Re: Site to Site VPN Up! but no traffic goes in or out

edgsoccer · ‎08-27-2012

Site to Site vpn is up but no traffic goes thru...

SRP541 and cisco 800

Cisco 800 Config ---------------------------------------

ip source-route

ip dhcp pool quest

network 10.10.11.0 255.255.255.0

default-router 10.10.11.1

dns-server 8.8.8.8 8.8.4.4

!

ip dhcp pool roadrunner

network 192.168.1.0 255.255.255.0

default-router 192.168.1.1

dns-server 8.8.8.8 8.8.4.4

!

ip cef

ip name-server 8.8.8.8

ip name-server 8.8.4.4

no ipv6 cef

!

crypto isakmp policy 1

encr 3des

hash md5

authentication pre-share

group 2

lifetime 28800

crypto isakmp key test address xx.xx.xx.153

crypto isakmp key test1 address xx.xx.xx.24

!

crypto ipsec transform-set qwest esp-3des esp-md5-hmac

crypto ipsec transform-set roadrunner esp-3des esp-md5-hmac

!

crypto map maptest1 2 ipsec-isakmp

! Incomplete

!

crypto map qwest 1 ipsec-isakmp

set peer xx.xx.xx.24

set transform-set qwest

match address 100

!

crypto map roadrunner 1 ipsec-isakmp

set peer xx.xx.xx.153

set transform-set roadrunner

match address 101

!

interface FastEthernet0

description roadrunner

switchport access vlan 2

!

interface FastEthernet1

description roadrunner

switchport access vlan 2

!

interface FastEthernet2

description roadrunner

switchport access vlan 2

!

interface FastEthernet3

description roadrunner

switchport access vlan 2

!

interface FastEthernet4

description qwest

!

interface FastEthernet5

description qwest

!

interface FastEthernet6

description qwest

!

interface FastEthernet7

description qwest

!

interface FastEthernet8

description qwest connection

no ip address

ip nat outside

ip virtual-reassembly

duplex auto

speed auto

pppoe enable group global

pppoe-client dial-pool-number 1

!

interface GigabitEthernet0

description roadrunner connection

ip address xx.xx.xx.134 255.255.255.252

ip nat outside

ip virtual-reassembly

duplex auto

speed auto

crypto map roadrunner

!

interface Vlan1

description quest

ip address 10.10.11.1 255.255.255.0

ip nat inside

ip virtual-reassembly

!

interface Vlan2

description roadrunner

ip address 192.168.1.1 255.255.255.0

ip nat inside

ip virtual-reassembly

!

interface Async1

no ip address

encapsulation slip

!

interface Dialer1

ip address negotiated

ip mtu 1492

ip nat outside

ip virtual-reassembly

encapsulation ppp

ip tcp adjust-mss 1452

dialer pool 1

dialer-group 1

ppp authentication chap pap callin

ppp chap hostname xxxxx

ppp chap password 0 xxxxxx

crypto map qwest

!

ip forward-protocol nd

no ip http server

no ip http secure-server

!

ip nat inside source list nat interface Dialer1 overload

ip nat inside source list nat1 interface GigabitEthernet0 overload

ip route 0.0.0.0 0.0.0.0 Dialer1

ip route 0.0.0.0 0.0.0.0 GigabitEthernet0

!

ip access-list extended nat

permit ip 10.10.11.0 0.0.0.255 any

deny ip 10.10.11.0 0.0.0.255 10.10.10.0 0.0.0.255

ip access-list extended nat1

deny ip 192.168.1.0 0.0.0.255 192.168.0.0 0.0.0.255

permit ip 192.168.1.0 0.0.0.255 any

!

access-list 1 permit 10.10.11.0 0.0.0.255

access-list 1 permit 192.168.1.0 0.0.0.255

access-list 100 remark maptest1 category=4

access-list 100 remark IPSec Rule

access-list 100 permit ip 10.10.11.0 0.0.0.255 10.10.10.0 0.0.0.255

access-list 101 remark maptest1 category=4

access-list 101 remark IPSec Rule

access-list 101 permit ip 192.168.1.0 0.0.0.255 192.168.0.0 0.0.0.255

dialer-list 1 protocol ip permit

------------------------------------

pictures for the SRP are provided...

Jennifer Halim · ‎08-27-2012

The following NAT access-list is the other way round:

ip access-list extended nat

permit ip 10.10.11.0 0.0.0.255 any

deny ip 10.10.11.0 0.0.0.255 10.10.10.0 0.0.0.255

The deny statement should be configured on top of the permit statement as follows:

ip access-list extended nat

deny ip 10.10.11.0 0.0.0.255 10.10.10.0 0.0.0.255

permit ip 10.10.11.0 0.0.0.255 any

edgsoccer · ‎08-28-2012

Hi!

I made the changes that you mentioned and I can now ping from SRP to the cisco 800 but cannot ping from cisco 800 to SRP.

Sending 5, 100-byte ICMP Echos to 10.10.10.1, timeout is 2 seconds:

.....

Success rate is 0 percent (0/5)

ping 10.10.10.3

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.10.10.3, timeout is 2 seconds:

.....

Success rate is 0 percent (0/5)

ping 10.10.10.4

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.10.10.4, timeout is 2 seconds:

.....

Success rate is 0 percent (0/5)

-------------------------------------------------------------

PING 10.10.11.1 (10.10.11.1): 32 data bytes
32 bytes from 10.10.11.1: icmp_seq=0 ttl=255 time=57.1 ms
32 bytes from 10.10.11.1: icmp_seq=1 ttl=255 time=100.2 ms
32 bytes from 10.10.11.1: icmp_seq=2 ttl=255 time=57.0 ms
32 bytes from 10.10.11.1: icmp_seq=3 ttl=255 time=57.0 ms
32 bytes from 10.10.11.1: icmp_seq=4 ttl=255 time=57.0 ms
--- 10.10.11.1 ping statistics ---
5 packets transmitted
5 packets received
0% packet loss
round-trip min/avg/max = 57.0/65.6/100.2 ms

Dan Murray · ‎08-28-2012

I have nearly the same situation. both the ASA and router report the SA as up and active.

from the ASA I can do a 'ping inside without issue, but actual lan devices on the ASA side cant reach anything (on the other site) Thinking it has to do with a nat rule, but I've specifically excluded that traffic from nat (at the beginning of the acl). odd.

From ASA site:

MDG-VA-Beach-ASA#

pi inside 172.16.50.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.16.50.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 40/44/50 ms

MDG-VA-Beach-ASA# pi inside 172.16.50.30

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.16.50.30, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 40/42/50 ms

From a ASA Lan PC

C:\Users\Public>route print |findstr "0.0.0.0"

0.0.0.0 0.0.0.0 192.168.200.2 192.168.200.113

224.0.0.0 240.0.0.0 On-link 127.0.0.1

224.0.0.0 240.0.0.0 On-link 192.168.200.113

C:\Users\Public>ping 172.16.50.30 -n 1

Pinging 172.16.50.30 with 32 bytes of data:

Request timed out.

Ping statistics for 172.16.50.30:

Packets: Sent = 1, Received = 0, Lost = 1 (100% loss),

C:\Users\Public>ping 172.16.50.1 -n 1

Pinging 172.16.50.1 with 32 bytes of data:

Request timed out.

Ping statistics for 172.16.50.1:

Packets: Sent = 1, Received = 0, Lost = 1 (100% loss),

On the router side, I can ping the lan interface of the ASA (.2) from the protected interface of the router, but nothing else (tried .5)

US-CRANE-GW#pi

Target IP address: 192.168.200.2

Extended commands [n]: y

Source address or interface: 172.16.50.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.200.2, timeout is 2 seconds:

Packet sent with a source address of 172.16.50.1

.!!!!

Success rate is 80 percent (4/5), round-trip min/avg/max = 44/44/44 ms

US-CRANE-GW#pi

Target IP address: 192.168.200.5

Extended commands [n]: y

Source address or interface: 172.16.50.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.200.5, timeout is 2 seconds:

Packet sent with a source address of 172.16.50.1

.....

Success rate is 0 percent (0/5)