Troubles With VPN Tunnel Between ASA and Sophos XG

[shankm001]

Hi All,

I am hoping for some guidance here as i have been struggling with this for a day, i have not been able to bring up the tunnel between an XG230 and an ASA 5510-x.

The configuration on the ASA end:

access-list testvpn extended permit ip any <ip/subnet of remote site> (not ASA)
access-list testvpn extended permit ip <ip/subnet of network attached to ASA locally>
access-list testvpn extended permit ip <ip/subnet of network known to ASA, one of our branch sites>

crypto ipsec ikev1 transform-set testusavpn esp-aes-256 esp-sha-hmac

crypto ipsec ikev1 transform-set transform esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set users esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set software esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set external esp-aes esp-sha-hmac

crypto map test 16 match address testvpn
crypto map test 16 set pfs
crypto map test 16 set peer x.x.x.x
crypto map test 16 set ikev1 transform-set testvpn
crypto map test 16 set reverse-route

crypto ikev2 enable outside
crypto ikev1 enable outside
crypto ikev1 policy 1
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
crypto ikev1 policy 2
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
crypto ikev1 policy 3
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 14400
crypto ikev1 policy 4
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400

tunnel-group x.x.x.x type ipsec-l2l
tunnel-group x.x.x.x ipsec-attributes
ikev1 pre-shared-key *****
peer-id-validate nocheck
isakmp keepalive disable

nat (asalocal,outside) source static asalocalnetwork asalocalnetwork destination static TestSite TestSite no-proxy-arp
nat (inside,outside) source static Branchoffice Branchoffice destination static TestUSASite TestUSASite no-proxy-arp
nat (inside,any) source static TestSite TestSite destination static VPNusers VPNUsers no-proxy-arp route-lookup
nat (outside,outside) source static VPNUsers VPNUsers destination static TestSite TestSite no-proxy-arp route-lookup

Sophos Configuration:

Connection Type: Site to Site

Policy:  

Allow Rekeying

Key negotiation tries 3

Main mode

Pass data in compressed format

Algorithm Encryption: AES256

Authentication Sha1

DH Group 2

Key life 86400

Rekey Margin 120

Dead Peer detection enabled

Phase 2

AES256/Sha1

PFS Group 2

Key life 86400

I have attached the debug log at level 254 on the ASA.  I have messed around with the policy on the Sophos and just haven't been able to get the connection up.

Please help!

Thanks

[Philip D'Ath]

Hoes does your branch network connect to this ASA?

[shankm001]

MPLS network provided by the ISP. 

We have two other Sophos UTM 9's with successful VPN tunnels to the ASA, so it does work.  I have tried to replicate the config, but it's not working.

[Philip D'Ath]

Lets start by correcting the access list.  Delete it and replace it with:

access-list testvpn extended permit ip <ip/subnet of network attached to ASA locally> <ip/subnet of remote site>
access-list testvpn extended permit ip <ip/subnet of network known to ASA, one of our branch sites> <ip/subnet of remote site>

[shankm001]

I had it like this originally, but the ASA kept on saying it did not match any policies.  Once i added this line it finally matched the crypto statements in 16.

[shankm001]

I have attached the IPsec logs from the sophos as well.

[shankm001]

Ok after removing the top line, debug log shows this:

Apr 27 12:34:34 [IKEv1]Group = x.x.x.x, IP = x.x.x.x, Static Crypto Map check, map = CMAP, seq = 16, ACL does not match proxy IDs src:10.50.0.0 dst:0.0.0.0
Apr 27 12:34:34 [IKEv1]Group = x.x.x.x, IP = x.x.x.x, Skipping dynamic map DYNMAP sequence 100: cannot match peerless map when peer found in previous map entry.
Apr 27 12:34:34 [IKEv1]Group = x.x.x.x, IP = x.x.x.x, Rejecting IPSec tunnel: no matching crypto map entry for remote proxy 10.50.0.0/255.255.255.0/0/0 local proxy 0.0.0.0/0.0.0.0/0/0 on interface outside

To make things easier:

access-list testvpn line 1 extended permit ip 10.100.0.0 255.255.0.0 10.50.0.0 255.255.255.0 
access-list testvpn line 2 extended permit ip 10.10.0.0 255.255.0.0 10.50.0.0 255.255.255.0 

[Philip D'Ath]

Your access list and the remote access list do not match.

[shankm001]

I haven't actually set an ACL on the Sophos, are you talking about the configured firewall rules?

[Philip D'Ath]

How does Sophos now what subnets to encrypt traffic for?

[shankm001]

Thanks for pointing out that configuration flaw though!

[shankm001]

Alright i have gotten the VPN connection working.

I had to uncheck pass data in compressed format on the Sophos!

Although, i cannot ping the internal subnets from the ASA > Sophos or vice versa.

Going to assume it's the routing table, the ASA has the 10.50.x.x in it's route table and pointed to the outside interface.  Now just need to figure out how to get it into the Sophos?

[shankm001]

Ok so i used to be able to use a remote connect VPN back to the datacenter from this testsite.  Since creating the tunnel and the site to site vpn, i can no longer remote connect.

Is this going to be possible anymore?  It is the same originating IP addess.

Logs from the ASA:

(config)# Apr 27 21:48:50 [IKEv1]Group = VPNGROUP, Username = xxxx, IP = x.x.x.x, QM FSM error (P2 struct &0x00007fff9e3e2840, mess id 0x7db5 f26c)!
Apr 27 21:48:50 [IKEv1]Group = VPNGROUP Username = xxxxx IP = x.x.x.x, Removing peer from correlator table failed, no match!
Apr 27 21:48:50 [IKEv1]Group = VPNGROUP, Username = xxxxxx, IP = x.x.x.x, Session is being torn down. Reason: crypto map policy not found

[Philip D'Ath]

What IP address does your client get?  Something from the local lan?  Something from a pool of addresses?

[shankm001]

The IP that is getting x'd out there is the off site public IP, once connected the client would get an IP from a specified range not in the local lan.  It is specific to remote access VPN users.  If that is what you are asking?