4 out of 25 VPN tunnel is not getting up.....

Hi Experts,
I have found one strange problem with IPSec VPN, the scenario is like this, our corporate office is connected to its 25 remote office with IPSec VPN, at corporate site, cisco 2811 router is installed and same type of router is installed at each remote site and IPSec VPN is configured between remote office and corporate office and further each remote site router has two other VPN configured which are working properly. Now the problem is, 4 out of 25 remote offices are not getting up with corporate office, I mean the VPN is not getting up for these location. I sit at corporate office and have tried my level best to up these VPN but the problem not getting resolved.
Now the strange problem is that the VPN gets up by itself, after sometime like in 10days or 20days, for sometime and gets down by itself later.
Anyone who can give some insights where the problem could be and how could i troubleshoot the problem?
Thanks in advance for your valuable response

Hi Mike,
Thanks for your reply...
Below are some logs from corporate router with one of the tunnel which is not getting up::
RTR-FTR-PJB#debug crypto isakmp
Crypto ISAKMP debugging is on
RTR-FTR-PJB#ping 172.26.10.1 source l1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.26.10.1, timeout is 2 seconds:
Packet sent with a source address of 172.21.128.1
*Mar 22 12:19:32.147: ISAKMP: local port 500, remote port 500
*Mar 22 12:19:32.147: ISAKMP: set new node 0 to QM_IDLE
*Mar 22 12:19:32.147: ISAKMP: Find a dup sa in the avl tree during calling isadb_insert sa = 459BC390
*Mar 22 12:19:32.147: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
*Mar 22 12:19:32.147: ISAKMP:(0):found peer pre-shared key matching remote_ipsec_peer
*Mar 22 12:19:32.147: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID
*Mar 22 12:19:32.147: ISAKMP:(0): constructed NAT-T vendor-07 ID
*Mar 22 12:19:32.147: ISAKMP:(0): constructed NAT-T vendor-03 ID
*Mar 22 12:19:32.147: ISAKMP:(0): constructed NAT-T vendor-02 ID
*Mar 22 12:19:32.147: ISAKMP:(0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
*Mar 22 12:19:32.147: ISAKMP:(0):Old State = IKE_READY  New State = IKE_I_MM1
*Mar 22 12:19:32.147: ISAKMP:(0): beginning Main Mode exchange
*Mar 22 12:19:32.147: ISAKMP:(0): sending packet to remote_ipsec_peer my_port 500 peer_port 500 (I) MM_NO_STATE
*Mar 22 12:19:32.147: ISAKMP:(0):Sending an IKE IPv4 Packet......
Success rate is 0 percent (0/5)
RTR-FTR-PJB#
*Mar 22 12:19:42.147: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
*Mar 22 12:19:42.147: ISAKMP (0:0): incrementing error counter on sa, attempt 1 of 5: retransmit phase 1
*Mar 22 12:19:42.147: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
*Mar 22 12:19:42.147: ISAKMP:(0): sending packet to remote_ipsec_peer my_port 500 peer_port 500 (I) MM_NO_STATE
*Mar 22 12:19:42.147: ISAKMP:(0):Sending an IKE IPv4 Packet.
*Mar 22 12:19:52.147: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
*Mar 22 12:19:52.147: ISAKMP (0:0): incrementing error counter on sa, attempt 2 of 5: retransmit phase 1
*Mar 22 12:19:52.147: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
*Mar 22 12:19:52.147: ISAKMP:(0): sending packet to remote_ipsec_peer my_port 500 peer_port 500 (I) MM_NO_STATE
*Mar 22 12:19:52.147: ISAKMP:(0):Sending an IKE IPv4 Packet.
*Mar 22 12:20:02.143: ISAKMP: set new node 0 to QM_IDLE
*Mar 22 12:20:02.143: ISAKMP:(0):SA is still budding. Attached new ipsec request to it. (local 10.100.103.2, remote remote_ipsec_peer)
*Mar 22 12:20:02.147: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
*Mar 22 12:20:02.147: ISAKMP (0:0): incrementing error counter on sa, attempt 3 of 5: retransmit phase 1
*Mar 22 12:20:02.147: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
*Mar 22 12:20:02.147: ISAKMP:(0): sending packet to remote_ipsec_peer my_port 500 peer_port 500 (I) MM_NO_STATE
*Mar 22 12:20:02.147: ISAKMP:(0):Sending an IKE IPv4 Packet.
*Mar 22 12:20:03.847: ISAKMP:(0):purging node 1974447943
*Mar 22 12:20:03.847: ISAKMP:(0):purging node -1277953536
*Mar 22 12:20:12.147: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
*Mar 22 12:20:12.147: ISAKMP (0:0): incrementing error counter on sa, attempt 4 of 5: retransmit phase 1
*Mar 22 12:20:12.147: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
*Mar 22 12:20:12.147: ISAKMP:(0): sending packet to remote_ipsec_peer my_port 500 peer_port 500 (I) MM_NO_STATE
*Mar 22 12:20:12.147: ISAKMP:(0):Sending an IKE IPv4 Packet.
*Mar 22 12:20:13.847: ISAKMP:(0):purging SA., sa=451DF344, delme=451DF344
*Mar 22 12:20:22.147: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
*Mar 22 12:20:22.147: ISAKMP (0:0): incrementing error counter on sa, attempt 5 of 5: retransmit phase 1
*Mar 22 12:20:22.147: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
*Mar 22 12:20:22.147: ISAKMP:(0): sending packet to remote_ipsec_peermy_port 500 peer_port 500 (I) MM_NO_STATE
*Mar 22 12:20:22.147: ISAKMP:(0):Sending an IKE IPv4 Packet.
*Mar 22 12:20:32.147: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
*Mar 22 12:20:32.147: ISAKMP:(0):peer does not do paranoid keepalives.
*Mar 22 12:20:32.147: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer remote_ipsec_peer)
*Mar 22 12:20:32.147: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer remote_ipsec_peer)
*Mar 22 12:20:32.147: ISAKMP:(0):deleting node -1242602279 error FALSE reason "IKE deleted"
*Mar 22 12:20:32.147: ISAKMP:(0):deleting node 275856152 error FALSE reason "IKE deleted"
*Mar 22 12:20:32.147: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
*Mar 22 12:20:32.147: ISAKMP:(0):Old State = IKE_I_MM1  New State = IKE_DEST_SA
*Mar 22 12:21:22.147: ISAKMP:(0):purging node -1242602279
*Mar 22 12:21:22.147: ISAKMP:(0):purging node 275856152
*Mar 22 12:21:32.147: ISAKMP:(0):purging SA., sa=459BC390, delme=459BC390
RTR-FTR-PJB#debug crypto ipsec
Crypto IPSEC debugging is on
RTR-FTR-PJB#ping 172.26.10.1 source l1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.26.10.1, timeout is 2 seconds:
Packet sent with a source address of 172.21.128.1
*Mar 22 12:23:27.411: IPSEC(sa_request): ,
  (key eng. msg.) OUTBOUND local= 10.100.103.2, remote= remote_ipsec_peer,
    local_proxy= 172.21.128.0/255.255.252.0/0/0 (type=4),
    remote_proxy= 172.26.10.0/255.255.254.0/0/0 (type=4),
    protocol= ESP, transform= esp-des esp-md5-hmac  (Tunnel),
    lifedur= 3600s and 4608000kb,
    spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x0.....
Success rate is 0 percent (0/5)
RTR-FTR-PJB#
*Mar 22 12:23:57.411: IPSEC(key_engine): request timer fired: count = 1,
  (identity) local= 10.100.103.2, remote= remote_ipsec_peer,
    local_proxy= 172.21.128.0/255.255.252.0/0/0 (type=4),
    remote_proxy= 172.26.10.0/255.255.254.0/0/0 (type=4)
*Mar 22 12:23:57.411: IPSEC(sa_request): ,
  (key eng. msg.) OUTBOUND local= 10.100.103.2, remote= remote_ipsec_peer,
    local_proxy= 172.21.128.0/255.255.252.0/0/0 (type=4),
    remote_proxy= 172.26.10.0/255.255.254.0/0/0 (type=4),
    protocol= ESP, transform= esp-des esp-md5-hmac  (Tunnel),
    lifedur= 3600s and 4608000kb,
    spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x0
RTR-FTR-PJB#debug crypto engine
*Mar 22 12:28:59.415: crypto_engine: Generate IKE hash
*Mar 22 12:28:59.415: crypto_engine: Generate IKE hash
*Mar 22 12:28:59.415: crypto_engine: Encrypt IKE packet
*Mar 22 12:28:59.727: crypto_engine: Generate IKE hash
*Mar 22 12:28:59.727: crypto_engine: Encrypt IKE packet
*Mar 22 12:28:59.763: crypto_engine: Decrypt IKE packet
*Mar 22 12:28:59.763: crypto_engine: Generate IKE hash
*Mar 22 12:29:00.099: crypto_engine: Decrypt IKE packet
*Mar 22 12:29:00.099: crypto_engine: Generate IKE hash
*Mar 22 12:29:00.099: crypto_engine: Generate IKE hash
*Mar 22 12:29:00.099: crypto_engine: Encrypt IKE packet
*Mar 22 12:29:00.239: crypto_engine: Generate IKE hash
*Mar 22 12:29:00.239: crypto_engine: Encrypt IKE packet
*Mar 22 12:29:00.271: crypto_engine: Decrypt IKE packet
*Mar 22 12:29:00.271: crypto_engine: Generate IKE hash
*Mar 22 12:29:00.359: crypto_engine: Decrypt IKE packet
*Mar 22 12:29:00.359: crypto_engine: Generate IKE hash
*Mar 22 12:29:00.359: crypto_engine: Generate IKE hash
*Mar 22 12:29:00.363: crypto_engine: Encrypt IKE packet
*Mar 22 12:29:00.403: crypto_engine: Generate IKE hash
Few things i would like mention here are:
1. I am able to ping remote_ipsec_peer from my router.
2. At both routers other tunnels are working fine.
3. NATing is not involved at both sides router, we have static ip at both side and static routes are configured to reach the peer.
Anyone who can provide some insights by looking the above log, where the problem could be?

Similar Messages

  • L2L issue, the tunnel does not getting up from one direction

    Hello,
    We have configure a L2L vpn between Asa and 1841 router. We are facing this issue.
    The tunnel is not getting up from the 1841 site never. When we are trying to generate traffic from the ASA site the tunnel is up and we can see decryps and encryps packets.
    Router 1841 Config:
    crypto isakmp policy 100
    encr 3des
    hash md5
    authentication pre-share
    group 2
    crypto isakmp key * address 213.249.XX.XX
    crypto ipsec transform-set XXXXX esp-3des esp-md5-hmac
    crypto map EKO_BG 100 ipsec-isakmp
    set peer 213.249.x.x
    set security-association lifetime seconds 28800
    set transform-set XXXXX
    set pfs group2
    match address 111
    interface FastEthernet0/0.2
    encapsulation dot1Q 3338
    ip address 212.200.30.130 255.255.255.252
    ip nat outside
    ip virtual-reassembly
    crypto map XXXXX
    ip nat pool nat_pool 93.87.XX.XX 93.87.XX.XX prefix-length 29
    ip nat inside source list 101 pool nat_pool overload
    ip nat inside source static 10.70.2.10 93.87.18.161
    ip nat inside source static 10.70.25.10 93.87.18.162
    ip nat inside source static 10.70.36.5 93.87.18.163
    ip nat inside source static 10.70.39.10 93.87.18.164
    ip nat inside source static 10.70.5.10 93.87.18.165
    access-list 101 deny   ip 10.70.200.0 0.0.0.255 any
    access-list 101 permit ip 10.70.0.0 0.0.255.255 any
    access-list 111 permit ip 10.70.200.0 0.0.0.255 172.40.10.100 0.0.0.3
    Asa Config:
    access-list inside_nat0_outbound extended permit ip 172.40.10.100 255.255.255.252 10.70.200.0 255.255.255.0
    access-list outside_cryptomap_320 remark xxxxxxx
    access-list outside_cryptomap_320 extended permit ip 172.40.10.100 255.255.255.252 10.70.200.0 255.255.255.0
    access-list inside_pnat_outbound_V5 extended permit ip host 10.8.x.x 10.70.200.0 255.255.255.0
    pager lines 24
    nat (inside) 9 access-list inside_pnat_outbound_V5
    crypto ipsec transform-set xxxxx esp-3des esp-md5-hmac
    crypto map mymap 150 match address
    crypto map mymap 150 set pfs
    crypto map mymap 150 set peer XXXXXX
    crypto map mymap 150 set transform-set XXX
    crypto map mymap 150 set security-association lifetime seconds 28800
    crypto map mymap 150 set security-association lifetime kilobytes 10000
    crypto map mymap 320 match address outside_cryptomap_320
    crypto map mymap 320 set pfs
    crypto map mymap 320 set peer XXXXX
    crypto map mymap 320 set transform-set XXXXX
    crypto map mymap 320 set security-association lifetime seconds 28800
    crypto map mymap 320 set security-association lifetime kilobytes 4608000
    crypto map mymap 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map mymap interface outside
    isakmp policy 150 authentication pre-share
    isakmp policy 150 encryption 3des
    isakmp policy 150 hash md5
    isakmp policy 150 group 2
    tunnel-group 212.200.x.x type ipsec-l2l
    tunnel-group 212.200.x.x ipsec-attributes
    pre-shared-key *
    Please advise.
    Thank you.

    hello Ashley,
    thank you for this info. Now from the router site the tunneling is getting up and I can see packets but althought the tunnel is up it can not make telnet to our server (172.40.10.100) on a specific port.
    We from ASA site can ping router Site and make telnet.
    Any ideas???
    Thank you all from your answers!

  • I set iCloud up last week and the next day when out in the field I could not get Outlook to open up.  I want to change my settings so I can get mail at home or in the field

    I set iCloud up last week and the next day when out in the field I could not get Outlook to open up.  I want to change my settings so I can get mail at home or in the field, not just when i'm at home.  I have a PC and fios internet with Verizon at home.  I have a Sprint air card in the field or access an available wifi.  I want to change my settings to allow for receiving email in the field.  What's the point of an air card and icloud for backup fi it doesn't work in the field for some odd reason?

    Apple - Support - Mail Setup Assistant

  • Cisco 881 ISR IPSec VPN Tunnel does not pass traffic from the vlan.

    I have a cisco 881 ISR Router with a site-to-site IPsec vpn tunnel to a mikrotik device on the other end (I inherited this from my client). The tunnel is constructed properly and is up, however traffic does not pass or get routed to the FA4 interface. I see in my packet captures that it hits the vlan1 interface (vlans are required on the L2 ports) and does not pass to the tunnel.
    This is my configuration:
    141Kerioth#sh config
    Using 3763 out of 262136 bytes
    ! Last configuration change at 01:02:41 UTC Mon May 26 2014 by admin
    version 15.2
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname 141Kerioth
    boot-start-marker
    boot-end-marker
    logging buffered 51200 warnings
    aaa new-model
    141Kerioth#do wr mem
                  ^
    % Invalid input detected at '^' marker.
    141Kerioth#wr mem
    Building configuration...
    [OK]
    141Kerioth#sh run
    Building configuration...
    Current configuration : 5053 bytes
    ! Last configuration change at 01:38:06 UTC Mon May 26 2014 by admin
    version 15.2
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname 141Kerioth
    boot-start-marker
    boot-end-marker
    logging buffered 51200 warnings
    aaa new-model
    aaa authentication login default local
    aaa authentication ppp default local
    aaa session-id common
    memory-size iomem 10
    crypto pki trustpoint TP-self-signed-580381394
     enrollment selfsigned
     subject-name cn=IOS-Self-Signed-Certificate-580381394
     revocation-check none
     rsakeypair TP-self-signed-580381394
    crypto pki certificate chain TP-self-signed-580381394
     certificate self-signed 01
      30820229 30820192 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
      30312E30 2C060355 04031325 494F532D 53656C66 2D536967 6E65642D 43657274
      69666963 6174652D 35383033 38313339 34301E17 0D313430 35323231 38323333
      365A170D 32303031 30313030 30303030 5A303031 2E302C06 03550403 1325494F
      532D5365 6C662D53 69676E65 642D4365 72746966 69636174 652D3538 30333831
      33393430 819F300D 06092A86 4886F70D 01010105 0003818D 00308189 02818100
      B001A012 2CA6970C 0648798B 2A786704 84F2D989 83974B19 9B4287F2 4503D2C9
      173F23C4 FF34D160 202A7565 4A1CE08B 60B3ADAE 6E19EE6E 9CD39E72 71F9650E
      930F22FE C4441F9C 2D7DD420 71F75DFC 3CCAC94E BA304685 E0E62658 A3E8D01C
      D01D7D6A 5AF0B0E6 3CF6AF3A B7E51F83 9BF6D38E 65254E1F 71369718 ADADD691
      02030100 01A35330 51300F06 03551D13 0101FF04 05300301 01FF301F 0603551D
      23041830 168014D6 24878F12 1FFADF2F 537A438E 6DD7FB6B D79E4130 1D060355
      1D0E0416 0414D624 878F121F FADF2F53 7A438E6D D7FB6BD7 9E41300D 06092A86
      4886F70D 01010505 00038181 00771667 FCA66002 8AB9E5FB F210012F C50B586F
      9A9640BB 45B4CEFD 030A38C0 E610AAC8 B41EF3C4 E55810F9 B2C727CF C1DEFCF1
      0846E7BC 1D95420E 5DADB5F8 EFE7EB37 B5433B80 4FF787D4 B1F2A527 06F065A4
      00522E97 A9D2335C E83C4AE1 E68D7A41 9D0046A7 ADCC282B 7527F84D E71CC567
      14EF37EA 15E57AD0 3C5D01F3 EF
            quit
    ip dhcp excluded-address 10.0.16.1
    ip dhcp pool ccp-pool
     import all
     network 10.0.16.0 255.255.255.0
     default-router 10.0.16.1
     dns-server 8.8.8.8
     lease 0 2
    ip domain name kerioth.com
    ip host hostname.domain z.z.z.z
    ip name-server 8.8.8.8
    ip name-server 4.2.2.2
    ip cef
    no ipv6 cef
    license udi pid CISCO881-K9 sn FTX180483DD
    username admin privilege 15 secret 4 CmmfIy.RPySmo4Q2gEIZ2jlr3J.bTBAszoe5Bry0z4c
    username meadowbrook privilege 0 password 0 $8UBr#Ux
    username meadowbrook autocommand exit
    policy-map type inspect outbound-policy
    crypto isakmp policy 1
     encr 3des
     authentication pre-share
     group 5
    crypto isakmp key 141Township address z.z.z.z
    crypto isakmp keepalive 10
    crypto ipsec transform-set TS esp-3des esp-sha-hmac
     mode tunnel
    crypto map mymap 10 ipsec-isakmp
     set peer z.z.z.z
     set transform-set TS
     match address 115
    interface Loopback0
     no ip address
    interface Tunnel1
     no ip address
    interface FastEthernet0
     no ip address
    interface FastEthernet1
     no ip address
    interface FastEthernet2
     no ip address
    interface FastEthernet3
     no ip address
    interface FastEthernet4
     description $FW_OUTSIDE_WAN$
     ip address 50.y.y.y 255.255.255.240
     ip nat outside
     ip virtual-reassembly in
     duplex auto
     speed auto
     crypto map mymap
    interface Vlan1
     description $ETH_LAN$
     ip address 10.0.16.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
     ip tcp adjust-mss 1452
    ip forward-protocol nd
    ip http server
    ip http access-class 23
    ip http authentication local
    ip http secure-server
    ip http timeout-policy idle 60 life 86400 requests 10000
    ip nat inside source list 115 interface Vlan1 overload
    ip nat inside source list 199 interface FastEthernet4 overload
    ip nat inside source route-map nonat interface FastEthernet4 overload
    ip route 0.0.0.0 0.0.0.0 50.x.x.x
    access-list 110 deny   ip 10.0.16.0 0.0.0.255 10.0.1.0 0.0.0.255
    access-list 110 permit ip 10.0.16.0 0.0.0.255 any
    access-list 115 permit ip 10.0.16.0 0.0.0.255 10.0.1.0 0.0.0.255
    access-list 144 permit icmp host c.c.c.c host 10.0.1.50
    access-list 144 permit icmp host p.p.p.p host 10.0.16.105
    access-list 199 permit ip a.a.a.a 0.0.0.255 any
    no cdp run
    route-map nonat permit 10
     match ip address 100
    line con 0
     no modem enable
    line aux 0
    line vty 0 4
     access-class 1 in
     exec-timeout 30 0
     privilege level 15
     transport preferred ssh
     transport input ssh
    line vty 5 15
     access-class 23 in
     privilege level 15
     transport input telnet ssh
    cns trusted-server all-agents x.x.x.x
    cns trusted-server all-agents hostname
    cns trusted-server all-agents hostname.domain
    cns id hardware-serial
    cns id hardware-serial event
    cns id hardware-serial image
    cns event hostname.domain 11011
    cns config initial hostname.domain 80
    cns config partial hostname.domain 80
    cns exec 80
    end

    Why do you have following command on the PIX?
    crypto map outside_map 40 set transform-set 165.228.x.x
    Also you have this transform set on the PIX:
    crypto ipsec transform-set 10.112.60.0 esp-aes-256 esp-sha-hmac
    This does not match the transfor set on the router:
    crypto ipsec transform-set tritest esp-3des esp-md5-hmac
    Where are you using the access-list/route-map
    101 ?

  • Site-2-Site IPSEC VPN tunnel will not come up.

    Hello Experts,
    Just wondering if I can get some help on setting up a IPSEC VPN tunnel between a Cisco 2921 and ASA 550x. Below is the config
    show run | s crypto
    crypto pki token default removal timeout 0
    crypto isakmp policy 1
    encr aes
    authentication pre-share
    group 2
    lifetime 28800
    crypto isakmp key xxxxxxxxxxxxxxxxxxxxxx address A.A.A.A
    crypto ipsec transform-set ESP-AES128-SHA esp-aes esp-sha-hmac
    mode transport
    crypto map ICQ-2-ILAND 1 ipsec-isakmp
    set peer A.A.A.A
    set transform-set ESP-AES128-SHA
    match address iland_london_s2s_vpn
    crypto map ICQ-2-ILAND
    The config on the remote end has not been shared with me, so I don't know if I am doing something wrong locally or if the remote end is wrongly configured.
    The command Sh crypto isakmp sa displays the following
    show crypto isakmp sa
    IPv4 Crypto ISAKMP SA
    dst             src             state          conn-id status
    A.A.A.A    B.B.B.B   MM_NO_STATE       1231 ACTIVE (deleted)
    IPv6 Crypto ISAKMP SA
    show crypto session
    Crypto session current status
    Interface: GigabitEthernet0/0
    Session status: DOWN-NEGOTIATING
    Peer: A.A.A.A port 500
      IKEv1 SA: local B.B.B.B/500 remote A.A.A.A/500 Inactive
      IKEv1 SA: local B.B.B.B/500 remote A.A.A.A/500 Inactive
      IPSEC FLOW: permit ip 10.20.111.0/255.255.255.0 10.120.1.0/255.255.255.0
            Active SAs: 0, origin: crypto map
      IPSEC FLOW: permit ip 10.10.0.0/255.255.0.0 10.120.1.0/255.255.255.0
            Active SAs: 0, origin: crypto map
    The debug logs from the debug crypto isakmp command are listed below.
    ISAKMP:(0): local preshared key found
    Dec  6 08:51:52.019: ISAKMP : Scanning profiles for xauth ...
    Dec  6 08:51:52.019: ISAKMP:(0):Checking ISAKMP transform 1 against priority 1 policy
    Dec  6 08:51:52.019: ISAKMP:      encryption AES-CBC
    Dec  6 08:51:52.019: ISAKMP:      keylength of 128
    Dec  6 08:51:52.019: ISAKMP:      hash SHA
    Dec  6 08:51:52.019: ISAKMP:      default group 2
    Dec  6 08:51:52.019: ISAKMP:      auth pre-share
    Dec  6 08:51:52.019: ISAKMP:      life type in seconds
    Dec  6 08:51:52.019: ISAKMP:      life duration (basic) of 28800
    Dec  6 08:51:52.019: ISAKMP:(0):atts are acceptable. Next payload is 0
    Dec  6 08:51:52.019: ISAKMP:(0):Acceptable atts:actual life: 0
    Dec  6 08:51:52.019: ISAKMP:(0):Acceptable atts:life: 0
    Dec  6 08:51:52.019: ISAKMP:(0):Basic life_in_seconds:28800
    Dec  6 08:51:52.019: ISAKMP:(0):Returning Actual lifetime: 28800
    Dec  6 08:51:52.019: ISAKMP:(0)::Started lifetime timer: 28800.
    Dec  6 08:51:52.019: ISAKMP:(0): processing vendor id payload
    Dec  6 08:51:52.019: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch
    Dec  6 08:51:52.019: ISAKMP:(0): vendor ID is NAT-T v2
    Dec  6 08:51:52.019: ISAKMP:(0): processing vendor id payload
    Dec  6 08:51:52.019: ISAKMP:(0): processing IKE frag vendor id payload
    Dec  6 08:51:52.019: ISAKMP:(0):Support for IKE Fragmentation not enabled
    Dec  6 08:51:52.019: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    Dec  6 08:51:52.019: ISAKMP:(0):Old State = IKE_I_MM2  New State = IKE_I_MM2
    Dec  6 08:51:52.019: ISAKMP:(0): sending packet to A.A.A.A my_port 500 peer_port 500 (I) MM_SA_SETUP
    Dec  6 08:51:52.019: ISAKMP:(0):Sending an IKE IPv4 Packet.
    Dec  6 08:51:52.019: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    Dec  6 08:51:52.019: ISAKMP:(0):Old State = IKE_I_MM2  New State = IKE_I_MM3
    Dec  6 08:51:52.155: ISAKMP (0): received packet from A.A.A.A dport 500 sport 500 Global (I) MM_SA_SETUP
    Dec  6 08:51:52.155: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    Dec  6 08:51:52.155: ISAKMP:(0):Old State = IKE_I_MM3  New State = IKE_I_MM4
    Dec  6 08:51:52.155: ISAKMP:(0): processing KE payload. message ID = 0
    Dec  6 08:51:52.175: ISAKMP:(0): processing NONCE payload. message ID = 0
    Dec  6 08:51:52.175: ISAKMP:(0):found peer pre-shared key matching A.A.A.A
    Dec  6 08:51:52.175: ISAKMP:(1227): processing vendor id payload
    Dec  6 08:51:52.175: ISAKMP:(1227): vendor ID is Unity
    Dec  6 08:51:52.175: ISAKMP:(1227): processing vendor id payload
    Dec  6 08:51:52.175: ISAKMP:(1227): vendor ID seems Unity/DPD but major 92 mismatch
    Dec  6 08:51:52.175: ISAKMP:(1227): vendor ID is XAUTH
    Dec  6 08:51:52.175: ISAKMP:(1227): processing vendor id payload
    Dec  6 08:51:52.175: ISAKMP:(1227): speaking to another IOS box!
    Dec  6 08:51:52.175: ISAKMP:(1227): processing vendor id payload
    Dec  6 08:51:52.175: ISAKMP:(1227):vendor ID seems Unity/DPD but hash mismatch
    Dec  6 08:51:52.175: ISAKMP:received payload type 20
    Dec  6 08:51:52.175: ISAKMP (1227): His hash no match - this node outside NAT
    Dec  6 08:51:52.175: ISAKMP:received payload type 20
    Dec  6 08:51:52.175: ISAKMP (1227): No NAT Found for self or peer
    Dec  6 08:51:52.175: ISAKMP:(1227):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    Dec  6 08:51:52.179: ISAKMP:(1227):Old State = IKE_I_MM4  New State = IKE_I_MM4
    Dec  6 08:51:52.179: ISAKMP:(1227):Send initial contact
    Dec  6 08:51:52.179: ISAKMP:(1227):SA is doing pre-shared key authentication using id type ID_IPV4_ADDR
    Dec  6 08:51:52.179: ISAKMP (1227): ID payload
            next-payload : 8
            type         : 1
            address      : B.B.B.B
            protocol     : 17
            port         : 500
            length       : 12
    Dec  6 08:51:52.179: ISAKMP:(1227):Total payload length: 12
    Dec  6 08:51:52.179: ISAKMP:(1227): sending packet to A.A.A.A my_port 500 peer_port 500 (I) MM_KEY_EXCH
    Dec  6 08:51:52.179: ISAKMP:(1227):Sending an IKE IPv4 Packet.
    Dec  6 08:51:52.179: ISAKMP:(1227):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    Dec  6 08:51:52.179: ISAKMP:(1227):Old State = IKE_I_MM4  New State = IKE_I_MM5
    Dec  6 08:51:52.315: ISAKMP (1227): received packet from A.A.A.A dport 500 sport 500 Global (I) MM_KEY_EXCH
    Dec  6 08:51:52.315: ISAKMP:(1227): processing ID payload. message ID = 0
    Dec  6 08:51:52.315: ISAKMP (1227): ID payload
            next-payload : 8
            type         : 1
            address      : A.A.A.A
            protocol     : 17
            port         : 0
            length       : 12
    Dec  6 08:51:52.315: ISAKMP:(0):: peer matches *none* of the profiles
    Dec  6 08:51:52.315: ISAKMP:(1227): processing HASH payload. message ID = 0
    Dec  6 08:51:52.315: ISAKMP:received payload type 17
    Dec  6 08:51:52.315: ISAKMP:(1227): processing vendor id payload
    Dec  6 08:51:52.315: ISAKMP:(1227): vendor ID is DPD
    Dec  6 08:51:52.315: ISAKMP:(1227):SA authentication status:
            authenticated
    Dec  6 08:51:52.315: ISAKMP:(1227):SA has been authenticated with A.A.A.A
    Dec  6 08:51:52.315: ISAKMP: Trying to insert a peer B.B.B.B/A.A.A.A/500/,  and inserted successfully 2B79E8BC.
    Dec  6 08:51:52.315: ISAKMP:(1227):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    Dec  6 08:51:52.315: ISAKMP:(1227):Old State = IKE_I_MM5  New State = IKE_I_MM6
    Dec  6 08:51:52.315: ISAKMP:(1227):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    Dec  6 08:51:52.315: ISAKMP:(1227):Old State = IKE_I_MM6  New State = IKE_I_MM6
    Dec  6 08:51:52.315: ISAKMP:(1227):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    Dec  6 08:51:52.315: ISAKMP:(1227):Old State = IKE_I_MM6  New State = IKE_P1_COMPLETE
    Dec  6 08:51:52.315: ISAKMP:(1227):beginning Quick Mode exchange, M-ID of 1511581970
    Dec  6 08:51:52.315: ISAKMP:(1227):QM Initiator gets spi
    Dec  6 08:51:52.315: ISAKMP:(1227): sending packet to A.A.A.A my_port 500 peer_port 500 (I) QM_IDLE
    Dec  6 08:51:52.315: ISAKMP:(1227):Sending an IKE IPv4 Packet.
    Dec  6 08:51:52.315: ISAKMP:(1227):Node 1511581970, Input = IKE_MESG_INTERNAL, IKE_INIT_QM
    Dec  6 08:51:52.315: ISAKMP:(1227):Old State = IKE_QM_READY  New State = IKE_QM_I_QM1
    Dec  6 08:51:52.315: ISAKMP:(1227):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
    Dec  6 08:51:52.315: ISAKMP:(1227):Old State = IKE_P1_COMPLETE  New State = IKE_P1_COMPLETE
    Dec  6 08:51:52.455: ISAKMP (1227): received packet from A.A.A.A dport 500 sport 500 Global (I) QM_IDLE
    Dec  6 08:51:52.455: ISAKMP: set new node -1740216573 to QM_IDLE
    Dec  6 08:51:52.455: ISAKMP:(1227): processing HASH payload. message ID = 2554750723
    Dec  6 08:51:52.455: ISAKMP:(1227): processing NOTIFY PROPOSAL_NOT_CHOSEN protocol 3
            spi 0, message ID = 2554750723, sa = 0x2B78D574
    Dec  6 08:51:52.455: ISAKMP:(1227):deleting node -1740216573 error FALSE reason "Informational (in) state 1"
    Dec  6 08:51:52.455: ISAKMP:(1227):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY
    Dec  6 08:51:52.455: ISAKMP:(1227):Old State = IKE_P1_COMPLETE  New State = IKE_P1_COMPLETE
    Dec  6 08:51:52.455: ISAKMP (1227): received packet from A.A.A.A dport 500 sport 500 Global (I) QM_IDLE
    Dec  6 08:51:52.455: ISAKMP: set new node 1297146574 to QM_IDLE
    Dec  6 08:51:52.455: ISAKMP:(1227): processing HASH payload. message ID = 1297146574
    Dec  6 08:51:52.455: ISAKMP:(1227): processing DELETE payload. message ID = 1297146574
    Dec  6 08:51:52.455: ISAKMP:(1227):peer does not do paranoid keepalives.
    Dec  6 08:51:52.455: ISAKMP:(1227):deleting SA reason "No reason" state (I) QM_IDLE       (peer A.A.A.A)
    Dec  6 08:51:52.455: ISAKMP:(1227):deleting node 1297146574 error FALSE reason "Informational (in) state 1"
    Dec  6 08:51:52.455: ISAKMP: set new node -1178304129 to QM_IDLE
    Dec  6 08:51:52.455: ISAKMP:(1227): sending packet to A.A.A.A my_port 500 peer_port 500 (I) QM_IDLE
    Dec  6 08:51:52.455: ISAKMP:(1227):Sending an IKE IPv4 Packet.
    Dec  6 08:51:52.455: ISAKMP:(1227):purging node -1178304129
    Dec  6 08:51:52.455: ISAKMP:(1227):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
    Dec  6 08:51:52.455: ISAKMP:(1227):Old State = IKE_P1_COMPLETE  New State = IKE_DEST_SA
    Dec  6 08:51:52.455: ISAKMP:(1227):deleting SA reason "No reason" state (I) QM_IDLE       (peer A.A.A.A)
    Dec  6 08:51:52.455: ISAKMP: Unlocking peer struct 0x2B79E8BC for isadb_mark_sa_deleted(), count 0
    Dec  6 08:51:52.455: ISAKMP: Deleting peer node by peer_reap for A.A.A.A: 2B79E8BC
    Dec  6 08:51:52.455: ISAKMP:(1227):deleting node 1511581970 error FALSE reason "IKE deleted"
    Dec  6 08:51:52.455: ISAKMP:(1227):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    Dec  6 08:51:52.455: ISAKMP:(1227):Old State = IKE_DEST_SA  New State = IKE_DEST_SA
    would appreciate any help you can provide.
    Regards,
    Sidney Dsouza

    Hi Anuj,
    thanks for responding. Here are the logs from the debug crypto ipsec
    Dec 10 15:54:38.099 UTC: IPSEC(sa_request): ,
      (key eng. msg.) OUTBOUND local= B.B.B.B:500, remote= A.A.A.A:500,
        local_proxy= 10.20.0.0/255.255.0.0/0/0 (type=4),
        remote_proxy= 10.120.1.0/255.255.255.0/0/0 (type=4),
        protocol= ESP, transform= esp-aes esp-sha-hmac  (Tunnel),
        lifedur= 3600s and 4608000kb,
        spi= 0x0(0), conn_id= 0, keysize= 128, flags= 0x0
    Dec 10 15:54:38.671 UTC: IPSEC(key_engine): got a queue event with 1 KMI message(s)
    thats all that appeared after pinging the remote subnet.

  • RV016 V3 vs RV082 V3 VPN Tunnel Backup not available on RV016

    VPN tunnel backup is not available on the RV016 firmware version 4.0.2.08 (it IS on the RV082. The data sheet and the manual for the RV016 is wrong. I have purchased several RV016 hardware V3 and several RV082 hardware V3. Both have the same current firmware version. We have noted that the RV016 does not have the VPN tunnel failover option found in the RV082. It also does not have split DNS (noted in the manual. A I would have thought that the firmware would provide equal options on the RV042, RV082, and RV016. Good job, Cisco!

    We did not have VPN back up with the V1 RV016, either. Also tried V2 and at the time it was not working. The product that we have found works as expected is the Peplink Balance. There is still a few second delay on failover, but if you have two broadband connections, it is imperceptible. We gave up on the Cisco products.

  • VPN tunnel Problem

    Hi all ,
    I need create VPN tunnels between two  ASAs devices . And these devices are connected through DSL . And as you know in this case we use private outside IP address , because there is  a NAT device at the outside . The problem is that no VPN tunnel is created even though all the parameters and the pre-shared-key are typical .

    I hve allready configured following configuration.
    no crypto map newmap interface outside
    no crypto map newmap 171 set peer 195.11.199.144
    no isakmp key ********* address 195.11.199.144 netmask 255.255.255.255 no-xauth no-config-mode
    crypto map newmap 171 set peer 195.11.204.5
    isakmp key ******** address 195.11.204.5 netmask 255.255.255.255 no-xauth no-config-mode
    clear crypto ipsec sa
    clear crypto isakmp sa
    crypto map newmap interface outside
    Setting were applied successfully however Still VPN tunnel is not been initiated.

  • Cisco ASA 5505 Site to Site VPN tunnel up, but not passing traffic

    Thanks to a previous thread, I do have a 5505 up and running, and passing data....
    https://supportforums.cisco.com/message/3900751
    Now I am trying to get a IPSEC VPN tunnel working.
    I actually have it up (IKE phase 1 & 2 both passed), but it is not sending/receiving data through the tunnel.
    The networks concerned:
    name 10.0.0.0  Eventual  (HQ Site behind Firewall)
    name 1.1.1.0  CFS  (Public Network Gateway for Palo Alto Firewall - Firewall IP: 1.1.1.1)
    name 2.2.2.0  T1  (Remote site - Outside interface of 5505: 2.2.2.2)
    name 10.209.0.0  Local  (Remote Network - internal interface of 5505: 10.209.0.3)
    On a ping to the HQ network from behind the ASA, I get....
    portmap translation creation failed for icmp src inside:10.209.0.9 dst inside:10.0.0.33 (type 8, code 0)
    I am suspecting that there is a NAT error and/or a lack of a static route for the rest of the 10.0.0.0 traffic, and that I may have to exempt/route the traffic for the HQ network (10.0.0.0), but I haven't been able to get the correct entries to make it work.
    Below is the config.
    Can anyone see if there is something sticking out?
    : Saved
    ASA Version 8.2(5)
    hostname ciscoasa
    enable password 8Ry2YjIyt7RRXU24 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 10.0.0.0 Eventual
    name 10.209.0.0 Local
    name 2.2.2.0 T1
    name 1.1.1.0 CFS
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 0
    ip address 10.209.0.3 255.0.0.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address 2.2.2.2 255.255.255.248
    time-range Indefinite
    ftp mode passive
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object-group protocol DM_INLINE_PROTOCOL_1
    protocol-object ip
    protocol-object icmp
    protocol-object udp
    protocol-object tcp
    object-group network DM_INLINE_NETWORK_1
    network-object Eventual 255.0.0.0
    network-object T1 255.255.255.248
    network-object CFS 255.255.255.240
    access-list outside_1_cryptomap extended permit ip Local 255.255.255.0 object-group DM_INLINE_NETWORK_1
    pager lines 24
    logging enable
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any outside
    icmp permit any inside
    asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 1 0.0.0.0 0.0.0.0
    route outside 0.0.0.0 0.0.0.0 67.139.113.217 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http Eventual 255.0.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer 1.1.1.1
    crypto map outside_map 1 set transform-set ESP-3DES-MD5
    crypto map outside_map 1 set phase1-mode aggressive
    crypto map outside_map interface outside
    crypto ca trustpoint _SmartCallHome_ServerCA
    crl configure
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 28800
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    dhcpd address 10.209.0.201-10.209.0.232 inside
    dhcpd dns 8.8.8.8 8.8.4.4 interface inside
    dhcpd auto_config outside interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy DfltGrpPolicy attributes
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    group-policy FTMGP internal
    group-policy FTMGP attributes
    vpn-idle-timeout none
    vpn-filter none
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    tunnel-group 1.1.1.1 type ipsec-l2l
    tunnel-group 1.1.1.1 general-attributes
    default-group-policy FTMGP
    tunnel-group 1.1.1.1 ipsec-attributes
    pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    call-home reporting anonymous
    Cryptochecksum:701d8da28ee256692a1e49d904e9cb04
    : end
    asdm location Eventual 255.0.0.0 inside
    asdm location Local 255.255.255.0 inside
    asdm location T1 255.255.255.248 inside
    asdm location CFS 255.255.255.240 inside
    asdm history enable
    Thank You.

    I'm just re-engaging on the firewall this afternoon, but right now I'm getting request timed out on the pings....
    Here's the output requested:
    Result of the command: "show crypto isakmp sa"
    Active SA: 1
    Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
    Total IKE SA: 1
    1 IKE Peer: 1.1.1.1
    Type : L2L Role : initiator
    Rekey : no State : AM_ACTIVE
    Result of the command: "show crypto ipsec sa"
    interface: outside
    Crypto map tag: outside_map, seq num: 1, local addr: 2.2.2.2
    access-list outside_1_cryptomap extended permit ip 10.209.0.0 255.255.255.0 10.0.0.0 255.0.0.0
    local ident (addr/mask/prot/port): (Local/255.255.255.0/0/0)
    remote ident (addr/mask/prot/port): (Eventual/255.0.0.0/0/0)
    current_peer: 1.1.1.1
    #pkts encaps: 84, #pkts encrypt: 84, #pkts digest: 84
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 84, #pkts comp failed: 0, #pkts decomp failed: 0
    #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
    #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
    #send errors: 0, #recv errors: 0
    local crypto endpt.: 2.2.2.2, remote crypto endpt.: 1.1.1.1
    path mtu 1500, ipsec overhead 58, media mtu 1500
    current outbound spi: 8FC06BD1
    current inbound spi : 42EC16F4
    inbound esp sas:
    spi: 0x42EC16F4 (1122768628)
    transform: esp-3des esp-md5-hmac no compression
    in use settings ={L2L, Tunnel, PFS Group 2, }
    slot: 0, conn_id: 4096, crypto-map: outside_map
    sa timing: remaining key lifetime (kB/sec): (62207/28464)
    IV size: 8 bytes
    replay detection support: Y
    Anti replay bitmap:
    0x00000000 0x00000001
    outbound esp sas:
    spi: 0x8FC06BD1 (2411752401)
    transform: esp-3des esp-md5-hmac no compression
    in use settings ={L2L, Tunnel, PFS Group 2, }
    slot: 0, conn_id: 4096, crypto-map: outside_map
    sa timing: remaining key lifetime (kB/sec): (62201/28464)
    IV size: 8 bytes
    replay detection support: Y
    Anti replay bitmap:
    0x00000000 0x00000001
    Here's the current config:
    : Saved
    ASA Version 8.2(5)
    hostname ciscoasa
    enable password 8Ry2YjIyt7RRXU24 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 10.0.0.0 Eventual
    name 10.209.0.0 Local
    name 67.139.113.216 T1
    name 1.1.1.0 IntegraCFS
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 0
    ip address 10.209.0.3 255.0.0.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address 2.2.2.2 255.255.255.248
    time-range Indefinite
    ftp mode passive
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object-group protocol DM_INLINE_PROTOCOL_1
    protocol-object ip
    protocol-object icmp
    protocol-object udp
    protocol-object tcp
    object-group network DM_INLINE_NETWORK_1
    network-object Eventual 255.0.0.0
    network-object T1 255.255.255.248
    network-object IntegraCFS 255.255.255.240
    access-list outside_1_cryptomap extended permit ip Local 255.255.255.0 object-group DM_INLINE_NETWORK_1
    access-list No_NAT extended permit ip Local 255.255.255.0 Eventual 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any inside
    icmp permit any outside
    asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list No_NAT
    nat (inside) 1 0.0.0.0 0.0.0.0
    route outside 0.0.0.0 0.0.0.0 2.2.2.0 1
    route outside Eventual 255.255.255.0 1.1.1.1 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http Eventual 255.0.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer 1.1.1.1
    crypto map outside_map 1 set transform-set ESP-3DES-MD5
    crypto map outside_map 1 set security-association lifetime kilobytes 65535
    crypto map outside_map 1 set phase1-mode aggressive
    crypto map outside_map interface outside
    crypto ca trustpoint _SmartCallHome_ServerCA
    crl configure
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 28800
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    dhcpd address 10.209.0.201-10.209.0.232 inside
    dhcpd dns 8.8.8.8 8.8.4.4 interface inside
    dhcpd auto_config outside interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy DfltGrpPolicy attributes
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    group-policy FTMGP internal
    group-policy FTMGP attributes
    vpn-idle-timeout none
    vpn-filter none
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    tunnel-group 1.1.1.1 type ipsec-l2l
    tunnel-group 1.1.1.1 general-attributes
    default-group-policy FTMGP
    tunnel-group 1.1.1.1 ipsec-attributes
    pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
    message-length maximum client auto
    message-length maximum 512
    policy-map global_policy
    class inspection_default
    inspect dns preset_dns_map
    inspect ftp
    inspect h323 h225
    inspect h323 ras
    inspect rsh
    inspect rtsp
    inspect esmtp
    inspect sqlnet
    inspect skinny
    inspect sunrpc
    inspect xdmcp
    inspect sip
    inspect netbios
    inspect tftp
    inspect ip-options
    inspect icmp
    service-policy global_policy global
    prompt hostname context
    call-home reporting anonymous
    Cryptochecksum:301e573544ce0f89b3c597bdfe2c414a
    : end
    asdm location Eventual 255.0.0.0 inside
    asdm location Local 255.255.255.0 inside
    asdm location T1 255.255.255.248 inside
    asdm location IntegraCFS 255.255.255.240 inside
    asdm history enable

  • Router-to-PIX VPN Tunnels fade in and out

    Does anyone know of any problems with Router-to-PIX vpn tunnels? For a number of months we've had about 35 831Routers vpn'd into our PIX515 and the tunnel has been stable. Recently, however, the tunnel has been dropping out at a number of sites.
    When the tunnel goes down the users still have access to their local internet but obviously not to the shared network resources of the vpn tunnel. In most cases the tunnel can be re-established at each location simply by rebooting the router. Only problem with that is that some of the locations are having to reboot their 831Router more than two or three times a day.
    I've added keepalive statements into theconfig of the routers and the PIX. Specifically I've added these two lines to the routers:
    Crypto isakmp keepalive 10 5
    crypto ipsec secutity-association lifetime seconds 28800
    I added a similar isakmp keepalive to the PIX. Any suggestions would be appreciated as some of my users are getting frustrated.
    Thank you,
    Chris

    Try using the debug commands and see if you are getting any error messages that might give us some idea.

  • VPN split tunneling does not work with filtering enabled

    I restricted our Windows VPN clients  to reach only certain IPs and ports using filtering in their group policy. It works but I would like to add split tunneling for client's local Internet access. I temporary disabled filtering, unchecked the 'user default gateway on remote' box in properties of Windows VPN client, configured networks to be tunneled and it works. The moment I configure filters, my split tunneling does not tunnel the networks - they are not listed in Windows 'route print'. I change filtering to inherit or NONE and reconnect VPN and the tunneled networks show up again. I change filtering to a simple testing ACL/ACE and reconnect and they are gone again. Can I have split tunneling and filtering working simultaneously? Any help would be appreciated.

    I'm not aware of any method named tokenize and there isn't one listing in
    the alphabetic list of methods in the J2SE API. Perhaps you were thinking
    of java.util.StringTokenizer, whose API contains this note:
    StringTokenizer is a legacy class that is retained for compatibility reasons
    although its use is discouraged in new code. It is recommended that anyone
    seeking this functionality use the split method of String or the java.util.regex
    package instead.

  • Cisco ASA 5505 L2L VPN Tunnel with one Dynamic IP

    Hi Rizwan,
    Thanks for your response.  I updated the configuration per your response below... It still doesn't work.  please see my new config files below.  Please help.  Thanks in advance for your help....
    Hi Pinesh,
    Please make follow changes on host: officeasa
    remove this line below highlighted.
    crypto dynamic-map L2LMap 1 match address Crypto_L2L
    It is only because group1 is weak, so please change it to group2
    crypto dynamic-map L2LMap 1 set pfs group1
    route outside 10.10.6.0 255.255.255.0 96.xxx.xxx.117
    Please make follow changes on host: homeasa
    It is only because group1 is weak, so please change it to group2
    crypto map L2Lmap 1 set pfs group1
    route outside 10.10.5.0 255.255.255.0 xxx.xxx.xxx.xxx default gateway on homeasa.
    Hope that helps, if not please open a new thread.
    Thanks
    Rizwan Rafeek
    New config files..
    Site-A:   (Office):
    Hostname: asaoffice
    Inside: 10.10.5.0/254
    Outside e0/0: Static IP 96.xxx.xxx.118/30
    Site-B:   (Home):
    Hostname: asahome
    Inside: 10.10.6.0/254
    Outside e0/0: Dynamic IP (DG: 66.xxx.xxx.1)
    SIte-A:
    officeasa(config)# sh config
    : Saved
    : Written by enable_15 at 15:34:23.899 UTC Sat Mar 3 2012
    ASA Version 8.2(5)
    hostname officeasa
    enable password xyz encrypted
    passwd xyz encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    switchport access vlan 3
    interface Ethernet0/2
    switchport access vlan 3
    interface Ethernet0/3
    switchport access vlan 3
    interface Ethernet0/4
    switchport access vlan 3
    interface Ethernet0/5
    switchport access vlan 3
    interface Ethernet0/6
    switchport access vlan 3
    interface Ethernet0/7
    switchport access vlan 3
    interface Vlan2
    nameif outside
    security-level 0
    ip address 96.xxx.xxx.118 255.255.255.252
    interface Vlan3
    nameif inside
    security-level 100
    ip address 10.10.5.254 255.255.255.0
    ftp mode passive
    same-security-traffic permit inter-interface
    access-list NONAT extended permit ip 10.10.5.0 255.255.255.0 192.168.100.0 255.2
    access-list NONAT extended permit ip 10.10.5.0 255.255.255.0 10.10.6.0 255.255.2
    access-list ormtST standard permit 10.10.5.0 255.255.255.0
    access-list OCrypto_L2L extended permit ip 10.10.5.0 255.255.255.0 10.10.6.0 255
    pager lines 24
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    ip local pool ormtIPP 192.168.100.100-192.168.100.110 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list NONAT
    nat (inside) 1 0.0.0.0 0.0.0.0
    route outside 0.0.0.0 0.0.0.0 96.xxx.xxx.117 1
    route outside 10.10.6.0 255.255.255.0 96.xxx.xxx.117 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 10.10.5.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set OSite2Site esp-3des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map OL2LMap 1 set pfs
    crypto dynamic-map OL2LMap 1 set transform-set OSite2Site
    crypto dynamic-map OL2LMap 1 set reverse-route
    crypto map out_L2lMap 65535 ipsec-isakmp dynamic OL2LMap
    crypto map out_L2LMap interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    client-update enable
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    dhcpd address 10.10.5.101-10.10.5.132 inside
    dhcpd dns 8.8.8.8 8.8.4.4 interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    enable outside
    svc image disk0:/anyconnect-win-2.4.1012-k9.pkg 1
    svc image disk0:/anyconnect-macosx-i386-2.4.1012-k9.pkg 2
    svc enable
    tunnel-group-list enable
    group-policy ormtGP internal
    group-policy ormtGP attributes
    dns-server value 8.8.8.8
    vpn-tunnel-protocol svc webvpn
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value ormtST
    address-pools value ormtIPP
    webvpn
    svc keep-installer installed
    svc rekey time 30
    svc rekey method ssl
    svc ask enable default svc timeout 20
    username user1 password abcxyz encrypted
    username user1 attributes
    service-type remote-access
    tunnel-group ormtProfile type remote-access
    tunnel-group ormtProfile general-attributes
    default-group-policy ormtGP
    tunnel-group ormtProfile webvpn-attributes
    group-alias OFFICE enable
    tunnel-group defaultL2LGroup type ipsec-l2l
    tunnel-group defaultL2LGroup ipsec-attributes
    pre-shared-key *
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
    message-length maximum client auto
    message-length maximum 512
    policy-map global_policy
    class inspection_default
    inspect dns preset_dns_map
    inspect ftp
    inspect h323 h225
    inspect h323 ras
    inspect rsh
    inspect rtsp
    inspect esmtp
    inspect sqlnet
    inspect skinny
    inspect sunrpc
    inspect xdmcp
    inspect sip
    inspect netbios
    inspect tftp
    inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:46d5c2e1ac91d73293f2fb1a0045180c
    officeasa(config)#
    Site-B:
    Home ASA Configuration:
    homeasa# sh config
    : Saved
    : Written by enable_15 at 15:48:42.479 UTC Sat Mar 3 2012
    ASA Version 8.2(5)
    hostname homeasa
    enable password xyz encrypted
    passwd xyz encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    switchport access vlan 3
    interface Ethernet0/2
    switchport access vlan 3
    interface Ethernet0/3
    switchport access vlan 3
    interface Ethernet0/4
    switchport access vlan 3
    interface Ethernet0/5
    switchport access vlan 3
    interface Ethernet0/6
    switchport access vlan 3
    interface Ethernet0/7
    switchport access vlan 3
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface Vlan3
    nameif inside
    security-level 100
    ip address 10.10.6.254 255.255.255.0
    ftp mode passive
    same-security-traffic permit inter-interface
    access-list NONAT extended permit ip 10.10.6.0 255.255.255.0 192.168.101.0 255.255.255.0
    access-list NONAT extended permit ip 10.10.6.0 255.255.255.0 10.10.5.0 255.255.255.0
    access-list hrmtST standard permit 10.10.6.0 255.255.255.0
    access-list Crypto_L2L extended permit ip 10.10.6.0 255.255.255.0 10.10.5.0 255.255.255.0
    pager lines 24
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    ip local pool hrmtIPP 192.168.101.100-192.168.101.110 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list NONAT
    nat (inside) 1 0.0.0.0 0.0.0.0
    route outside 10.10.5.0 255.255.255.0 66.xxx.xxx.1 1   (IP address of the Dynamic IP from ISP)
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 10.10.6.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set Site2Site esp-3des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map L2Lmap 1 match address Crypto_L2L
    crypto map L2Lmap 1 set peer 96.xxx.xxx.118
    crypto map L2Lmap 1 set transform-set Site2Site
    crypto map L2LMap 1 set pfs
    crypto map L2LMap interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    dhcpd address 10.10.6.101-10.10.6.132 inside
    dhcpd dns 8.8.8.8 8.8.4.4 interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    enable outside
    svc image disk0:/anyconnect-win-2.4.1012-k9.pkg 1
    svc image disk0:/anyconnect-macosx-i386-2.4.1012-k9.pkg 2
    svc enable
    tunnel-group-list enable
    group-policy hrmtGP internal
    group-policy hrmtGP attributes
    dns-server value 8.8.8.8
    vpn-tunnel-protocol svc webvpn
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value hrmtST
    address-pools value hrmtIPP
    webvpn
    svc keep-installer installed
    svc rekey time 30
    svc rekey method ssl
    svc ask enable default svc timeout 20
    username user1 password abcxyz encrypted
    username user1 attributes
    service-type admin
    tunnel-group hrmtProfile type remote-access
    tunnel-group hrmtProfile general-attributes
    default-group-policy hrmtGP
    tunnel-group hrmtProfile webvpn-attributes
    group-alias hrmtCGA enable
    tunnel-group 96.xxx.xxx.118 type ipsec-l2l
    tunnel-group 96.xxx.xxx.118 ipsec-attributes
    pre-shared-key *
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
    message-length maximum client auto
    message-length maximum 512
    policy-map global_policy
    class inspection_default
    inspect dns preset_dns_map
    inspect ftp
    inspect h323 h225
    inspect h323 ras
    inspect rsh
    inspect rtsp
    inspect esmtp
    inspect sqlnet
    inspect skinny
    inspect sunrpc
    inspect xdmcp
    inspect sip
    inspect netbios
    inspect tftp
    inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:d16a0d49f275612dff7e404f49bcc499
    homeasa#

    Thanks Rizwan,
    Still no luck.  I can't even ping the otherside (office)..  I am not sure if i'm running the debug rightway.   Here are my results...
    homeasa(config)# ping inside 10.10.5.254............. (Office CIsco ASA5505 IP on local side.  I also tried pinging the server on other side (office) whic is @10.10.5.10 and got the same result)
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 10.10.5.254, timeout is 2 seconds:
    Success rate is 0
    homeasa(config)# debug crypto isakmp 7
    homeasa(config)# debug crypto ipsec 7
    homeasa(config)# sho crypto isakmp 7
                                       ^
    ERROR: % Invalid input detected at '^' marker.
    homeasa(config)# sho crypto isakmp
    There are no isakmp sas
    Global IKE Statistics
    Active Tunnels: 0
    Previous Tunnels: 0
    In Octets: 0
    In Packets: 0
    In Drop Packets: 0
    In Notifys: 0
    In P2 Exchanges: 0
    In P2 Exchange Invalids: 0
    In P2 Exchange Rejects: 0
    In P2 Sa Delete Requests: 0
    Out Octets: 0
    Out Packets: 0
    Out Drop Packets: 0
    Out Notifys: 0
    Out P2 Exchanges: 0
    Out P2 Exchange Invalids: 0
    Out P2 Exchange Rejects: 0
    Out P2 Sa Delete Requests: 0
    Initiator Tunnels: 0
    Initiator Fails: 0
    Responder Fails: 0
    System Capacity Fails: 0
    Auth Fails: 0
    Decrypt Fails: 0
    Hash Valid Fails: 0
    No Sa Fails: 0
    Global IPSec over TCP Statistics
    Embryonic connections: 0
    Active connections: 0
    Previous connections: 0
    Inbound packets: 0
    Inbound dropped packets: 0
    Outbound packets: 0
    Outbound dropped packets: 0
    RST packets: 0
    Recevied ACK heart-beat packets: 0
    Bad headers: 0
    Bad trailers: 0
    Timer failures: 0
    Checksum errors: 0
    Internal errors: 0
    hjnavasa(config)# sh crypto ipsec sa peer 96.xxx.xxx.118
    There are no ipsec sas
    homeasa(config)#

  • ASA 5505 site-to-site VPN tunnel and client VPN sessions

    Hello all
    I have several years of general networking experience, but I have not yet had to set up an ASA from the ground up, so please bear with me.
    I have a client who needs to establish a VPN tunnel from his satellite office (Site A) to his corporate office (Site Z).  His satellite office will have a single PC sitting behind the ASA.  In addition, he needs to be able to VPN from his home (Site H) to Site A to access his PC.
    The first question I have is about the ASA 5505 and the various licensing options.  I want to ensure that an ASA5505-BUN-K9 will be able to establish the site-to-site tunnel as well as allow him to use either the IPsec or SSL VPN client to connect from Site H to Site A.  Would someone please confirm or deny that for me?
    Secondly, I would like to verify that no special routing or configuration would need to take place in order to allow traffic not destined for Site Z (i.e., general web browsing or other traffic to any resource that is not part of the Site Z network) to go out his outside interface without specifically traversing the VPN tunnel (split tunneling?)
    Finally, if the client were to establish a VPN session from Site H to Site A, would that allow for him to connect directly into resources at Site Z without any special firewall security rules?  Since the VPN session would come in on the outside interface, and the tunnel back to Site Z goes out on the same interface, would this constitute a split horizon scenario that would call for a more complex config, or will the ASA handle that automatically without issue?
    I don't yet have the equipment in-hand, so I can't provide any sample configs for you to look over, but I will certainly do so once I've got it.
    Thanks in advance for any assistance provided!

    First question:
    Yes, 5505 will be able to establish site-to-site tunnel, and he can use IPSec vpn client, and SSL VPN (it comes with 2 default SSL VPN license).
    Second question:
    Yes, you are right. No special routing is required. All you need to configure is site-to-site VPN between Site A and Site Z LAN, and the internet traffic will be routed via Site A internet. Assuming you have all the NAT statement configured for that.
    Last question:
    This needs to be configured, it wouldn't automatically allow access to Site Z when he VPNs in to Site A.
    Here is what needs to be configured:
    1) Split tunnel ACL for VPN Client should include both Site Z and Site A LAN subnets.
    2) On site A configures: same-security-traffic permit intra-interface
    3) Crypto ACL for the site-to-site tunnel between Site Z and Site A needs to include the VPN Client pool subnet as follows:
    On Site Z:
    access-list permit ip
    On Site A:
    access-list permit ip
    4) NAT exemption on site Z needs to include vpn client pool subnet as well.
    Hope that helps.
    Message was edited by: Jennifer Halim

  • Remote Access VPN connecting but not passing traffic

    I have a remote access VPN configured on a device here. I'm able to connect a device and it assigns me an IP address out of the pool, and injects the routes to its local network, but I'm not able to pass any traffic through the VPN and none of the IPSec SA counters increment for the dial-in connection. I've compared the config here to the samples from documentation and I don't know what I'm missing. Config is below.
    3118-FWL001(config)# sho run
    : Saved
    ASA Version 7.2(3)
    hostname 3118-FWL001
    domain-name rr-rentals.com
    enable password hEgvNHfNHV8zypPu encrypted
    names
    interface Vlan1
     nameif inside
     security-level 100
     ip address 192.168.10.1 255.255.255.0
    interface Vlan2
     nameif outside
     security-level 0
     ip address 199.X.X.162 255.255.255.248
    interface Ethernet0/0
     switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    passwd 2KFQnbNIdI.2KYOU encrypted
    banner exec
    banner exec
    banner exec
    banner exec Any attempted or unauthorized access, use, or modification is prohibited.
    banner exec Unauthorized users may face criminal and/or civil penalties.
    banner exec The use of this system may be monitored and recorded.
    banner exec If the monitoring reveals possible evidence of criminal activity, Adhost can
    banner exec provide the records to law enforcement.
    banner exec Be safe!  Do not share your access information with anyone!
    banner exec
    banner exec
    banner exec
    banner asdm
    banner asdm
    banner asdm
    banner asdm Any attempted or unauthorized access, use, or modification is prohibited.
    banner asdm Unauthorized users may face criminal and/or civil penalties.
    banner asdm The use of this system may be monitored and recorded.
    banner asdm If the monitoring reveals possible evidence of criminal activity, Adhost can
    banner asdm provide the records to law enforcement.
    banner asdm Be safe!  Do not share your access information with anyone!
    banner asdm
    banner asdm
    banner asdm
    ftp mode passive
    dns server-group DefaultDNS
     domain-name rr-rentals.com
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    access-list outside_acl extended permit ip any host 199.X.X.163
    access-list outside_acl extended permit icmp any any echo
    access-list outside_acl extended permit icmp any any echo-reply
    access-list outside_acl extended permit tcp 216.X.X.64 255.255.255.192 any
    access-list outside_acl extended permit tcp host 76.X.X.166 any eq 3389
    access-list outside_acl extended permit tcp 67.X.X.192 255.255.255.224 any eq 3389
    access-list outside_acl extended permit tcp any any eq ftp
    access-list outside_acl extended permit tcp any any eq ftp-data
    access-list outside_acl extended permit tcp host 72.X.X.71 any eq 3389
    access-list outside_acl extended permit tcp host 26.X.X.155 any eq 3389
    access-list outside_acl extended permit tcp host 24.X.X.155 any eq 3389
    access-list outside_acl extended permit icmp any any unreachable
    access-list outside_acl extended permit icmp any any time-exceeded
    access-list outside_acl extended permit tcp host 71.X.X.170 any eq 3389
    access-list outside_acl extended permit tcp host 24.X.X.200 any eq 3389
    access-list inside_nat0_outbound extended permit ip 192.168.10.0 255.255.255.0 192.168.1.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.10.0 255.255.255.0 192.168.2.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.10.0 255.255.255.0 192.168.4.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.10.0 255.255.255.0 192.168.3.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.10.0 255.255.255.0 192.168.20.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.20.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.20.0 255.255.255.0 192.168.1.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.20.0 255.255.255.0 192.168.10.0 255.255.255.0
    access-list outside_1_cryptomap extended permit ip 192.168.10.0 255.255.255.0 192.168.1.0 255.255.255.0
    access-list outside_1_cryptomap extended permit ip 192.168.20.0 255.255.255.0 192.168.1.0 255.255.255.0
    access-list outside_2_cryptomap extended permit ip 192.168.10.0 255.255.255.0 192.168.2.0 255.255.255.0
    access-list outside_4_cryptomap extended permit ip 192.168.10.0 255.255.255.0 192.168.4.0 255.255.255.0
    access-list outside_3_cryptomap extended permit ip 192.168.10.0 255.255.255.0 192.168.3.0 255.255.255.0
    access-list rr-vpn_splitTunnelAcl standard permit 192.168.10.0 255.255.255.0
    access-list rr-vpn_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0
    pager lines 24
    logging enable
    logging buffer-size 1048576
    logging buffered debugging
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool vpnpool 192.168.20.1-192.168.20.254 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-523.bin
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    static (inside,outside) 199.X.X.163 192.168.10.2 netmask 255.255.255.255
    access-group outside_acl in interface outside
    route outside 0.0.0.0 0.0.0.0 199.X.X.161 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout uauth 0:05:00 absolute
    aaa authentication ssh console LOCAL
    aaa authentication http console LOCAL
    aaa authentication enable console LOCAL
    aaa authentication serial console LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    http 216.X.X.64 255.255.255.192 outside
    http 0.0.0.0 0.0.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    sysopt connection tcpmss 1200
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map outside_dyn_map 20 set pfs
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer 50.X.X.58
    crypto map outside_map 1 set transform-set ESP-AES-128-SHA
    crypto map outside_map 2 match address outside_2_cryptomap
    crypto map outside_map 2 set pfs
    crypto map outside_map 2 set peer 75.X.X.253
    crypto map outside_map 2 set transform-set ESP-AES-128-SHA
    crypto map outside_map 3 match address outside_3_cryptomap
    crypto map outside_map 3 set pfs
    crypto map outside_map 3 set peer 173.X.X.69
    crypto map outside_map 3 set transform-set ESP-AES-128-SHA
    crypto map outside_map 4 match address outside_4_cryptomap
    crypto map outside_map 4 set pfs
    crypto map outside_map 4 set peer 70.X.X.194
    crypto map outside_map 4 set transform-set ESP-AES-128-SHA
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
     authentication pre-share
     encryption aes
     hash sha
     group 5
     lifetime 86400
    crypto isakmp policy 30
     authentication pre-share
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    telnet timeout 5
    ssh 192.168.10.2 255.255.255.255 inside
    ssh 192.168.0.0 255.255.0.0 inside
    ssh 216.X.X.64 255.255.255.192 outside
    ssh 50.X.X.58 255.255.255.255 outside
    ssh timeout 60
    ssh version 2
    console timeout 0
    management-access inside
    class-map inspection_default
     match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
     parameters
      message-length maximum 512
    policy-map global_policy
     class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect icmp
      inspect icmp error
    service-policy global_policy global
    tftp-server outside 216.X.X.116 3118-FWL001.config
    group-policy rr-vpn internal
    group-policy rr-vpn attributes
     dns-server value 216.X.X.12 66.X.X.11
     vpn-tunnel-protocol IPSec
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value rr-vpn_splitTunnelAcl
    username rrlee password B6rKS8LmKC50oIXK encrypted privilege 0
    username rrlee attributes
     vpn-group-policy rr-vpn
    username cschirado password QYICGrOFAZ9iPWpp encrypted privilege 0
    username cschirado attributes
     vpn-group-policy rr-vpn
    username daniel password SZsXZCSuVXcFn9NB encrypted privilege 15
    username adhostadm password 7P2Y2Ow1o0.VSjvh encrypted privilege 15
    username troy password amZKsxVU.8N9kKPb encrypted privilege 0
    username troy attributes
     vpn-group-policy rr-vpn
    username troyr password Hek9zbMrM6wEDSfi encrypted privilege 15
    username druiz password 33oau7XOcvhJ3DMv encrypted privilege 0
    username druiz attributes
     vpn-group-policy rr-vpn
    username theresa password qWsPnR.vfjXzlunC encrypted privilege 0
    username theresa attributes
     vpn-group-policy rr-vpn
    username kevin password R5DPfUVhzGCEg6pu encrypted privilege 0
    username kevin attributes
     vpn-group-policy rr-vpn
    username andrea password MyhIPdH6UJQDon77 encrypted privilege 0
    username andrea attributes
     vpn-group-policy rr-vpn
    tunnel-group 50.X.X.58 type ipsec-l2l
    tunnel-group 50.X.X.58 ipsec-attributes
     pre-shared-key *
    tunnel-group 75.X.X.253 type ipsec-l2l
    tunnel-group 75.X.X.253 ipsec-attributes
     pre-shared-key *
    tunnel-group 72.X.X.71 type ipsec-l2l
    tunnel-group 72.X.X.71 ipsec-attributes
     pre-shared-key *
    tunnel-group 173.X.X.69 type ipsec-l2l
    tunnel-group 173.X.X.69 ipsec-attributes
     pre-shared-key *
    tunnel-group rr-vpn type ipsec-ra
    tunnel-group rr-vpn general-attributes
     address-pool vpnpool
     default-group-policy rr-vpn
    tunnel-group rr-vpn ipsec-attributes
     pre-shared-key *
    tunnel-group 70.X.X.194 type ipsec-l2l
    tunnel-group 70.X.X.194 ipsec-attributes
     pre-shared-key *
    prompt hostname context

    Here are the results of the commands you requested. I'm not able to ping either direction.
    Thanks,
    James
    3118-FWL001# sho cry isa sa
       Active SA: 5
        Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
    Total IKE SA: 5
    1   IKE Peer: 50.34.254.58
        Type    : L2L             Role    : responder
        Rekey   : no              State   : MM_ACTIVE
    2   IKE Peer: 173.10.71.69
        Type    : L2L             Role    : responder
        Rekey   : no              State   : MM_ACTIVE
    3   IKE Peer: 75.151.109.253
        Type    : L2L             Role    : initiator
        Rekey   : no              State   : MM_ACTIVE
    4   IKE Peer: 70.99.88.194
        Type    : L2L             Role    : initiator
        Rekey   : no              State   : MM_ACTIVE
    5   IKE Peer: 216.211.143.85
        Type    : user            Role    : responder
        Rekey   : no              State   : AM_ACTIVE
    3118-FWL001# sho cry ips sa
    interface: outside
        Crypto map tag: outside_dyn_map, seq num: 20, local addr: 199.21.66.162
          local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
          remote ident (addr/mask/prot/port): (192.168.20.2/255.255.255.255/0/0)
          current_peer: 216.211.143.85, username: kevin
          dynamic allocated peer ip: 192.168.20.2
          #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
          #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
          #pkts compressed: 0, #pkts decompressed: 0
          #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
          #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
          #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
          #send errors: 0, #recv errors: 0
          local crypto endpt.: 199.21.66.162, remote crypto endpt.: 216.211.143.85
          path mtu 1500, ipsec overhead 58, media mtu 1500
          current outbound spi: CBF94621
        inbound esp sas:
          spi: 0x8D8279CA (2374138314)
             transform: esp-3des esp-sha-hmac none
             in use settings ={RA, Tunnel, }
             slot: 0, conn_id: 200, crypto-map: outside_dyn_map
             sa timing: remaining key lifetime (sec): 28715
             IV size: 8 bytes
             replay detection support: Y
        outbound esp sas:
          spi: 0xCBF94621 (3422111265)
             transform: esp-3des esp-sha-hmac none
             in use settings ={RA, Tunnel, }
             slot: 0, conn_id: 200, crypto-map: outside_dyn_map
             sa timing: remaining key lifetime (sec): 28715
             IV size: 8 bytes
             replay detection support: Y
        Crypto map tag: outside_map, seq num: 1, local addr: 199.21.66.162
          access-list outside_1_cryptomap permit ip 192.168.10.0 255.255.255.0 192.168.1.0 255.255.255.0
          local ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0)
          remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
          current_peer: 50.34.254.58
          #pkts encaps: 15356573, #pkts encrypt: 15356573, #pkts digest: 15356573
          #pkts decaps: 9021115, #pkts decrypt: 9021114, #pkts verify: 9021114
          #pkts compressed: 0, #pkts decompressed: 0
          #pkts not compressed: 15356573, #pkts comp failed: 0, #pkts decomp failed: 0
          #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
          #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
          #send errors: 0, #recv errors: 0
          local crypto endpt.: 199.21.66.162, remote crypto endpt.: 50.34.254.58
          path mtu 1500, ipsec overhead 74, media mtu 1500
          current outbound spi: FE16571B
        inbound esp sas:
          spi: 0x78BD7E4F (2025684559)
             transform: esp-aes esp-sha-hmac none
             in use settings ={L2L, Tunnel, PFS Group 2, }
             slot: 0, conn_id: 86, crypto-map: outside_map
             sa timing: remaining key lifetime (kB/sec): (4263158/5788)
             IV size: 16 bytes
             replay detection support: Y
        outbound esp sas:
          spi: 0xFE16571B (4262876955)
             transform: esp-aes esp-sha-hmac none
             in use settings ={L2L, Tunnel, PFS Group 2, }
             slot: 0, conn_id: 86, crypto-map: outside_map
             sa timing: remaining key lifetime (kB/sec): (4064653/5788)
             IV size: 16 bytes
             replay detection support: Y
        Crypto map tag: outside_map, seq num: 4, local addr: 199.21.66.162
          access-list outside_4_cryptomap permit ip 192.168.10.0 255.255.255.0 192.168.4.0 255.255.255.0
          local ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0)
          remote ident (addr/mask/prot/port): (192.168.4.0/255.255.255.0/0/0)
          current_peer: 70.99.88.194
          #pkts encaps: 491814, #pkts encrypt: 491814, #pkts digest: 491814
          #pkts decaps: 416810, #pkts decrypt: 416810, #pkts verify: 416810
          #pkts compressed: 0, #pkts decompressed: 0
          #pkts not compressed: 491814, #pkts comp failed: 0, #pkts decomp failed: 0
          #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
          #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
          #send errors: 0, #recv errors: 0
          local crypto endpt.: 199.21.66.162, remote crypto endpt.: 70.99.88.194
          path mtu 1500, ipsec overhead 74, media mtu 1500
          current outbound spi: 533F55E1
        inbound esp sas:
          spi: 0xE2F461AD (3807666605)
             transform: esp-aes esp-sha-hmac none
             in use settings ={L2L, Tunnel, PFS Group 2, }
             slot: 0, conn_id: 194, crypto-map: outside_map
             sa timing: remaining key lifetime (kB/sec): (4273818/27167)
             IV size: 16 bytes
             replay detection support: Y
        outbound esp sas:
          spi: 0x533F55E1 (1396659681)
             transform: esp-aes esp-sha-hmac none
             in use settings ={L2L, Tunnel, PFS Group 2, }
             slot: 0, conn_id: 194, crypto-map: outside_map
             sa timing: remaining key lifetime (kB/sec): (4266133/27167)
             IV size: 16 bytes
             replay detection support: Y
        Crypto map tag: outside_map, seq num: 2, local addr: 199.21.66.162
          access-list outside_2_cryptomap permit ip 192.168.10.0 255.255.255.0 192.168.2.0 255.255.255.0
          local ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0)
          remote ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)
          current_peer: 75.151.109.253
          #pkts encaps: 207718, #pkts encrypt: 207718, #pkts digest: 207718
          #pkts decaps: 142739, #pkts decrypt: 142739, #pkts verify: 142739
          #pkts compressed: 0, #pkts decompressed: 0
          #pkts not compressed: 207722, #pkts comp failed: 0, #pkts decomp failed: 0
          #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
          #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
          #send errors: 0, #recv errors: 0
          local crypto endpt.: 199.21.66.162, remote crypto endpt.: 75.151.109.253
          path mtu 1500, ipsec overhead 74, media mtu 1500
          current outbound spi: 8D74AC18
        inbound esp sas:
          spi: 0x0CF7F70B (217577227)
             transform: esp-aes esp-sha-hmac none
             in use settings ={L2L, Tunnel, PFS Group 2, }
             slot: 0, conn_id: 195, crypto-map: outside_map
             sa timing: remaining key lifetime (kB/sec): (4274490/23242)
             IV size: 16 bytes
             replay detection support: Y
        outbound esp sas:
          spi: 0x8D74AC18 (2373233688)
             transform: esp-aes esp-sha-hmac none
             in use settings ={L2L, Tunnel, PFS Group 2, }
             slot: 0, conn_id: 195, crypto-map: outside_map
             sa timing: remaining key lifetime (kB/sec): (4270718/23242)
             IV size: 16 bytes
             replay detection support: Y
        Crypto map tag: outside_map, seq num: 3, local addr: 199.21.66.162
          access-list outside_3_cryptomap permit ip 192.168.10.0 255.255.255.0 192.168.3.0 255.255.255.0
          local ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0)
          remote ident (addr/mask/prot/port): (192.168.3.0/255.255.255.0/0/0)
          current_peer: 173.10.71.69
          #pkts encaps: 3427935, #pkts encrypt: 3427935, #pkts digest: 3427935
          #pkts decaps: 2006044, #pkts decrypt: 2006044, #pkts verify: 2006044
          #pkts compressed: 0, #pkts decompressed: 0
          #pkts not compressed: 3427935, #pkts comp failed: 0, #pkts decomp failed: 0
          #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
          #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
          #send errors: 0, #recv errors: 0
          local crypto endpt.: 199.21.66.162, remote crypto endpt.: 173.10.71.69
          path mtu 1500, ipsec overhead 74, media mtu 1500
          current outbound spi: 2E8A6147
        inbound esp sas:
          spi: 0x467968AB (1182361771)
             transform: esp-aes esp-sha-hmac none
             in use settings ={L2L, Tunnel, PFS Group 2, }
             slot: 0, conn_id: 154, crypto-map: outside_map
             sa timing: remaining key lifetime (kB/sec): (4270213/18597)
             IV size: 16 bytes
             replay detection support: Y
        outbound esp sas:
          spi: 0x2E8A6147 (780820807)
             transform: esp-aes esp-sha-hmac none
             in use settings ={L2L, Tunnel, PFS Group 2, }
             slot: 0, conn_id: 154, crypto-map: outside_map
             sa timing: remaining key lifetime (kB/sec): (4162093/18597)
             IV size: 16 bytes
             replay detection support: Y
    3118-FWL001# sho run route
    route outside 0.0.0.0 0.0.0.0 199.21.66.161 1

  • 2 VPN Tunnels between 2 devices on separate links

    Hello,
    I have a 2811 connected to two different ISPs, implying I have 2 separate interfaces for both links. I initially setup a VPN tunnel to a 3rd party remote site on one of the links/interfaces. I am now required to setup an additonal VPN tunnel to the same remote site on the other interface/link. When I finish the config and run tests, I get an error saying that the crypto map is not applied on the correct interface and that the peer is being routed through a non-crypto map interface.
    One thing I would like to know is if it is possible to configure the router to establish these two tunnels on the different links/interfaces to the same peer. Please note that the first VPN tunnel is still active, but the other one has just refused to come up. Please see the snippets of my router config below:
    crypto ipsec transform-set ABCD esp-3des esp-md5-hmac
    crypto isakmp policy 4
    encr 3des
    hash md5
    authentication pre-share
    group 5
    crypto isakmp policy 5
    encr 3des
    authentication pre-share
    group 2
    crypto isakmp policy 6
    encr 3des
    authentication pre-share
    group 2
    crypto isakmp key 123key address x.x.130.130
    crypto map SDM_CMAP_1 3 ipsec-isakmp
    description VPN Tunnel to ABCD on x.x.130.130
    set peer x.x.130.130
    set transform-set ABCD
    set pfs group5
    match address ABCD
    crypto map SDM_CMAP_2 1 ipsec-isakmp
    description description PROD VPN Tunnel to ABCD
    set peer x.x.130.130
    set transform-set ABCD
    set pfs group5
    match address ABCD_PROD
    interface FastEthernet0/1
    description ISP1 WAN INTERFACE$ETH-WAN$
    ip address a.a.42.66 255.255.255.252
    ip nbar protocol-discovery
    ip flow ingress
    ip flow egress
    ip nat outside
    ip virtual-reassembly
    duplex auto
    speed auto
    auto discovery qos
    crypto map SDM_CMAP_1
    interface FastEthernet0/2/0
    description ISP2_WAN_INTERFACE
    ip address y.y.12.94 255.255.255.192
    ip nbar protocol-discovery
    ip flow ingress
    ip flow egress
    ip nat outside
    ip virtual-reassembly
    duplex auto
    speed auto
    auto discovery qos
    crypto map SDM_CMAP_2
    ip access-list extended ABCD
    permit ip host 172.30.50.2 host x.x.130.138
    ip access-list extended ABCD_PROD
    permit ip host 172.19.205.31 host x.x.130.134
    ip route 0.0.0.0 0.0.0.0 a.a.42.65
    So its the tunnel running on ISP1 that is fine while the tunnel on ISP2 is not coming up.
    While pasting this though, I just realized there is no default route for ISP2, could this be the problem and would adding another default route not create some sort of loop?
    Regards,
    Femi

    Hello Marcin,
    When you said I didnt need to put both ISPs into VRF, i assume you meant that I only needed to put on f the ISPs into VRF, specifically the other ISP I was trying to establish a new VPN connection over?
    I did read the cheat sheet thoroughly and also went through some other documents. However, I still cound not get out of the router as the router kept complaining about routing issues:
    1. The peer must be routed through the crypto map interface. The following peer(s) are  routed through non-crypto map interface - a.b.130.130
    2. The tunnel traffic destination must be routed through the crypto map interface. The following destinations are routed through non-crypto map interface - a.b.130.134
    Below is the config I applied but I didnt get traffic out of the router still to even attempt to establish a connection:
    ip vrf PROD_INTCON
    rd 100:1
    route-target export 100:1
    route-target import 100:1
    ip vrf ISP2
    rd 101:1
    route-target export 101:1
    route-target import 101:1
    crypto keyring NI2-keyring vrf ISP2
      pre-shared-key address a.b.130.130 key xxxxx
    crypto isakmp policy 4
    encr 3des
    hash md5
    authentication pre-share
    group 5
    crypto isakmp policy 5
    encr 3des
    authentication pre-share
    group 2
    crypto isakmp policy 6
    encr 3des
    authentication pre-share
    group 2
    crypto isakmp profile NI2-profile
    vrf PROD_INTCON
    keyring NI2-keyring
    match identity address a.b.130.130 255.255.255.255 ISP2
    isakmp authorization list default
    crypto ipsec transform-set NI2set esp-3des esp-md5-hmac
    crypto map SDM_CMAP_2 1 ipsec-isakmp
    description PROD VPN Tunnel to NI2
    set peer a.b.130.130
    set transform-set NI2set
    set pfs group5
    set isakmp-profile NI2-profile
    match address NI2_ACL
    reverse-route
    interface FastEthernet0/2/0
    ip vrf forwarding ISP2
    ip address z.y.12.94 255.255.255.192
    crypto map SDM_CMAP_2
    interface FastEthernet0/2/1.603
    description PROD_INTCON_ZONE
    encapsulation dot1Q 603
    ip vrf forwarding PROD_INTCON
    ip address 172.19.205.1 255.255.255.0
    ip flow ingress
    ip nat inside
    ip virtual-reassembly
    ip route vrf ISP2 0.0.0.0 0.0.0.0 z.y.12.65
    ip route vrf PROD_INTCON a.b.130.134 255.255.255.255 FastEthernet0/2/0 z.y.12.65
    ip access-list extended NI2_ACL
    permit ip host 172.19.205.31 host a.b.130.134

  • How can I improve performance over a Branch Office IPsec vpn tunnel between and SA540 and an SA520

    Hello,
    I just deployed one Cisco SA540 and three SA520s.
    The SA540 is at the Main Site.
    The three SA520s are the the spoke sites.
    Main Site:
    Downstream Speed: 32 Mbps
    Upstream Speed: 9.4 Mbps
    Spoke Site#1:
    Downstream Speed: 3.6 Mbps
    Upstream Speed: 7.2 Mbps (yes, the US is faster than the DS at the time the speed test was taken).
    The SA tunnels are "Established"
    I see packets being tranmsitted and received.
    Pinging across the tunnel has an average speed of 32 ms (which is good).
    DNS resolves names to ip addresses flawlessly and quickly across the Inter-network.
    But it takes from 10 to 15 minutes to log on to the domain from the Spoke Site#1 to the Main Site across the vpn tunnel.
    It takes about 15 minutes to print across the vpn tunnel.
    The remedy this, we have implemented Terminal Services across the Internet.
    Printing takes about 1 minute over the Terminal Service Connection, while it takes about 15 minutes over the VPN.
    Logging on to the network takes about 10 minutes over the vpn tunnel.
    Using an LOB application takes about 2 minutes per transaction across the vpn tunnel; it takes seconds using Terminal Services.
    I have used ASAs before in other implementation without any issues at all.
    I am wondering if I replaced the SAs with ASAs, that they may fix my problem.
    I wanted to go Small Business Pro, to take advantage of the promotions and because I am a Select Certified Partner, but from my experience, these SA vpn tunnels are unuseable.
    I opened a case with Small Business Support on Friday evening, but they couldnt even figure out how to rename an IKE Policy Name (I figured out that you had to delete the IKE Policy; you cannot rename them once they are created).
    Maybe the night weekend shift has a skeleton crew, and the best engineers are available at that time or something....i dont know.
    I just know that my experience with the Cisco TAC has been great for the last 10 years.
    My short experience with the Cisco Small Business Support Center has not been as great at all.
    Bottom Line:
    I am going to open another case with the Day Shift tomorrow and see if they can find a way to speed things up.
    Now this is not just happening between the Main Site and Spoke Site #1 above. It is also happeninng between the Main Site and Spoke #2 (I think Spoke#2 has a Download Speed of about 3Mbps and and Upload Speed of about 0.5 Mbps.
    Please help.
    I would hate to dismiss SA5xx series without making sure it is not just a simple configuration setting.

    Hi Anthony,
    I agree!.  My partner wants to just replace the SA5xxs with ASAs, as we have never had problems with ASA vpn performance.
    But I want to know WHY this is happening too.
    I will definitely run a sniffer trace to see what is happening.
    Here are some other things I have learned from the Cisco Small Business Support Center (except for Item 1 which I learned from you!)
    1.  Upgrade the SA540 at the Main Site to 2.1.45.
    2a. For cable connections, use the standard MTU of 1500 bytes.
    2.b For DSL, use the following command to determine the largets MTU that will be sent without packet fragmentation:
    ping -f -l packetsize
    Perform the items below to see if this increases performance:
    I was told by the Cisco Small Business Support Center that setting up a Manual Policy is not recommended; I am not sure why they stated this.
    3a. Lower the IKE encryption algorithm from "AES-128" to DES.
    3b. Lower the IKE authentication algorithm to MD5
    3c. Also do the above for the VPN Policy
    Any input is welcome!

Maybe you are looking for