ospf interface inside host 192.168.166.2

access-list outside_access_in extended permit icmp any any echo-reply

access-list global_mpc extended permit ip any any

access-list domainipad_splitTunnelAcl standard permit 192.168.10.0 255.255.255.0

access-list domainipad_splitTunnelAcl standard permit 10.0.0.0 255.0.0.0

access-list domainipad_splitTunnelAcl standard permit 192.168.0.0 255.255.0.0

access-list domainipad_splitTunnelAcl standard permit 192.168.14.0 255.255.255.0

access-list test extended permit ip host 192.168.10.82 host 192.168.20.10

access-list test extended permit ip host 192.168.20.10 host 192.168.10.82

pager lines 30

logging enable

logging buffer-size 32768

logging asdm-buffer-size 512

logging console debugging

logging monitor debugging

logging buffered debugging

logging asdm debugging

no logging message 106015

no logging message 313001

no logging message 313008

no logging message 106023

no logging message 710003

no logging message 106100

no logging message 302015

no logging message 302014

no logging message 302013

no logging message 302018

no logging message 302017

no logging message 302016

no logging message 302021

no logging message 302020

flow-export destination inside 192.168.16.16 2055

flow-export template timeout-rate 10

mtu outside 1492

mtu inside 1500

mtu secondary 1500

mtu management 1500

ip local pool VPNusers 10.10.98.0-10.10.98.100 mask 255.255.255.0

no failover

icmp unreachable rate-limit 1 burst-size 1

icmp permit any outside

icmp permit any inside

asdm image disk0:/asdm-649-103.bin

no asdm history enable

arp timeout 14400

arp permit-nonconnected

nat (inside,outside) source static DM_INLINE_NETWORK_1 DM_INLINE_NETWORK_1 destination static DM_INL

INE_NETWORK_2 DM_INLINE_NETWORK_2 no-proxy-arp route-lookup

nat (inside,outside) source static NETWORK_OBJ_192.168.16.0_24 NETWORK_OBJ_192.168.16.0_24 destinati

on static NETWORK_OBJ_10.10.98.0_25 NETWORK_OBJ_10.10.98.0_25 no-proxy-arp route-lookup

nat (inside,outside) source static DM_INLINE_NETWORK_3 DM_INLINE_NETWORK_3 destination static SiteC_Subnet_192.168.14.0 SITEC_Subnet_192.168.14.0 no-proxy-arp route-lookup

nat (inside,outside) source static NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 destinati

on static NETWORK_OBJ_10.10.98.0_25 NETWORK_OBJ_10.10.98.0_25 no-proxy-arp route-lookup

nat (inside,outside) source static GRETunnelLocal GRETunnelLocal destination static GRETunnel GRETun

nel no-proxy-arp route-lookup

!

object network obj-192.168.16.12

nat (inside,outside) static interface service tcp https https

object network obj-192.168.16.14

nat (inside,outside) static interface service tcp smtp smtp

object network obj-any

nat (inside,outside) dynamic interface

access-group outside_access_in in interface outside

access-group inside_access_in in interface inside

route outside 0.0.0.0 0.0.0.0 68.170.255.254 1

route inside 10.1.21.0 255.255.255.0 192.168.166.2 1

route outside 10.1.100.0 255.255.255.0 68.170.255.254 1

route outside 10.10.98.0 255.255.255.0 68.170.255.254 1

route outside 10.10.99.0 255.255.255.0 68.170.255.254 1

route inside 10.55.77.0 255.255.255.0 192.168.166.2 1

route outside 94.10.72.52 255.255.255.255 68.170.255.254 1

route outside SiteB 255.255.255.0 40.120.2.25 1

route inside 192.168.14.0 255.255.255.0 192.168.166.2 1

route inside 192.168.16.0 255.255.255.0 192.168.166.2 1

route inside 192.168.20.0 255.255.255.0 192.168.166.2 1

route outside 192.168.100.0 255.255.255.0 40.120.2.25 1

route inside 192.168.144.0 255.255.255.0 192.168.166.2 1

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

aaa-server LDAP protocol ldap

aaa-server LDAP (inside) host 192.168.16.18

ldap-base-dn CN=Users,DC=domain,DC=local

ldap-group-base-dn CN=Users,DC=domain,DC=local

ldap-scope subtree

ldap-naming-attribute sAMAccountName

ldap-login-password *****

ldap-login-dn cn=administrator,CN=users,DC=domain,DC=local

server-type microsoft

user-identity default-domain LOCAL

aaa authentication enable console LOCAL

aaa authentication telnet console LOCAL

aaa authentication http console LOCAL

aaa authentication serial console LOCAL

aaa authentication ssh console LOCAL

http server enable 440

http 0.0.0.0 0.0.0.0 inside

http 0.0.0.0 0.0.0.0 outside

snmp-server host inside 192.168.16.16 community ***** version 2c

no snmp-server location

no snmp-server contact

snmp-server community *****

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec ikev2 ipsec-proposal AES256

protocol esp encryption aes-256

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal AES192

protocol esp encryption aes-192

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal AES

protocol esp encryption aes

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal 3DES

protocol esp encryption 3des

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal DES

protocol esp encryption des

protocol esp integrity sha-1 md5

crypto ipsec df-bit clear-df outside

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-1

28-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP

-DES-SHA ESP-DES-MD5

crypto map outside_map 1 match address outside_cryptomap

crypto map outside_map 1 set peer 40.120.2.25

crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP

-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

crypto map outside_map 10 match address outside_cryptomap_10

crypto map outside_map 10 set peer 94.10.72.52

crypto map outside_map 10 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ES

P-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map outside_map interface outside

crypto ikev2 policy 1

encryption aes-256

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 10

encryption aes-192

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 20

encryption aes

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 30

encryption 3des

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 40

encryption des

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 enable outside

crypto ikev2 enable inside

crypto ikev1 enable outside

crypto ikev1 enable inside

crypto ikev1 policy 10

authentication crack

encryption aes-256

hash sha

group 2

lifetime 86400

crypto ikev1 policy 20

authentication rsa-sig

encryption aes-256

hash sha

group 2

lifetime 86400

crypto ikev1 policy 30

authentication pre-share

encryption aes-256

hash sha

group 2

lifetime 86400

crypto ikev1 policy 40

authentication crack

encryption aes-192

hash sha

group 2

lifetime 86400

crypto ikev1 policy 50

authentication rsa-sig

encryption aes-192

hash sha

group 2

lifetime 86400

crypto ikev1 policy 60

authentication pre-share

encryption aes-192

hash sha

group 2

lifetime 86400

crypto ikev1 policy 70

authentication crack

encryption aes

hash sha

group 2

lifetime 86400

crypto ikev1 policy 80

authentication rsa-sig

encryption aes

hash sha

group 2

lifetime 86400

crypto ikev1 policy 90

authentication pre-share

encryption aes

hash sha

group 2

lifetime 86400

crypto ikev1 policy 100

authentication crack

encryption 3des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 110

authentication rsa-sig

encryption 3des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 120

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 130

authentication crack

encryption des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 140

authentication rsa-sig

encryption des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 150

authentication pre-share

encryption des

hash sha

group 2

lifetime 86400

telnet 0.0.0.0 0.0.0.0 outside

telnet 0.0.0.0 0.0.0.0 inside

telnet SiteB 255.255.255.0 inside

telnet timeout 5

ssh scopy enable

ssh 0.0.0.0 0.0.0.0 outside

ssh 0.0.0.0 0.0.0.0 inside

ssh timeout 5

ssh key-exchange group dh-group1-sha1

console timeout 0

management-access inside

dhcpd address 192.168.1.2-192.168.1.254 management

dhcpd enable management

!

threat-detection rate bad-packet-drop rate-interval 600 average-rate 100 burst-rate 400

threat-detection rate bad-packet-drop rate-interval 3600 average-rate 80 burst-rate 320

threat-detection rate bad-packet-drop rate-interval 18000 average-rate 2147483647 burst-rate 2147483

647

threat-detection basic-threat

threat-detection statistics port

threat-detection statistics protocol

threat-detection statistics access-list

threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200

ntp server 192.168.16.4 source inside prefer

webvpn

group-policy GroupPolicy_94.10.72.52 internal

group-policy GroupPolicy_94.10.72.52 attributes

vpn-tunnel-protocol ikev1

group-policy GroupPolicy_40.120.2.25 internal

group-policy GroupPolicy_40.120.2.25 attributes

vpn-tunnel-protocol ikev1 ikev2

group-policy vpndomain internal

group-policy vpndomain attributes

dns-server value 192.168.16.18 4.2.2.2

vpn-tunnel-protocol ikev1 l2tp-ipsec

split-tunnel-policy tunnelspecified

split-tunnel-network-list value domainipad_splitTunnelAcl

default-domain value domain.local

group-policy domainipad internal

group-policy domainipad attributes

dns-server value 192.168.16.18 4.2.2.2

vpn-simultaneous-logins 20

vpn-idle-timeout 30

vpn-session-timeout none

vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec

password-storage enable

split-tunnel-policy tunnelspecified

split-tunnel-network-list value domainipad_splitTunnelAcl

default-domain value domain.local

username admin password dfuF7mMMwX/B/6Fh encrypted privilege 15

username ipaduser password HdfnFhbw1RaM4q8b encrypted privilege 0

username ipaduser attributes

vpn-group-policy domainipad

username cisco password xKAAxDzyn0eA1HT1 encrypted privilege 15

tunnel-group 40.120.2.25 type ipsec-l2l

tunnel-group 40.120.2.25 general-attributes

default-group-policy GroupPolicy_40.120.2.25

tunnel-group 40.120.2.25 ipsec-attributes

ikev1 pre-shared-key *****

tunnel-group vpndomain type remote-access

tunnel-group vpndomain general-attributes

address-pool VPNusers

authentication-server-group LDAP

default-group-policy vpndomain

tunnel-group vpndomain ipsec-attributes

ikev1 pre-shared-key *****

tunnel-group 94.10.72.52 type ipsec-l2l

tunnel-group 94.10.72.52 general-attributes

default-group-policy GroupPolicy_94.10.72.52

tunnel-group 94.10.72.52 ipsec-attributes

ikev1 pre-shared-key *****

ikev2 remote-authentication pre-shared-key *****

ikev2 local-authentication pre-shared-key *****

tunnel-group domainipad type remote-access

tunnel-group domainipad general-attributes

address-pool VPNusers

default-group-policy domainipad

tunnel-group domainipad ipsec-attributes

ikev1 pre-shared-key *****

!

class-map global-class

match access-list global_mpc

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

message-length maximum client auto

message-length maximum 512

policy-map global_policy

description Netflow

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

inspect ip-options

inspect icmp

class global-class

flow-export event-type all destination 192.168.16.16

class class-default

flow-export event-type all destination 192.168.16.16

user-statistics accounting

!

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

hpm topN enable

Cryptochecksum:8279c0f16a1d3c4505f9fae944c2b0ad

: end

SiteAasa#

[sokakkar]

Hi Anthony,

One thing which is missing is following command:

same-security-traffic permit inter-interface

Rest looks ok to me on this ASA at least (relevant config):

ip local pool VPNusers 10.10.98.0-10.10.98.100 mask 255.255.255.0

crypto map outside_map 1 match address outside_cryptomap

crypto map outside_map 1 set peer 40.120.2.25

access-list outside_cryptomap extended permit ip object-group DM_INLINE_NETWORK_1 object-group DM_IN

LINE_NETWORK_2

object-group network DM_INLINE_NETWORK_1

network-object 192.168.16.0 255.255.255.0

network-object object SITEA_VPN_USERS_Subnet_10.10.98.0

network-object object 192.168.144.0

network-object object 192.168.166.0

network-object object WirelessSubnet_10.55.77.0

network-object object SITEC_Subnet_192.168.14.0

network-object object VNET_192.168.20.0

network-object object ISCSI_SiteA_10.1.21.0

object-group network DM_INLINE_NETWORK_2

network-object object SITEB_Subnet_192.168.10.0

network-object object SITEB_VPN_USERS_Subnet_10.10.99.0

network-object object 192.168.100.0

network-object object ISCSI_SiteB_10.1.100.0

nat (inside,outside) source static DM_INLINE_NETWORK_1 DM_INLINE_NETWORK_1 destination static DM_INL

INE_NETWORK_2 DM_INLINE_NETWORK_2 no-proxy-arp route-lookup

Add the above command in bold and if it still fails, paste the config from second ASA along with the logs when you try to access resources on second site from VPN client.

-

Sourav

[adleveritt]

Sourav,

This doesn't seem to have worked. I will try to get the other ASA config and the logs posted by Tuesday. I have a busy weekend ahead. Thanks for your help so far.

Anthony

[graeme2010 · Accepted solution]

I believe the command you need is:

same-security-traffic permit Intra-interface (not inter-interface)

Both remote VPN and site-to-site VPN use the same outside interface, so this command allows the VPN traffic to hairpin off this interface

Sent from Cisco Technical Support iPad App

[sokakkar · Accepted solution]

Hi Anthony,

graeme2010 is right. The command i mentioned is already there in your config, basically I copied that and missed out to change it to 'intra'. Since, source and destination are behind same interface, command mentioned by 'graeme2010 ' is correct. Please add following and see if it works, if not, get us the requested info:

same-security-traffic permit Intra-interface

Here is the link to command reference which explains above command in detail:

http://www.cisco.com/en/US/docs/security/asa/asa84/command/reference/s1.html#wp1444448

Thank you 'graeme2010' for highlighting this :-).

-

Sourav

[adleveritt]

Yep, that command worked on the SiteA ASA that I posted the settings for. I can now ping site B when I am on Site A's VPN. This is a huge help. Thanks Sourav and graeme2010 for your help so far. 

I also tried adding this command to site B but apparently something else is missing from the config.

SiteB# show run

: Saved

:

ASA Version 8.4(4)5

!

hostname SiteB

domain-name domain.local

enable password password encrypted

passwd password encrypted

names

!

interface Ethernet0/0

description Secondary Comcast Cable Modem

nameif secondary

security-level 0

ip address 173.165.58.154 255.255.255.248

!

interface Ethernet0/1

description Local Area Network

nameif inside

security-level 100

ip address 192.168.100.1 255.255.255.252

!

interface Ethernet0/2

description Metro E to Comcast

speed 100

duplex full

nameif outside

security-level 0

ip address 55.45.0.34 255.255.255.252

!

interface Ethernet0/3

description Guest_Wireless_DMZ

nameif Guest_Wireless_DMZ

security-level 50

ip address 192.168.7.20 255.255.255.0

!

interface Management0/0

nameif management

security-level 100

ip address 192.168.1.1 255.255.255.0

management-only

!

banner login  This system is for the use of authorized users only.

banner login  Individuals using this computer system without authority, or in

banner login  excess of their authority, are subject to having all of their

banner login  activities on this system monitored and recorded by system personnel.

banner login

banner login  In the course of monitoring individuals improperly using this

banner login  system, or in the course of system maintenance, the activities

banner login  of authorized users may also be monitored.

banner login

banner login  Anyone using this system expressly consents to such monitoring

banner login  and is advised that if such monitoring reveals possible

banner login  evidence of criminal activity, system personnel may provide the

banner login  evidence of such monitoring to law enforcement officials.

banner asdm  This system is for the use of authorized users only.

banner asdm  Individuals using this computer system without authority, or in

banner asdm  excess of their authority, are subject to having all of their

banner asdm  activities on this system monitored and recorded by system personnel.

banner asdm

banner asdm  In the course of monitoring individuals improperly using this

banner asdm  system, or in the course of system maintenance, the activities

banner asdm  of authorized users may also be monitored.

banner asdm

banner asdm  Anyone using this system expressly consents to such monitoring

banner asdm  and is advised that if such monitoring reveals possible

banner asdm  evidence of criminal activity, system personnel may provide the

banner asdm  evidence of such monitoring to law enforcement officials.

boot system disk0:/asa844-5-k8.bin

ftp mode passive

clock timezone CST -6

clock summer-time CDT recurring

dns domain-lookup secondary

dns domain-lookup inside

dns domain-lookup outside

dns server-group DefaultDNS

name-server 192.168.10.173

name-server 192.168.10.174

domain-name domain.local

dns server-group Internet

name-server 75.75.75.75

name-server 75.75.75.76

name-server 4.2.2.2

dns server-group Metro

name-server 75.75.75.75

name-server 75.75.75.76

name-server 192.168.10.173

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

object network obj_any

subnet 0.0.0.0 0.0.0.0

object network VPN_USERS_Subnet_10.10.99.0

subnet 10.10.99.0 255.255.255.128

object network MetroE_Subnet_202.0.220

subnet 50.202.0.220 255.255.255.252

object network Private_LDAP_192.168.10.173

host 192.168.10.173

object network Public_Outlook_50.203.0.137

host 50.203.0.137

object network Private_Outlook_192.168.10.127

host 192.168.10.127

object network SITEA_Subnet_192.168.16.0

subnet 192.168.16.0 255.255.255.0

object network SITEA_VPN_USERS_Subnet_10.10.98.0

subnet 10.10.98.0 255.255.255.0

object network SITEC_Subnet_192.168.14.0

subnet 192.168.14.0 255.255.255.0

object network 192.168.10.0

subnet 192.168.10.0 255.255.255.0

object network 192.168.144.0

subnet 192.168.144.0 255.255.255.0

object network NETWORK_OBJ_10.10.99.0_25

subnet 10.10.99.0 255.255.255.128

object network NETWORK_OBJ_192.168.0.0_24

subnet 192.168.0.0 255.255.255.0

object network Private_SPAM_FILTER_192.168.10.251

host 192.168.10.251

object network Public_SPAM_FILTER_50.203.0.138

host 50.203.0.138

object network 192.168.166.0

subnet 192.168.166.0 255.255.255.0

object network obj-any

subnet 0.0.0.0 0.0.0.0

object network 192.168.100.0

subnet 192.168.100.0 255.255.255.0

object network VNET_192.168.20.0

subnet 192.168.20.0 255.255.255.0

object network Wireless_10.55.77.0

subnet 10.55.77.0 255.255.255.0

object network ISCSI_Kamfin_10.1.21.0

subnet 10.1.21.0 255.255.255.0

object network ISCSI_Domain_10.1.100.0

subnet 10.1.100.0 255.255.255.0

object network ISCSI_SiteA_10.1.21.0

subnet 10.1.21.0 255.255.255.0

object network 192.168.7.0

subnet 192.168.7.0 255.255.255.0

object network DMZ_Wireless

subnet 192.168.7.0 255.255.255.0

description DMZ_Wireless

object network Guest_DMZ_Int

host 192.168.7.20

object-group network DM_INLINE_NETWORK_1

network-object object VPN_USERS_Subnet_10.10.99.0

network-object object 192.168.10.0

network-object object 192.168.100.0

network-object object ISCSI_Domain_10.1.100.0

object-group network DM_INLINE_NETWORK_2

network-object object SITEA_Subnet_192.168.16.0

network-object object SITEA_VPN_USERS_Subnet_10.10.98.0

network-object object 192.168.144.0

network-object object 192.168.166.0

network-object object Wireless_10.55.77.0

network-object object SITEC_Subnet_192.168.14.0

network-object object ISCSI_SiteA_10.1.21.0

network-object object VNET_192.168.20.0

object-group network DM_INLINE_NETWORK_3

network-object 192.168.10.0 255.255.255.0

network-object object 192.168.10.0

network-object object VPN_USERS_Subnet_10.10.99.0

object-group network DM_INLINE_NETWORK_4

network-object object 192.168.144.0

network-object object SITEC_Subnet_192.168.14.0

object-group network DM_INLINE_NETWORK_5

network-object 10.10.98.0 255.255.255.0

network-object 192.168.0.0 255.255.255.0

network-object object VPN_USERS_Subnet_10.10.99.0

network-object object 192.168.10.0

network-object 192.168.0.0 255.255.0.0

object-group network DM_INLINE_NETWORK_6

network-object 192.168.0.0 255.255.255.0

network-object object VPN_USERS_Subnet_10.10.99.0

object-group service DM_INLINE_SERVICE_1

service-object icmp alternate-address

service-object icmp conversion-error

service-object icmp echo

service-object icmp echo-reply

service-object icmp information-reply

service-object icmp information-request

service-object icmp mask-reply

service-object icmp mask-request

service-object icmp mobile-redirect

service-object icmp parameter-problem

service-object icmp redirect

service-object icmp router-advertisement

service-object icmp router-solicitation

service-object icmp source-quench

service-object icmp time-exceeded

service-object icmp timestamp-request

service-object icmp traceroute

service-object icmp unreachable

service-object tcp-udp destination eq www

service-object tcp destination eq citrix-ica

service-object tcp destination eq ftp

service-object tcp destination eq ftp-data

service-object tcp destination eq www

service-object tcp destination eq https

service-object tcp destination eq pop3

service-object tcp destination eq smtp

service-object udp destination eq www

service-object udp destination eq isakmp

service-object udp destination eq ntp

service-object udp destination eq snmp

service-object udp destination eq snmptrap

service-object udp destination eq tftp

object-group network DM_INLINE_NETWORK_7

network-object 192.168.100.0 255.255.255.252

network-object object 192.168.10.0

network-object object NETWORK_OBJ_10.10.99.0_25

object-group network DM_INLINE_NETWORK_8

network-object 10.0.0.0 255.0.0.0

network-object 192.168.0.0 255.255.0.0

object-group network DM_INLINE_NETWORK_9

network-object 10.0.0.0 255.0.0.0

network-object 192.168.0.0 255.255.0.0

object-group icmp-type DM_INLINE_ICMP_1

icmp-object alternate-address

icmp-object conversion-error

icmp-object echo

icmp-object echo-reply

icmp-object information-reply

icmp-object information-request

icmp-object mask-reply

icmp-object mask-request

icmp-object mobile-redirect

icmp-object parameter-problem

icmp-object redirect

icmp-object router-advertisement

icmp-object router-solicitation

icmp-object source-quench

icmp-object time-exceeded

icmp-object timestamp-reply

icmp-object timestamp-request

icmp-object traceroute

icmp-object unreachable

object-group network BackupRoutingLocal

network-object host 192.168.100.1

object-group network BackupRoutingSiteC

network-object host 3.3.3.3

network-object host 192.168.144.1

object-group network GRETunnelSiteA

network-object host 192.168.166.2

object-group network GRETunnelLocal

network-object host 1.1.1.1

object-group network GRETunnelSiteC

network-object host 8.8.8.8

access-list outside_access_in extended permit icmp any any object-group DM_INLINE_ICMP_1

access-list outside_access_in extended permit tcp any any eq ssh

access-list outside_access_in extended permit ip 10.0.0.0 255.0.0.0 any

access-list outside_access_in extended permit ip 192.168.0.0 255.255.0.0 any

access-list outside_access_in extended permit tcp any any

access-list outside_access_in extended permit ospf any any

access-list outside_access_in extended permit icmp any any unreachable

access-list outside_access_in extended permit icmp any any echo-reply

access-list outside_access_in extended permit icmp any any time-exceeded

access-list outside_access_in_1 extended permit ip any any

access-list vpndomain_splitTunnelAcl standard permit 192.168.10.0 255.255.255.0

access-list vpndomain_splitTunnelAcl standard permit 192.168.16.0 255.255.255.0

access-list vpndomain_splitTunnelAcl standard permit 192.168.14.0 255.255.255.0

access-list vpndomain_splitTunnelAcl standard permit 10.10.98.0 255.255.255.0

access-list vpndomain_splitTunnelAcl standard permit 192.168.100.0 255.255.255.0

access-list vpndomain_splitTunnelAcl standard permit 192.168.166.0 255.255.255.0

access-list vpndomain_splitTunnelAcl standard permit 192.168.144.0 255.255.255.0

access-list vpndomain_splitTunnelAcl standard permit 10.55.77.0 255.255.255.0

access-list vpndomain_splitTunnelAcl standard permit 192.168.20.0 255.255.255.0

access-list inside_access_in extended permit ip object Private_LDAP_192.168.10.173 any

access-list inside_access_in extended permit ip object-group DM_INLINE_NETWORK_5 any

access-list inside_access_in extended permit object-group DM_INLINE_SERVICE_1 object-group DM_INLINE

_NETWORK_6 any

access-list inside_access_in extended permit icmp any interface outside

access-list inside_access_in extended permit icmp any object-group DM_INLINE_NETWORK_7

access-list inside_access_in extended permit ip object-group DM_INLINE_NETWORK_8 any

access-list inside_access_in extended permit ip any object-group DM_INLINE_NETWORK_9

access-list inside_access_in extended permit ip any any

access-list outside_cryptomap extended permit ip object-group DM_INLINE_NETWORK_1 object-group DM_IN

LINE_NETWORK_2

access-list outside_cryptomap_1 extended permit ip object-group GRETunnelLocal object-group GRETunne

lSiteC

access-list outside_cryptomap_1 extended permit gre object-group GRETunnelLocal object-group GRETunn

elSiteC

access-list domainipad_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0

access-list domainipad_splitTunnelAcl standard permit 192.168.100.0 255.255.255.252

access-list domainipad_splitTunnelAcl standard permit 192.168.10.0 255.255.255.0

access-list global_mpc extended permit ip any any

access-list test extended permit ip host 192.168.10.82 host 192.168.20.10

access-list test extended permit ip host 192.168.20.10 host 192.168.10.82

access-list outside_access_wireless extended permit ip 10.0.0.0 255.0.0.0 any

access-list outside_access_wireless extended permit ip 192.168.0.0 255.255.0.0 any

access-list outside_access_wireless extended permit tcp any any

access-list outside_access_wireless extended permit icmp any any unreachable

access-list outside_access_wireless extended permit icmp any any echo-reply

access-list outside_access_wireless extended permit icmp any any time-exceeded

access-list cap-list extended permit tcp host 192.168.7.2 any

access-list cap-list extended permit tcp any host 192.168.7.2

pager lines 24

logging enable

logging buffer-size 32768

logging asdm-buffer-size 512

logging monitor informational

logging buffered informational

logging asdm informational

flow-export destination outside 192.168.16.16 2055

mtu secondary 1500

mtu inside 1500

mtu outside 1500

mtu management 1500

mtu Guest_Wireless_DMZ 1500

ip local pool VPNusers 10.10.99.0-10.10.99.100 mask 255.255.255.0

no failover

icmp unreachable rate-limit 1 burst-size 1

icmp permit any secondary

icmp permit any inside

icmp permit any outside

asdm image disk0:/asdm-649-103.bin

asdm history enable

arp timeout 14400

arp permit-nonconnected

nat (inside,outside) source static any any destination static VPN_USERS_Subnet_10.10.99.0 VPN_USERS_

Subnet_10.10.99.0 no-proxy-arp route-lookup

nat (inside,outside) source static MetroE_Subnet_202.0.220 MetroE_Subnet_202.0.220 destination stati

c VPN_USERS_Subnet_10.10.99.0 VPN_USERS_Subnet_10.10.99.0 no-proxy-arp route-lookup

nat (inside,outside) source static DM_INLINE_NETWORK_1 DM_INLINE_NETWORK_1 destination static DM_INL

INE_NETWORK_2 DM_INLINE_NETWORK_2 no-proxy-arp route-lookup

nat (inside,outside) source static DM_INLINE_NETWORK_3 DM_INLINE_NETWORK_3 destination static DM_INL

INE_NETWORK_4 DM_INLINE_NETWORK_4 no-proxy-arp route-lookup

nat (inside,outside) source static NETWORK_OBJ_192.168.0.0_24 NETWORK_OBJ_192.168.0.0_24 destination

static NETWORK_OBJ_10.10.99.0_25 NETWORK_OBJ_10.10.99.0_25 no-proxy-arp route-lookup

nat (inside,outside) source static BackupRoutingLocal BackupRoutingLocal destination static BackupRo

utingSiteC BackupRoutingSiteC

nat (inside,outside) source static GRETunnelLocal GRETunnelLocal destination static GRETunnelStatesb

oro GRETunnelSiteC no-proxy-arp route-lookup

!

object network Private_Outlook_192.168.10.127

nat (inside,outside) static 50.203.0.137

object network Private_SPAM_FILTER_192.168.10.251

nat (inside,outside) static 50.203.0.138

object network obj-any

nat (any,outside) dynamic interface

access-group inside_access_in in interface inside

access-group outside_access_in_1 in interface outside control-plane

access-group outside_access_wireless in interface outside

route outside 0.0.0.0 0.0.0.0 50.202.0.221 1

route outside 10.1.21.0 255.255.255.0 50.202.0.221 1

route inside 10.1.100.0 255.255.255.0 192.168.100.2 1

route outside 10.10.98.0 255.255.255.0 87.70.25.10 1

route outside 10.55.77.0 255.255.255.0 87.70.25.10 1

route outside 74.32.84.42 255.255.255.255 50.202.0.221 1

route inside 192.168.7.0 255.255.255.0 192.168.100.2 1

route inside 192.168.10.0 255.255.255.0 192.168.100.2 1

route outside 192.168.14.0 255.255.255.0 50.202.0.221 1

route outside 192.168.16.0 255.255.255.0 87.70.25.10 1

route outside 192.168.20.0 255.255.255.0 50.202.0.221 1

route outside 192.168.144.0 255.255.255.0 87.70.25.10 1

route outside 192.168.166.0 255.255.255.0 87.70.25.10 1

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

aaa-server 192.168.10.173 protocol ldap

aaa-server 192.168.10.173 (inside) host 192.168.10.173

ldap-base-dn CN=Users,DC=domain,DC=local

ldap-group-base-dn CN=Users,DC=domain,DC=local

ldap-scope subtree

ldap-naming-attribute sAMAccountName

ldap-login-password *****

ldap-login-dn cn=administrator,CN=users,DC=domain,DC=local

server-type microsoft

user-identity domain wstx-adc1 aaa-server 192.168.10.173

user-identity default-domain LOCAL

aaa authentication enable console LOCAL

aaa authentication http console LOCAL

aaa authentication serial console LOCAL

aaa authentication ssh console LOCAL

aaa authentication telnet console LOCAL

http server enable

http 0.0.0.0 0.0.0.0 inside

http 0.0.0.0 0.0.0.0 secondary

http 0.0.0.0 0.0.0.0 outside

snmp-server host outside 192.168.16.16 community ***** version 2c

no snmp-server location

no snmp-server contact

snmp-server community *****

snmp-server enable traps snmp authentication linkup linkdown coldstart

auth-prompt prompt This system is for the use of authorized users only. Individuals using this compu

ter system without authority, or in excess of their authority, are subject to having all of their

crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport

crypto ipsec ikev2 ipsec-proposal DES

protocol esp encryption des

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal 3DES

protocol esp encryption 3des

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal AES

protocol esp encryption aes

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal AES192

protocol esp encryption aes-192

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal AES256

protocol esp encryption aes-256

protocol esp integrity sha-1 md5

crypto ipsec df-bit clear-df outside

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-1

28-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP

-DES-SHA ESP-DES-MD5

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES D

ES

crypto map outside_map 1 match address outside_cryptomap

crypto map outside_map 1 set peer 87.70.25.10

crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP

-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

crypto map outside_map 2 match address outside_cryptomap_1

crypto map outside_map 2 set peer 74.32.84.42

crypto map outside_map 2 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP

-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

crypto map outside_map 2 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES

crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map outside_map interface outside

crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map inside_map interface inside

crypto map secondary_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map secondary_map interface secondary

crypto ca trustpoint ASDM_TrustPoint0

enrollment self

subject-name CN=SiteB

keypair sslvpndomain

crl configure

crypto ca trustpoint ASDM_TrustPoint1

enrollment self

fqdn none

subject-name CN=55.45.0.34

ip-address 55.45.0.34

keypair sslvpndomain

crl configure

crypto ca trustpoint SSLVPN

enrollment self

subject-name CN=SiteB

keypair vpndomain

crl configure

crypto ca trustpoint ASDM_TrustPoint2

enrollment self

fqdn 50-202-0-222-static.hfc.comcastbusiness.net

subject-name CN=50-202-0-222-static.hfc.comcastbusiness.net

keypair SSL

crl configure

crypto ca certificate chain ASDM_TrustPoint0

certificate 25395350

    308201e5 3082014e a0030201 02020425 39535030 0d06092a 864886f7 0d010105

    05003037 3110300e 06035504 03130763 68676f61 73613123 30210609 2a864886

    f70d0109 02161463 68676f61 73612e77 65737465 782e6c6f 63616c30 1e170d31

    32303931 35303335 3435305a 170d3232 30393133 30333534 35305a30 37311030

    0e060355 04031307 6368676f 61736131 23302106 092a8648 86f70d01 09021614

    6368676f 6173612e 77657374 65782e6c 6f63616c 30819f30 0d06092a 864886f7

    0d010101 05000381 8d003081 89028181 00b24190 ab4a2ee4 191ffd45 63db06f4

    c34abc21 ad2395cf b8f265be b649c426 2a206754 8010596c 94913887 38295417

    998e96a1 69967a47 40f6c243 6b860be5 8293dcc8 cf9a7dd2 4e86060e 56ee278c

    5a1e8388 12506915 d6134ca0 4670b9b8 d071947c 9e32d2c1 c0fc5101 52652703

    af3eac77 6a451dd0 e9f06217 c076c535 d3020301 0001300d 06092a86 4886f70d

    01010505 00038181 008d6cf9 8a7d56fd 79e56d71 4fe28da0 afad8684 20208eb7

    6d79d87f 0958c844 083fc6cb b6b580ab 19b5f39c 49ffa0ff 8837fb15 043c9ceb

    efbeb458 5ec40ccc 8d05cdfb 61ce8943 1a00f610 b947dd2a 97d28252 bde2c422

    1a40b886 ab89a6b9 94c161e4 15769010 9d304d4c 6fe07c2e 8f906504 a1ac2ee5

    5a9d4015 36a4c66b b0

  quit

crypto ca certificate chain ASDM_TrustPoint1

certificate 24395350

    308201db 30820144 a0030201 02020424 39535030 0d06092a 864886f7 0d010105

    05003032 31303013 06035504 03130c35 302e3230 322e302e 32323230 1906092a

    864886f7 0d010908 130c3530 2e323032 2e302e32 3232301e 170d3132 30393135

    30333531 35345a17 0d323230 39313330 33353135 345a3032 31303013 06035504

    03130c35 302e3230 322e302e 32323230 1906092a 864886f7 0d010908 130c3530

    2e323032 2e302e32 32323081 9f300d06 092a8648 86f70d01 01010500 03818d00

    30818902 818100b2 4190ab4a 2ee4191f fd4563db 06f4c34a bc21ad23 95cfb8f2

    65beb649 c4262a20 67548010 596c9491 38873829 5417998e 96a16996 7a4740f6

    c2436b86 0be58293 dcc8cf9a 7dd24e86 060e56ee 278c5a1e 83881250 6915d613

    4ca04670 b9b8d071 947c9e32 d2c1c0fc 51015265 2703af3e ac776a45 1dd0e9f0

    6217c076 c535d302 03010001 300d0609 2a864886 f70d0101 05050003 818100a8

    12ea6ead 33fac15b f1dfedc1 0dba7347 cd588d0a 5c87053f f3d71722 a8c11d3b

    6c33a840 85a00c90 966c6657 1c66f32e ac2d4b88 089c1a26 8ded7139 c9330b0b

    77e39431 5c5d60bd edfda2b9 90d00d98 7e819a02 155f522d e9a90c1b d620ea04

    1515871e 3a71c01b d59c0f32 d0cafb43 03cabc81 157941d9 809906dc 3e6d83

  quit

crypto ca certificate chain SSLVPN

certificate 26395350

    308201e5 3082014e a0030201 02020426 39535030 0d06092a 864886f7 0d010105

    05003037 3110300e 06035504 03130763 68676f61 73613123 30210609 2a864886

    f70d0109 02161463 68676f61 73612e77 65737465 782e6c6f 63616c30 1e170d31

    32303931 35303335 3534305a 170d3232 30393133 30333535 34305a30 37311030

    0e060355 04031307 6368676f 61736131 23302106 092a8648 86f70d01 09021614

    6368676f 6173612e 77657374 65782e6c 6f63616c 30819f30 0d06092a 864886f7

    0d010101 05000381 8d003081 89028181 00cb29a1 e53286e8 b0a9eb3a baaef827

    a76e5d12 92eca332 cd3f4633 1f1c1a07 4f959e23 27f15bb9 0d7430ed aba1bfaa

    a5fc53d0 34f13a4b 119dedd6 0e77e1ba 0cc4f1e4 370627fe 9dbc6c9e 51f7556c

    067ae357 58c1e381 4089faba 348a3c4d 77d37c5f 28016ae2 e1f64cbd 3a80f6b4

    8356d987 3d887aeb 307f5ed9 05d38da9 7d020301 0001300d 06092a86 4886f70d

    01010505 00038181 0009c42b 526a2e40 1e9ed254 68ad1348 251e12ef f6257297

    5d179d95 54287b1e f4b41db7 4fe977e1 e40f9c9a c2c1fc1b 8360ee30 7f5bd320

    942380c0 a46687c6 074766c6 4725a01b 8c0fd40b 15cd3750 07a3652d e855c51b

    c920c0fd 5e676308 dc937dc9 2bbeea8c b7c74554 f0db9fa7 bd38ea95 8aa90a7f

    d7bfcd45 a647f6a6 f6

  quit

crypto ca certificate chain ASDM_TrustPoint2

certificate 27395350

    3082025b 308201c4 a0030201 02020427 39535030 0d06092a 864886f7 0d010105

    05003072 31343032 06035504 03132b35 302d3230 322d302d 3232322d 73746174

    69632e68 66632e63 6f6d6361 73746275 73696e65 73732e6e 6574313a 30380609

    2a864886 f70d0109 02162b35 302d3230 322d302d 3232322d 73746174 69632e68

    66632e63 6f6d6361 73746275 73696e65 73732e6e 6574301e 170d3132 30393135

    30343030 31335a17 0d323230 39313330 34303031 335a3072 31343032 06035504

    03132b35 302d3230 322d302d 3232322d 73746174 69632e68 66632e63 6f6d6361

    73746275 73696e65 73732e6e 6574313a 30380609 2a864886 f70d0109 02162b35

    302d3230 322d302d 3232322d 73746174 69632e68 66632e63 6f6d6361 73746275

    73696e65 73732e6e 65743081 9f300d06 092a8648 86f70d01 01010500 03818d00

    30818902 818100e8 2156c1bd d5a6b2f0 3996eb86 f5b8d5aa 23943a86 1b36096e

    16641bf0 b1320717 55b06f50 af8f6bcf fcb090cd cbbe825a 67e8fb96 9fb19302

    f69611b9 9288b9ca 33cf7e12 60cf00f0 c1ac1de3 c14ea4b5 82d7258a 7e46d2b4

    00ce0636 b2b2049a 77e9aa76 7f32b952 3e35b53c c9a91956 add1a10c b963271f

    1347919a ca3bd502 03010001 300d0609 2a864886 f70d0101 05050003 81810024

    5aa60efb 2252a843 1ea0fa0b b70f59a9 95ba9f0b db5e92a1 eab4dcb4 2ae654b6

    6dc96d4e 0ce97469 3f2c0464 bf350c03 7242a19d 8c144d25 29608596 01d799d2

    ad1d2452 c0d2371b 0bc1371d 81ea67f1 f29658b7 e8b5448f 865ab40c 8e38f1ae

    70ef091d 0e827403 dbf3b670 22568cd8 101b1455 e4a05a6d 7370047e 0afa2e

  quit

crypto ikev2 policy 1

encryption aes-256

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 10

encryption aes-192

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 20

encryption aes

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 30

encryption 3des

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 40

encryption des

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 enable secondary

crypto ikev2 enable inside

crypto ikev2 enable outside client-services port 443

crypto ikev2 remote-access trustpoint ASDM_TrustPoint0

crypto ikev1 enable secondary

crypto ikev1 enable inside

crypto ikev1 enable outside

crypto ikev1 ipsec-over-tcp port 10000

crypto ikev1 policy 10

authentication crack

encryption aes-256

hash sha

group 2

lifetime 86400

crypto ikev1 policy 20

authentication rsa-sig

encryption aes-256

hash sha

group 2

lifetime 86400

crypto ikev1 policy 30

authentication pre-share

encryption aes-256

hash sha

group 2

lifetime 86400

crypto ikev1 policy 40

authentication crack

encryption aes-192

hash sha

group 2

lifetime 86400

crypto ikev1 policy 50

authentication rsa-sig

encryption aes-192

hash sha

group 2

lifetime 86400

crypto ikev1 policy 60

authentication pre-share

encryption aes-192

hash sha

group 2

lifetime 86400

crypto ikev1 policy 70

authentication crack

encryption aes

hash sha

group 2

lifetime 86400

crypto ikev1 policy 80

authentication rsa-sig

encryption aes

hash sha

group 2

lifetime 86400

crypto ikev1 policy 90

authentication pre-share

encryption aes

hash sha

group 2

lifetime 86400

crypto ikev1 policy 100

authentication crack

encryption 3des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 110

authentication rsa-sig

encryption 3des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 120

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 130

authentication crack

encryption des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 140

authentication rsa-sig

encryption des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 150

authentication pre-share

encryption des

hash sha

group 2

lifetime 86400

telnet timeout 5

ssh scopy enable

ssh 0.0.0.0 0.0.0.0 secondary

ssh 0.0.0.0 0.0.0.0 inside

ssh 0.0.0.0 0.0.0.0 outside

ssh timeout 60

ssh key-exchange group dh-group1-sha1

console timeout 0

dhcpd address 192.168.7.64-192.168.7.191 Guest_Wireless_DMZ

dhcpd dns 75.75.75.75 75.75.76.76 interface Guest_Wireless_DMZ

dhcpd lease 28800 interface Guest_Wireless_DMZ

dhcpd ping_timeout 250 interface Guest_Wireless_DMZ

dhcpd domain guestwireless interface Guest_Wireless_DMZ

dhcpd enable Guest_Wireless_DMZ

!

threat-detection basic-threat

threat-detection scanning-threat

threat-detection statistics

threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200

ntp server 192.168.10.1 source inside prefer

ssl encryption rc4-sha1 aes128-sha1 aes256-sha1 3des-sha1 dhe-aes128-sha1 dhe-aes256-sha1

ssl trust-point ASDM_TrustPoint0 inside

ssl trust-point ASDM_TrustPoint0 outside

webvpn

enable outside

anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1

anyconnect profiles VPNuser_client_profile disk0:/VPNuser_client_profile.xml

anyconnect enable

tunnel-group-list enable

group-policy DfltGrpPolicy attributes

dns-server value 192.168.10.173 192.168.10.174

vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-client ssl-clientless

default-domain value domain.local

group-policy domainipad internal

group-policy domainipad attributes

dns-server value 192.168.10.173 192.168.10.174

vpn-idle-timeout 60

vpn-session-timeout none

vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec

split-tunnel-policy tunnelspecified

split-tunnel-network-list value domainipad_splitTunnelAcl

default-domain value domain.local

secure-unit-authentication disable

user-authentication disable

group-policy GroupPolicy_74.32.84.42 internal

group-policy GroupPolicy_74.32.84.42 attributes

vpn-tunnel-protocol ikev1 ikev2

group-policy GroupPolicy_87.70.25.10 internal

group-policy GroupPolicy_87.70.25.10 attributes

vpn-tunnel-protocol ikev1 ikev2

group-policy vpndomain internal

group-policy vpndomain attributes

dns-server value 192.168.10.173 192.168.10.174

vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-client

split-tunnel-policy tunnelspecified

split-tunnel-network-list value vpndomain_splitTunnelAcl

default-domain value domain.local

username admin password password encrypted privilege 15

username ipaduser password password encrypted privilege 15

username ipaduser attributes

vpn-group-policy domainipad

vpn-simultaneous-logins 10

password-storage enable

username cisco password 6bg.xkmjb0xcNK/q encrypted privilege 15

tunnel-group DefaultWEBVPNGroup general-attributes

address-pool VPNusers

tunnel-group 87.70.25.10 type ipsec-l2l

tunnel-group 87.70.25.10 general-attributes

default-group-policy GroupPolicy_87.70.25.10

tunnel-group 87.70.25.10 ipsec-attributes

ikev1 pre-shared-key *****

tunnel-group vpndomain type remote-access

tunnel-group vpndomain general-attributes

address-pool VPNusers

authentication-server-group 192.168.10.173 LOCAL

default-group-policy vpndomain

tunnel-group vpndomain ipsec-attributes

ikev1 pre-shared-key *****

tunnel-group 74.32.84.42 type ipsec-l2l

tunnel-group 74.32.84.42 general-attributes

default-group-policy GroupPolicy_74.32.84.42

tunnel-group 74.32.84.42 ipsec-attributes

ikev1 pre-shared-key *****

peer-id-validate nocheck

ikev2 remote-authentication pre-shared-key *****

ikev2 local-authentication pre-shared-key *****

tunnel-group domainipad type remote-access

tunnel-group domainipad general-attributes

address-pool VPNusers

default-group-policy domainipad

tunnel-group domainipad ipsec-attributes

ikev1 pre-shared-key *****

!

class-map global-class

match access-list global_mpc

class-map type inspect http match-all asdm_medium_security_methods

match not request method head

match not request method post

match not request method get

class-map inspection_default

match default-inspection-traffic

class-map type regex match-any URL-BLOCK

class-map type inspect http match-any URL-Block

match request uri regex class URL-BLOCK

match request header host regex class URL-BLOCK

class-map type inspect http match-all asdm_high_security_methods

match not request method head

match not request method get

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum client auto

  message-length maximum 512

policy-map type inspect http URL

parameters

  protocol-violation action drop-connection log

class URL-Block

  drop-connection log

policy-map global_policy

description Netflow

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny

  inspect sunrpc

  inspect xdmcp

  inspect sip

  inspect netbios

  inspect tftp

  inspect ip-options

  inspect http URL

  inspect icmp

class global-class

class class-default

  user-statistics accounting

!

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

hpm topN enable

Cryptochecksum:105604110a6d35be5f2a5e5bc86017c6

: end

[sokakkar]

Hi Anthony,

Glad to know that it works for Site A now. I checked the config and it looks ok to me:

crypto map outside_map 1 match address outside_cryptomap

crypto map outside_map 1 set peer 87.70.25.10

crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

access-list outside_cryptomap extended permit ip object-group DM_INLINE_NETWORK_1 object-group DM_INLINE_NETWORK_2

object-group network DM_INLINE_NETWORK_1

network-object object VPN_USERS_Subnet_10.10.99.0

network-object object 192.168.10.0

network-object object 192.168.100.0

network-object object ISCSI_Domain_10.1.100.0

object-group network DM_INLINE_NETWORK_2

network-object object SITEA_Subnet_192.168.16.0

network-object object SITEA_VPN_USERS_Subnet_10.10.98.0

network-object object 192.168.144.0

network-object object 192.168.166.0

network-object object Wireless_10.55.77.0

network-object object SITEC_Subnet_192.168.14.0

network-object object ISCSI_SiteA_10.1.21.0

network-object object VNET_192.168.20.0

ip local pool VPNusers 10.10.99.0-10.10.99.100 mask 255.255.255.0

nat (inside,outside) source static any any destination static VPN_USERS_Subnet_10.10.99.0 VPN_USERS_Subnet_10.10.99.0 no-proxy-arp route-lookup

nat (inside,outside) source static DM_INLINE_NETWORK_1 DM_INLINE_NETWORK_1 destination static DM_INLINE_NETWORK_2 DM_INLINE_NETWORK_2 no-proxy-arp route-lookup

nat (inside,outside) source static NETWORK_OBJ_192.168.0.0_24 NETWORK_OBJ_192.168.0.0_24 destination static NETWORK_OBJ_10.10.99.0_25 NETWORK_OBJ_10.10.99.0_25 no-proxy-arp route-lookup

Can you post the following info:

- Output of "packet-tracer input outside udp 10.10.99.10 discard 192.168.16.10 80"

- Logs of the time when you connect to ASA and access the resource on inside of second site ASA (mention IP's involved).

- show crypto ipsec sa peer

-

Sourav

[adleveritt]

This is odd but I think a reboot fixed it. I lost my internet connection a few minutes ago and decided to reset the ASA. After that the internet came back up and out of curiosity I checked the VPN. Seems to be working now. Thanks for all of your help.

Anthony