VPN connection between ASA5520 and RV215w

Question

Hello everyone,
I am trying to setup a vpn connection between ASA5520 with 9.1.(3) and rv215w 1.1.0.6
Here is my setup ...
But the vpn connection fails with an error message on ASA.
RV215w shows ipsec established but i cannot ping the network behind.
You can find asa-config and show-tech as attachment. I have added also some screenshots from RV215w.
Any hint or help is appreciated.
Cengiz

Answer 1

Hi Cengiz,
Dynamic CRYPTO maps mostly used in a Remote Access or Client to site VPN because end users working from home can have IP address new every time or like different whcn connect from home or from Internet cafe , hence ASA cant make a fix IP as Peer.
But for site to site also Dynamic Crypto Map can be used but only at one side , else if you use Dynamic crypto map at both ends , both peer will wait for each other to initiate a tunnel Request as the device n this case ASA) configured with Dynamic Crypto map can only REPLY for a tunnel initiation , it can never send tunned initilaization request as it never know the IP address of the peer. Hence never make both device as dynamic crypto map or else they both never initiate and wait for each pther and tunnel will never happen.
The main steps to be configured on the ASA end in order to establish dynamic tunnel:
    Phase 1 ISAKMP related configuration
    Nat exemption configuration
    Dynamic crypto map configuration
The Cisco IOS router has a static crypto map configured because the ASA is assumed to have a static public IP address. Now this is the list of main steps to be configured on the Cisco IOS Router end to establish dynamic IPSEC tunnel.
    Phase 1 ISAKMP related configuration
    Static crypto map related configuration
!---1. Configure the IPsec transform-set
crypto ipsec transform-set myset esp-des esp-md5-hmac
!--- 2. Configure the dynamic crypto map. Always rememeber to bind a dynamic crypto map to a blank static crypto map and then call that static crypto map to a ASA OUTSIDE Interface as Dynamic Crypto maps cannot be bind directly to ASA OUTSIDE Interface or say any interface.
crypto dynamic-map MY_DYNAMIC_MAP 1 set transform-set myset
crypto dynamic-map MY_DYNAMIC_MAP 1 set reverse-route
!--- Enable Reverse Route Injection (RRI), which allows the ASA
!--- to learn routing information for connected clients hence the static route will come above defaut route and hence
!... will make the routing decision fast else every time for the other side router dynamic IP , default route have to get a hit but only after checking the entire routing table and when no match then use default route , so to save this entire route matchin process always good to use reverse route enjection so that other side non dynamic crypt peer can insert a static route enrty in ASA.
!--- 2A. Always Bind dynamic crypto map named MY_DYNAMIC_MAP to a static crypto map named STATIC_MAP_CALLING_DYMANIC_MAP using a keyword dynamic in the last 
crypto map STATIC_MAP_CALLING_DYMANIC_MAP 10 IPSec-isakmp dynamic MY_DYNAMIC_MAP
!--- 2B.now apply static map on ASA OUTSIDE Interface
crypto map STATIC_MAP_CALLING_DYMANIC_MAP interface outside
!--- 3. Configure the phase I ISAKMP policy
crypto isakmp policy 10
authentication pre-share
encryption des
hash md5
group 2
lifetime 86400
!--- 4. Configure the default L2L tunnel group parameters
tunnel-group DefaultL2LGroup IPSec-attributes
pre-shared-key *
Plase rate if you like my post.
Best Regards
Sachin Garg