Solved

Cisco VPN with ASA5505 and PIX506E

Posted on 2008-10-16
9
1,327 Views
Last Modified: 2008-10-23
Hello
I have to configure a vpn between a CISCO ASA5505 and PIX506E. I''ve done some research on the net and configured the vpn to some extent. My vpn is up but I cannot ping the other side of the vpn. My network looks like this:
On the cisco asa5505 external ip 81.196.151.170, internal ip 192.168.2.1
On the cisco pix 506e external ip: 195.225.64.6, internal ip 192.168.1.1
In front of the cisco asa5505 i have a linux server. Using tcpdump i came to the conclusion that when I send a ping to the other end(192.168.1.1) the packet does not go through the tunnel. I have no experience in configuring cisco routers but i have good knowledge on linux networking.
I should mention that there was a vpn configured between the two routers and I made my configuration on top of that using this link: http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805c5ad9.shtml
The previous ip address of the pix506e was 82.76.17.127 so it shows up on the configuration.
After configuring the vpn all the unnecessary configuration has to be removed.
Here is the configuration of the ASA5505:

ciscoasa(config)# sh run

: Saved

:

ASA Version 7.2(3) 

!

hostname ciscoasa

domain-name default.domain.invalid

enable password fXX82h2lCH4Xtjpp encrypted

names

!

interface Vlan1

 nameif inside

 security-level 100

 ip address 192.168.2.1 255.255.255.0 

!

interface Vlan2

 nameif outside

 security-level 0

 ip address 81.196.151.170 255.255.255.0 

!

interface Ethernet0/0

 switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!             

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

passwd 2KFQnbNIdI.2KYOU encrypted

ftp mode passive

dns server-group DefaultDNS

 domain-name default.domain.invalid

access-list ssh extended permit ip host 195.225.64.6 host 82.76.17.127 

access-list vpn_traffic extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0 

pager lines 24

logging asdm informational

mtu inside 1500

mtu outside 1500

icmp unreachable rate-limit 1 burst-size 1

icmp permit any inside

icmp permit any outside

asdm image disk0:/asdm-523.bin

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list vpn_traffic

nat (inside) 1 192.168.2.0 255.255.255.0

access-group ssh in interface outside

route outside 0.0.0.0 0.0.0.0 81.196.151.161 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout uauth 0:05:00 absolute

aaa authentication ssh console LOCAL 

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set PORTAL esp-3des esp-sha-hmac 

crypto map static 10 match address vpn_traffic

crypto map static 10 set peer 195.225.64.6 

crypto map static 10 set transform-set PORTAL

crypto map static interface outside

crypto isakmp identity address 

crypto isakmp enable outside

crypto isakmp policy 10

 authentication pre-share

 encryption des

 hash md5

 group 2

 lifetime 8640

crypto isakmp nat-traversal  10

telnet timeout 5

ssh 192.168.2.0 255.255.255.0 inside

ssh 195.225.64.6 255.255.255.255 outside

ssh 89.137.14.129 255.255.255.255 outside

ssh 89.137.17.237 255.255.255.255 outside

ssh timeout 60

ssh version 2

console timeout 0

management-access inside

dhcpd dns 4.2.2.2

dhcpd wins 192.168.1.2

dhcpd auto_config outside

!

dhcpd address 192.168.2.2-192.168.2.20 inside

dhcpd wins 192.168.1.2 interface inside

dhcpd enable inside

!

              

!

class-map inspection_default

 match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

 parameters

  message-length maximum 512

policy-map global_policy

 class inspection_default

  inspect dns preset_dns_map 

  inspect ftp 

  inspect h323 h225 

  inspect h323 ras 

  inspect rsh 

  inspect rtsp 

  inspect esmtp 

  inspect sqlnet 

  inspect skinny 

  inspect sunrpc 

  inspect xdmcp 

  inspect sip 

  inspect netbios 

  inspect tftp 

!

service-policy global_policy global

username portal password lkzHotDKgBQnMeX6 encrypted

tunnel-group 195.225.64.6 type ipsec-l2l

tunnel-group 195.225.64.6 ipsec-attributes

 pre-shared-key *

prompt hostname context 

 

 

 

Here is the PIX506E configuration:

 

PIX Version 6.3(5)

interface ethernet0 auto

interface ethernet1 auto

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password fXX82h2lCH4Xtjpp encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

hostname portalPIX

domain-name blablabla.com

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names         

name 192.168.1.2 fileserver

name 192.168.1.3 mailserver

name 195.225.64.6 portal

access-list acl_out permit tcp any host portal eq www 

access-list acl_out permit tcp any host portal eq https 

access-list acl_out permit tcp any host portal eq smtp 

access-list acl_out permit icmp any any 

access-list acl_out deny tcp host 195.225.64.122 host portal eq 20022 

access-list acl_out permit tcp host 89.137.17.237 interface outside 

access-list acl_out permit udp host 82.76.17.127 interface outside 

access-list acl_out permit tcp host 78.96.155.223 interface outside 

access-list acl_out permit udp any host portal eq 11194 

access-list acl_out permit udp host 82.79.151.202 interface outside 

access-list acl_out permit tcp host 82.79.151.202 interface outside 

access-list acl_out permit udp 81.196.151.160 255.255.255.224 interface outside 

access-list acl_out permit tcp 81.196.151.160 255.255.255.224 interface outside 

access-list 110 permit ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.0 

access-list nonat permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0 

access-list 150 permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0 

pager lines 24

logging on

logging timestamp

logging standby

logging buffered debugging

logging trap critical

logging history debugging

logging facility 22

logging host inside mailserver

icmp permit any outside

icmp permit any inside

mtu outside 1500

mtu inside 1500

ip address outside portal 255.255.255.252

ip address inside 192.168.1.1 255.255.255.0

ip audit name INFOPOLICY info action alarm

ip audit name ACTIONPOLICY attack action alarm drop

ip audit interface outside INFOPOLICY

ip audit interface outside ACTIONPOLICY

ip audit info action alarm

ip audit attack action alarm

ip local pool Remote_access 192.168.100.1-192.168.100.10 mask 255.255.255.0

pdm location mailserver 255.255.255.255 inside

pdm location 192.168.1.254 255.255.255.255 inside

pdm location 195.225.64.122 255.255.255.255 outside

pdm location 192.168.2.0 255.255.255.0 outside

pdm location 192.168.10.0 255.255.255.0 outside

pdm location 89.137.14.129 255.255.255.255 outside

pdm location fileserver 255.255.255.255 inside

pdm location 89.137.17.237 255.255.255.255 outside

pdm logging informational 100

pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 0.0.0.0 0.0.0.0 0 0

alias (inside) mailserver portal 255.255.255.255

static (inside,outside) tcp portal smtp mailserver smtp netmask 255.255.255.255 0 80 

static (outside,inside) tcp mailserver https portal https netmask 255.255.255.255 0 80 

static (inside,outside) tcp interface www mailserver www dns netmask 255.255.255.255 0 100 

static (inside,outside) tcp interface 20022 mailserver ssh dns netmask 255.255.255.255 0 100 

static (inside,outside) tcp interface 30022 fileserver ssh dns netmask 255.255.255.255 0 100 

static (inside,outside) udp interface 11194 fileserver 11194 dns netmask 255.255.255.255 0 0 

static (inside,outside) udp interface 21194 fileserver 21194 dns netmask 255.255.255.255 0 0 

access-group acl_out in interface outside

route outside 0.0.0.0 0.0.0.0 195.225.64.5 1

timeout xlate 0:05:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout sip-disconnect 0:02:00 sip-invite 0:03:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+ 

aaa-server TACACS+ max-failed-attempts 3

aaa-server TACACS+ deadtime 10 

aaa-server RADIUS protocol radius 

aaa-server RADIUS max-failed-attempts 3 

aaa-server RADIUS deadtime 10 

aaa-server LOCAL protocol local 

aaa authentication secure-http-client

aaa authentication ssh console LOCAL

ntp server 82.76.121.165 source outside

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

virtual telnet 192.168.1.100

floodguard enable

sysopt connection permit-ipsec

sysopt noproxyarp inside

crypto map static 10 ipsec-isakmp

crypto map static 10 match address 110

! Incomplete

crypto map static 20 ipsec-isakmp

crypto map static 20 match address 150

crypto map static 20 set peer 82.76.17.127

crypto map static client configuration address initiate

crypto map static client configuration address respond

isakmp key ******** address 82.76.17.127 netmask 255.255.255.255 no-xauth 

isakmp identity address

vpngroup portal idle-time 1800

telnet timeout 5

ssh 89.137.17.237 255.255.255.255 outside

ssh 82.79.151.202 255.255.255.255 outside

ssh 81.196.151.160 255.255.255.224 outside

ssh 192.168.1.0 255.255.255.0 inside

ssh 192.168.2.0 255.255.255.0 inside

ssh timeout 60

management-access inside

console timeout 0

dhcpd address 192.168.1.200-192.168.1.253 inside

dhcpd lease 3600

dhcpd ping_timeout 750

username portal password lkzHotDKgBQnMeX6 encrypted privilege 2

vpnclient server 81.196.151.170

vpnclient mode network-extension-mode

vpnclient vpngroup mytunnel password ********

vpnclient username portal password ********

vpnclient enable

terminal width 80

Open in new window

0
Comment
Question by:gabos_denes
  • 6
  • 2
9 Comments
 
LVL 8

Expert Comment

by:Jay_Gridley
ID: 22741525
If I understand correctly you get the tunnel up, but you can't get traffic to the other side.
This would seem like a NAT problem.

The ASA side looks fine, however the NAT on the PIX side looks a bit iffy. I'd make the following changes:
First delete the current NAT0 with the following:
no nat (inside) 0 0.0.0.0 0.0.0.0 0 0

Then add the new rules:
nat (inside) 1 192.168.1.0 255.255.255.0 0 0
nat (inside) 0 access-list nonat

Also, I don't think it will matter a lot in this case, but your crypto map 10 is incomplete and therefore won't work. I'd delete it if I were you:
no crypto map static 10 ipsec-isakmp
0
 

Author Comment

by:gabos_denes
ID: 22748482
When i issue nat (inside) 0 access-list nonat it gives me: ERROR: Policy NAT cannot be be configured with VPN Client enabled.

And when I start the vpn client with vpnclient enable, the internet stops working on the computers behind the PIX and the ports forwarded stop working also.
0
 

Author Comment

by:gabos_denes
ID: 22751720
Here is the latest configuration of my routers. I think one of the tunnel-groups should be removed from the asa5505 configuration.
Here is the ASA5505 configuration
 

ciscoasa(config)# sh run

: Saved

:

ASA Version 7.2(3)

!

hostname ciscoasa

domain-name default.domain.invalid

enable password fXX82h2lCH4Xtjpp encrypted

names

!

interface Vlan1

 nameif inside

 security-level 100

 ip address 192.168.2.1 255.255.255.0

!

interface Vlan2

 nameif outside

 security-level 0

 ip address 81.196.151.170 255.255.255.0

!

interface Ethernet0/0

 switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

passwd 2KFQnbNIdI.2KYOU encrypted

ftp mode passive

dns server-group DefaultDNS

 domain-name default.domain.invalid

access-list ssh extended permit ip host 195.225.64.6 host 81.196.151.170

access-list vpn_traffic extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0

access-list nonat extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0

access-list ezvpn1 extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0

pager lines 24

logging asdm informational

mtu inside 1500

mtu outside 1500

icmp unreachable rate-limit 1 burst-size 1

icmp permit any inside

icmp permit any outside

icmp permit any echo-reply outside

asdm image disk0:/asdm-523.bin

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list nonat

nat (inside) 1 0.0.0.0 0.0.0.0

route outside 0.0.0.0 0.0.0.0 81.196.151.161 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout uauth 0:05:00 absolute

aaa authentication ssh console LOCAL

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set mySET esp-des esp-md5-hmac

crypto dynamic-map myDYN-MAP 5 set transform-set mySET

crypto map static 10 match address vpn_traffic

crypto map myMAP 60 ipsec-isakmp dynamic myDYN-MAP

crypto map myMAP interface outside

crypto isakmp enable outside

crypto isakmp policy 1

 authentication pre-share

 encryption des

 hash md5

 group 2

 lifetime 86400

crypto isakmp policy 65535

 authentication pre-share

 encryption 3des

 hash sha

 group 2

 lifetime 86400

telnet timeout 5

ssh 192.168.2.0 255.255.255.0 inside

ssh 195.225.64.6 255.255.255.255 outside

ssh 89.137.14.129 255.255.255.255 outside

ssh 89.137.17.237 255.255.255.255 outside

ssh timeout 60

ssh version 2

console timeout 0

management-access inside

dhcpd dns 4.2.2.2

dhcpd wins 192.168.1.2

dhcpd auto_config outside

!

dhcpd address 192.168.2.2-192.168.2.20 inside

dhcpd wins 192.168.1.2 interface inside

dhcpd enable inside

!
 

!

class-map inspection_default

 match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

 parameters

  message-length maximum 512

policy-map global_policy

 class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny

  inspect sunrpc

  inspect xdmcp

  inspect sip

  inspect netbios

  inspect tftp

!

service-policy global_policy global

group-policy myGROUP internal

group-policy myGROUP attributes

 split-tunnel-policy tunnelspecified

 split-tunnel-network-list value ezvpn1

 nem enable

username portal password lkzHotDKgBQnMeX6 encrypted

tunnel-group 195.225.64.6 type ipsec-l2l

tunnel-group 195.225.64.6 ipsec-attributes

 pre-shared-key *

tunnel-group mytunnel type ipsec-ra

tunnel-group mytunnel general-attributes

 default-group-policy myGROUP

tunnel-group mytunnel ipsec-attributes

 pre-shared-key *

prompt hostname context
 
 
 
 
 

PIX506E config:
 

portalPIX(config)# sh run

: Saved

:

PIX Version 6.3(5)

interface ethernet0 auto

interface ethernet1 auto

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password fXX82h2lCH4Xtjpp encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

hostname portalPIX

domain-name portalleasing.ro

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names

name 192.168.1.2 fileserver

name 192.168.1.3 mailserver

name 195.225.64.6 portal

access-list acl_out permit tcp any host portal eq www

access-list acl_out permit tcp any host portal eq https

access-list acl_out permit tcp any host portal eq smtp

access-list acl_out permit icmp any any

access-list acl_out permit tcp host 89.137.17.237 interface outside

access-list acl_out permit udp host 82.76.17.127 interface outside

access-list acl_out permit tcp host 78.96.155.223 interface outside

access-list acl_out permit udp any host portal eq 11194

access-list acl_out permit udp host 82.79.151.202 interface outside

access-list acl_out permit tcp host 82.79.151.202 interface outside

access-list acl_out permit udp 81.196.151.160 255.255.255.224 interface outside

access-list acl_out permit tcp 81.196.151.160 255.255.255.224 interface outside

access-list 110 permit ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.0

access-list nonat permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0

access-list 150 permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0

pager lines 24

logging on

logging timestamp

logging standby

logging buffered debugging

logging trap critical

logging history debugging

logging facility 22

logging host inside mailserver

icmp permit any outside

icmp permit any inside

mtu outside 1500

mtu inside 1500

ip address outside portal 255.255.255.252

ip address inside 192.168.1.1 255.255.255.0

ip audit name INFOPOLICY info action alarm

ip audit name ACTIONPOLICY attack action alarm drop

ip audit interface outside INFOPOLICY

ip audit interface outside ACTIONPOLICY

ip audit info action alarm

ip audit attack action alarm

ip local pool Remote_access 192.168.100.1-192.168.100.10 mask 255.255.255.0

pdm logging informational 100

pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list nonat

nat (inside) 1 0.0.0.0 0.0.0.0 dns 0 0

alias (inside) mailserver portal 255.255.255.255

static (inside,outside) tcp portal smtp mailserver smtp netmask 255.255.255.255 0 80

static (outside,inside) tcp mailserver https portal https netmask 255.255.255.255 0 80

static (inside,outside) tcp interface www mailserver www dns netmask 255.255.255.255 0 100

static (inside,outside) tcp interface 20022 mailserver ssh dns netmask 255.255.255.255 0 100

static (inside,outside) tcp interface 30022 fileserver ssh dns netmask 255.255.255.255 0 100

static (inside,outside) udp interface 11194 fileserver 11194 dns netmask 255.255.255.255 0 0

static (inside,outside) udp interface 21194 fileserver 21194 dns netmask 255.255.255.255 0 0

access-group acl_out in interface outside

route outside 0.0.0.0 0.0.0.0 195.225.64.5 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout sip-disconnect 0:02:00 sip-invite 0:03:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server TACACS+ max-failed-attempts 3

aaa-server TACACS+ deadtime 10

aaa-server RADIUS protocol radius

aaa-server RADIUS max-failed-attempts 3

aaa-server RADIUS deadtime 10

aaa-server LOCAL protocol local

aaa authentication secure-http-client

aaa authentication ssh console LOCAL

ntp server 82.76.121.165 source outside

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

virtual telnet 192.168.1.100

floodguard enable

sysopt connection permit-ipsec

sysopt noproxyarp inside

vpngroup portal idle-time 1800

telnet timeout 5

ssh 89.137.17.237 255.255.255.255 outside

ssh 82.79.151.202 255.255.255.255 outside

ssh 81.196.151.160 255.255.255.224 outside

ssh 192.168.1.0 255.255.255.0 inside

ssh 192.168.2.0 255.255.255.0 inside

ssh timeout 60

management-access inside

console timeout 0

dhcpd address 192.168.1.200-192.168.1.253 inside

dhcpd lease 3600

dhcpd ping_timeout 750

username portal password lkzHsdDKgBQnMeX6 encrypted privilege 2

terminal width 80

Open in new window

0
 
LVL 28

Accepted Solution

by:
batry_boy earned 500 total points
ID: 22752141
You have two crypto maps defined on your ASA, but you can only have one crypto map applied to any interface at the same time, so we will need to decide on which crypto map to use, either "static" or "myMAP".  I will choose "myMAP" since it will be fewer changes.

Put in these statements into the ASA:

crypto map myMAP 10 match address vpn_traffic
crypto map myMAP 10 set peer 195.225.64.6
crypto map myMAP 10 set transform-set mySET

The above commands assume that you have already configured the "pre-shared-key" command with the correct pre-shared key you wish to use for the tunnel.  You can leave the multiple tunnel groups alone for now.  After it is working, you can remove extraneous commands and I can help with that too.

Put these statements into the PIX:

access-list vpn_traffic permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
crypto ipsec transform-set myset esp-des esp-md5-hmac  
crypto map mymap 10 ipsec-isakmp
crypto map mymap 10 match address vpn_traffic
crypto map mymap 10 set peer 81.196.151.170
crypto map mymap 10 set transform-set myset
crypto map mymap interface outside
isakmp enable outside
isakmp key <pre-shared-key-value> address 81.196.151.170 netmask 255.255.255.255  
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400

Try a ping test from 192.168.1.x to 192.168.2.x or the other way around after you put these in and see if that works...
0
6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

 

Author Comment

by:gabos_denes
ID: 22752591
I have no ping reply from the other ends.
Here is my complete configuration and some debug messages.
portalPIX(config)# sh run

: Saved

:

PIX Version 6.3(5)

interface ethernet0 auto

interface ethernet1 auto

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password fXX82h2lCH4Xtjpp encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

hostname portalPIX

domain-name blabla.com

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names

name 192.168.1.2 fileserver

name 192.168.1.3 mailserver

name 195.225.64.6 portal

access-list acl_out permit tcp any host portal eq www

access-list acl_out permit tcp any host portal eq https

access-list acl_out permit tcp any host portal eq smtp

access-list acl_out permit icmp any any

access-list acl_out permit tcp host 89.137.17.237 interface outside

access-list acl_out permit udp host 82.76.17.127 interface outside

access-list acl_out permit tcp host 78.96.155.223 interface outside

access-list acl_out permit udp any host portal eq 11194

access-list acl_out permit udp host 82.79.151.202 interface outside

access-list acl_out permit tcp host 82.79.151.202 interface outside

access-list acl_out permit udp 81.196.151.160 255.255.255.224 interface outside

access-list acl_out permit tcp 81.196.151.160 255.255.255.224 interface outside

access-list 110 permit ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.0

access-list nonat permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0

access-list 150 permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0

access-list vpn_traffic permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0

pager lines 24

logging on

logging timestamp

logging standby

logging buffered debugging

logging trap critical

logging history debugging

logging facility 22

logging host inside mailserver

icmp permit any outside

icmp permit any inside

mtu outside 1500

mtu inside 1500

ip address outside portal 255.255.255.252

ip address inside 192.168.1.1 255.255.255.0

ip audit name INFOPOLICY info action alarm

ip audit name ACTIONPOLICY attack action alarm drop

ip audit interface outside INFOPOLICY

ip audit interface outside ACTIONPOLICY

ip audit info action alarm

ip audit attack action alarm

ip local pool Remote_access 192.168.100.1-192.168.100.10 mask 255.255.255.0

pdm logging informational 100

pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list nonat

nat (inside) 1 0.0.0.0 0.0.0.0 dns 0 0

alias (inside) mailserver portal 255.255.255.255

static (inside,outside) tcp portal smtp mailserver smtp netmask 255.255.255.255 0 80

static (outside,inside) tcp mailserver https portal https netmask 255.255.255.255 0 80

static (inside,outside) tcp interface www mailserver www dns netmask 255.255.255.255 0 100

static (inside,outside) tcp interface 20022 mailserver ssh dns netmask 255.255.255.255 0 100

static (inside,outside) tcp interface 30022 fileserver ssh dns netmask 255.255.255.255 0 100

static (inside,outside) udp interface 11194 fileserver 11194 dns netmask 255.255.255.255 0 0

static (inside,outside) udp interface 21194 fileserver 21194 dns netmask 255.255.255.255 0 0

access-group acl_out in interface outside

route outside 0.0.0.0 0.0.0.0 195.225.64.5 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout sip-disconnect 0:02:00 sip-invite 0:03:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server TACACS+ max-failed-attempts 3

aaa-server TACACS+ deadtime 10

aaa-server RADIUS protocol radius

aaa-server RADIUS max-failed-attempts 3

aaa-server RADIUS deadtime 10

aaa-server LOCAL protocol local

aaa authentication secure-http-client

aaa authentication ssh console LOCAL

ntp server 82.76.121.165 source outside

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

virtual telnet 192.168.1.100

floodguard enable

sysopt connection permit-ipsec

sysopt noproxyarp inside

crypto ipsec transform-set myset esp-des esp-md5-hmac

crypto map mymap 10 ipsec-isakmp

crypto map mymap 10 match address vpn_traffic

crypto map mymap 10 set peer 81.196.151.170

crypto map mymap 10 set transform-set myset

crypto map mymap interface outside

isakmp enable outside

isakmp key ******** address 81.196.151.170 netmask 255.255.255.255

isakmp policy 10 authentication pre-share

isakmp policy 10 encryption des

isakmp policy 10 hash md5

isakmp policy 10 group 2

isakmp policy 10 lifetime 86400

vpngroup portal idle-time 1800

telnet timeout 5

ssh 89.137.17.237 255.255.255.255 outside

ssh 82.79.151.202 255.255.255.255 outside

ssh 81.196.151.160 255.255.255.224 outside

ssh 192.168.1.0 255.255.255.0 inside

ssh 192.168.2.0 255.255.255.0 inside

ssh timeout 60

management-access inside

console timeout 0

dhcpd address 192.168.1.200-192.168.1.253 inside

dhcpd lease 3600

dhcpd ping_timeout 750

username portal password lkzHddDKgBQnMeX7 encrypted privilege 2

terminal width 80
 

------------------------------------------------------------------------
 

ciscoasa(config)# sh run

: Saved

:

ASA Version 7.2(3)

!

hostname ciscoasa

domain-name default.domain.invalid

enable password fXX82h2lCH4Xtjpp encrypted

names

!

interface Vlan1

 nameif inside

 security-level 100

 ip address 192.168.2.1 255.255.255.0

!

interface Vlan2

 nameif outside

 security-level 0

 ip address 81.196.151.170 255.255.255.0

!

interface Ethernet0/0

 switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

passwd 2KFQnbNIdI.2KYOU encrypted

ftp mode passive

dns server-group DefaultDNS

 domain-name default.domain.invalid

access-list ssh extended permit ip host 195.225.64.6 host 81.196.151.170

access-list vpn_traffic extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0

access-list nonat extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0

access-list ezvpn1 extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0

pager lines 24

logging asdm informational

mtu inside 1500

mtu outside 1500

icmp unreachable rate-limit 1 burst-size 1

icmp permit any inside

icmp permit any outside

icmp permit any echo-reply outside

asdm image disk0:/asdm-523.bin

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list nonat

nat (inside) 1 0.0.0.0 0.0.0.0

route outside 0.0.0.0 0.0.0.0 81.196.151.161 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout uauth 0:05:00 absolute

aaa authentication ssh console LOCAL

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set mySET esp-des esp-md5-hmac

crypto dynamic-map myDYN-MAP 5 set transform-set mySET

crypto map static 10 match address vpn_traffic

crypto map myMAP 10 match address vpn_traffic

crypto map myMAP 10 set peer 195.225.64.6

crypto map myMAP 10 set transform-set mySET

crypto map myMAP 60 ipsec-isakmp dynamic myDYN-MAP

crypto map myMAP interface outside

crypto isakmp enable outside

crypto isakmp policy 1

 authentication pre-share

 encryption des

 hash md5

 group 2

 lifetime 86400

crypto isakmp policy 65535

 authentication pre-share

 encryption 3des

 hash sha

 group 2

 lifetime 86400

telnet timeout 5

ssh 192.168.2.0 255.255.255.0 inside

ssh 195.225.64.6 255.255.255.255 outside

ssh 89.137.14.129 255.255.255.255 outside

ssh 89.137.17.237 255.255.255.255 outside

ssh timeout 60

ssh version 2

console timeout 0

management-access inside

dhcpd dns 4.2.2.2

dhcpd wins 192.168.1.2

dhcpd auto_config outside

!

dhcpd address 192.168.2.2-192.168.2.20 inside

dhcpd wins 192.168.1.2 interface inside

dhcpd enable inside

!
 

!

class-map inspection_default

 match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

 parameters

  message-length maximum 512

policy-map global_policy

 class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny

  inspect sunrpc

  inspect xdmcp

  inspect sip

  inspect netbios

  inspect tftp

!

service-policy global_policy global

group-policy myGROUP internal

group-policy myGROUP attributes

 split-tunnel-policy tunnelspecified

 split-tunnel-network-list value ezvpn1

 nem enable

username portal password zq6sEW3VKcYqMVe/ encrypted

tunnel-group 195.225.64.6 type ipsec-l2l

tunnel-group 195.225.64.6 ipsec-attributes

 pre-shared-key *

tunnel-group mytunnel type ipsec-ra

tunnel-group mytunnel general-attributes

 default-group-policy myGROUP

tunnel-group mytunnel ipsec-attributes

 pre-shared-key *

prompt hostname context
 

------------------------------------------------------------------------
 

portalPIX(config)# show crypto ipsec sa
 
 

interface: outside

    Crypto map tag: mymap, local addr. portal
 

   local  ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)

   remote ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)

   current_peer: 81.196.151.170:500

     PERMIT, flags={origin_is_acl,}

    #pkts encaps: 12, #pkts encrypt: 12, #pkts digest 12

    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0

    #pkts compressed: 0, #pkts decompressed: 0

    #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0

    #send errors 97, #recv errors 0
 

     local crypto endpt.: portal, remote crypto endpt.: 81.196.151.170

     path mtu 1500, ipsec overhead 56, media mtu 1500

     current outbound spi: f003ba8f
 

     inbound esp sas:

      spi: 0xb9ccf8ac(3117217964)

        transform: esp-des esp-md5-hmac ,

        in use settings ={Tunnel, }

        slot: 0, conn id: 1, crypto map: mymap

        sa timing: remaining key lifetime (k/sec): (4608000/27903)

        IV size: 8 bytes

        replay detection support: Y
 
 

     inbound ah sas:
 
 

     inbound pcp sas:
 
 

     outbound esp sas:

      spi: 0xf003ba8f(4026776207)

        transform: esp-des esp-md5-hmac ,

        in use settings ={Tunnel, }

        slot: 0, conn id: 2, crypto map: mymap

        sa timing: remaining key lifetime (k/sec): (4607999/27903)

        IV size: 8 bytes

        replay detection support: Y
 
 

     outbound ah sas:
 
 

     outbound pcp sas:
 
 

portalPIX(config)# show crypto isakmp sa

Total     : 1

Embryonic : 0

        dst               src        state     pending     created

          portal   81.196.151.170    QM_IDLE         0           1
 
 
 

ciscoasa(config)# show crypto ipsec sa

interface: outside

    Crypto map tag: myMAP, seq num: 10, local addr: 81.196.151.170
 

      access-list vpn_traffic permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0

      local ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)

      remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)

      current_peer: 195.225.64.6
 

      #pkts encaps: 29, #pkts encrypt: 29, #pkts digest: 29

      #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0

      #pkts compressed: 0, #pkts decompressed: 0

      #pkts not compressed: 29, #pkts comp failed: 0, #pkts decomp failed: 0

      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0

      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0

      #send errors: 0, #recv errors: 0
 

      local crypto endpt.: 81.196.151.170, remote crypto endpt.: 195.225.64.6
 

      path mtu 1500, ipsec overhead 58, media mtu 1500

      current outbound spi: B9CCF8AC
 

    inbound esp sas:

      spi: 0xF003BA8F (4026776207)

         transform: esp-des esp-md5-hmac none

         in use settings ={L2L, Tunnel, }

         slot: 0, conn_id: 1, crypto-map: myMAP

         sa timing: remaining key lifetime (kB/sec): (4275000/27756)

         IV size: 8 bytes

         replay detection support: Y

    outbound esp sas:

      spi: 0xB9CCF8AC (3117217964)

         transform: esp-des esp-md5-hmac none

         in use settings ={L2L, Tunnel, }

         slot: 0, conn_id: 1, crypto-map: myMAP

         sa timing: remaining key lifetime (kB/sec): (4274998/27756)

         IV size: 8 bytes

         replay detection support: Y
 

ciscoasa(config)# show crypto isakmp sa
 

   Active SA: 1

    Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)

Total IKE SA: 1
 

1   IKE Peer: 195.225.64.6

    Type    : L2L             Role    : initiator

    Rekey   : no              State   : MM_ACTIVE
 
 
 
 
 

After debug crypto ipsec 10 and debug crypto isakmp 10 on both routers i got this message repeating over and over on the ASA5505:
 

Oct 19 06:59:06 [IKEv1 DEBUG]: Group = 195.225.64.6, IP = 195.225.64.6, processing hash payload

Oct 19 06:59:06 [IKEv1 DEBUG]: Group = 195.225.64.6, IP = 195.225.64.6, processing notify payload

Oct 19 06:59:06 [IKEv1 DEBUG]: Group = 195.225.64.6, IP = 195.225.64.6, Received keep-alive of type DPD R-U-THERE-ACK (seq number 0x6404d71)

Oct 19 06:59:16 [IKEv1 DEBUG]: Group = 195.225.64.6, IP = 195.225.64.6, Sending keep-alive of type DPD R-U-THERE (seq number 0x6404d72)

Oct 19 06:59:16 [IKEv1 DEBUG]: Group = 195.225.64.6, IP = 195.225.64.6, constructing blank hash payload

Oct 19 06:59:16 [IKEv1 DEBUG]: Group = 195.225.64.6, IP = 195.225.64.6, constructing qm hash payload

Oct 19 06:59:16 [IKEv1]: IP = 195.225.64.6, IKE_DECODE SENDING Message (msgid=e4e65555) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total leng    th : 80

Oct 19 06:59:16 [IKEv1]: IP = 195.225.64.6, IKE_DECODE RECEIVED Message (msgid=55349d4) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total leng    th : 80
 

On the PIX i got no debug messages.

Open in new window

0
 
LVL 28

Expert Comment

by:batry_boy
ID: 22753389
Please post the output of the "sh ver" command from the ASA and PIX.
0
 

Author Comment

by:gabos_denes
ID: 22753966
ciscoasa# sh ver

Cisco Adaptive Security Appliance Software Version 7.2(3)
Device Manager Version 5.2(3)

Compiled on Wed 15-Aug-07 16:08 by builders
System image file is "disk0:/asa723-k8.bin"
Config file at boot was "startup-config"

ciscoasa up 6 hours 37 mins

Hardware:   ASA5505, 256 MB RAM, CPU Geode 500 MHz
Internal ATA Compact Flash, 128MB
BIOS Flash M50FW080 @ 0xffe00000, 1024KB

Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
                             Boot microcode   : CNlite-MC-Boot-Cisco-1.2
                             SSL/IKE microcode: CNlite-MC-IPSEC-Admin-3.03
                             IPSec microcode  : CNlite-MC-IPSECm-MAIN-2.04
 0: Int: Internal-Data0/0    : address is 001e.4a3c.ee51, irq 11
 1: Ext: Ethernet0/0         : address is 001e.4a3c.ee49, irq 255
 2: Ext: Ethernet0/1         : address is 001e.4a3c.ee4a, irq 255
 3: Ext: Ethernet0/2         : address is 001e.4a3c.ee4b, irq 255
 4: Ext: Ethernet0/3         : address is 001e.4a3c.ee4c, irq 255
 5: Ext: Ethernet0/4         : address is 001e.4a3c.ee4d, irq 255
 6: Ext: Ethernet0/5         : address is 001e.4a3c.ee4e, irq 255
 7: Ext: Ethernet0/6         : address is 001e.4a3c.ee4f, irq 255
 8: Ext: Ethernet0/7         : address is 001e.4a3c.ee50, irq 255
 9: Int: Internal-Data0/1    : address is 0000.0003.0002, irq 255
10: Int: Not used            : irq 255
11: Int: Not used            : irq 255

Licensed features for this platform:
Maximum Physical Interfaces : 8
VLANs                       : 3, DMZ Restricted
Inside Hosts                : 10
Failover                    : Disabled
VPN-DES                     : Enabled
VPN-3DES-AES                : Enabled
VPN Peers                   : 10
WebVPN Peers                : 2
Dual ISPs                   : Disabled
VLAN Trunk Ports            : 0

This platform has a Base license.



portalPIX(config)# sh ver

Cisco PIX Firewall Version 6.3(5)
Cisco PIX Device Manager Version 3.0(4)

Compiled on Thu 04-Aug-05 21:40 by morlee

portalPIX up 7 hours 1 min

Hardware:   PIX-506E, 32 MB RAM, CPU Pentium II 300 MHz
Flash E28F640J3 @ 0x300, 8MB
BIOS Flash AM29F400B @ 0xfffd8000, 32KB

0: ethernet0: address is 0018.ba14.a45c, irq 10
1: ethernet1: address is 0018.ba14.a45d, irq 11
Licensed Features:
Failover:                    Disabled
VPN-DES:                     Enabled
VPN-3DES-AES:                Enabled
Maximum Physical Interfaces: 2
Maximum Interfaces:          4
Cut-through Proxy:           Enabled
Guards:                      Enabled
URL-filtering:               Enabled
Inside Hosts:                Unlimited
Throughput:                  Unlimited
IKE peers:                   Unlimited

This PIX has a Restricted (R) license.
0
 

Author Comment

by:gabos_denes
ID: 22764525
I tried pinging from the routers and also from the lan computers with no success. Here is my latest config on the routers.
ciscoasa(config)# no crypto dynamic-map myDYN-MAP 5 set transform-set mySET

WARNING: The crypto map entry will be incomplete!

ciscoasa(config)# no crypto map static 10 match address vpn_traffic

ciscoasa(config)# no crypto map myMAP 60 ipsec-isakmp dynamic myDYN-MAP

WARNING: The crypto map entry is incomplete!

ciscoasa(config)# clear crypto is sa

ciscoasa(config)# clear crypto ip sa

ciscoasa(config)# ping 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

?????

Success rate is 0 percent (0/5)

ciscoasa(config)# ping 192.168.1.254

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.254, timeout is 2 seconds:

?????

Success rate is 0 percent (0/5)
 
 
 
 

portalPIX(config)# clear crypto is sa

portalPIX(config)# clear crypto ip sa

portalPIX(config)# ping 192.168.2.1

        192.168.2.1 NO response received -- 1000ms

        192.168.2.1 NO response received -- 1000ms

        192.168.2.1 NO response received -- 1000ms
 

--------------------------------------------------------------
 

ciscoasa(config)# show cryp is sa
 

   Active SA: 1

    Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)

Total IKE SA: 1
 

1   IKE Peer: 195.225.64.6

    Type    : L2L             Role    : initiator

    Rekey   : no              State   : MM_ACTIVE
 
 
 

portalPIX(config)# show cryp is sa

Total     : 1

Embryonic : 0

        dst               src        state     pending     created

          portal   81.196.151.170    QM_IDLE         0           1
 

--------------------------------------------------------------
 
 

ciscoasa(config)# sh cryp ip sa

interface: outside

    Crypto map tag: myMAP, seq num: 10, local addr: 81.196.151.170
 

      access-list vpn_traffic permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0

      local ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)

      remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)

      current_peer: 195.225.64.6
 

      #pkts encaps: 147, #pkts encrypt: 147, #pkts digest: 147

      #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0

      #pkts compressed: 0, #pkts decompressed: 0

      #pkts not compressed: 147, #pkts comp failed: 0, #pkts decomp failed: 0

      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0

      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0

      #send errors: 0, #recv errors: 0
 

      local crypto endpt.: 81.196.151.170, remote crypto endpt.: 195.225.64.6
 

      path mtu 1500, ipsec overhead 58, media mtu 1500

      current outbound spi: E81E717F
 

    inbound esp sas:

      spi: 0x0056CF34 (5689140)

         transform: esp-des esp-md5-hmac none

         in use settings ={L2L, Tunnel, }

         slot: 0, conn_id: 6, crypto-map: myMAP

         sa timing: remaining key lifetime (kB/sec): (4275000/28432)

         IV size: 8 bytes

         replay detection support: Y

    outbound esp sas:

      spi: 0xE81E717F (3894309247)

         transform: esp-des esp-md5-hmac none

         in use settings ={L2L, Tunnel, }

         slot: 0, conn_id: 6, crypto-map: myMAP

         sa timing: remaining key lifetime (kB/sec): (4274963/28432)

         IV size: 8 bytes

         replay detection support: Y
 
 
 
 
 

portalPIX(config)# sh cryp ip sa
 
 

interface: outside

    Crypto map tag: mymap, local addr. portal
 

   local  ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)

   remote ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)

   current_peer: 81.196.151.170:500

     PERMIT, flags={origin_is_acl,}

    #pkts encaps: 4, #pkts encrypt: 4, #pkts digest 4

    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0

    #pkts compressed: 0, #pkts decompressed: 0

    #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0

    #send errors 0, #recv errors 0
 

     local crypto endpt.: portal, remote crypto endpt.: 81.196.151.170

     path mtu 1500, ipsec overhead 56, media mtu 1500

     current outbound spi: 56cf34
 

     inbound esp sas:

      spi: 0xe81e717f(3894309247)

        transform: esp-des esp-md5-hmac ,

        in use settings ={Tunnel, }

        slot: 0, conn id: 1, crypto map: mymap

        sa timing: remaining key lifetime (k/sec): (4608000/28445)

        IV size: 8 bytes

        replay detection support: Y
 
 

     inbound ah sas:
 
 

     inbound pcp sas:
 
 

     outbound esp sas:

      spi: 0x56cf34(5689140)

        transform: esp-des esp-md5-hmac ,

        in use settings ={Tunnel, }

        slot: 0, conn id: 2, crypto map: mymap

        sa timing: remaining key lifetime (k/sec): (4607999/28436)

        IV size: 8 bytes

        replay detection support: Y
 
 

     outbound ah sas:
 
 

     outbound pcp sas:
 
 

--------------------------------------------------------------
 

Full config on asa:

ciscoasa(config)#  sh run

: Saved

:

ASA Version 7.2(3)

!

hostname ciscoasa

domain-name default.domain.invalid

names

!

interface Vlan1

 nameif inside

 security-level 100

 ip address 192.168.2.1 255.255.255.0

!

interface Vlan2

 nameif outside

 security-level 0

 ip address 81.196.151.170 255.255.255.0

!

interface Ethernet0/0

 switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

ftp mode passive

dns server-group DefaultDNS

 domain-name default.domain.invalid

access-list ssh extended permit ip host 195.225.64.6 host 81.196.151.170

access-list vpn_traffic extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0

access-list nonat extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0

access-list ezvpn1 extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0

pager lines 24

logging asdm informational

mtu inside 1500

mtu outside 1500

icmp unreachable rate-limit 1 burst-size 1

icmp permit any inside

icmp permit any outside

icmp permit any echo-reply outside

asdm image disk0:/asdm-523.bin

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list nonat

nat (inside) 1 0.0.0.0 0.0.0.0

route outside 0.0.0.0 0.0.0.0 81.196.151.161 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout uauth 0:05:00 absolute

aaa authentication ssh console LOCAL

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set mySET esp-des esp-md5-hmac

crypto map myMAP 10 match address vpn_traffic

crypto map myMAP 10 set peer 195.225.64.6

crypto map myMAP 10 set transform-set mySET

crypto map myMAP interface outside

crypto isakmp enable outside

crypto isakmp policy 1

 authentication pre-share

 encryption des

 hash md5

 group 2

 lifetime 86400

crypto isakmp policy 65535

 authentication pre-share

 encryption 3des

 hash sha

 group 2

 lifetime 86400

telnet timeout 5

ssh 192.168.2.0 255.255.255.0 inside

ssh 195.225.64.6 255.255.255.255 outside

ssh 89.137.14.129 255.255.255.255 outside

ssh 89.137.17.237 255.255.255.255 outside

ssh timeout 60

ssh version 2

console timeout 0

management-access inside

dhcpd dns 4.2.2.2

dhcpd wins 192.168.1.2

dhcpd auto_config outside

!

dhcpd address 192.168.2.2-192.168.2.20 inside

dhcpd wins 192.168.1.2 interface inside

dhcpd enable inside

!
 

!

class-map inspection_default

 match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

 parameters

  message-length maximum 512

policy-map global_policy

 class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny

  inspect sunrpc

  inspect xdmcp

  inspect sip

  inspect netbios

  inspect tftp

!

service-policy global_policy global

group-policy myGROUP internal

group-policy myGROUP attributes

 split-tunnel-policy tunnelspecified

 split-tunnel-network-list value ezvpn1

 nem enable

username portal password zq6sEW3VKcYqMVe/ encrypted

tunnel-group 195.225.64.6 type ipsec-l2l

tunnel-group 195.225.64.6 ipsec-attributes

 pre-shared-key *

tunnel-group mytunnel type ipsec-ra

tunnel-group mytunnel general-attributes

 default-group-policy myGROUP

tunnel-group mytunnel ipsec-attributes

 pre-shared-key *

prompt hostname context
 
 

--------------------------------------------------------------
 

Full config on PIX:

portalPIX(config)# sh run

: Saved

:

PIX Version 6.3(5)

interface ethernet0 auto

interface ethernet1 auto

nameif ethernet0 outside security0

nameif ethernet1 inside security100

hostname portalPIX

domain-name blabla.com

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names

name 192.168.1.2 fileserver

name 192.168.1.3 mailserver

name 195.225.64.6 portal

access-list acl_out permit tcp any host portal eq www

access-list acl_out permit tcp any host portal eq https

access-list acl_out permit tcp any host portal eq smtp

access-list acl_out permit icmp any any

access-list acl_out permit tcp host 89.137.17.237 interface outside

access-list acl_out permit udp host 82.76.17.127 interface outside

access-list acl_out permit tcp host 78.96.155.223 interface outside

access-list acl_out permit udp any host portal eq 11194

access-list acl_out permit udp host 82.79.151.202 interface outside

access-list acl_out permit tcp host 82.79.151.202 interface outside

access-list acl_out permit udp 81.196.151.160 255.255.255.224 interface outside

access-list acl_out permit tcp 81.196.151.160 255.255.255.224 interface outside

access-list 110 permit ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.0

access-list nonat permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0

access-list 150 permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0

access-list vpn_traffic permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0

pager lines 24

logging on

logging timestamp

logging standby

logging buffered debugging

logging trap critical

logging history debugging

logging facility 22

logging host inside mailserver

icmp permit any outside

icmp permit any inside

mtu outside 1500

mtu inside 1500

ip address outside portal 255.255.255.252

ip address inside 192.168.1.1 255.255.255.0

ip audit name INFOPOLICY info action alarm

ip audit name ACTIONPOLICY attack action alarm drop

ip audit interface outside INFOPOLICY

ip audit interface outside ACTIONPOLICY

ip audit info action alarm

ip audit attack action alarm

ip local pool Remote_access 192.168.100.1-192.168.100.10 mask 255.255.255.0

pdm logging informational 100

pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list nonat

nat (inside) 1 0.0.0.0 0.0.0.0 dns 0 0

alias (inside) mailserver portal 255.255.255.255

static (inside,outside) tcp portal smtp mailserver smtp netmask 255.255.255.255 0 80

static (outside,inside) tcp mailserver https portal https netmask 255.255.255.255 0 80

static (inside,outside) tcp interface www mailserver www dns netmask 255.255.255.255 0 100

static (inside,outside) tcp interface 20022 mailserver ssh dns netmask 255.255.255.255 0 100

static (inside,outside) tcp interface 30022 fileserver ssh dns netmask 255.255.255.255 0 100

static (inside,outside) udp interface 11194 fileserver 11194 dns netmask 255.255.255.255 0 0

static (inside,outside) udp interface 21194 fileserver 21194 dns netmask 255.255.255.255 0 0

access-group acl_out in interface outside

route outside 0.0.0.0 0.0.0.0 195.225.64.5 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout sip-disconnect 0:02:00 sip-invite 0:03:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server TACACS+ max-failed-attempts 3

aaa-server TACACS+ deadtime 10

aaa-server RADIUS protocol radius

aaa-server RADIUS max-failed-attempts 3

aaa-server RADIUS deadtime 10

aaa-server LOCAL protocol local

aaa authentication secure-http-client

aaa authentication ssh console LOCAL

ntp server 82.76.121.165 source outside

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

virtual telnet 192.168.1.100

floodguard enable

sysopt connection permit-ipsec

sysopt noproxyarp inside

crypto ipsec transform-set myset esp-des esp-md5-hmac

crypto map mymap 10 ipsec-isakmp

crypto map mymap 10 match address vpn_traffic

crypto map mymap 10 set peer 81.196.151.170

crypto map mymap 10 set transform-set myset

crypto map mymap interface outside

isakmp enable outside

isakmp key ******** address 81.196.151.170 netmask 255.255.255.255

isakmp policy 10 authentication pre-share

isakmp policy 10 encryption des

isakmp policy 10 hash md5

isakmp policy 10 group 2

isakmp policy 10 lifetime 86400

vpngroup portal idle-time 1800

telnet timeout 5

ssh 89.137.17.237 255.255.255.255 outside

ssh 82.79.151.202 255.255.255.255 outside

ssh 81.196.151.160 255.255.255.224 outside

ssh 192.168.1.0 255.255.255.0 inside

ssh 192.168.2.0 255.255.255.0 inside

ssh timeout 60

management-access inside

console timeout 0

dhcpd address 192.168.1.200-192.168.1.253 inside

dhcpd lease 3600

dhcpd ping_timeout 750

terminal width 80

Open in new window

0
 

Author Comment

by:gabos_denes
ID: 22767854
Here is the output of the sh cryp ipsec sa command.

 
ciscoasa# sh cryp ipsec sa

interface: outside

    Crypto map tag: myMAP, seq num: 10, local addr: 81.196.151.170
 

      access-list vpn_traffic permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0

      local ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)

      remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)

      current_peer: 195.225.64.6
 

      #pkts encaps: 8321, #pkts encrypt: 8321, #pkts digest: 8321

      #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0

      #pkts compressed: 0, #pkts decompressed: 0

      #pkts not compressed: 8321, #pkts comp failed: 0, #pkts decomp failed: 0

      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0

      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0

      #send errors: 0, #recv errors: 0
 

      local crypto endpt.: 81.196.151.170, remote crypto endpt.: 195.225.64.6
 

      path mtu 1500, ipsec overhead 58, media mtu 1500

      current outbound spi: D4CFAEFA
 

    inbound esp sas:

      spi: 0x165EDE7F (375316095)

         transform: esp-des esp-md5-hmac none

         in use settings ={L2L, Tunnel, }

         slot: 0, conn_id: 6, crypto-map: myMAP

         sa timing: remaining key lifetime (kB/sec): (4275000/15697)

         IV size: 8 bytes

         replay detection support: Y

    outbound esp sas:

      spi: 0xD4CFAEFA (3570380538)

         transform: esp-des esp-md5-hmac none

         in use settings ={L2L, Tunnel, }

         slot: 0, conn_id: 6, crypto-map: myMAP

         sa timing: remaining key lifetime (kB/sec): (4274806/15697)

         IV size: 8 bytes

         replay detection support: Y
 
 
 

--------------------------------------------------------------------------------------------------
 

portalPIX# sh cryp ipsec sa
 
 

interface: outside

    Crypto map tag: mymap, local addr. portal
 

   local  ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)

   remote ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)

   current_peer: 81.196.151.170:500

     PERMIT, flags={origin_is_acl,}

    #pkts encaps: 126, #pkts encrypt: 126, #pkts digest 126

    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0

    #pkts compressed: 0, #pkts decompressed: 0

    #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0

    #send errors 0, #recv errors 0
 

     local crypto endpt.: portal, remote crypto endpt.: 81.196.151.170

     path mtu 1500, ipsec overhead 56, media mtu 1500

     current outbound spi: 165ede7f
 

     inbound esp sas:

      spi: 0xd4cfaefa(3570380538)

        transform: esp-des esp-md5-hmac ,

        in use settings ={Tunnel, }

        slot: 0, conn id: 4, crypto map: mymap

        sa timing: remaining key lifetime (k/sec): (4608000/15656)

        IV size: 8 bytes

        replay detection support: Y
 
 

     inbound ah sas:
 
 

     inbound pcp sas:
 
 

     outbound esp sas:

      spi: 0x165ede7f(375316095)

        transform: esp-des esp-md5-hmac ,

        in use settings ={Tunnel, }

        slot: 0, conn id: 3, crypto map: mymap

        sa timing: remaining key lifetime (k/sec): (4607989/15647)

        IV size: 8 bytes

        replay detection support: Y
 
 

     outbound ah sas:
 
 

     outbound pcp sas:

Open in new window

0

Featured Post

6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

Join & Write a Comment

This article will cover setting up redundant ISPs for outbound connectivity on an ASA 5510 (although the same should work on the 5520s and up as well).  It’s important to note that this covers outbound connectivity only.  The ASA does not have built…
Use of TCL script on Cisco devices:  - create file and merge it with running configuration to apply configuration changes
In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now