Vpn tunnel

how do i go about connecting 2 airports in two diffrent locations NY /GA so both locations act like one all the time, not that i have to vpn in when i want access

No I'm not using the Linksys software.
I have a Microsft Server set up as a VPN server behind a Linksys v1.1 router. Therefore I cannot ping the WAN IP address as the router is set up to not reply to pings. On the client side, I was just using the Microsoft PPTP VPN connection that comes with XP. When the client tried to connect to the server through a Linksys router at the client end, I get the dialog box that says "Verifying user name and password". But it does not connect and eventually times out. If I bypass the Linksys router on the client end, and plug my computer directly into the cable modem, I get connected to the VPN server with no problems.
It seems so far that it is just when I am trying to get the VPN connection when  the client it is conencted to a Linksys v5 router. I have not been able to test this out with another version of the Linksys router. When the client is connected to some other brands of routers, I can get a VPN tunnel to work. Is there some problem with Linksys to Linksys Microsoft VPN tunnel connectivity?

Similar Messages

  • Configure a VPN client and Site to Site VPN tunnel

    Hi, I'm setting up a test network between 2 sites. SiteA has a 515E PIX and SiteB has a 501 PIX. Both sites have been setup with a site to site VPN tunnel, see SiteA config below. I also require that remote clients using Cisco VPN client 3.6 be able to connect into SiteA, be authenticated, get DHCP info and connect to hosts inside the network. However, when I add these config lines, see below, to SiteA PIX it stops the vpn tunnel to SiteB. However, the client can conect and do as needed so that part of my config is correct but I cannot see why the site to site vpn tunnel is then no longer.
    SiteA config with working VPN tunnel to SiteB:
    SITE A
    PIX Version 6.3(1)
    interface ethernet0 auto
    interface ethernet1 auto
    interface ethernet2 auto shutdown
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    nameif ethernet2 webdmz security20
    enable password xxx
    passwd xxx
    hostname SiteA-pix
    fixup protocol ftp 21
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol ils 389
    fixup protocol rsh 514
    fixup protocol rtsp 554
    no fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    fixup protocol smtp 25
    fixup protocol sqlnet 1521
    names
    name 200.x.x.0 SiteA_INT
    name 201.x.x.201 SiteA_EXT
    name 200.x.x.254 PIX_INT
    name 10.10.10.0 SiteB_INT
    name 11.x.x.11 SiteB_EXT
    access-list inside_outbound_nat0_acl permit ip SiteA_INT 255.255.0.0 SiteB_INT 255.255.255.0
    access-list outside_cryptomap_20 permit ip SiteA_INT 255.255.0.0 SiteB_INT 255.255.255.0
    access-list acl_inside permit icmp any any
    access-list acl_inside permit ip any any
    access-list acl_outside permit ip any any
    access-list acl_outside permit icmp any any
    pager lines 24
    mtu outside 1500
    mtu inside 1500
    mtu webdmz 1500
    ip address outside SiteA_EXT 255.x.x.128
    ip address inside PIX_INT 255.255.0.0
    no ip address webdmz
    ip audit info action alarm
    ip audit attack action alarm
    pdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_outbound_nat0_acl
    route outside 0.0.0.x.x.0.0 201.201.201.202 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server RADIUS protocol radius
    aaa-server LOCAL protocol local
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    no snmp-server enable traps
    floodguard enable
    sysopt connection permit-ipsec
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto map outside_map 20 ipsec-isakmp
    crypto map outside_map 20 match address outside_cryptomap_20
    crypto map outside_map 20 set peer SiteB_EXT
    crypto map outside_map 20 set transform-set ESP-DES-MD5
    crypto map outside_map interface outside
    isakmp enable outside
    isakmp key secret address SiteB_EXT netmask 255.255.255.255 no-xauth no-config-mode
    isakmp policy 20 authentication pre-share
    isakmp policy 20 encryption des
    isakmp policy 20 hash md5
    isakmp policy 20 group 2
    isakmp policy 20 lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    terminal width 80
    SiteA-pix(config)#
    Lines I add for Cisco VPN clients is attached
    I entered each line one by one and did a reload and sh crypto map all was OK until I entered the crypto map VPNPEER lines.
    Anyone any ideas what this can be?
    Thanks

    Heres my config:
    PIX Version 6.3(1)
    interface ethernet0 auto
    interface ethernet1 auto
    interface ethernet2 auto shutdown
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    nameif ethernet2 webdmz security20
    enable password xxx
    passwd xxx
    hostname SiteA-pix
    fixup protocol ftp 21
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol ils 389
    fixup protocol rsh 514
    fixup protocol rtsp 554
    no fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    fixup protocol smtp 25
    fixup protocol sqlnet 1521
    names
    name 200.x.x.0 SiteA_INT
    name 201.x.x.201 SiteA_EXT
    name 200.x.x.254 PIX_INT
    name 10.10.10.0 SiteB_INT
    name 11.11.11.11 SiteB_EXT
    access-list inside_outbound_nat0_acl permit ip SiteA_INT 255.255.0.0 SiteB_INT 255.255.255.0
    access-list outside_cryptomap_20 permit ip SiteA_INT 255.255.0.0 SiteB_INT 255.255.255.0
    access-list acl_inside permit icmp any any
    access-list acl_inside permit ip any any
    access-list acl_outside permit ip any any
    access-list acl_outside permit icmp any any
    access-list 80 permit ip SiteA_INT 255.255.0.0 200.220.0.0 255.255.0.0
    pager lines 24
    mtu outside 1500
    mtu inside 1500
    mtu webdmz 1500
    ip address outside SiteA_EXT 255.255.255.128
    ip address inside PIX_INT 255.255.0.0
    no ip address webdmz
    ip audit info action alarm
    ip audit attack action alarm
    ip local pool pix_inside 200.x.x.100-200.220.200.150
    pdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_outbound_nat0_acl
    route outside 0.0.0.0 0.0.0.x.x.201.202 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server RADIUS protocol radius
    aaa-server RADIUS (inside) host 200.200.200.20 letmein timeout 10
    aaa-server LOCAL protocol local
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    no snmp-server enable traps
    floodguard enable
    sysopt connection permit-ipsec
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set AAADES esp-3des esp-md5-hmac
    crypto dynamic-map DYNOMAP 10 match address 80
    crypto dynamic-map DYNOMAP 10 set transform-set AAADES
    crypto map outside_map 20 ipsec-isakmp
    crypto map outside_map 20 match address outside_cryptomap_20
    crypto map outside_map 20 set peer SiteB_EXT
    crypto map outside_map 20 set transform-set ESP-DES-MD5
    crypto map outside_map 30 ipsec-isakmp dynamic DYNOMAP
    crypto map outside_map client authentication RADIUS
    crypto map outside_map interface outside
    isakmp enable outside
    isakmp key secret address SiteB_EXT netmask 255.255.255.255 no-xauth no-config-mode
    isakmp policy 20 authentication pre-share
    isakmp policy 20 encryption des
    isakmp policy 20 hash md5
    isakmp policy 20 group 2
    isakmp policy 20 lifetime 86400
    isakmp policy 30 authentication pre-share
    isakmp policy 30 encryption 3des
    isakmp policy 30 hash sha
    isakmp policy 30 group 2
    isakmp policy 30 lifetime 86400
    vpngroup Remote address-pool pix_inside
    vpngroup Remote dns-server 200.200.200.20
    vpngroup Remote wins-server 200.200.200.20
    vpngroup Remote default-domain mycorp.co.uk
    vpngroup Remote idle-time 1800
    vpngroup Remote password password
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    terminal width 80
    I will attach debug output later today.
    Thanks

  • Can i use same address pool for different remote access VPN tunnel groups and policy

    Hi all,
    i want to create a different remote access VPN profile in ASA. ihave one RA vpn already configured for some purpose.
    can i use the same ip address pool used for the existing one for the new tunnel-group (to avoid add rotuing on internal devices for new pool) and its a temporary requirement)
    thanks in advance
    Shnail

    Thanks Karsten..
    but still i can have filtering right? iam planning to create a new group policy and tunnelgroup and use the existing pool for new RA  and i have to do some filetring also. for the new RA i have to restrict access to a particualr server ,my existing RA have full access.
    so iam planning to create new local usernames for the new RA and new group policy with vpn-filter value access-list to apply for that user as below,  this will achive waht i need right??
    access-list 15 extended permit tcp any host 192.168.205.134 eq 80
    username test password password test
    username test attributes
    vpn-group-policy TEST
    vpn-filter value 15
    group-policy TEST internal
    group-policy TEST attributes
    dns-server value 192.168.200.16
    vpn-filter value 15
    vpn-tunnel-protocol IPSec
    address-pools value existing-pool
    tunnel-group RAVPN type ipsec-ra
    tunnel-group RAVPN general-attributes
    address-pool existing-pool
    default-group-policy TEST
    tunnel-group Payroll ipsec-attributes
    pre-shared-key xxx

  • Cisco ASA 5505 L2L VPN Tunnel with one Dynamic IP

    Hi Rizwan,
    Thanks for your response.  I updated the configuration per your response below... It still doesn't work.  please see my new config files below.  Please help.  Thanks in advance for your help....
    Hi Pinesh,
    Please make follow changes on host: officeasa
    remove this line below highlighted.
    crypto dynamic-map L2LMap 1 match address Crypto_L2L
    It is only because group1 is weak, so please change it to group2
    crypto dynamic-map L2LMap 1 set pfs group1
    route outside 10.10.6.0 255.255.255.0 96.xxx.xxx.117
    Please make follow changes on host: homeasa
    It is only because group1 is weak, so please change it to group2
    crypto map L2Lmap 1 set pfs group1
    route outside 10.10.5.0 255.255.255.0 xxx.xxx.xxx.xxx default gateway on homeasa.
    Hope that helps, if not please open a new thread.
    Thanks
    Rizwan Rafeek
    New config files..
    Site-A:   (Office):
    Hostname: asaoffice
    Inside: 10.10.5.0/254
    Outside e0/0: Static IP 96.xxx.xxx.118/30
    Site-B:   (Home):
    Hostname: asahome
    Inside: 10.10.6.0/254
    Outside e0/0: Dynamic IP (DG: 66.xxx.xxx.1)
    SIte-A:
    officeasa(config)# sh config
    : Saved
    : Written by enable_15 at 15:34:23.899 UTC Sat Mar 3 2012
    ASA Version 8.2(5)
    hostname officeasa
    enable password xyz encrypted
    passwd xyz encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    switchport access vlan 3
    interface Ethernet0/2
    switchport access vlan 3
    interface Ethernet0/3
    switchport access vlan 3
    interface Ethernet0/4
    switchport access vlan 3
    interface Ethernet0/5
    switchport access vlan 3
    interface Ethernet0/6
    switchport access vlan 3
    interface Ethernet0/7
    switchport access vlan 3
    interface Vlan2
    nameif outside
    security-level 0
    ip address 96.xxx.xxx.118 255.255.255.252
    interface Vlan3
    nameif inside
    security-level 100
    ip address 10.10.5.254 255.255.255.0
    ftp mode passive
    same-security-traffic permit inter-interface
    access-list NONAT extended permit ip 10.10.5.0 255.255.255.0 192.168.100.0 255.2
    access-list NONAT extended permit ip 10.10.5.0 255.255.255.0 10.10.6.0 255.255.2
    access-list ormtST standard permit 10.10.5.0 255.255.255.0
    access-list OCrypto_L2L extended permit ip 10.10.5.0 255.255.255.0 10.10.6.0 255
    pager lines 24
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    ip local pool ormtIPP 192.168.100.100-192.168.100.110 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list NONAT
    nat (inside) 1 0.0.0.0 0.0.0.0
    route outside 0.0.0.0 0.0.0.0 96.xxx.xxx.117 1
    route outside 10.10.6.0 255.255.255.0 96.xxx.xxx.117 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 10.10.5.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set OSite2Site esp-3des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map OL2LMap 1 set pfs
    crypto dynamic-map OL2LMap 1 set transform-set OSite2Site
    crypto dynamic-map OL2LMap 1 set reverse-route
    crypto map out_L2lMap 65535 ipsec-isakmp dynamic OL2LMap
    crypto map out_L2LMap interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    client-update enable
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    dhcpd address 10.10.5.101-10.10.5.132 inside
    dhcpd dns 8.8.8.8 8.8.4.4 interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    enable outside
    svc image disk0:/anyconnect-win-2.4.1012-k9.pkg 1
    svc image disk0:/anyconnect-macosx-i386-2.4.1012-k9.pkg 2
    svc enable
    tunnel-group-list enable
    group-policy ormtGP internal
    group-policy ormtGP attributes
    dns-server value 8.8.8.8
    vpn-tunnel-protocol svc webvpn
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value ormtST
    address-pools value ormtIPP
    webvpn
    svc keep-installer installed
    svc rekey time 30
    svc rekey method ssl
    svc ask enable default svc timeout 20
    username user1 password abcxyz encrypted
    username user1 attributes
    service-type remote-access
    tunnel-group ormtProfile type remote-access
    tunnel-group ormtProfile general-attributes
    default-group-policy ormtGP
    tunnel-group ormtProfile webvpn-attributes
    group-alias OFFICE enable
    tunnel-group defaultL2LGroup type ipsec-l2l
    tunnel-group defaultL2LGroup ipsec-attributes
    pre-shared-key *
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
    message-length maximum client auto
    message-length maximum 512
    policy-map global_policy
    class inspection_default
    inspect dns preset_dns_map
    inspect ftp
    inspect h323 h225
    inspect h323 ras
    inspect rsh
    inspect rtsp
    inspect esmtp
    inspect sqlnet
    inspect skinny
    inspect sunrpc
    inspect xdmcp
    inspect sip
    inspect netbios
    inspect tftp
    inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:46d5c2e1ac91d73293f2fb1a0045180c
    officeasa(config)#
    Site-B:
    Home ASA Configuration:
    homeasa# sh config
    : Saved
    : Written by enable_15 at 15:48:42.479 UTC Sat Mar 3 2012
    ASA Version 8.2(5)
    hostname homeasa
    enable password xyz encrypted
    passwd xyz encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    switchport access vlan 3
    interface Ethernet0/2
    switchport access vlan 3
    interface Ethernet0/3
    switchport access vlan 3
    interface Ethernet0/4
    switchport access vlan 3
    interface Ethernet0/5
    switchport access vlan 3
    interface Ethernet0/6
    switchport access vlan 3
    interface Ethernet0/7
    switchport access vlan 3
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface Vlan3
    nameif inside
    security-level 100
    ip address 10.10.6.254 255.255.255.0
    ftp mode passive
    same-security-traffic permit inter-interface
    access-list NONAT extended permit ip 10.10.6.0 255.255.255.0 192.168.101.0 255.255.255.0
    access-list NONAT extended permit ip 10.10.6.0 255.255.255.0 10.10.5.0 255.255.255.0
    access-list hrmtST standard permit 10.10.6.0 255.255.255.0
    access-list Crypto_L2L extended permit ip 10.10.6.0 255.255.255.0 10.10.5.0 255.255.255.0
    pager lines 24
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    ip local pool hrmtIPP 192.168.101.100-192.168.101.110 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list NONAT
    nat (inside) 1 0.0.0.0 0.0.0.0
    route outside 10.10.5.0 255.255.255.0 66.xxx.xxx.1 1   (IP address of the Dynamic IP from ISP)
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 10.10.6.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set Site2Site esp-3des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map L2Lmap 1 match address Crypto_L2L
    crypto map L2Lmap 1 set peer 96.xxx.xxx.118
    crypto map L2Lmap 1 set transform-set Site2Site
    crypto map L2LMap 1 set pfs
    crypto map L2LMap interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    dhcpd address 10.10.6.101-10.10.6.132 inside
    dhcpd dns 8.8.8.8 8.8.4.4 interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    enable outside
    svc image disk0:/anyconnect-win-2.4.1012-k9.pkg 1
    svc image disk0:/anyconnect-macosx-i386-2.4.1012-k9.pkg 2
    svc enable
    tunnel-group-list enable
    group-policy hrmtGP internal
    group-policy hrmtGP attributes
    dns-server value 8.8.8.8
    vpn-tunnel-protocol svc webvpn
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value hrmtST
    address-pools value hrmtIPP
    webvpn
    svc keep-installer installed
    svc rekey time 30
    svc rekey method ssl
    svc ask enable default svc timeout 20
    username user1 password abcxyz encrypted
    username user1 attributes
    service-type admin
    tunnel-group hrmtProfile type remote-access
    tunnel-group hrmtProfile general-attributes
    default-group-policy hrmtGP
    tunnel-group hrmtProfile webvpn-attributes
    group-alias hrmtCGA enable
    tunnel-group 96.xxx.xxx.118 type ipsec-l2l
    tunnel-group 96.xxx.xxx.118 ipsec-attributes
    pre-shared-key *
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
    message-length maximum client auto
    message-length maximum 512
    policy-map global_policy
    class inspection_default
    inspect dns preset_dns_map
    inspect ftp
    inspect h323 h225
    inspect h323 ras
    inspect rsh
    inspect rtsp
    inspect esmtp
    inspect sqlnet
    inspect skinny
    inspect sunrpc
    inspect xdmcp
    inspect sip
    inspect netbios
    inspect tftp
    inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:d16a0d49f275612dff7e404f49bcc499
    homeasa#

    Thanks Rizwan,
    Still no luck.  I can't even ping the otherside (office)..  I am not sure if i'm running the debug rightway.   Here are my results...
    homeasa(config)# ping inside 10.10.5.254............. (Office CIsco ASA5505 IP on local side.  I also tried pinging the server on other side (office) whic is @10.10.5.10 and got the same result)
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 10.10.5.254, timeout is 2 seconds:
    Success rate is 0
    homeasa(config)# debug crypto isakmp 7
    homeasa(config)# debug crypto ipsec 7
    homeasa(config)# sho crypto isakmp 7
                                       ^
    ERROR: % Invalid input detected at '^' marker.
    homeasa(config)# sho crypto isakmp
    There are no isakmp sas
    Global IKE Statistics
    Active Tunnels: 0
    Previous Tunnels: 0
    In Octets: 0
    In Packets: 0
    In Drop Packets: 0
    In Notifys: 0
    In P2 Exchanges: 0
    In P2 Exchange Invalids: 0
    In P2 Exchange Rejects: 0
    In P2 Sa Delete Requests: 0
    Out Octets: 0
    Out Packets: 0
    Out Drop Packets: 0
    Out Notifys: 0
    Out P2 Exchanges: 0
    Out P2 Exchange Invalids: 0
    Out P2 Exchange Rejects: 0
    Out P2 Sa Delete Requests: 0
    Initiator Tunnels: 0
    Initiator Fails: 0
    Responder Fails: 0
    System Capacity Fails: 0
    Auth Fails: 0
    Decrypt Fails: 0
    Hash Valid Fails: 0
    No Sa Fails: 0
    Global IPSec over TCP Statistics
    Embryonic connections: 0
    Active connections: 0
    Previous connections: 0
    Inbound packets: 0
    Inbound dropped packets: 0
    Outbound packets: 0
    Outbound dropped packets: 0
    RST packets: 0
    Recevied ACK heart-beat packets: 0
    Bad headers: 0
    Bad trailers: 0
    Timer failures: 0
    Checksum errors: 0
    Internal errors: 0
    hjnavasa(config)# sh crypto ipsec sa peer 96.xxx.xxx.118
    There are no ipsec sas
    homeasa(config)#

  • Cisco ASA 5505 Site to Site VPN tunnel up, but not passing traffic

    Thanks to a previous thread, I do have a 5505 up and running, and passing data....
    https://supportforums.cisco.com/message/3900751
    Now I am trying to get a IPSEC VPN tunnel working.
    I actually have it up (IKE phase 1 & 2 both passed), but it is not sending/receiving data through the tunnel.
    The networks concerned:
    name 10.0.0.0  Eventual  (HQ Site behind Firewall)
    name 1.1.1.0  CFS  (Public Network Gateway for Palo Alto Firewall - Firewall IP: 1.1.1.1)
    name 2.2.2.0  T1  (Remote site - Outside interface of 5505: 2.2.2.2)
    name 10.209.0.0  Local  (Remote Network - internal interface of 5505: 10.209.0.3)
    On a ping to the HQ network from behind the ASA, I get....
    portmap translation creation failed for icmp src inside:10.209.0.9 dst inside:10.0.0.33 (type 8, code 0)
    I am suspecting that there is a NAT error and/or a lack of a static route for the rest of the 10.0.0.0 traffic, and that I may have to exempt/route the traffic for the HQ network (10.0.0.0), but I haven't been able to get the correct entries to make it work.
    Below is the config.
    Can anyone see if there is something sticking out?
    : Saved
    ASA Version 8.2(5)
    hostname ciscoasa
    enable password 8Ry2YjIyt7RRXU24 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 10.0.0.0 Eventual
    name 10.209.0.0 Local
    name 2.2.2.0 T1
    name 1.1.1.0 CFS
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 0
    ip address 10.209.0.3 255.0.0.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address 2.2.2.2 255.255.255.248
    time-range Indefinite
    ftp mode passive
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object-group protocol DM_INLINE_PROTOCOL_1
    protocol-object ip
    protocol-object icmp
    protocol-object udp
    protocol-object tcp
    object-group network DM_INLINE_NETWORK_1
    network-object Eventual 255.0.0.0
    network-object T1 255.255.255.248
    network-object CFS 255.255.255.240
    access-list outside_1_cryptomap extended permit ip Local 255.255.255.0 object-group DM_INLINE_NETWORK_1
    pager lines 24
    logging enable
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any outside
    icmp permit any inside
    asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 1 0.0.0.0 0.0.0.0
    route outside 0.0.0.0 0.0.0.0 67.139.113.217 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http Eventual 255.0.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer 1.1.1.1
    crypto map outside_map 1 set transform-set ESP-3DES-MD5
    crypto map outside_map 1 set phase1-mode aggressive
    crypto map outside_map interface outside
    crypto ca trustpoint _SmartCallHome_ServerCA
    crl configure
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 28800
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    dhcpd address 10.209.0.201-10.209.0.232 inside
    dhcpd dns 8.8.8.8 8.8.4.4 interface inside
    dhcpd auto_config outside interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy DfltGrpPolicy attributes
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    group-policy FTMGP internal
    group-policy FTMGP attributes
    vpn-idle-timeout none
    vpn-filter none
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    tunnel-group 1.1.1.1 type ipsec-l2l
    tunnel-group 1.1.1.1 general-attributes
    default-group-policy FTMGP
    tunnel-group 1.1.1.1 ipsec-attributes
    pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    call-home reporting anonymous
    Cryptochecksum:701d8da28ee256692a1e49d904e9cb04
    : end
    asdm location Eventual 255.0.0.0 inside
    asdm location Local 255.255.255.0 inside
    asdm location T1 255.255.255.248 inside
    asdm location CFS 255.255.255.240 inside
    asdm history enable
    Thank You.

    I'm just re-engaging on the firewall this afternoon, but right now I'm getting request timed out on the pings....
    Here's the output requested:
    Result of the command: "show crypto isakmp sa"
    Active SA: 1
    Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
    Total IKE SA: 1
    1 IKE Peer: 1.1.1.1
    Type : L2L Role : initiator
    Rekey : no State : AM_ACTIVE
    Result of the command: "show crypto ipsec sa"
    interface: outside
    Crypto map tag: outside_map, seq num: 1, local addr: 2.2.2.2
    access-list outside_1_cryptomap extended permit ip 10.209.0.0 255.255.255.0 10.0.0.0 255.0.0.0
    local ident (addr/mask/prot/port): (Local/255.255.255.0/0/0)
    remote ident (addr/mask/prot/port): (Eventual/255.0.0.0/0/0)
    current_peer: 1.1.1.1
    #pkts encaps: 84, #pkts encrypt: 84, #pkts digest: 84
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 84, #pkts comp failed: 0, #pkts decomp failed: 0
    #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
    #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
    #send errors: 0, #recv errors: 0
    local crypto endpt.: 2.2.2.2, remote crypto endpt.: 1.1.1.1
    path mtu 1500, ipsec overhead 58, media mtu 1500
    current outbound spi: 8FC06BD1
    current inbound spi : 42EC16F4
    inbound esp sas:
    spi: 0x42EC16F4 (1122768628)
    transform: esp-3des esp-md5-hmac no compression
    in use settings ={L2L, Tunnel, PFS Group 2, }
    slot: 0, conn_id: 4096, crypto-map: outside_map
    sa timing: remaining key lifetime (kB/sec): (62207/28464)
    IV size: 8 bytes
    replay detection support: Y
    Anti replay bitmap:
    0x00000000 0x00000001
    outbound esp sas:
    spi: 0x8FC06BD1 (2411752401)
    transform: esp-3des esp-md5-hmac no compression
    in use settings ={L2L, Tunnel, PFS Group 2, }
    slot: 0, conn_id: 4096, crypto-map: outside_map
    sa timing: remaining key lifetime (kB/sec): (62201/28464)
    IV size: 8 bytes
    replay detection support: Y
    Anti replay bitmap:
    0x00000000 0x00000001
    Here's the current config:
    : Saved
    ASA Version 8.2(5)
    hostname ciscoasa
    enable password 8Ry2YjIyt7RRXU24 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 10.0.0.0 Eventual
    name 10.209.0.0 Local
    name 67.139.113.216 T1
    name 1.1.1.0 IntegraCFS
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 0
    ip address 10.209.0.3 255.0.0.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address 2.2.2.2 255.255.255.248
    time-range Indefinite
    ftp mode passive
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object-group protocol DM_INLINE_PROTOCOL_1
    protocol-object ip
    protocol-object icmp
    protocol-object udp
    protocol-object tcp
    object-group network DM_INLINE_NETWORK_1
    network-object Eventual 255.0.0.0
    network-object T1 255.255.255.248
    network-object IntegraCFS 255.255.255.240
    access-list outside_1_cryptomap extended permit ip Local 255.255.255.0 object-group DM_INLINE_NETWORK_1
    access-list No_NAT extended permit ip Local 255.255.255.0 Eventual 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any inside
    icmp permit any outside
    asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list No_NAT
    nat (inside) 1 0.0.0.0 0.0.0.0
    route outside 0.0.0.0 0.0.0.0 2.2.2.0 1
    route outside Eventual 255.255.255.0 1.1.1.1 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http Eventual 255.0.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer 1.1.1.1
    crypto map outside_map 1 set transform-set ESP-3DES-MD5
    crypto map outside_map 1 set security-association lifetime kilobytes 65535
    crypto map outside_map 1 set phase1-mode aggressive
    crypto map outside_map interface outside
    crypto ca trustpoint _SmartCallHome_ServerCA
    crl configure
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 28800
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    dhcpd address 10.209.0.201-10.209.0.232 inside
    dhcpd dns 8.8.8.8 8.8.4.4 interface inside
    dhcpd auto_config outside interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy DfltGrpPolicy attributes
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    group-policy FTMGP internal
    group-policy FTMGP attributes
    vpn-idle-timeout none
    vpn-filter none
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    tunnel-group 1.1.1.1 type ipsec-l2l
    tunnel-group 1.1.1.1 general-attributes
    default-group-policy FTMGP
    tunnel-group 1.1.1.1 ipsec-attributes
    pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
    message-length maximum client auto
    message-length maximum 512
    policy-map global_policy
    class inspection_default
    inspect dns preset_dns_map
    inspect ftp
    inspect h323 h225
    inspect h323 ras
    inspect rsh
    inspect rtsp
    inspect esmtp
    inspect sqlnet
    inspect skinny
    inspect sunrpc
    inspect xdmcp
    inspect sip
    inspect netbios
    inspect tftp
    inspect ip-options
    inspect icmp
    service-policy global_policy global
    prompt hostname context
    call-home reporting anonymous
    Cryptochecksum:301e573544ce0f89b3c597bdfe2c414a
    : end
    asdm location Eventual 255.0.0.0 inside
    asdm location Local 255.255.255.0 inside
    asdm location T1 255.255.255.248 inside
    asdm location IntegraCFS 255.255.255.240 inside
    asdm history enable

  • Cisco ASA 5520 Site-to-site VPN TUNNELS disconnection problem

    Hi,
    i recently purchased a Cisco ASA 5520 and running firmware v. 8.4(2) and ASDM v. 6.4(5)106.
    I have installed 50 Site-to-Site VPN tunnels, and they work fine.
    but randomly the VPN Tunnels keep disconnecting and few seconds after it connects it self automaticly....
    it happens when there is no TRAFIC on, i suspect.
    in ASDM in Group Policies under DfltGrpPolicy (system default) i have "idle timeout" to "UNLMITED" but still they keep disconnecting and connecting again... i have also verified that all VPN TUNNELS are using this Group Policie. and all VPN tunnels have "Idle Timeout: 0"
    this is very annoying as in my case i have customers having a RDP (remote dekstop client) open 24/7 and suddenly it gets disconnected due to no traffic ?
    in ASDM under Monitoring -> VPN .. i can see all VPN tunnels recently disconnected in "Login Time Duration"... some 30minutes, 52minutes, 40minutes and some 12 minutes ago.. and so on... they dont DISCONNECT at SAME time.. all randomly..
    i dont WANT the VPN TUNNELS to disconnect, i want them to RUN until we manually disconnect them.
    Any idea?
    Thanks,
    Daniel

    What is the lifetime value configured for in your crypto policies?
    For example:
    crypto ikev1 policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400

  • ASA 5505 site-to-site VPN tunnel and client VPN sessions

    Hello all
    I have several years of general networking experience, but I have not yet had to set up an ASA from the ground up, so please bear with me.
    I have a client who needs to establish a VPN tunnel from his satellite office (Site A) to his corporate office (Site Z).  His satellite office will have a single PC sitting behind the ASA.  In addition, he needs to be able to VPN from his home (Site H) to Site A to access his PC.
    The first question I have is about the ASA 5505 and the various licensing options.  I want to ensure that an ASA5505-BUN-K9 will be able to establish the site-to-site tunnel as well as allow him to use either the IPsec or SSL VPN client to connect from Site H to Site A.  Would someone please confirm or deny that for me?
    Secondly, I would like to verify that no special routing or configuration would need to take place in order to allow traffic not destined for Site Z (i.e., general web browsing or other traffic to any resource that is not part of the Site Z network) to go out his outside interface without specifically traversing the VPN tunnel (split tunneling?)
    Finally, if the client were to establish a VPN session from Site H to Site A, would that allow for him to connect directly into resources at Site Z without any special firewall security rules?  Since the VPN session would come in on the outside interface, and the tunnel back to Site Z goes out on the same interface, would this constitute a split horizon scenario that would call for a more complex config, or will the ASA handle that automatically without issue?
    I don't yet have the equipment in-hand, so I can't provide any sample configs for you to look over, but I will certainly do so once I've got it.
    Thanks in advance for any assistance provided!

    First question:
    Yes, 5505 will be able to establish site-to-site tunnel, and he can use IPSec vpn client, and SSL VPN (it comes with 2 default SSL VPN license).
    Second question:
    Yes, you are right. No special routing is required. All you need to configure is site-to-site VPN between Site A and Site Z LAN, and the internet traffic will be routed via Site A internet. Assuming you have all the NAT statement configured for that.
    Last question:
    This needs to be configured, it wouldn't automatically allow access to Site Z when he VPNs in to Site A.
    Here is what needs to be configured:
    1) Split tunnel ACL for VPN Client should include both Site Z and Site A LAN subnets.
    2) On site A configures: same-security-traffic permit intra-interface
    3) Crypto ACL for the site-to-site tunnel between Site Z and Site A needs to include the VPN Client pool subnet as follows:
    On Site Z:
    access-list permit ip
    On Site A:
    access-list permit ip
    4) NAT exemption on site Z needs to include vpn client pool subnet as well.
    Hope that helps.
    Message was edited by: Jennifer Halim

  • VPN tunnel Problem

    Hi all ,
    I need create VPN tunnels between two  ASAs devices . And these devices are connected through DSL . And as you know in this case we use private outside IP address , because there is  a NAT device at the outside . The problem is that no VPN tunnel is created even though all the parameters and the pre-shared-key are typical .

    I hve allready configured following configuration.
    no crypto map newmap interface outside
    no crypto map newmap 171 set peer 195.11.199.144
    no isakmp key ********* address 195.11.199.144 netmask 255.255.255.255 no-xauth no-config-mode
    crypto map newmap 171 set peer 195.11.204.5
    isakmp key ******** address 195.11.204.5 netmask 255.255.255.255 no-xauth no-config-mode
    clear crypto ipsec sa
    clear crypto isakmp sa
    crypto map newmap interface outside
    Setting were applied successfully however Still VPN tunnel is not been initiated.

  • SSL VPN Tunnel and Windows 7

    Hi
    I have a SA520W with firmware 2.1.18 and are having huge trouble getting windows 7 clients to connect using the SSL VPN Tunnel in Split mode. I've tested the registered users using an XP machine, and they are able to log in just fine and I can ping servers on the inside of the network. On windows 7, however, the VPN tunnel is created, but no IP trafic flows over the virtual network adapter and I'm not able to ping resources on the inside of the network. For the XP clients, the SSL VPN tunnel works like a charm, but not not 7.
    Are there any consideration to be taken on windows 7 to enable trafic over the SSL VPN virtual network adapter?
    Windows firewall?
    SSL service?

    Hi skcisco11,
    You can alternatively use Cisco VPN Client if your SA520 has firmware version 2.1.18 and above. Here is a document how to set it up:
    http://www.cisco.com/en/US/docs/security/multi_function_security/multi_function_security_appliance/sa_500/technote/note/SA500_vpnclient_appnote.pdf
    Alternatively, please use the following document on how to setup SSL VPN.  If you are using a local database on the SA520 to authenticate users,, then ignore the references to Active Directory.
    http://www.cisco.com/en/US/docs/security/multi_function_security/multi_function_security_appliance/sa_500/technote/note/active_directory.pdf
    Hope this helps,
    Julio

  • 2 VPN Tunnels between 2 devices on separate links

    Hello,
    I have a 2811 connected to two different ISPs, implying I have 2 separate interfaces for both links. I initially setup a VPN tunnel to a 3rd party remote site on one of the links/interfaces. I am now required to setup an additonal VPN tunnel to the same remote site on the other interface/link. When I finish the config and run tests, I get an error saying that the crypto map is not applied on the correct interface and that the peer is being routed through a non-crypto map interface.
    One thing I would like to know is if it is possible to configure the router to establish these two tunnels on the different links/interfaces to the same peer. Please note that the first VPN tunnel is still active, but the other one has just refused to come up. Please see the snippets of my router config below:
    crypto ipsec transform-set ABCD esp-3des esp-md5-hmac
    crypto isakmp policy 4
    encr 3des
    hash md5
    authentication pre-share
    group 5
    crypto isakmp policy 5
    encr 3des
    authentication pre-share
    group 2
    crypto isakmp policy 6
    encr 3des
    authentication pre-share
    group 2
    crypto isakmp key 123key address x.x.130.130
    crypto map SDM_CMAP_1 3 ipsec-isakmp
    description VPN Tunnel to ABCD on x.x.130.130
    set peer x.x.130.130
    set transform-set ABCD
    set pfs group5
    match address ABCD
    crypto map SDM_CMAP_2 1 ipsec-isakmp
    description description PROD VPN Tunnel to ABCD
    set peer x.x.130.130
    set transform-set ABCD
    set pfs group5
    match address ABCD_PROD
    interface FastEthernet0/1
    description ISP1 WAN INTERFACE$ETH-WAN$
    ip address a.a.42.66 255.255.255.252
    ip nbar protocol-discovery
    ip flow ingress
    ip flow egress
    ip nat outside
    ip virtual-reassembly
    duplex auto
    speed auto
    auto discovery qos
    crypto map SDM_CMAP_1
    interface FastEthernet0/2/0
    description ISP2_WAN_INTERFACE
    ip address y.y.12.94 255.255.255.192
    ip nbar protocol-discovery
    ip flow ingress
    ip flow egress
    ip nat outside
    ip virtual-reassembly
    duplex auto
    speed auto
    auto discovery qos
    crypto map SDM_CMAP_2
    ip access-list extended ABCD
    permit ip host 172.30.50.2 host x.x.130.138
    ip access-list extended ABCD_PROD
    permit ip host 172.19.205.31 host x.x.130.134
    ip route 0.0.0.0 0.0.0.0 a.a.42.65
    So its the tunnel running on ISP1 that is fine while the tunnel on ISP2 is not coming up.
    While pasting this though, I just realized there is no default route for ISP2, could this be the problem and would adding another default route not create some sort of loop?
    Regards,
    Femi

    Hello Marcin,
    When you said I didnt need to put both ISPs into VRF, i assume you meant that I only needed to put on f the ISPs into VRF, specifically the other ISP I was trying to establish a new VPN connection over?
    I did read the cheat sheet thoroughly and also went through some other documents. However, I still cound not get out of the router as the router kept complaining about routing issues:
    1. The peer must be routed through the crypto map interface. The following peer(s) are  routed through non-crypto map interface - a.b.130.130
    2. The tunnel traffic destination must be routed through the crypto map interface. The following destinations are routed through non-crypto map interface - a.b.130.134
    Below is the config I applied but I didnt get traffic out of the router still to even attempt to establish a connection:
    ip vrf PROD_INTCON
    rd 100:1
    route-target export 100:1
    route-target import 100:1
    ip vrf ISP2
    rd 101:1
    route-target export 101:1
    route-target import 101:1
    crypto keyring NI2-keyring vrf ISP2
      pre-shared-key address a.b.130.130 key xxxxx
    crypto isakmp policy 4
    encr 3des
    hash md5
    authentication pre-share
    group 5
    crypto isakmp policy 5
    encr 3des
    authentication pre-share
    group 2
    crypto isakmp policy 6
    encr 3des
    authentication pre-share
    group 2
    crypto isakmp profile NI2-profile
    vrf PROD_INTCON
    keyring NI2-keyring
    match identity address a.b.130.130 255.255.255.255 ISP2
    isakmp authorization list default
    crypto ipsec transform-set NI2set esp-3des esp-md5-hmac
    crypto map SDM_CMAP_2 1 ipsec-isakmp
    description PROD VPN Tunnel to NI2
    set peer a.b.130.130
    set transform-set NI2set
    set pfs group5
    set isakmp-profile NI2-profile
    match address NI2_ACL
    reverse-route
    interface FastEthernet0/2/0
    ip vrf forwarding ISP2
    ip address z.y.12.94 255.255.255.192
    crypto map SDM_CMAP_2
    interface FastEthernet0/2/1.603
    description PROD_INTCON_ZONE
    encapsulation dot1Q 603
    ip vrf forwarding PROD_INTCON
    ip address 172.19.205.1 255.255.255.0
    ip flow ingress
    ip nat inside
    ip virtual-reassembly
    ip route vrf ISP2 0.0.0.0 0.0.0.0 z.y.12.65
    ip route vrf PROD_INTCON a.b.130.134 255.255.255.255 FastEthernet0/2/0 z.y.12.65
    ip access-list extended NI2_ACL
    permit ip host 172.19.205.31 host a.b.130.134

  • VPN Tunnel setup - can't ping either endpoint

    So I was given the task to set up a new VPN tunnel for a client and even though I've basically made it open, we still cannot ping each other's endpoints. I troubleshooted for over an hour with one of their techs, still to no avail. I included the config of this router. The tunnel can build out, completes phase 1 and 2, but still doesn't allow traffic or ability to connect to either endpoint. Please help.
    Result of the command: "sh run"
    : Saved
    ASA Version 8.0(3)6
    hostname RBPASA01
    domain-name rbmc.org
    enable password *removed* encrypted
    passwd *removed* encrypted
    names
    name 10.20.10.0 OBD-DHCP-10.20.10.x description DHCP Scopes for VLAN20
    name 10.20.11.0 OBD-DHCP-10.20.11.x description DHCP Scopes for VLAN20
    name 10.20.12.0 OBD-DHCP-10.20.12.x description DHCP Scopes for VLAN20
    name 10.10.14.0 PAD-DHCP-10.10.14.X description DHCP Scopes for VLAN10
    name 128.127.0.0 Millennium-Remote
    name 10.10.0.0 Pad-10.10-network
    name 10.11.0.0 Pad-10.11-network
    name 10.12.0.0 Pad-10.12-network
    name 10.100.91.0 Pad-10.100-network
    name 10.30.13.0 Millennium-nat
    name 10.100.91.200 Maxsys-Server
    name 65.171.123.34 Maxsys-Remote description Landacorp remote access
    name 65.211.65.21 FTP-External-Address
    name 172.31.0.15 FTP-Internal-Address description FTP Server in DMZ
    name 10.100.91.201 RBPMAXYS02 description Landacorp Access
    name 10.10.10.231 c05407
    name 192.168.55.4 c05407Nat
    name 192.168.55.3 c057017Nat
    name 10.10.13.50 c05744
    name 192.168.55.5 c05744Nat
    name 151.198.253.253 VPN-External
    name 10.13.102.30 NBI20610 description Viewpoint Server SBHCS
    name 10.100.90.51 RBPASA01 description PRI ASA
    name 10.100.90.52 RBPASA02 description SECASA
    name 151.198.253.254 VPN02External
    name 10.10.7.189 RBMHIS description AergoVPN(Local)
    name 10.10.7.43 RBMHIS1 description AergoVPN(Local)
    name 10.10.7.44 RBMHIS2 description AergoVPN(Local)
    name 10.100.98.21 RBMS2 description AergoVPN(Local)
    name 10.1.6.0 AergoVPN-Remote description AergoVPN-Remote
    name 216.167.127.4 Lynx-PicisHost1 description Lynx Encryption Domain
    name 216.167.127.30 Lynx-PicisHost10 description Lynx Encryption Domain
    name 216.167.127.31 Lynx-PicisHost11 description Lynx Encryption Domain
    name 216.167.127.32 Lynx-PicisHost12 description Lynx Encryption Domain
    name 216.167.127.33 Lynx-PicisHost13 description Lynx Encryption Domain
    name 216.167.127.34 Lynx-PicisHost14 description Lynx Encryption Domain
    name 216.167.127.35 Lynx-PicisHost15 description Lynx Encryption Domain
    name 216.167.127.5 Lynx-PicisHost2 description Lynx Encryption Domain
    name 216.167.127.6 Lynx-PicisHost3 description Lynx Encryption Domain
    name 216.167.127.7 Lynx-PicisHost4 description Lynx Encryption Domain
    name 216.167.127.8 Lynx-PicisHost5 description Lynx Encryption Domain
    name 216.167.127.9 Lynx-PicisHost6 description Lynx Encryption Domain
    name 216.167.127.10 Lynx-PicisHost7 description Lynx Encryption Domain
    name 216.167.127.28 Lynx-PicisHost8 description Lynx Encryption Domain
    name 216.167.127.29 Lynx-PicisHost9 description Lynx Encryption Domain
    name 216.167.119.208 Lynx-PicisNtwk description Lynx-PicisNtwk
    name 10.10.7.152 OLSRV2RED description Picis-LynxLocal
    name 10.100.91.14 RBPPICISTST description Lynx-PicisLocal
    name 10.100.98.20 RBPAERGO1 description AERGO
    name 10.50.1.141 PACSHost1 description GE PACS Local
    name 10.50.1.149 PACSHost2 description GE PACS Local
    name 10.50.1.151 PACSHost3 description GE PACS Local
    name 10.50.1.38 PACSHost4 description GE PACS Local
    name 10.50.1.39 PACSHost5 description GE PACS Local
    name 10.50.1.41 PACSHost6 description GE PACS Local
    name 10.50.1.42 PACSHost7 description GE PACS Local
    name 10.50.1.43 PACSHost8 description GE PACS Local
    name 10.50.1.64 PACSHost10 description GE PACS Local
    name 10.50.1.67 PACSHost11 description GE PACS Local
    name 10.50.1.68 PACSHost12 description GE PACS Local
    name 10.50.1.69 PACSHost13 description GE PACS Local
    name 10.50.1.44 PACSHost9 description GE PACS Local
    name 10.50.1.70 PACSHost14 description GE PACS Local
    name 10.50.1.71 PACSHost15 description GE PACS Local
    name 10.50.1.72 PACSHost16 description GE PACS Local
    name 10.50.1.73 PACSHost17 description GE PACS Local
    name 10.50.1.74 PACSHost18 description GE PACS Local
    name 10.50.1.75 PACSHost19 description GE PACS Local
    name 10.50.1.76 PACSHost20 description GE PACS Local
    name 10.50.1.77 PACSHost21 description GE PACS Local
    name 10.50.1.91 PACSHost22 description GE PACS Local
    name 10.50.1.92 PACSHost23 description GE PACS Local
    name 10.60.1.42 PACSHost24 description GE PACS Local
    name 10.60.1.43 PACSHost25 description GE PACS Local
    name 10.60.1.44 PACSHost26 description GE PACS Local
    name 10.60.1.45 PACSHost27 description GE PACS Local
    name 10.60.1.46 PACSHost28 description GE PACS Local
    name 10.60.1.47 PACSHost29 description GE PACS Local
    name 10.60.1.48 PACSHost30 description GE PACS Local
    name 10.60.1.49 PACSHost31 description GE PACS Local
    name 10.60.1.51 PACSHost32 description GE PACS Local
    name 10.60.1.52 PACSHost33 description GE PACS Local
    name 10.60.1.53 PACSHost34 description GE PACS Local
    name 10.60.1.80 PACSHost35 description GE PACS Local
    name 10.50.1.30 PACSHost36 description GE PACS Local
    name 10.50.1.200 PACSHost37 description GE PACS Local
    name 10.50.1.137 PACSHost38 description GE PACS Local
    name 10.50.1.203 PACSHost39 description GE PACS Local
    name 10.50.1.206 PACSHost40 description GE PACS Local
    name 10.50.1.209 PACSHost41 description GE PACS Local
    name 10.60.1.215 PACSHost42 description GE PACS Local
    name 10.60.1.23 PACSHost43 description GE PACS Local
    name 10.60.1.21 PACSHost44 description GE PACS Local
    name 10.50.1.36 PACSHost45 description GE PACS Local
    name 10.50.1.34 PACSHost46 description GE PACS Local
    name 10.50.1.10 PACSHost47 description GE PACS Local
    name 150.2.0.0 GE_PACS_NET description GE PACS Remote
    name 10.50.1.19 PACSHost49 description GE PACS Local
    name 10.50.1.28 PACSHost50 description GE PACS Local
    name 10.50.1.29 PACSHost51 description GE PACS Local
    name 10.50.1.140 PACSHost52 description GE PACS Local
    name 10.60.1.161 PACSHost53 description GE PACS Local
    name 10.50.1.31 PACSHost54 description GE PACS Local
    name 10.50.1.32 PACSHost55 description GE PACS Local
    name 10.50.1.4 PACSHost56 description GE PACS Local
    name 10.50.1.35 PACSHost57 description GE PACS Local
    name 10.50.1.37 PACSHost58 description GE PACS Local
    name 10.60.1.22 PACSHost59 description GE PACS Local
    name 10.60.1.24 PACSHost60 description GE PACS Local
    name 10.60.1.218 PACSHost61 description GE PACS Local
    name 10.60.1.221 PACSHost62 description GE PACS Local
    name 10.50.1.16 PACSHost63 description GE PACS Local
    name 10.50.1.15 PACSHost64 description GE PACS Local
    name 10.50.1.106 PACSHost65 description GE PACS Local
    name 10.50.1.33 PACSHost66 description GE PACS Local
    name 10.20.7.160 PACSHost67 description GE PACS Local
    name 10.50.1.135 PACSHost68 description GE PACS Local
    name 10.60.1.141 PACSHost69 description GE PACS Local
    name 10.60.1.150 PACSHost70 description GE PACS Local
    name 10.60.1.154 PACSHost71 description GE PACS Local
    name 10.50.1.136 PACSHost72 description GE PACS Local
    name 10.50.1.147 PACSHost73 description GE PACS Local
    name 10.50.1.161 PACSHost74 description GE PACS Local
    name 10.60.1.155 PACSHost75 description GE PACS Local
    name 10.30.0.0 Throckmorton_Net1 description Internal
    name 108.58.104.208 Throckmorton_Net2 description External
    name 10.0.0.0 PAD_Internal description PAD INternal
    name 172.16.100.16 LandaCorp_Remote description LandaCorp
    name 192.168.55.6 C05817Nat description ViewPoint Computer
    name 10.10.13.71 C05817 description ViewPoint Computer
    name 10.50.1.189 RBMCCCG description GE PACS Local
    name 10.50.1.21 RBMCDAS21 description GE PACS Local
    name 10.50.1.22 RBMCDAS22 description GE PACS Local
    name 10.50.1.23 RBMCDAS23 description GE PACS Local
    name 10.50.1.24 RBMCDAS24 description GE PACS Local
    name 10.50.1.248 RBMCNAS_BACKUP description GE PACS Local
    name 10.50.1.243 RBMCNAS_STS description GE PACS Local
    name 10.50.1.186 RBMCSPS description GE PACS Local
    name 10.50.1.188 RBMCTESTCCG description GE PACS Local
    name 10.50.1.252 RBMCTESTIMS description GE PACS Local
    name 10.50.1.249 RBMICISU2 description GE PACS Local
    name 10.50.1.191 RBMC1DAS32ILO description GE PACS Local
    name 10.50.1.192 RBMC1DAS33ILO description GE PACS Local
    name 10.50.1.193 RBMC1DAS34ILO description GE PACS Local
    name 10.50.1.194 RBMC1DAS35ILO description GE PACS Local
    name 10.50.1.195 RBMC1DAS36ILO description GE PACS Local
    name 10.50.1.197 RBMC1DAS38ILO description GE PACS Local
    name 10.50.1.190 RBMC1DPS106ILO description GE PACS Local
    name 10.50.1.196 RBMCCWEBILO description GE PACS Local
    name 10.50.1.17 RBMCEACA description GE PACS Local
    name 10.50.1.247 RBMCNAS_BACKUPILO description GE PACS Local
    name 10.50.1.254 RBMICISU2ILO description GE PACS Local
    name 10.50.1.187 RBMC1DAS31_ILO description GE PACS Local
    name 10.50.1.253 RBMCTESTDAS description GE PACS Local
    name 12.145.95.0 LabCorp_Test_Remote description LabCorp VPN TEST
    name 38.107.151.110 ClearSea_Server description DeafTalk External Server
    name 10.100.90.15 DeafTalk1
    name 10.10.10.155 Dennis
    name 10.10.7.81 RBPMAM description SunQuest Lab Server
    dns-guard
    interface GigabitEthernet0/0
    description External Interface
    speed 1000
    duplex full
    nameif Verizon-ISP
    security-level 0
    ip address VPN-External 255.255.255.224 standby VPN02External
    ospf cost 10
    interface GigabitEthernet0/1
    description LAN/STATE Failover Interface
    interface GigabitEthernet0/2
    description INTERNAL-NET
    nameif Internal
    security-level 100
    ip address RBPASA01 255.255.255.0 standby RBPASA02
    ospf cost 10
    interface GigabitEthernet0/3
    description DMZ Zone
    nameif DMZ
    security-level 10
    ip address 172.31.0.51 255.255.255.0
    interface Management0/0
    shutdown
    no nameif
    no security-level
    no ip address
    time-range Vendor-Access
    periodic Monday 9:00 to Friday 16:00
    clock timezone EST -5
    clock summer-time EDT recurring
    dns domain-lookup Verizon-ISP
    dns domain-lookup Internal
    dns server-group DefaultDNS
    name-server 10.100.91.5
    name-server 10.10.7.149
    domain-name rbmc.org
    object-group service VPN_Tunnel tcp
    description Ports used for Site to Site VPN Tunnel
    port-object eq 10000
    port-object eq 2746
    port-object eq 4500
    port-object eq 50
    port-object eq 500
    port-object eq 51
    object-group network Millennium-Local-Network
    description Pad networks that connect to millennium
    network-object Pad-10.10-network 255.255.0.0
    network-object Throckmorton_Net1 255.255.0.0
    object-group icmp-type ICMP-Request-Group
    icmp-object echo
    icmp-object information-request
    icmp-object mask-request
    icmp-object timestamp-request
    object-group service DM_INLINE_TCP_2 tcp
    port-object eq ftp
    port-object eq ftp-data
    port-object eq ssh
    object-group network Viewpoint
    description OB Viewpoint Clients
    network-object host 10.10.10.220
    network-object host c05407
    network-object host c05744
    network-object host 192.168.55.2
    network-object host c057017Nat
    network-object host c05407Nat
    network-object host c05744Nat
    network-object host C05817Nat
    network-object host C05817
    object-group service ConnectionPorts tcp-udp
    port-object eq 3872
    port-object eq 4890
    port-object eq 4898
    object-group service TCP tcp
    port-object eq 3389
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    object-group service DM_INLINE_TCP_1 tcp
    group-object ConnectionPorts
    port-object eq 3389
    object-group protocol DM_INLINE_PROTOCOL_1
    protocol-object icmp
    protocol-object tcp
    object-group network AergoVPN-Local
    description Aergo VPN Local HIS Servers
    network-object host RBMHIS
    network-object host RBMHIS1
    network-object host RBMHIS2
    network-object host RBMS2
    network-object host RBPAERGO1
    object-group protocol DM_INLINE_PROTOCOL_3
    protocol-object icmp
    protocol-object tcp
    object-group protocol DM_INLINE_PROTOCOL_4
    protocol-object icmp
    protocol-object udp
    protocol-object tcp
    object-group network Lynx-PicisRemote
    description Lynx-Picis Remote Encryption Domain
    network-object Lynx-PicisNtwk 255.255.255.240
    network-object host Lynx-PicisHost7
    network-object host Lynx-PicisHost8
    network-object host Lynx-PicisHost9
    network-object host Lynx-PicisHost10
    network-object host Lynx-PicisHost11
    network-object host Lynx-PicisHost12
    network-object host Lynx-PicisHost13
    network-object host Lynx-PicisHost14
    network-object host Lynx-PicisHost15
    network-object host Lynx-PicisHost1
    network-object host Lynx-PicisHost2
    network-object host Lynx-PicisHost3
    network-object host Lynx-PicisHost4
    network-object host Lynx-PicisHost5
    network-object host Lynx-PicisHost6
    object-group network DM_INLINE_NETWORK_1
    network-object host OLSRV2RED
    network-object host RBPPICISTST
    object-group network DM_INLINE_NETWORK_2
    network-object host OLSRV2RED
    network-object host RBPPICISTST
    object-group protocol DM_INLINE_PROTOCOL_5
    protocol-object icmp
    protocol-object tcp
    object-group network DM_INLINE_NETWORK_3
    network-object host OLSRV2RED
    network-object host RBPPICISTST
    object-group service DM_INLINE_SERVICE_1
    service-object icmp
    service-object udp
    service-object tcp
    service-object tcp eq ftp
    object-group protocol DM_INLINE_PROTOCOL_6
    protocol-object icmp
    protocol-object udp
    protocol-object tcp
    object-group protocol DM_INLINE_PROTOCOL_7
    protocol-object icmp
    protocol-object udp
    protocol-object tcp
    object-group protocol DM_INLINE_PROTOCOL_2
    protocol-object icmp
    protocol-object udp
    protocol-object tcp
    object-group service DM_INLINE_TCP_3 tcp
    group-object ConnectionPorts
    port-object eq 3389
    object-group network GE_PACS_Local
    description GE PACS Local Hosts
    network-object host PACSHost67
    network-object host PACSHost65
    network-object host PACSHost47
    network-object host PACSHost68
    network-object host PACSHost72
    network-object host PACSHost38
    network-object host PACSHost52
    network-object host PACSHost1
    network-object host PACSHost73
    network-object host PACSHost2
    network-object host PACSHost3
    network-object host PACSHost64
    network-object host PACSHost74
    network-object host PACSHost63
    network-object host PACSHost49
    network-object host PACSHost37
    network-object host PACSHost39
    network-object host PACSHost40
    network-object host PACSHost41
    network-object host PACSHost50
    network-object host PACSHost51
    network-object host PACSHost36
    network-object host PACSHost54
    network-object host PACSHost55
    network-object host PACSHost66
    network-object host PACSHost46
    network-object host PACSHost57
    network-object host PACSHost45
    network-object host PACSHost58
    network-object host PACSHost4
    network-object host PACSHost5
    network-object host PACSHost6
    network-object host PACSHost7
    network-object host PACSHost8
    network-object host PACSHost9
    network-object host PACSHost56
    network-object host PACSHost10
    network-object host PACSHost11
    network-object host PACSHost12
    network-object host PACSHost13
    network-object host PACSHost14
    network-object host PACSHost15
    network-object host PACSHost16
    network-object host PACSHost17
    network-object host PACSHost18
    network-object host PACSHost19
    network-object host PACSHost20
    network-object host PACSHost21
    network-object host PACSHost22
    network-object host PACSHost23
    network-object host PACSHost69
    network-object host PACSHost70
    network-object host PACSHost71
    network-object host PACSHost75
    network-object host PACSHost53
    network-object host PACSHost42
    network-object host PACSHost61
    network-object host PACSHost44
    network-object host PACSHost62
    network-object host PACSHost59
    network-object host PACSHost43
    network-object host PACSHost60
    network-object host PACSHost24
    network-object host PACSHost25
    network-object host PACSHost26
    network-object host PACSHost27
    network-object host PACSHost28
    network-object host PACSHost29
    network-object host PACSHost30
    network-object host PACSHost31
    network-object host PACSHost32
    network-object host PACSHost33
    network-object host PACSHost34
    network-object host PACSHost35
    network-object host RBMCSPS
    network-object host RBMCTESTCCG
    network-object host RBMCCCG
    network-object host RBMCDAS21
    network-object host RBMCDAS22
    network-object host RBMCDAS23
    network-object host RBMCNAS_STS
    network-object host RBMCNAS_BACKUP
    network-object host RBMICISU2
    network-object host RBMCDAS24
    network-object host RBMCTESTIMS
    network-object host RBMCEACA
    network-object host RBMC1DAS31_ILO
    network-object host RBMC1DPS106ILO
    network-object host RBMC1DAS32ILO
    network-object host RBMC1DAS33ILO
    network-object host RBMC1DAS34ILO
    network-object host RBMC1DAS35ILO
    network-object host RBMC1DAS36ILO
    network-object host RBMCCWEBILO
    network-object host RBMC1DAS38ILO
    network-object host RBMCNAS_BACKUPILO
    network-object host RBMCTESTDAS
    network-object host RBMICISU2ILO
    object-group service DM_INLINE_SERVICE_2
    service-object icmp
    service-object udp
    service-object tcp
    service-object tcp eq ftp
    object-group service DM_INLINE_SERVICE_3
    service-object icmp
    service-object udp
    service-object tcp
    service-object tcp eq ftp
    object-group network DM_INLINE_NETWORK_4
    network-object Throckmorton_Net1 255.255.0.0
    network-object Throckmorton_Net2 255.255.255.248
    object-group network DM_INLINE_NETWORK_5
    network-object Throckmorton_Net1 255.255.0.0
    network-object Throckmorton_Net2 255.255.255.248
    object-group network DM_INLINE_NETWORK_6
    network-object Throckmorton_Net1 255.255.0.0
    network-object Throckmorton_Net2 255.255.255.248
    object-group network DM_INLINE_NETWORK_7
    network-object Throckmorton_Net1 255.255.0.0
    network-object Throckmorton_Net2 255.255.255.248
    object-group network DM_INLINE_NETWORK_8
    network-object Throckmorton_Net1 255.255.0.0
    network-object Throckmorton_Net2 255.255.255.248
    object-group service DM_INLINE_SERVICE_4
    service-object icmp
    service-object udp
    service-object tcp
    service-object tcp eq ftp
    object-group service DM_INLINE_SERVICE_5
    service-object icmp
    service-object udp
    service-object tcp
    service-object tcp eq ftp
    object-group network DM_INLINE_NETWORK_9
    network-object host RBMCEACA
    group-object GE_PACS_Local
    object-group protocol DM_INLINE_PROTOCOL_9
    protocol-object ip
    protocol-object icmp
    object-group service ClearSea tcp-udp
    description DeafTalk
    port-object range 10000 19999
    port-object eq 35060
    object-group service ClearSeaUDP udp
    description DeafTalk
    port-object range 10000 19999
    object-group service DM_INLINE_TCP_4 tcp
    group-object ClearSea
    port-object eq www
    port-object eq https
    object-group network DM_INLINE_NETWORK_11
    network-object 0.0.0.0 0.0.0.0
    network-object host DeafTalk1
    object-group protocol DM_INLINE_PROTOCOL_10
    protocol-object ip
    protocol-object icmp
    object-group protocol DM_INLINE_PROTOCOL_11
    protocol-object ip
    protocol-object icmp
    access-list RBMCVPNCL_splitTunnelAcl standard permit Pad-10.100-network 255.255.255.0
    access-list Verizon-ISP_Internal extended permit tcp any host FTP-External-Address eq ftp
    access-list dmz_internal extended permit tcp host FTP-Internal-Address any eq ftp
    access-list Internal_access_in extended permit object-group DM_INLINE_PROTOCOL_4 object-group AergoVPN-Local AergoVPN-Remote 255.255.255.0
    access-list Internal_access_in extended permit object-group DM_INLINE_SERVICE_1 object-group DM_INLINE_NETWORK_3 object-group Lynx-PicisRemote
    access-list Internal_access_in extended permit object-group DM_INLINE_PROTOCOL_6 object-group Viewpoint host NBI20610
    access-list Internal_access_in extended permit object-group DM_INLINE_PROTOCOL_7 host RBPMAXYS02 host LandaCorp_Remote
    access-list Internal_access_in extended permit tcp host RBPMAXYS02 host LandaCorp_Remote object-group DM_INLINE_TCP_3
    access-list Internal_access_in extended permit object-group DM_INLINE_SERVICE_2 object-group GE_PACS_Local GE_PACS_NET 255.255.0.0
    access-list Internal_access_in extended permit object-group DM_INLINE_SERVICE_4 Pad-10.10-network 255.255.0.0 object-group DM_INLINE_NETWORK_7
    access-list Internal_access_in remark Permit to connect to DeafTalk Server
    access-list Internal_access_in extended permit tcp object-group DM_INLINE_NETWORK_11 host ClearSea_Server object-group DM_INLINE_TCP_4
    access-list Internal_access_in extended permit object-group DM_INLINE_PROTOCOL_10 any LabCorp_Test_Remote 255.255.255.0
    access-list Verizon-ISP_cryptomap_1 extended permit object-group DM_INLINE_PROTOCOL_11 host RBPMAM LabCorp_Test_Remote 255.255.255.0
    access-list Verizon-ISP_2_cryptomap extended permit tcp host Maxsys-Server host Maxsys-Remote object-group VPN_Tunnel
    access-list Internal_nat0_outbound extended permit tcp Pad-10.100-network 255.255.255.0 host Maxsys-Remote object-group VPN_Tunnel
    access-list DMZ_access_in extended permit ip Pad-10.10-network 255.255.0.0 172.31.0.0 255.255.255.0
    access-list Verizon-ISP_access_in extended permit tcp any host FTP-External-Address object-group DM_INLINE_TCP_2
    access-list Verizon-ISP_access_in extended permit tcp host LandaCorp_Remote host RBPMAXYS02 object-group DM_INLINE_TCP_1
    access-list Verizon-ISP_access_in extended permit object-group DM_INLINE_PROTOCOL_1 host NBI20610 object-group Viewpoint
    access-list Verizon-ISP_access_in extended permit object-group DM_INLINE_PROTOCOL_3 AergoVPN-Remote 255.255.255.0 object-group AergoVPN-Local
    access-list Verizon-ISP_access_in extended permit object-group DM_INLINE_PROTOCOL_5 object-group Lynx-PicisRemote object-group DM_INLINE_NETWORK_2
    access-list Verizon-ISP_access_in extended permit object-group DM_INLINE_PROTOCOL_2 host LandaCorp_Remote host RBPMAXYS02
    access-list Verizon-ISP_access_in extended permit object-group DM_INLINE_SERVICE_3 GE_PACS_NET 255.255.0.0 object-group DM_INLINE_NETWORK_9
    access-list Verizon-ISP_access_in extended permit object-group DM_INLINE_PROTOCOL_9 LabCorp_Test_Remote 255.255.255.0 any
    access-list Verizon-ISP_access_in extended permit object-group DM_INLINE_SERVICE_5 object-group DM_INLINE_NETWORK_8 Pad-10.10-network 255.255.0.0
    access-list Verizon-ISP_3_cryptomap extended permit ip host Maxsys-Server host Maxsys-Remote
    access-list Internal_nat0_outbound_1 extended permit ip host RBPMAXYS02 host LandaCorp_Remote
    access-list Internal_nat0_outbound_1 extended permit ip object-group AergoVPN-Local AergoVPN-Remote 255.255.255.0
    access-list Internal_nat0_outbound_1 extended permit ip host OLSRV2RED object-group Lynx-PicisRemote
    access-list Internal_nat0_outbound_1 extended permit ip object-group DM_INLINE_NETWORK_1 object-group Lynx-PicisRemote
    access-list Internal_nat0_outbound_1 extended permit ip any 10.100.99.0 255.255.255.0
    access-list Internal_nat0_outbound_1 extended permit ip object-group GE_PACS_Local GE_PACS_NET 255.255.0.0
    access-list Internal_nat0_outbound_1 extended permit ip Pad-10.10-network 255.255.0.0 object-group DM_INLINE_NETWORK_4
    access-list Internal_nat0_outbound_1 extended permit ip PAD_Internal 255.0.0.0 object-group DM_INLINE_NETWORK_5
    access-list Internal_nat0_outbound_1 extended permit ip PAD_Internal 255.0.0.0 object-group DM_INLINE_NETWORK_6
    access-list Internal_nat0_outbound_1 extended permit ip object-group Millennium-Local-Network Millennium-Remote 255.255.0.0
    access-list Internal_nat0_outbound_1 extended deny ip any LabCorp_Test_Remote 255.255.255.0 inactive
    access-list Verizon-ISP_5_cryptomap extended permit ip host RBPMAXYS02 host LandaCorp_Remote
    access-list Verizon-ISP_6_cryptomap extended permit ip object-group Viewpoint host NBI20610
    access-list Verizon-ISP_4_cryptomap extended permit ip object-group DM_INLINE_NETWORK_1 object-group Lynx-PicisRemote
    access-list Verizon-ISP_7_cryptomap extended permit ip object-group GE_PACS_Local GE_PACS_NET 255.255.0.0
    access-list Verizon-ISP_8_cryptomap extended permit ip PAD_Internal 255.0.0.0 object-group DM_INLINE_NETWORK_5
    access-list Verizon-ISP_9_cryptomap extended permit ip PAD_Internal 255.0.0.0 object-group DM_INLINE_NETWORK_6
    access-list Verizon-ISP_cryptomap extended permit ip object-group AergoVPN-Local AergoVPN-Remote 255.255.255.0
    pager lines 24
    logging enable
    logging buffer-size 32000
    logging buffered debugging
    logging asdm debugging
    mtu Verizon-ISP 1500
    mtu Internal 1500
    mtu DMZ 1500
    ip local pool CiscoClient-IPPool-192.168.55.x 192.168.45.1-192.168.45.25 mask 255.255.255.0
    ip local pool VLAN99VPNUsers 10.100.99.6-10.100.99.255 mask 255.255.255.0
    failover
    failover lan unit primary
    failover lan interface Failover GigabitEthernet0/1
    failover key *****
    failover replication http
    failover link Failover GigabitEthernet0/1
    failover interface ip Failover 172.16.90.17 255.255.255.248 standby 172.16.90.18
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit host 173.72.107.26 Verizon-ISP
    icmp deny any Verizon-ISP
    icmp permit host 192.168.10.2 Internal
    icmp permit host 192.168.10.3 Internal
    icmp permit host 192.168.10.4 Internal
    icmp permit host 192.168.10.5 Internal
    icmp permit host 10.10.10.96 Internal
    icmp permit host 10.10.13.20 Internal
    icmp permit host 10.10.12.162 Internal
    icmp deny any Internal
    icmp permit host Dennis Internal
    asdm image disk0:/asdm-603.bin
    asdm history enable
    arp timeout 14400
    global (Verizon-ISP) 1 65.211.65.6-65.211.65.29 netmask 255.255.255.224
    global (Verizon-ISP) 101 interface
    nat (Internal) 0 access-list Internal_nat0_outbound_1
    nat (Internal) 101 0.0.0.0 0.0.0.0
    static (Internal,DMZ) Pad-10.10-network Pad-10.10-network netmask 255.255.0.0
    static (Verizon-ISP,DMZ) FTP-Internal-Address FTP-External-Address netmask 255.255.255.255
    static (DMZ,Verizon-ISP) FTP-External-Address FTP-Internal-Address netmask 255.255.255.255
    static (Internal,Verizon-ISP) c05407Nat c05407 netmask 255.255.255.255
    static (Internal,Verizon-ISP) c057017Nat 10.10.10.220 netmask 255.255.255.255
    static (Internal,Verizon-ISP) c05744Nat c05744 netmask 255.255.255.255
    static (Verizon-ISP,Internal) Maxsys-Server VPN-External netmask 255.255.255.255
    static (Internal,Verizon-ISP) C05817Nat C05817 netmask 255.255.255.255
    access-group Verizon-ISP_access_in in interface Verizon-ISP
    access-group Internal_access_in in interface Internal
    access-group dmz_internal in interface DMZ
    route Verizon-ISP 0.0.0.0 0.0.0.0 65.211.65.2 1
    route Internal Pad-10.10-network 255.255.0.0 10.10.0.1 1
    route Internal 10.20.0.0 255.255.0.0 10.10.0.1 1
    route Internal Throckmorton_Net1 255.255.0.0 10.10.0.1 1
    route Internal 10.50.0.0 255.255.0.0 10.10.0.1 1
    route Internal 10.60.0.0 255.255.0.0 10.10.0.1 1
    route Internal 10.70.0.0 255.255.0.0 10.10.0.1 1
    route Internal 10.100.0.0 255.255.0.0 10.10.0.1 1
    route Internal 64.46.192.0 255.255.255.0 10.10.0.1 1
    route Internal 64.46.193.0 255.255.255.0 10.10.0.1 1
    route Internal 64.46.194.0 255.255.255.0 10.10.0.1 1
    route Internal 64.46.195.0 255.255.255.0 10.10.0.1 1
    route Internal 64.46.196.0 255.255.255.0 10.10.0.1 1
    route Internal 64.46.201.0 255.255.255.0 10.10.0.1 1
    route Internal 64.46.246.0 255.255.255.0 10.10.0.1 1
    route Verizon-ISP 65.51.206.130 255.255.255.255 65.211.65.2 255
    route Verizon-ISP Millennium-Remote 255.255.0.0 65.211.65.2 1
    route Internal Millennium-Remote 255.255.0.0 10.10.0.1 255
    route Internal 172.31.1.0 255.255.255.0 10.10.0.1 1
    route Internal 192.168.55.0 255.255.255.0 10.10.0.1 1
    route Internal 195.21.26.0 255.255.255.0 10.10.0.1 1
    route Internal 199.21.26.0 255.255.255.0 10.10.0.1 1
    route Internal 199.21.27.0 255.255.255.0 10.10.0.1 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server RadiusServer protocol radius
    aaa-server RadiusServer (Internal) host 10.10.7.240
    timeout 5
    key r8mcvpngr0up!
    radius-common-pw r8mcvpngr0up!
    aaa-server SafeNetOTP protocol radius
    max-failed-attempts 1
    aaa-server SafeNetOTP (Internal) host 10.100.91.13
    key test
    radius-common-pw test
    aaa-server VPN-FW protocol radius
    aaa-server VPN-FW (Internal) host 10.10.7.240
    timeout 5
    key r8mcvpngr0up!
    aaa authentication ssh console LOCAL
    aaa authentication telnet console LOCAL
    aaa authentication enable console LOCAL
    aaa local authentication attempts max-fail 16
    http server enable
    http Dennis 255.255.255.255 Internal
    http 10.10.11.108 255.255.255.255 Internal
    http 10.10.10.194 255.255.255.255 Internal
    http 10.10.10.195 255.255.255.255 Internal
    http 10.10.12.162 255.255.255.255 Internal
    http 10.10.13.20 255.255.255.255 Internal
    snmp-server location BRN2 Data Center
    snmp-server contact Crystal Holmes
    snmp-server community r8mc0rg
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    snmp-server enable traps entity config-change
    auth-prompt prompt Your credentials have been verified
    auth-prompt accept Your credentials have been accepted
    auth-prompt reject Your credentials have been rejected. Contact your system administrator
    service resetoutside
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map Verizon-ISP_map 1 match address Verizon-ISP_cryptomap
    crypto map Verizon-ISP_map 1 set peer 65.51.154.66
    crypto map Verizon-ISP_map 1 set transform-set ESP-3DES-MD5
    crypto map Verizon-ISP_map 2 match address Verizon-ISP_2_cryptomap
    crypto map Verizon-ISP_map 2 set peer Maxsys-Remote
    crypto map Verizon-ISP_map 2 set transform-set ESP-3DES-SHA
    crypto map Verizon-ISP_map 2 set nat-t-disable
    crypto map Verizon-ISP_map 3 match address Verizon-ISP_3_cryptomap
    crypto map Verizon-ISP_map 3 set peer Maxsys-Remote
    crypto map Verizon-ISP_map 3 set transform-set ESP-3DES-SHA
    crypto map Verizon-ISP_map 3 set nat-t-disable
    crypto map Verizon-ISP_map 4 match address Verizon-ISP_4_cryptomap
    crypto map Verizon-ISP_map 4 set peer 198.65.114.68
    crypto map Verizon-ISP_map 4 set transform-set ESP-AES-256-SHA
    crypto map Verizon-ISP_map 4 set nat-t-disable
    crypto map Verizon-ISP_map 5 match address Verizon-ISP_5_cryptomap
    crypto map Verizon-ISP_map 5 set peer 12.195.130.2
    crypto map Verizon-ISP_map 5 set transform-set ESP-3DES-SHA
    crypto map Verizon-ISP_map 5 set nat-t-disable
    crypto map Verizon-ISP_map 6 match address Verizon-ISP_6_cryptomap
    crypto map Verizon-ISP_map 6 set peer 208.68.22.250
    crypto map Verizon-ISP_map 6 set transform-set ESP-3DES-SHA
    crypto map Verizon-ISP_map 6 set nat-t-disable
    crypto map Verizon-ISP_map 7 match address Verizon-ISP_7_cryptomap
    crypto map Verizon-ISP_map 7 set peer 208.51.30.227
    crypto map Verizon-ISP_map 7 set transform-set ESP-3DES-MD5
    crypto map Verizon-ISP_map 8 match address Verizon-ISP_8_cryptomap
    crypto map Verizon-ISP_map 8 set peer Throckmorton_Net2
    crypto map Verizon-ISP_map 8 set transform-set ESP-3DES-MD5
    crypto map Verizon-ISP_map 9 match address Verizon-ISP_9_cryptomap
    crypto map Verizon-ISP_map 9 set peer 108.58.104.210
    crypto map Verizon-ISP_map 9 set transform-set ESP-3DES-MD5
    crypto map Verizon-ISP_map 10 match address Verizon-ISP_cryptomap_1
    crypto map Verizon-ISP_map 10 set peer 162.134.70.20
    crypto map Verizon-ISP_map 10 set transform-set ESP-3DES-SHA
    crypto map Verizon-ISP_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map Verizon-ISP_map interface Verizon-ISP
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment self
    fqdn vpn.rbmc.org
    subject-name CN=vpn.rbmc.org
    keypair sslvpnkeypair
    no client-types
    crl configure
    crypto ca certificate chain ASDM_TrustPoint0
    certificate 31
        308201dc 30820145 a0030201 02020131 300d0609 2a864886 f70d0101 04050030
        34311530 13060355 0403130c 76706e2e 72626d63 2e6f7267 311b3019 06092a86
        4886f70d 01090216 0c76706e 2e72626d 632e6f72 67301e17 0d303830 38323030
        34313134 345a170d 31383038 31383034 31313434 5a303431 15301306 03550403
        130c7670 6e2e7262 6d632e6f 7267311b 30190609 2a864886 f70d0109 02160c76
        706e2e72 626d632e 6f726730 819f300d 06092a86 4886f70d 01010105 0003818d
        00308189 02818100 a1664806 3a378c37 a55b2cd7 86c1fb5a de884ec3 6d5652e3
        953e9c01 37f4593c a6b61c31 80f87a51 c0ccfe65 e5ca3d33 216dea84 0eeeecf3
        394505ea 231b0a5f 3c0b59d9 b7c9ba4e 1da130fc cf0159bf 537282e4 e34c2442
        beffc258 a8d8edf9 59412e87 c5f819d0 2d233ecc 214cea8b 3a3922e5 2718ef6a
        87c340a3 d3a0ae21 02030100 01300d06 092a8648 86f70d01 01040500 03818100
        33902c9e 54dc8574 13084948 a21390a2 7000648a a9c7ad0b 3ffaeae6 c0fc4e6c
        60b6a60a ac89c3da 869d103d af409a8a e2d43387 a4fa2278 5a105773 a8d6b5c3
        c13a743c 8a42c34a e6859f6e 760a81c7 5116f42d b3d81b83 11fafae7 b541fad1
        f9bc1cb0 5ed77033 6cab9c90 0a14a841 fc30d8e4 9c85c0e0 d2cca126 fd449e39
      quit
    crypto isakmp identity address
    crypto isakmp enable Verizon-ISP
    crypto isakmp enable Internal
    crypto isakmp policy 50
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 28800
    crypto isakmp ipsec-over-tcp port 10000
    telnet timeout 5
    ssh 173.72.107.26 255.255.255.255 Verizon-ISP
    ssh 10.10.12.162 255.255.255.255 Internal
    ssh 10.100.91.53 255.255.255.255 Internal
    ssh Dennis 255.255.255.255 Internal
    ssh timeout 60
    console timeout 2
    management-access Internal
    vpn load-balancing
    interface lbpublic Verizon-ISP
    interface lbprivate Internal
    cluster key r8mcl0adbalanc3
    cluster encryption
    threat-detection basic-threat
    threat-detection statistics host
    threat-detection statistics access-list
    ntp server 207.5.137.133 source Verizon-ISP prefer
    ntp server 10.100.91.5 source Internal prefer
    ssl trust-point ASDM_TrustPoint0
    ssl trust-point ASDM_TrustPoint0 Verizon-ISP
    webvpn
    enable Verizon-ISP
    svc image disk0:/anyconnect-win-2.1.0148-k9.pkg 1
    svc image disk0:/anyconnect-macosx-i386-2.1.0148-k9.pkg 2
    svc image disk0:/anyconnect-linux-2.1.0148-k9.pkg 3
    tunnel-group-list enable
    group-policy DfltGrpPolicy attributes
    wins-server value 10.100.91.5
    dns-server value 10.100.91.5
    vpn-simultaneous-logins 1
    vpn-idle-timeout 15
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    webvpn
      svc ask none default webvpn
    group-policy VPNUsers internal
    group-policy VPNUsers attributes
    dns-server value 10.100.91.6 10.100.91.5
    vpn-tunnel-protocol IPSec
    default-domain value RBMC
    tunnel-group DefaultL2LGroup ipsec-attributes
    peer-id-validate nocheck
    tunnel-group 65.51.154.66 type ipsec-l2l
    tunnel-group 65.51.154.66 ipsec-attributes
    pre-shared-key *
    tunnel-group 65.171.123.34 type ipsec-l2l
    tunnel-group 65.171.123.34 ipsec-attributes
    pre-shared-key *
    peer-id-validate nocheck
    tunnel-group 12.195.130.2 type ipsec-l2l
    tunnel-group 12.195.130.2 ipsec-attributes
    pre-shared-key *
    tunnel-group 208.68.22.250 type ipsec-l2l
    tunnel-group 208.68.22.250 ipsec-attributes
    pre-shared-key *
    tunnel-group 198.65.114.68 type ipsec-l2l
    tunnel-group 198.65.114.68 ipsec-attributes
    pre-shared-key *
    tunnel-group VPNUsers type remote-access
    tunnel-group VPNUsers general-attributes
    address-pool VLAN99VPNUsers
    authentication-server-group VPN-FW
    default-group-policy VPNUsers
    tunnel-group VPNUsers ipsec-attributes
    trust-point ASDM_TrustPoint0
    tunnel-group 208.51.30.227 type ipsec-l2l
    tunnel-group 208.51.30.227 ipsec-attributes
    pre-shared-key *
    tunnel-group 108.58.104.210 type ipsec-l2l
    tunnel-group 108.58.104.210 ipsec-attributes
    pre-shared-key *
    tunnel-group 162.134.70.20 type ipsec-l2l
    tunnel-group 162.134.70.20 ipsec-attributes
    pre-shared-key *
    tunnel-group-map default-group DefaultL2LGroup
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect sunrpc
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:9d17ad8684073cb9f3707547e684007f
    : end
    Message was edited by: Dennis Farrell

    Hi Dennis,
    Your tunnel to "12.145.95.0 LabCorp_Test_Remote" segment can only be initiated from host: RBPMAM is due to your crytp-acl below.
    access-list Verizon-ISP_cryptomap_1 extended permit object-group DM_INLINE_PROTOCOL_11 host RBPMAM LabCorp_Test_Remote 255.255.255.0
    Secondly your no-nat on internal interface is denying the traffic that must enter into crytp engine, therefore your tunnel never going to come up.
    Therefore please turn it to a "permit" instead.
    access-list Internal_nat0_outbound_1 extended deny ip any LabCorp_Test_Remote 255.255.255.0 inactive
    Please update,
    thanks
    Rizwan Rafeek
    Message was edited by: Rizwan Mohamed

  • How can I improve performance over a Branch Office IPsec vpn tunnel between and SA540 and an SA520

    Hello,
    I just deployed one Cisco SA540 and three SA520s.
    The SA540 is at the Main Site.
    The three SA520s are the the spoke sites.
    Main Site:
    Downstream Speed: 32 Mbps
    Upstream Speed: 9.4 Mbps
    Spoke Site#1:
    Downstream Speed: 3.6 Mbps
    Upstream Speed: 7.2 Mbps (yes, the US is faster than the DS at the time the speed test was taken).
    The SA tunnels are "Established"
    I see packets being tranmsitted and received.
    Pinging across the tunnel has an average speed of 32 ms (which is good).
    DNS resolves names to ip addresses flawlessly and quickly across the Inter-network.
    But it takes from 10 to 15 minutes to log on to the domain from the Spoke Site#1 to the Main Site across the vpn tunnel.
    It takes about 15 minutes to print across the vpn tunnel.
    The remedy this, we have implemented Terminal Services across the Internet.
    Printing takes about 1 minute over the Terminal Service Connection, while it takes about 15 minutes over the VPN.
    Logging on to the network takes about 10 minutes over the vpn tunnel.
    Using an LOB application takes about 2 minutes per transaction across the vpn tunnel; it takes seconds using Terminal Services.
    I have used ASAs before in other implementation without any issues at all.
    I am wondering if I replaced the SAs with ASAs, that they may fix my problem.
    I wanted to go Small Business Pro, to take advantage of the promotions and because I am a Select Certified Partner, but from my experience, these SA vpn tunnels are unuseable.
    I opened a case with Small Business Support on Friday evening, but they couldnt even figure out how to rename an IKE Policy Name (I figured out that you had to delete the IKE Policy; you cannot rename them once they are created).
    Maybe the night weekend shift has a skeleton crew, and the best engineers are available at that time or something....i dont know.
    I just know that my experience with the Cisco TAC has been great for the last 10 years.
    My short experience with the Cisco Small Business Support Center has not been as great at all.
    Bottom Line:
    I am going to open another case with the Day Shift tomorrow and see if they can find a way to speed things up.
    Now this is not just happening between the Main Site and Spoke Site #1 above. It is also happeninng between the Main Site and Spoke #2 (I think Spoke#2 has a Download Speed of about 3Mbps and and Upload Speed of about 0.5 Mbps.
    Please help.
    I would hate to dismiss SA5xx series without making sure it is not just a simple configuration setting.

    Hi Anthony,
    I agree!.  My partner wants to just replace the SA5xxs with ASAs, as we have never had problems with ASA vpn performance.
    But I want to know WHY this is happening too.
    I will definitely run a sniffer trace to see what is happening.
    Here are some other things I have learned from the Cisco Small Business Support Center (except for Item 1 which I learned from you!)
    1.  Upgrade the SA540 at the Main Site to 2.1.45.
    2a. For cable connections, use the standard MTU of 1500 bytes.
    2.b For DSL, use the following command to determine the largets MTU that will be sent without packet fragmentation:
    ping -f -l packetsize
    Perform the items below to see if this increases performance:
    I was told by the Cisco Small Business Support Center that setting up a Manual Policy is not recommended; I am not sure why they stated this.
    3a. Lower the IKE encryption algorithm from "AES-128" to DES.
    3b. Lower the IKE authentication algorithm to MD5
    3c. Also do the above for the VPN Policy
    Any input is welcome!

  • VPN tunnels for multiple sites

    Hi, i am building new vpn tunnels for multple sites using 2 ASR 1004, and 100 remote devices cisco 2800 routers.
    I am thinking of using getvpn to do it, am i thinking correct ????? can i use DMVPN ???? what is else there ???
    thanks 

    Is there a need for branch to branch communication?  If so, I would go with the DMVPN option using a single tier, dual DMVPN cloud topology which will allow for spoke to spoke communication.
    Matt

  • Problems when trying to surf the Internet through a SSL VPN tunnel

    Hi,
    I have a small/big problem, I have a customer who have the need for the possibility to surf the internet through the SA500W when they are connected through a SSL VPN tunnel in to their network. I am not using a Split Tunnel. What I have seen until now, when you run IPCONFIG/ALL the default gateway for the SSL VPN IP settings is 0.0.0.0. Is this the problem and if so, how can this be solved?
    Thanks in advance!
    Brg
    Niklas Eklov

    There are various causes for this error, see [[Firefox is already running but is not responding]] for details.

  • Bandwidth Allocation for a specific VPN Tunnel - PIX 525 7.2(1)

    Hello,
    I have a PIX with a 10 MB internet connection. This PIX has several L2L VPN Tunnels configured: Tunnel1, Tunnel2...TunnelN. I want to be able guarentee 5Mb of the total 10Mb to a specific VPN Tunnel. Is this possible? I have read the following links, however I believe that the configuration guidelines I'm looking for are a combination of several examples shown here:
    http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008080dfa7.shtml#tab4
    https://supportforums.cisco.com/docs/DOC-1230
    http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a008084de0c.shtml#cqos
    The tunnel is being defined by the following commands:
    crypto map prdmay 20 match address vpn_1
    crypto map prdmay 20 set peer 61.172.142.222
    crypto map prdmay 20 set transform-set TS
    access-list vpn_1 extended permit ip 10.14.102.0 255.255.255.0 any
    access-list vpn_1 extended permit ip 10.14.101.0 255.255.255.0 any
    tunnel-group 61.172.142.222 type ipsec-l2l
    tunnel-group 61.172.142.222 ipsec-attributes
    pre-shared-key *
    Is the following what I need to do in order to accomplish what I want:
    priority-queue outside
    class-map vpn_5Mb
    match access-list vpn_1
    match tunnel-group 61.172.142.222
    policy-map police-priority-policy
    class vpn_5Mb
    police output 5120000
    service-policy police-priority-policy interface outside
    Thank you for your help.

    I don't think the ASA will let you match on ACL and tunnel group at the same time.
    Just the ACL will do though. The ACL should match local ip addresses (there are usually no-natted for the VPN anyway).
    Here is a page with a QoS examples on the ASA for reference https://supportforums.cisco.com/docs/DOC-1230
    I hope it helps.
    PK

Maybe you are looking for

  • How do I merge 2 Apple IDs?

    Basically I have 2 Apple IDs. I have my primary one that I set up years ago with my Hotmail address & it has all my iTunes purchases & iPhone stuff associated with it. My other one was a mobileme account, that I have since "upgraded" to an iCloud acc

  • Having major issues with InDesign CS6

    Having major issues with InDesign CS6. Not only is it crashing, but it is corrupting the existing file.  Then when I relaunch, it is not allowing me to open the file again. In another instance, yesterday I opened an file created 3 months ago and it a

  • Idoc error - basetype not found

    Hey, I try to configure a netweaver system (aii) and a r3 to communicate with each other. the aii system did not have the base type matmas01 to receive a material via bd10 from r3 to aii. I only send a material with a number and that`s it. I created

  • Sweden Currency validation

    Hello , Can any one tell me why the following is not retuning (0) as indication that S and S2 Strings are equal? java.text.NumberFormat currency = java.text.NumberFormat.getCurrencyInstance(new java.util.Locale("sv", "SE" )  ); String S = "1 234,56";

  • Transfer music from 3gs to 4s?

    Hi, I have backed up my 3gs and used the restore back function to copy this to my 4s. Contacts and texts have copied across, but not my music or apps?