cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
134
Views
5
Helpful
2
Replies
Highlighted
Beginner

VPN connection between Cisco ASA and Cisco Router issue

Hello Dears, 

 

I am trying to configure a VPN tunnel between Cisco ASA and cisco router 2900, but the tunnel doesn't seem to work.

 

- below are the changes i done on the ASA:

crypto ikev1 policy 5
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400


object-group network destination-ranges
network-object 192.168.15.0 255.255.255.0
!
access-list vpn-destination extended permit ip object-group local-ranges object-group destination-ranges
!
access-list outgoing extended permit tcp object-group local-ranges object-group destination-ranges range 1 65535
access-list outgoing extended permit ip object-group local-ranges object-group destination-ranges

nat (inside,outside) source static local-ranges local-ranges destination static destination-ranges destination-ranges no-proxy-arp route-lookup
!
crypto ipsec ikev1 transform-set ESP-AES-SHA esp-aes esp-sha-hmac
!

crypto ipsec ikev1 transform-set destination esp-3des esp-md5-hmac

crypto map outside_map 10 match address vpn-destination
crypto map outside_map 10 set peer (destination IP)
crypto map outside_map 10 set ikev1 transform-set destination


tunnel-group (destination IP) type ipsec-l2l
tunnel-group (destination IP) ipsec-attributes
ikev1 pre-shared-key (pre-shared key)

 

- and below are the changes done on the router:

 

crypto isakmp policy 10
encr aes
authentication pre-share
group 2

crypto isakmp key (pre-shared key) address (destination IP)

ip access-list extended VPN
permit ip 192.168.15.0 0.0.0.255 192.168.0.0 0.0.0.255

access-list 100 deny ip 192.168.15.0 0.0.0.255 192.168.0.0 0.0.0.255

crypto ipsec transform-set ESP-DES esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES esp-aes esp-sha-hmac


crypto map MAP 200 ipsec-isakmp
set peer (destination IP)
set transform-set ESP-DES
match address VPN

interface GigabitEthernet0/0
crypto map MAP

can anyone help or show me how i can troubleshoot the issue? 

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Beginner

Re: VPN connection between Cisco ASA and Cisco Router issue

Hello there...

There's several things to check out.

 

On the ASA

Is the 'destination-ranges' routed towards the outside interface?

There's no group-policy assigned to the ASA tunnel-group, so i inherits from the 'DfltGrpPolicy' is 'IKEv1' allowed as a 'vpn-tunnel-protocol'?

 

Is IKEv1 enabled on the outside interface?

Should be something like:

crypto ikev1 enable outside

 

On the router

Where is ACL 100 used? My guess would be in the NAT overload access-list, if there's any.

 

This could be a start to troubleshoot.

View solution in original post

2 REPLIES 2
Highlighted
Beginner

Re: VPN connection between Cisco ASA and Cisco Router issue

Hello there...

There's several things to check out.

 

On the ASA

Is the 'destination-ranges' routed towards the outside interface?

There's no group-policy assigned to the ASA tunnel-group, so i inherits from the 'DfltGrpPolicy' is 'IKEv1' allowed as a 'vpn-tunnel-protocol'?

 

Is IKEv1 enabled on the outside interface?

Should be something like:

crypto ikev1 enable outside

 

On the router

Where is ACL 100 used? My guess would be in the NAT overload access-list, if there's any.

 

This could be a start to troubleshoot.

View solution in original post

Highlighted
Beginner

Re: VPN connection between Cisco ASA and Cisco Router issue

I needed to enable it on the outside interface as you mentioned. thank you.