Re: Site to Site VPN with ASA 5505 and PIX 501

jerryfreeman · ‎04-29-2010

I am set up a site-to-site vpn with an ASA 5505 at one end and a PIX 501 at the other.

I followed the section titled Configuring LAN-to-LAN IPsec VPNs from the Command Line Configuration Guide and added these line to the ASA config:

isakmp policy 10 authentication pre-share

isakmp policy 10 encryption 3des

isakmp policy 10 hash sha

isakmp policy 10 group 2

isakmp policy 10 lifetime 43200

isakmp enable outside

crypto ipsec transform-set TRANSFORM_SET esp-3des esp-sha-hmac

access-list l2l_list extended permit ip 10.0.1.0 255.255.255.0 192.168.1.0 255.255.255.0

tunnel-group yyy.yyy.yyy.yyy type ipsec-l2l

tunnel-group yyy.yyy.yyy.yyy ipsec-attributes

pre-shared-key ****

crypto map CRYPTO_MAP 10 match address l2l_list

crypto map CRYPTO_MAP 10 set peer yyy.yyy.yyy.yyy

crypto map CRYPTO_MAP 10 set transform-set TRANSFORM_SET

crypto map CRYPTO_MAP interface outside

For the PIX I followed the example config in Richard Deal's book Cisco PIX Firewalls and added these lines to the PIX config:

access-list l2l_list permit ip 192.168.1.0 255.255.255.0 10.0.1.0 255.255.255.0

nat (inside) 0 access-list l2l_list

access-list IPSEC permit udp host yyy.yyy.yyy.yyy host xxx.xxx.xxx.xxx eq isakmp

access-list IPSEC permit ah host yyy.yyy.yyy.yyy host xxx.xxx.xxx.xxx

access-list IPSEC permit esp host yyy.yyy.yyy.yyy host xxx.xxx.xxx.xxx

access-group IPSEC in interface outside

isakmp policy 10 authentication pre-share

isakmp policy 10 encryption 3des

isakmp policy 10 group 2

isakmp policy 10 hash sha

isakmp key **** address xxx.xxx.xxx.xxx

crypto ipsec transform-set TRANSFORM_SET esp-3des esp-sha-hmac

crypto map GHA_CRYPTO_MAP 10 ipsec-isakmp

crypto map GHA_CRYPTO_MAP 10 set peer xxx.xxx.xxx.xxx

crypto map GHA_CRYPTO_MAP 10 match address l2l_list

crypto map GHA_CRYPTO_MAP 10 set transform-set TRANSFORM_SET

crypto map GHA_CRYPTO_MAP interface outside

I have not been able to establish a connection between the two devices. I just don't see what I am missing. Maybe it is not even possible with these two devices. The ASA has version is 7.2(4) and I believe the PIX is running version 6.3 (I will have to double check later).

Thanks for your help.

Federico Coto Fajardo · ‎04-29-2010

Hi,

Sure that you can establish an IPSec tunnel between both devices.

You're missing the NAT0 statement on the ASA (just like you have it on the PIX, referring the ACL)

Then, you can check if the tunnel is trying to establish with the commands:

sh cry isa sa

sh cry ips sa

Federico.

jerryfreeman · ‎04-29-2010

I added this to the ASA
nat (inside) 0 access-list l2l_list

This is the result:

ASA(config)# sh cry is sa

Active SA: 1

Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)

Total IKE SA: 1

1 IKE Peer: yyy.yyy.yyy.yyy

Type : user Role : initiator

Rekey : no State : MM_WAIT_MSG2

ASA(config)# sh cry ips sa

There are no ipsec sas

Federico Coto Fajardo · ‎04-29-2010

The tunnel from the PIX is landing on the wrong tunnel-group because it's being recognized on the ASA as a ''user''
connection. Should be a LAN-to-LAN.

Could you post both configs?

Federico.

jerryfreeman · ‎04-29-2010

ASA Version 7.2(4)

!

hostname ASA

domain-name xxx.com

enable password **** encrypted

passwd **** encrypted

names

!

interface Vlan1

nameif inside

security-level 100

ip address 10.0.1.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address xxx.xxx.xxx.xxx 255.255.255.240

!

interface Vlan3

no forward interface Vlan1

nameif dmz

security-level 50

no ip address

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

banner exec Authorized Access Only!!

ftp mode passive

clock timezone CST -6

clock summer-time CDT recurring

dns server-group DefaultDNS

domain-name xxx.com

object-group protocol TCPUDP

protocol-object udp

protocol-object tcp

access-list outside_in extended permit icmp any any echo-reply

access-list outside_in extended permit icmp any any time-exceeded

access-list outside_in extended permit tcp any interface outside eq pptp

access-list outside_in extended permit tcp any interface outside eq 3389

access-list outside_in extended permit tcp any interface outside eq ftp

access-list outside_in extended permit tcp any interface outside eq www

access-list outside_in extended permit tcp any interface outside eq https

access-list outside_in extended permit tcp any interface outside eq 3101

access-list split_tunnel extended permit ip 172.17.3.0 255.255.255.0 any

access-list split_tunnel extended permit ip 192.168.0.0 255.255.255.0 any

access-list no_nat extended permit ip 192.168.0.0 255.255.255.0 172.16.49.0 255.255.255.0

access-list no_nat extended permit ip 192.168.0.0 255.255.255.0 172.17.3.0 255.255.255.0

access-list l2l_list extended permit ip 10.0.1.0 255.255.255.0 192.168.1.0 255.255.255.0

pager lines 24

logging asdm informational

mtu inside 1500

mtu outside 1500

mtu dmz 1500

ip local pool dynamic_vpn_pool 172.17.3.1-172.17.3.254 mask 255.255.255.0

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-524.bin

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list l2l_list

nat (inside) 1 0.0.0.0 0.0.0.0

static (inside,outside) tcp interface ftp 10.0.1.5 ftp netmask 255.255.255.255

static (inside,outside) tcp interface pptp 10.0.1.10 pptp netmask 255.255.255.255

static (inside,outside) tcp interface smtp 10.0.1.11 smtp netmask 255.255.255.255

static (inside,outside) tcp interface www 10.0.1.11 www netmask 255.255.255.255

static (inside,outside) tcp interface https 10.0.1.11 https netmask 255.255.255.255

static (inside,outside) tcp interface 3389 10.0.1.11 3389 netmask 255.255.255.255

access-group outside_in in interface outside

route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

aaa authentication http console LOCAL

aaa authentication telnet console LOCAL

aaa authentication ssh console LOCAL

http server enable

http 192.168.1.0 255.255.255.0 inside

http 10.0.1.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set TRANSFORM_SET esp-3des esp-sha-hmac

crypto map CRYPTO_MAP 10 match address l2l_list

crypto map CRYPTO_MAP 10 set peer yyy.yyy.yyy.yyy

crypto map CRYPTO_MAP 10 set transform-set TRANSFORM_SET

crypto map CRYPTO_MAP interface outside

crypto isakmp enable outside

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 43200

telnet 10.0.1.0 255.255.255.0 inside

telnet 172.17.3.0 255.255.255.0 inside

telnet timeout 5

ssh 66.226.222.16 255.255.255.240 outside

ssh timeout 5

console timeout 0

group-policy employees internal

group-policy employees attributes

dns-server value 10.0.1.15

vpn-idle-timeout 720

split-tunnel-policy tunnelspecified

split-tunnel-network-list value split_tunnel

default-domain value xxx.com

username twistadmin password ***** encrypted privilege 15

username administrator password ***** encrypted privilege 15

tunnel-group employees type ipsec-ra

tunnel-group employees general-attributes

address-pool dynamic_vpn_pool

authentication-server-group (outside) LOCAL

default-group-policy employees

tunnel-group employees ipsec-attributes

pre-shared-key *

tunnel-group yyy.yyy.yyy.yyy type ipsec-l2l

tunnel-group yyy.yyy.yyy.yyy ipsec-attributes

pre-shared-key ****

!

class-map inspection_default

match default-inspection-traffic

!

policy-map global_policy

class inspection_default

inspect pptp

inspect ftp

!

service-policy global_policy global

prompt hostname context

Cryptochecksum:8aab3de376588b71bb7ac1c89f9d07ca

: end

Message was edited by: jerryfreeman

jerryfreeman · ‎04-29-2010

Here is the PIX config.

PIX Version 6.3(1)

interface ethernet0 auto

interface ethernet1 100full

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password **** encrypted

passwd **** encrypted

hostname PIX

domain-name xxx.com

clock timezone CST -6

clock summer-time CDT recurring 2 Sun Mar 2:00 1 Sun Nov 2:00

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol ils 389

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

names

access-list l2l_list permit ip 192.168.1.0 255.255.255.0 10.0.1.0 255.255.255.0

access-list IPSEC permit udp host yyy.yyy.yyy.yyy host xxx.xxx.xxx.xxx eq isakmp

access-list IPSEC permit ah host yyy.yyy.yyy.yyy host xxx.xxx.xxx.xxx

access-list IPSEC permit esp host yyy.yyy.yyy.yyy host xxx.xxx.xxx.xxx

pager lines 24

mtu outside 1500

mtu inside 1500

ip address outside dhcp setroute

ip address inside 192.168.1.1 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

pdm logging informational 100

pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list l2l_list

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

access-group IPSEC in interface outside

timeout xlate 0:05:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server LOCAL protocol local

http server enable

http 192.168.1.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

crypto ipsec transform-set TRANSFORM_SET esp-3des esp-sha-hmac

crypto map CRYPTO_MAP 10 ipsec-isakmp

crypto map CRYPTO_MAP 10 match address l2l_list

crypto map CRYPTO_MAP 10 set peer xxx.xxx.xxx.xxx

crypto map CRYPTO_MAP 10 set transform-set TRANSFORM_SET

crypto map CRYPTO_MAP interface outside

isakmp enable outside

isakmp key ******** address xxx.xxx.xxx.xxx netmask 255.255.255.255

isakmp identity address

isakmp policy 10 authentication pre-share

isakmp policy 10 encryption 3des

isakmp policy 10 hash sha

isakmp policy 10 group 2

isakmp policy 10 lifetime 7200

telnet 192.168.1.0 255.255.255.0 inside

telnet timeout 5

ssh timeout 5

console timeout 0

dhcpd address 192.168.1.100-192.168.1.120 inside

dhcpd dns 8.8.8.8 8.8.4.4

dhcpd lease 3600

dhcpd ping_timeout 750

dhcpd auto_config outside

dhcpd enable inside

terminal width 80

Cryptochecksum:8f870843699a2bc0307a73eb8eafd4f2

: end

Federico Coto Fajardo · ‎04-29-2010

On both sides, phase 1 is the same.

So, please make sure that the peer IPs are matching as well.

On the ASA:

tunnel-group yyy.yyy.yyy.yyy type ipsec-l2l
tunnel-group yyy.yyy.yyy.yyy ipsec-attributes
pre-shared-key ****

The IP defined above should be the public IP where the tunnel is going to terminate (outside IP of the PIX)

The pre-shared-key should match the pre-shared key on the PIX.

On the PIX:

isakmp key ******** address xxx.xxx.xxx.xxx netmask 255.255.255.255

Check that the IP and key defined also match the outside IP of the ASA.

If everything above is correct, also verify the peer statement under the crypto maps, that the're pointing to the correct IPs.

Federico.

jerryfreeman · ‎04-29-2010

I've verified the IP addresses and keys on both devices and I'm still not able to get them to link up. I really have no idea why this is not working.

Federico Coto Fajardo · ‎04-29-2010

Could you please post the debugs from the ASA when trying to establish the tunnel?

debug cry isa 127

debug cry ips 127

Federico.

jerryfreeman · ‎04-29-2010

Thanks for your patience with me, Federico.

ASA(config)# debug cry isa 127

ASA(config)# Apr 29 13:57:45 [IKEv1 DEBUG]: Pitcher: received a key acquiremessage, spi 0x0

Apr 29 13:57:45 [IKEv1]: IP = 76.183.133.235, IKE Initiator: New Phase 1, Intf inside, IKE Peer 76.183.133.235 local Proxy Address 10.0.1.0, remote Proxy Addre

ss 192.168.1.0, Crypto map (CRYPTO_MAP)

Apr 29 13:57:45 [IKEv1 DEBUG]: IP = OutsidePIXAddress, constructing ISAKMP SA paylo

ad

Apr 29 13:57:45 [IKEv1 DEBUG]: IP = OutsidePIXAddress, constructing Fragmentation V

ID + extended capabilities payload

Apr 29 13:57:45 [IKEv1]: IP = OutsidePIXAddress, IKE_DECODE SENDING Message (msgid=

0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

Apr 29 13:57:50 [IKEv1 DEBUG]: Pitcher: received a key acquire message, spi 0x0

Apr 29 13:57:50 [IKEv1]: IP = OutsidePIXAddress, Queuing KEY-ACQUIRE messages to be

processed when P1 SA is complete.

Apr 29 13:57:53 [IKEv1]: IP = OutsidePIXAddress, IKE_DECODE RESENDING Message (msgi

d=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

Apr 29 13:57:56 [IKEv1 DEBUG]: Pitcher: received a key acquire message, spi 0x0

Apr 29 13:57:56 [IKEv1]: IP = OutsidePIXAddress, Queuing KEY-ACQUIRE messages to be

processed when P1 SA is complete.

Apr 29 13:58:01 [IKEv1]: IP = OutsidePIXAddress, IKE_DECODE RESENDING Message (msgi

d=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

Apr 29 13:58:01 [IKEv1 DEBUG]: Pitcher: received a key acquire message, spi 0x0

Apr 29 13:58:01 [IKEv1]: IP = OutsidePIXAddress, Queuing KEY-ACQUIRE messages to be

processed when P1 SA is complete.

Apr 29 13:58:09 [IKEv1]: IP = 76.183.133.235, IKE_DECODE RESENDING Message (msgi

d=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

Apr 29 13:58:17 [IKEv1 DEBUG]: IP = OutsidePIXAddress, IKE MM Initiator FSM error h

istory (struct &0x42ee820) , : MM_DONE, EV_ERROR-->MM_WAIT_MSG2,

EV_RETRY-->MM_WAIT_MSG2, EV_TIMEOUT-->MM_WAIT_MSG2, NullEvent-->MM_SND_MSG1, EV

_SND_MSG-->MM_SND_MSG1, EV_START_TMR-->MM_SND_MSG1, EV_RESEND_MSG-->MM_WAIT_MSG2

, EV_RETRY

Apr 29 13:58:17 [IKEv1 DEBUG]: IP = OutsidePIXAddress, IKE SA MM:87862c4c terminati

ng: flags 0x01000022, refcnt 0, tuncnt 0

Apr 29 13:58:17 [IKEv1 DEBUG]: IP = OutsidePIXAddress, sending delete/delete with r

eason message

Apr 29 13:58:17 [IKEv1]: IP = OutsidePIXAddress, Removing peer from peer table fail

ed, no match!

Apr 29 13:58:17 [IKEv1]: IP = OutsidePIXAddress, Error: Unable to remove PeerTblEnt

ry

ASA(config)# debug cry ips 127

ASA(config)# Apr 29 14:01:07 [IKEv1 DEBUG]: Pitcher: received a key acquire

message, spi 0x0

Apr 29 14:01:07 [IKEv1]: IP = OutsidePIXAddress, IKE Initiator: New Phase 1, Intf i

nside, IKE Peer OutsidePIXAddress local Proxy Address 10.0.1.0, remote Proxy Addre

ss 192.168.1.0, Crypto map (CRYPTO_MAP)

Apr 29 14:01:07 [IKEv1 DEBUG]: IP = OutsidePIXAddress, constructing ISAKMP SA paylo

ad

Apr 29 14:01:07 [IKEv1 DEBUG]: IP = OutsidePIXAddress, constructing Fragmentation V

ID + extended capabilities payload

Apr 29 14:01:07 [IKEv1]: IP = OutsidePIXAddress, IKE_DECODE SENDING Message (msgid=

0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

Apr 29 14:01:12 [IKEv1 DEBUG]: Pitcher: received a key acquire message, spi 0x0

Apr 29 14:01:12 [IKEv1]: IP = OutsidePIXAddress, Queuing KEY-ACQUIRE messages to be

processed when P1 SA is complete.

Apr 29 14:01:15 [IKEv1]: IP = 76.183.133.235, IKE_DECODE RESENDING Message (msgi

d=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

Apr 29 14:01:18 [IKEv1 DEBUG]: Pitcher: received a key acquire message, spi 0x0

Apr 29 14:01:18 [IKEv1]: IP = 76.183.133.235, Queuing KEY-ACQUIRE messages to be

processed when P1 SA is complete.

Apr 29 14:01:23 [IKEv1]: IP = OutsidePIXAddress, IKE_DECODE RESENDING Message (msgi

d=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

Apr 29 14:01:23 [IKEv1 DEBUG]: Pitcher: received a key acquire message, spi 0x0

Apr 29 14:01:23 [IKEv1]: IP = 76.183.133.235, Queuing KEY-ACQUIRE messages to be

processed when P1 SA is complete.

Apr 29 14:01:31 [IKEv1]: IP = 76.183.133.235, IKE_DECODE RESENDING Message (msgi

d=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

Apr 29 14:01:36 [IKEv1 DEBUG]: Pitcher: received a key acquire message, spi 0x0

Apr 29 14:01:36 [IKEv1]: IP = OutsidePIXAddress, Queuing KEY-ACQUIRE messages to be

processed when P1 SA is complete.

Apr 29 14:01:38 [IKEv1 DEBUG]: Pitcher: received a key acquire message, spi 0x0

Apr 29 14:01:38 [IKEv1]: IP = OutsidePIXAddress, Queuing KEY-ACQUIRE messages to be

processed when P1 SA is complete.

Apr 29 14:01:39 [IKEv1 DEBUG]: Pitcher: received a key acquire message, spi 0x0

Apr 29 14:01:39 [IKEv1]: IP = OutsidePIXAddress, Queuing KEY-ACQUIRE messages to be

processed when P1 SA is complete.

Apr 29 14:01:39 [IKEv1 DEBUG]: IP = OutsidePIXAddress, IKE MM Initiator FSM error h

istory (struct &0x4123368) , : MM_DONE, EV_ERROR-->MM_WAIT_MSG2,

EV_RETRY-->MM_WAIT_MSG2, EV_TIMEOUT-->MM_WAIT_MSG2, NullEvent-->MM_SND_MSG1, EV

_SND_MSG-->MM_SND_MSG1, EV_START_TMR-->MM_SND_MSG1, EV_RESEND_MSG-->MM_WAIT_MSG2

, EV_RETRY

Apr 29 14:01:39 [IKEv1 DEBUG]: IP = OutsidePIXAddress, IKE SA MM:2eaca391 terminati

ng: flags 0x01000022, refcnt 0, tuncnt 0

Apr 29 14:01:39 [IKEv1 DEBUG]: IP = OutsidePIXAddress, sending delete/delete with r

eason message

Apr 29 14:01:39 [IKEv1]: IP = OutsidePIXAddress, Removing peer from peer table fail

ed, no match!

Apr 29 14:01:39 [IKEv1]: IP = OutsidePIXAddress, Error: Unable to remove PeerTblEnt

ry

Apr 29 14:01:41 [IKEv1 DEBUG]: Pitcher: received a key acquire message, spi 0x0

Apr 29 14:01:41 [IKEv1]: IP = OutsidePIXAddress, IKE Initiator: New Phase 1, Intf i

nside, IKE Peer OutsidePIXAddress local Proxy Address 10.0.1.0, remote Proxy Addre

ss 192.168.1.0, Crypto map (CRYPTO_MAP)

Apr 29 14:01:41 [IKEv1 DEBUG]: IP = OutsidePIXAddress, constructing ISAKMP SA paylo

ad

Apr 29 14:01:41 [IKEv1 DEBUG]: IP = OutsidePIXAddress, constructing Fragmentation V

ID + extended capabilities payload

Apr 29 14:01:41 [IKEv1]: IP = OutsidePIXAddress, IKE_DECODE SENDING Message (msgid=

0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

Apr 29 14:01:44 [IKEv1 DEBUG]: Pitcher: received a key acquire message, spi 0x0

Apr 29 14:01:44 [IKEv1]: IP = OutsidePIXAddress, Queuing KEY-ACQUIRE messages to be

processed when P1 SA is complete.

Apr 29 14:01:49 [IKEv1]: IP = OutsidePIXAddress, IKE_DECODE RESENDING Message (msgi

d=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

Apr 29 14:01:50 [IKEv1 DEBUG]: Pitcher: received a key acquire message, spi 0x0

Apr 29 14:01:50 [IKEv1]: IP = OutsidePIXAddress, Queuing KEY-ACQUIRE messages to be

processed when P1 SA is complete.

ASA(config)# Apr 29 14:01:57 [IKEv1]: IP = OutsidePIXAddress, IKE_DECODE RESEND

ING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) tota

l length : 108

Apr 29 14:02:05 [IKEv1]: IP = OutsidePIXAddress, IKE_DECODE RESENDING Message (msgi

d=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

ASA(config)#

ASA(config)# Apr 29 14:02:13 [IKEv1 DEBUG]: IP = OutsidePIXAddress, IKE MM Init

iator FSM error history (struct &0x41dff08) , : MM_DONE, EV_ERRO

R-->MM_WAIT_MSG2, EV_RETRY-->MM_WAIT_MSG2, EV_TIMEOUT-->MM_WAIT_MSG2, NullEvent-

->MM_SND_MSG1, EV_SND_MSG-->MM_SND_MSG1, EV_START_TMR-->MM_SND_MSG1, EV_RESEND_M

SG-->MM_WAIT_MSG2, EV_RETRY

Apr 29 14:02:13 [IKEv1 DEBUG]: IP = OutsidePIXAddress, IKE SA MM:83d9df69 terminati

ng: flags 0x01000022, refcnt 0, tuncnt 0

Apr 29 14:02:13 [IKEv1 DEBUG]: IP = OutsidePIXAddress, sending delete/delete with r

eason message

Apr 29 14:02:13 [IKEv1]: IP = OutsidePIXAddress, Removing peer from peer table fail

ed, no match!

Apr 29 14:02:13 [IKEv1]: IP = OutsidePIXAddress, Error: Unable to remove PeerTblEnt

ry

Federico Coto Fajardo · ‎04-29-2010

The only thing that I've noticed is that the outside IP of the PIX is given by DHCP.

Is this IP dynamic or static?

Normally with DHCP, you require a dynamic-to-static IPsec configuration on the ASA (if the outside IP of the PIX changes).

Have you checked that the outside IP of the PIX is the same as the peer's IP on the ASA?

Do you have any other tunnels currently active on either side? sh cry isa sa

Federico.

jerryfreeman · ‎04-29-2010

The outside address of the PIX is dynamic and the address of the ASA is static.

So should I change these lines on the ASA from this

crypto map CRYPTO_MAP 10 match address l2l_list

crypto map CRYPTO_MAP 10 set peer yyy.yyy.yyy.yyy

crypto map CRYPTO_MAP 10 set transform-set TRANSFORM_SET

crypto map CRYPTO_MAP interface outside

to this?

crypto dynamic-map DYN_MAP 10 match address l2l_list

crypto dynamic-map DYN_MAP 10 set transform-set TRANSFORM_SET

crypto map CRYPTO_MAP 10 ipsec-isakmp dynamic DYN_MAP

crypto map DYN_MAP interface outside

Are there any other changes I need to make to the ASA or the PIX to use the dynamic address of the PIX?

Federico Coto Fajardo · ‎04-29-2010

That's what you need correct.

Please try with that configuration.

The ASA side will have a dynamic map and the PIX will still use a static map configuration.

Federico.

jerryfreeman · ‎04-30-2010

Still not having any luck getting this figured out. Here are the configs for the ASA and PIX. I am sure I am missing something simple, but I can't find it.

When I try to ping from the 10.0.1.0 network to 192.168.1.0 network, I get no response.

This is the output I get when I use sh cry ip sa on the ASA:

There are no ipsec sas

This is the output I get when I use sh cry is sa on the ASA:

There are no isakmp sas

ASA Version 7.2(4)

!

hostname ASA

domain-name xxx.com

enable password removed encrypted

passwd removed encrypted

names

!

interface Vlan1

nameif inside

security-level 100

ip address 10.0.1.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address xxx.xxx.xxx.xxx 255.255.255.240

!

interface Vlan3

no forward interface Vlan1

nameif dmz

security-level 50

no ip address

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

banner exec Authorized Access Only!!

ftp mode passive

clock timezone CST -6

clock summer-time CDT recurring

dns server-group DefaultDNS

domain-name xxx.com

object-group protocol TCPUDP

protocol-object udp

protocol-object tcp

access-list outside_in extended permit icmp any any echo-reply

access-list outside_in extended permit icmp any any time-exceeded

access-list outside_in extended permit tcp any interface outside eq pptp

access-list outside_in extended permit tcp any interface outside eq 3389

access-list outside_in extended permit tcp any interface outside eq ftp

access-list outside_in extended permit tcp any interface outside eq www

access-list outside_in extended permit tcp any interface outside eq https

access-list outside_in extended permit tcp 64.18.0.0 255.255.240.0 interface outside eq smtp

access-list split_tunnel extended permit ip 172.17.3.0 255.255.255.0 any

access-list split_tunnel extended permit ip 192.168.0.0 255.255.255.0 any

access-list no_nat extended permit ip 192.168.0.0 255.255.255.0 172.16.49.0 255.255.255.0

access-list no_nat extended permit ip 192.168.0.0 255.255.255.0 172.17.3.0 255.255.255.0

access-list l2l_list extended permit ip 10.0.1.0 255.255.255.0 192.168.1.0 255.255.255.0

pager lines 24

logging asdm informational

mtu inside 1500

mtu outside 1500

mtu dmz 1500

ip local pool dynamic_vpn_pool 172.17.3.1-172.17.3.254 mask 255.255.255.0

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-524.bin

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list l2l_list

nat (inside) 1 0.0.0.0 0.0.0.0

static (inside,outside) tcp interface ftp 10.0.1.5 ftp netmask 255.255.255.255

static (inside,outside) tcp interface pptp 10.0.1.10 pptp netmask 255.255.255.255

static (inside,outside) tcp 65.44.73.211 ftp 10.0.1.91 ftp netmask 255.255.255.255

static (inside,outside) tcp interface 5000 10.0.1.39 5000 netmask 255.255.255.255

static (inside,outside) tcp interface 5003 10.0.1.39 5003 netmask 255.255.255.255

static (inside,outside) tcp interface 5200 10.0.1.39 5200 netmask 255.255.255.255

static (inside,outside) tcp interface telnet 10.0.1.40 telnet netmask 255.255.255.255

static (inside,outside) tcp interface smtp 10.0.1.11 smtp netmask 255.255.255.255

static (inside,outside) tcp interface www 10.0.1.11 www netmask 255.255.255.255

static (inside,outside) tcp interface https 10.0.1.11 https netmask 255.255.255.255

static (inside,outside) tcp interface 3389 10.0.1.11 3389 netmask 255.255.255.255

access-group outside_in in interface outside

route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.209 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

aaa authentication http console LOCAL

aaa authentication telnet console LOCAL

aaa authentication ssh console LOCAL

http server enable

http 192.168.1.0 255.255.255.0 inside

http 10.0.1.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set TRANSFORM_SET esp-3des esp-sha-hmac

crypto dynamic-map DYN_MAP 10 match address l2l_list

crypto dynamic-map DYN_MAP 10 set transform-set TRANSFORM_SET

crypto map CRYPTO_MAP 10 match address l2l_list

crypto map CRYPTO_MAP 10 set transform-set TRANSFORM_SET

crypto map CRYPTO_MAP 99 ipsec-isakmp dynamic DYN_MAP

crypto map CRYPTO_MAP interface outside

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

telnet 10.0.1.0 255.255.255.0 inside

telnet 172.17.3.0 255.255.255.0 inside

telnet timeout 60

ssh 66.226.222.16 255.255.255.240 outside

ssh timeout 5

console timeout 0

group-policy employees internal

group-policy employees attributes

dns-server value 10.0.1.15

vpn-idle-timeout 720

split-tunnel-policy tunnelspecified

split-tunnel-network-list value split_tunnel

default-domain value xxx.com

username twistadmin password removed encrypted privilege 15

username administrator password removed encrypted privilege 15

tunnel-group DefaultL2LGroup ipsec-attributes

pre-shared-key *

tunnel-group employees type ipsec-ra

tunnel-group employees general-attributes

address-pool dynamic_vpn_pool

authentication-server-group (outside) LOCAL

default-group-policy employees

tunnel-group employees ipsec-attributes

pre-shared-key *

!

class-map inspection_default

match default-inspection-traffic

!

policy-map global_policy

class inspection_default

inspect pptp

inspect ftp

!

service-policy global_policy global

prompt hostname context

Cryptochecksum:6fa6e6b3e629202b55a6cbd06be0df0b

: end

PIX Version 6.3(1)

interface ethernet0 auto

interface ethernet1 100full

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password removed encrypted

passwd removed encrypted

hostname PIX

domain-name xxx.com

clock timezone CST -6

clock summer-time CDT recurring 2 Sun Mar 2:00 1 Sun Nov 2:00

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol ils 389

fixup protocol pptp 1723

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

names

access-list l2l_list permit ip 192.168.1.0 255.255.255.0 10.0.1.0 255.255.255.0

access-list IPSEC permit udp host yyy.yyy.yyy.yyy host xxx.xxx.xxx.xxx eq isakmp

access-list IPSEC permit ah host yyy.yyy.yyy.yyy host xxx.xxx.xxx.xxx

access-list IPSEC permit esp host yyy.yyy.yyy.yyy host xxx.xxx.xxx.xxx

pager lines 24

mtu outside 1500

mtu inside 1500

ip address outside dhcp setroute

ip address inside 192.168.1.1 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

pdm logging informational 100

pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list l2l_list

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

access-group IPSEC in interface outside

timeout xlate 0:05:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server LOCAL protocol local

http server enable

http 192.168.1.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

crypto ipsec transform-set TRANSFORM_SET esp-3des esp-sha-hmac

crypto map CRYPTO_MAP 10 ipsec-isakmp

crypto map CRYPTO_MAP 10 match address l2l_list

crypto map CRYPTO_MAP 10 set peer xxx.xxx.xxx.xxx

crypto map CRYPTO_MAP 10 set transform-set TRANSFORM_SET

crypto map CRYPTO_MAP interface outside

isakmp key ******** address xxx.xxx.xxx.xxx netmask 255.255.255.255

isakmp policy 10 authentication pre-share

isakmp policy 10 encryption 3des

isakmp policy 10 hash sha

isakmp policy 10 group 2

isakmp policy 10 lifetime 86400

telnet 192.168.1.0 255.255.255.0 inside

telnet timeout 5

ssh timeout 5

console timeout 0

dhcpd address 192.168.1.100-192.168.1.120 inside

dhcpd dns 8.8.8.8 8.8.4.4

dhcpd lease 3600

dhcpd ping_timeout 750

dhcpd auto_config outside

dhcpd enable inside

terminal width 80

Cryptochecksum:88882f95e4ea5623e1ae6b3a24af1a01

: end

Federico Coto Fajardo · ‎04-30-2010

On the ASA, remove these two lines and try again please:

no crypto map CRYPTO_MAP 10 match address l2l_list

no crypto map CRYPTO_MAP 10 set transform-set TRANSFORM_SET

Federico.