Buy or Renew
Buy or Renew
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
4148
Views
0
Helpful
7
Replies

Site-to-site VPN Up But Won't Pass Traffic (ASA 5505's version 8.3.1 and 9.2.3)

Go to solution
Keegan Santos
Level 1
Level 1

‎02-10-2015 10:47 AM

Hello,

I am setting up a site to site vpn tunnel between two locations.  Both have cisco ASA 5505's running different version, i'll explain in more detail below.  so far I have been able to get the tunnel to come up but I cannot get it to pass traffic, I have been working at this for days now and have not been able to figure out why it won't pass traffic.  Needless to say the client is PO'd over the fact that their VPN isn't up and they have been having to do things by hand.  I'll put the configs below, if possible could someone help me ASAP, I really want to get this up and running so we don't lose the client.

Site A IP = 0.0.0.0
Site B IP = 1.1.1.1

Site A Version = 8.3.1
Site B Version = 9.2.3

__________________________

_________

SITE A RUNNING CONFIG

Result of the command: "sh run"

: Saved
:
ASA Version 8.3(1)
!
hostname SDMCLNASA01
domain-name SDMCLNASA01.LOCAL
enable password 5E8js/Fs7qxjxWdp encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.0.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 0.0.0.0 255.255.255.252
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
clock timezone CST -6
clock summer-time CDT recurring
dns domain-lookup inside
dns domain-lookup outside
dns server-group DefaultDNS
 domain-name SDMCLNASA01.LOCAL
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network NETWORK_OBJ_192.168.0.0_24
 subnet 192.168.0.0 255.255.255.0
object network NETWORK_OBJ_192.168.1.0_24
 subnet 192.168.1.0 255.255.255.0
object network lan_internal
 subnet 192.168.0.0 255.255.255.0
object network smtp
 host 192.168.0.245
object network http
 host 192.168.0.245
object network rdp
 host 192.168.0.245
object network ssl
 host 192.168.0.245
object network camera_1
 host 192.168.0.13
object network camerahttp
 host 192.168.0.13
object service 8081
 service tcp source eq 8081 destination eq 8081
 description dvr  
object network camera-http
 host 192.168.0.13
object network dvr-http
 host 192.168.0.13
object network dvr-mediaport
 host 192.168.0.13
object-group protocol DM_INLINE_PROTOCOL_1
 protocol-object udp
 protocol-object tcp
object-group protocol TCPUDP
 protocol-object udp
 protocol-object tcp
object-group service DM_INLINE_TCP_1 tcp
 port-object eq 3389
 port-object eq www
 port-object eq https
 port-object eq smtp
object-group service DM_INLINE_TCP_2 tcp
 port-object eq 34567
 port-object eq 34599
 port-object eq 8081
access-list outside_1_cryptomap extended permit ip 192.168.0.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list outside_access_in extended permit tcp any any eq smtp
access-list outside_access_in extended permit tcp any any object-group DM_INLINE_TCP_1
access-list outside_access_in extended permit tcp any any object-group DM_INLINE_TCP_2
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 192.168.1.0 255.255.255.0
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
icmp permit any outside
no asdm history enable
arp timeout 14400
nat (inside,outside) source static NETWORK_OBJ_192.168.0.0_24 NETWORK_OBJ_192.168.0.0_24 destination static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24
nat (outside,inside) source static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 destination static NETWORK_OBJ_192.168.0.0_24 NETWORK_OBJ_192.168.0.0_24
!
object network lan_internal
 nat (inside,outside) dynamic interface
object network smtp
 nat (any,outside) static interface service tcp smtp smtp
object network http
 nat (any,outside) static interface service tcp www www
object network rdp
 nat (any,outside) static interface service tcp 3389 3389
object network ssl
 nat (any,outside) static interface service tcp https https
object network dvr-http
 nat (any,outside) static interface service tcp 8081 8081
object network dvr-mediaport
 nat (any,outside) static interface service tcp 34567 34567
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 71.42.194.209 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable 8080
http 192.168.0.0 255.255.255.0 inside
http 192.168.1.0 255.255.255.0 inside
http 192.168.1.0 255.255.255.0 outside
http 71.40.221.136 255.255.255.252 inside
http 71.40.221.136 255.255.255.252 outside
http 192.168.0.0 255.255.255.0 outside
http 97.79.197.42 255.255.255.255 inside
http 97.79.197.42 255.255.255.255 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set peer 1.1.1.1
crypto map outside_map 1 set transform-set ESP-3DES-SHA
crypto map outside_map interface outside
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 65535
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.0.50-192.168.0.150 inside
dhcpd dns 192.168.0.245 209.18.47.62 interface inside
dhcpd domain SDMCLNASA01.LOCAL interface inside
dhcpd enable inside
!

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
group-policy DfltGrpPolicy attributes
 vpn-tunnel-protocol IPSec l2tp-ipsec
tunnel-group 1.1.1.1 type ipsec-l2l
tunnel-group 1.1.1.1 ipsec-attributes
 pre-shared-key *****
!
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
!
prompt hostname context
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:462428c25e9748896e98863f2d8aeee7
: end

________________________________

SITE B RUNNING CONFIG

Result of the command: "sh run"

: Saved
:
: Serial Number: JMX1635Z1BV
: Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz
:
ASA Version 9.2(3)
!
hostname ciscoasa
enable password qddbwnZVxqYXToV9 encrypted
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
names
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 1.1.1.1 255.255.255.252
!
ftp mode passive
clock timezone CST -6
clock summer-time CDT recurring
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network camera_http
 host 192.168.1.13
object network camera_media
 host 192.168.1.13
object network NETWORK_OBJ_192.168.0.0_24
 subnet 192.168.0.0 255.255.255.0
object network NETWORK_OBJ_192.168.1.0_24
 subnet 192.168.1.0 255.255.255.0
access-list outside_access_in extended permit tcp any any eq 9000
access-list outside_access_in extended permit tcp any any eq www
access-list outside_access_in extended permit icmp any any
access-list outside_cryptomap extended permit ip 192.168.1.0 255.255.255.0 object NETWORK_OBJ_192.168.0.0_24
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
icmp permit any outside
asdm image disk0:/asdm-732.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,outside) source static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 destination static NETWORK_OBJ_192.168.0.0_24 NETWORK_OBJ_192.168.0.0_24
nat (outside,inside) source static NETWORK_OBJ_192.168.0.0_24 NETWORK_OBJ_192.168.0.0_24 destination static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24
!
object network camera_http
 nat (any,outside) static interface service tcp www www
object network camera_media
 nat (any,outside) static interface service tcp 9000 9000
!
nat (inside,outside) after-auto source dynamic any interface
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 71.40.221.137 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
crypto ipsec ikev2 ipsec-proposal AES256
 protocol esp encryption aes-256
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
 protocol esp encryption aes-192
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
 protocol esp encryption aes
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
 protocol esp encryption 3des
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal DES
 protocol esp encryption des
 protocol esp integrity sha-1 md5
crypto ipsec security-association pmtu-aging infinite
crypto map outside_map 1 match address outside_cryptomap
crypto map outside_map 1 set peer 0.0.0.0
crypto map outside_map 1 set ikev1 transform-set ESP-3DES-SHA
crypto map outside_map interface outside
crypto ca trustpool policy
crypto ikev2 policy 1
 encryption aes-256
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 10
 encryption aes-192
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 20
 encryption aes
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 30
 encryption 3des
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 40
 encryption des
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev1 enable outside
crypto ikev1 policy 120
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
telnet timeout 5
ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0

dhcpd address 192.168.1.50-192.168.1.150 inside
dhcpd dns 192.168.0.245 209.18.47.61 interface inside
dhcpd domain SDPHARR.LOCAL interface inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
 anyconnect-essentials
group-policy DfltGrpPolicy attributes
 vpn-tunnel-protocol ikev1
group-policy GroupPolicy_0.0.0.0 internal
group-policy GroupPolicy_0.0.0.0 attributes
 vpn-tunnel-protocol ikev1 ikev2
tunnel-group 0.0.0.0 type ipsec-l2l
tunnel-group 0.0.0.0 ipsec-attributes
 ikev1 pre-shared-key *****
 ikev2 remote-authentication pre-shared-key *****
 ikev2 local-authentication pre-shared-key *****
!
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
!
prompt hostname context
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:19031ab1e3bae21d7cc8319fb7ecf0eb
: end
Labels:
0 Helpful
1 Accepted Solution

Accepted Solutions

Go to solution
burleyman
Level 8
Level 8
In response to Keegan Santos

‎02-10-2015 01:43 PM

Sorry my mistake.

Remove this if it is still there

crypto map external_map 1 set reverse-route

 

Add this to both sides

crypto map outside_map 1 set reverse-route

 

Sorry about that.

 

Mike

View solution in original post

0 Helpful
7 Replies 7

Go to solution
burleyman
Level 8
Level 8

‎02-10-2015 01:10 PM

You are close....this should fix it up.

 

Site A

Remove Not needed.
no nat (outside,inside) source static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 destination static NETWORK_OBJ_192.168.0.0_24 NETWORK_OBJ_192.168.0.0_24

Add this, it is missing
crypto map external_map 1 set reverse-route


Site B

Remove Not needed.
no nat (outside,inside) source static NETWORK_OBJ_192.168.0.0_24 NETWORK_OBJ_192.168.0.0_24 destination static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24

Add this, it is missing
crypto map external_map 1 set reverse-route

 

 

Hope this helps,

Mike

0 Helpful

Go to solution
Keegan Santos
Level 1
Level 1
In response to burleyman

‎02-10-2015 01:29 PM

I tried that but still not change.  I'm curious as to where external_map one is in my configs, I didn't see it, unless i'm confused as to the way it works

0 Helpful

Go to solution
burleyman
Level 8
Level 8
In response to Keegan Santos

‎02-10-2015 01:43 PM

Sorry my mistake.

Remove this if it is still there

crypto map external_map 1 set reverse-route

 

Add this to both sides

crypto map outside_map 1 set reverse-route

 

Sorry about that.

 

Mike

0 Helpful

Go to solution
Keegan Santos
Level 1
Level 1
In response to burleyman

‎02-10-2015 02:17 PM

ah ok, makes sense now, still no change though unfortunately.
 

0 Helpful

Go to solution
Keegan Santos
Level 1
Level 1
In response to Keegan Santos

‎02-10-2015 02:23 PM

i'm not sure if this is relevant or not but i did a sh ipsec sa on site b and it is showing pkts encaps, encrypt, and digest but nothing on decaps or decrypt

i ran the same command on site a and it is the exact opposite, it has pkts decaps, decrypt, and verify, but nothing in encaps, encrypt, or digest

i compared this to a known working vpn between two other cisco asa's (running pre-8.3 so they can't help me in this case) and on the known working one there is packets in both of those areas.  

Could this indicate that site b sends and encrypts and site a recieves and decrypts, site a is not able to send and encrypt?

0 Helpful

Go to solution
Keegan Santos
Level 1
Level 1
In response to Keegan Santos

‎02-11-2015 08:52 AM

After look at the stats on the sh ipsec sa i figured that the tunnel is getting traffic through but the asa 8.3 isnt' sending, did a reboot on it and that fixed the issue finally, i do know the crypto helped though becuase that wasn't the case  until i did that, thank you for you help.

0 Helpful

Go to solution
burleyman
Level 8
Level 8
In response to Keegan Santos

‎02-11-2015 10:36 AM

Glad I was able to help. One more thing that I do is remove the ikev2 if both sides don't support it or use it. I have had co-workers have it do odd things when one side has ikv2 "stuff" configured but is not using it. Based on that you could  remove

tunnel-group 0.0.0.0 ipsec-attributes
 no ikev2 remote-authentication pre-shared-key *****
 no ikev2 local-authentication pre-shared-key *****

 

Just remove the two lines with the "no", do NOT remove the tunnel-group.

 

But if it is working you could just leave it.

 

Mike

0 Helpful
Customers Also Viewed These Support Documents