Solved: VPN L2L dynamic to static w/o DefaultL2LGroup

Lybra1983 · ‎01-07-2011

I was looking for a method to have L2L VPN dyn to static without using DefaultL2LGroup but defining instead multiple tunnel groups for each router with dynamic IP. Many people say it's not possible, but I found this guide: http://inetpro.org/wiki/LAN-to-LAN_IPSec_VPN_between_PIX/ASA_7.2_hub_and_IOS_spokes_with_dynamic_IP_addresses

Now the problem: the vpn comes up but I cannot reach any device with a ping.

Static side: ASA 5505 - 8.22

Dynamic side: Zyxel P-661HW-D3

Here the config for the ASA:

access-list outside extended permit icmp any any
access-list outside extended deny ip any any
access-list inside extended permit ip 10.1.0.0 255.255.248.0 10.51.10.0 255.255.255.0
access-list inside extended deny ip any any
access-list VPN extended permit ip 10.1.0.0 255.255.248.0 10.51.10.0 255.255.255.0
access-list ST_3710 extended permit ip 10.1.0.0 255.255.248.0 10.51.10.0 255.255.255.0

nat (inside) 0 access-list VPN
nat (inside) 1 10.1.0.0 255.255.248.0

access-group inside in interface inside
access-group outside in interface outside

crypto ipsec transform-set myset esp-3des esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000

crypto dynamic-map DN3710 1 match address ST_3710
crypto dynamic-map DN3710 1 set transform-set myset

crypto map dyn-map 2 ipsec-isakmp dynamic DN3710
crypto map dyn-map interface outside

crypto isakmp enable outside

crypto isakmp policy 10
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400

crypto isakmp policy 20
authentication pre-share
encryption des
hash md5
group 2
lifetime 86400
no crypto isakmp nat-traversal

group-policy GP3710 internal
group-policy GP3710 attributes
vpn-filter value ST_3710
vpn-tunnel-protocol IPSec

tunnel-group TG3710 type ipsec-l2l
tunnel-group TG3710 general-attributes
default-group-policy GP3710
tunnel-group TG3710 ipsec-attributes
pre-shared-key *********

As you can see the vpn is up:

2   IKE Peer: ***.***.***.***
    Type    : L2L             Role    : responder
    Rekey   : no              State   : AM_ACTIVE

Thanks in advance if someone can help me with this issue.

Regards,

Luca

Gustavo Medina · ‎01-07-2011

Hello Luca,

You are right this can be done, you can have the spokes landing on separate tunnel-groups, not just to the DefaultL2LGroup, the ASA follows this sequence when doing a tunnel-group looup for L2L tunnels with Pre-shared keys:

- ike-id checked first and could be either hostname (fqdn) or IP address

- if ike-id lookup fails ASA tries Peer IP address

- DefaultRAGroup/DefaultL2LGroup is used as a last resort

From the output of your "sh cry isa sa" I can see that at least Phase 1 is up for your tunnel, please make sure that it landed on the correct tunnel-group.

The problem that I can clearly see here is the VPN filter that you applied to the group-policy, remember that we must apply the vpn-filters on inbound direction.

When a vpn-filter is applied to a group-policy that governs a LAN to LAN VPN connection, the ACL should be configured with the
remote network in the src_ip position of the ACL and the local network in the dest_ip position of the ACL. Caution should be exercised when constructing the
ACLs for use with the vpn-filter feature. The ACLs are constructed with the post-decrypted traffic in mind, however, they are also applied to the traffic
in the opposite direction.

In your case the remote network is 10.51.10.0 255.255.255.0 and the local network is 10.1.0.0 255.255.248.0. so lets say that you want to allow just telnet:

The following ACE will allow remote network to telnet to the local network:

access-list vpnfilt-l2l permit 10.51.10.0 255.255.255.0 10.1.0.0 255.255.248.0 eq 23

The following ACE will allow the local network to telnet to the remote network:
access-list vpnfilt-l2l permit 10.0.0.0 255.255.255.0 eq 23 10.1.0.0 255.255.248.0

Note: The ACE access-list vpnfilt-l2l permit 10.51.10.0 255.255.255.0 10.1.0.0 255.255.248.0 eq 23 will allow the local network to initiate a connection to the remote network on any TCP port if it uses a source port of 23.

The ACE access-list vpnfilt-l2l permit 10.0.0.0 255.255.255.0 eq 23 10.1.0.0 255.255.248.0 will allow the remote network to initiate a connection to the local network on any TCP port if it uses a source port of 23.

Regards,

View solution in original post

Gustavo Medina · ‎01-07-2011