gabos_denes
asked on
Cisco VPN with ASA5505 and PIX506E
Hello
I have to configure a vpn between a CISCO ASA5505 and PIX506E. I''ve done some research on the net and configured the vpn to some extent. My vpn is up but I cannot ping the other side of the vpn. My network looks like this:
On the cisco asa5505 external ip 81.196.151.170, internal ip 192.168.2.1
On the cisco pix 506e external ip: 195.225.64.6, internal ip 192.168.1.1
In front of the cisco asa5505 i have a linux server. Using tcpdump i came to the conclusion that when I send a ping to the other end(192.168.1.1) the packet does not go through the tunnel. I have no experience in configuring cisco routers but i have good knowledge on linux networking.
I should mention that there was a vpn configured between the two routers and I made my configuration on top of that using this link: http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805c5ad9.shtml
The previous ip address of the pix506e was 82.76.17.127 so it shows up on the configuration.
After configuring the vpn all the unnecessary configuration has to be removed.
I have to configure a vpn between a CISCO ASA5505 and PIX506E. I''ve done some research on the net and configured the vpn to some extent. My vpn is up but I cannot ping the other side of the vpn. My network looks like this:
On the cisco asa5505 external ip 81.196.151.170, internal ip 192.168.2.1
On the cisco pix 506e external ip: 195.225.64.6, internal ip 192.168.1.1
In front of the cisco asa5505 i have a linux server. Using tcpdump i came to the conclusion that when I send a ping to the other end(192.168.1.1) the packet does not go through the tunnel. I have no experience in configuring cisco routers but i have good knowledge on linux networking.
I should mention that there was a vpn configured between the two routers and I made my configuration on top of that using this link: http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805c5ad9.shtml
The previous ip address of the pix506e was 82.76.17.127 so it shows up on the configuration.
After configuring the vpn all the unnecessary configuration has to be removed.
Here is the configuration of the ASA5505:
ciscoasa(config)# sh run
: Saved
:
ASA Version 7.2(3)
!
hostname ciscoasa
domain-name default.domain.invalid
enable password fXX82h2lCH4Xtjpp encrypted
names
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.2.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 81.196.151.170 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
dns server-group DefaultDNS
domain-name default.domain.invalid
access-list ssh extended permit ip host 195.225.64.6 host 82.76.17.127
access-list vpn_traffic extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
icmp permit any outside
asdm image disk0:/asdm-523.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list vpn_traffic
nat (inside) 1 192.168.2.0 255.255.255.0
access-group ssh in interface outside
route outside 0.0.0.0 0.0.0.0 81.196.151.161 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
aaa authentication ssh console LOCAL
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set PORTAL esp-3des esp-sha-hmac
crypto map static 10 match address vpn_traffic
crypto map static 10 set peer 195.225.64.6
crypto map static 10 set transform-set PORTAL
crypto map static interface outside
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption des
hash md5
group 2
lifetime 8640
crypto isakmp nat-traversal 10
telnet timeout 5
ssh 192.168.2.0 255.255.255.0 inside
ssh 195.225.64.6 255.255.255.255 outside
ssh 89.137.14.129 255.255.255.255 outside
ssh 89.137.17.237 255.255.255.255 outside
ssh timeout 60
ssh version 2
console timeout 0
management-access inside
dhcpd dns 4.2.2.2
dhcpd wins 192.168.1.2
dhcpd auto_config outside
!
dhcpd address 192.168.2.2-192.168.2.20 inside
dhcpd wins 192.168.1.2 interface inside
dhcpd enable inside
!
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
username portal password lkzHotDKgBQnMeX6 encrypted
tunnel-group 195.225.64.6 type ipsec-l2l
tunnel-group 195.225.64.6 ipsec-attributes
pre-shared-key *
prompt hostname context
Here is the PIX506E configuration:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password fXX82h2lCH4Xtjpp encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname portalPIX
domain-name blablabla.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 192.168.1.2 fileserver
name 192.168.1.3 mailserver
name 195.225.64.6 portal
access-list acl_out permit tcp any host portal eq www
access-list acl_out permit tcp any host portal eq https
access-list acl_out permit tcp any host portal eq smtp
access-list acl_out permit icmp any any
access-list acl_out deny tcp host 195.225.64.122 host portal eq 20022
access-list acl_out permit tcp host 89.137.17.237 interface outside
access-list acl_out permit udp host 82.76.17.127 interface outside
access-list acl_out permit tcp host 78.96.155.223 interface outside
access-list acl_out permit udp any host portal eq 11194
access-list acl_out permit udp host 82.79.151.202 interface outside
access-list acl_out permit tcp host 82.79.151.202 interface outside
access-list acl_out permit udp 81.196.151.160 255.255.255.224 interface outside
access-list acl_out permit tcp 81.196.151.160 255.255.255.224 interface outside
access-list 110 permit ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list nonat permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list 150 permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
pager lines 24
logging on
logging timestamp
logging standby
logging buffered debugging
logging trap critical
logging history debugging
logging facility 22
logging host inside mailserver
icmp permit any outside
icmp permit any inside
mtu outside 1500
mtu inside 1500
ip address outside portal 255.255.255.252
ip address inside 192.168.1.1 255.255.255.0
ip audit name INFOPOLICY info action alarm
ip audit name ACTIONPOLICY attack action alarm drop
ip audit interface outside INFOPOLICY
ip audit interface outside ACTIONPOLICY
ip audit info action alarm
ip audit attack action alarm
ip local pool Remote_access 192.168.100.1-192.168.100.10 mask 255.255.255.0
pdm location mailserver 255.255.255.255 inside
pdm location 192.168.1.254 255.255.255.255 inside
pdm location 195.225.64.122 255.255.255.255 outside
pdm location 192.168.2.0 255.255.255.0 outside
pdm location 192.168.10.0 255.255.255.0 outside
pdm location 89.137.14.129 255.255.255.255 outside
pdm location fileserver 255.255.255.255 inside
pdm location 89.137.17.237 255.255.255.255 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 0.0.0.0 0.0.0.0 0 0
alias (inside) mailserver portal 255.255.255.255
static (inside,outside) tcp portal smtp mailserver smtp netmask 255.255.255.255 0 80
static (outside,inside) tcp mailserver https portal https netmask 255.255.255.255 0 80
static (inside,outside) tcp interface www mailserver www dns netmask 255.255.255.255 0 100
static (inside,outside) tcp interface 20022 mailserver ssh dns netmask 255.255.255.255 0 100
static (inside,outside) tcp interface 30022 fileserver ssh dns netmask 255.255.255.255 0 100
static (inside,outside) udp interface 11194 fileserver 11194 dns netmask 255.255.255.255 0 0
static (inside,outside) udp interface 21194 fileserver 21194 dns netmask 255.255.255.255 0 0
access-group acl_out in interface outside
route outside 0.0.0.0 0.0.0.0 195.225.64.5 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
aaa authentication secure-http-client
aaa authentication ssh console LOCAL
ntp server 82.76.121.165 source outside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
virtual telnet 192.168.1.100
floodguard enable
sysopt connection permit-ipsec
sysopt noproxyarp inside
crypto map static 10 ipsec-isakmp
crypto map static 10 match address 110
! Incomplete
crypto map static 20 ipsec-isakmp
crypto map static 20 match address 150
crypto map static 20 set peer 82.76.17.127
crypto map static client configuration address initiate
crypto map static client configuration address respond
isakmp key ******** address 82.76.17.127 netmask 255.255.255.255 no-xauth
isakmp identity address
vpngroup portal idle-time 1800
telnet timeout 5
ssh 89.137.17.237 255.255.255.255 outside
ssh 82.79.151.202 255.255.255.255 outside
ssh 81.196.151.160 255.255.255.224 outside
ssh 192.168.1.0 255.255.255.0 inside
ssh 192.168.2.0 255.255.255.0 inside
ssh timeout 60
management-access inside
console timeout 0
dhcpd address 192.168.1.200-192.168.1.253 inside
dhcpd lease 3600
dhcpd ping_timeout 750
username portal password lkzHotDKgBQnMeX6 encrypted privilege 2
vpnclient server 81.196.151.170
vpnclient mode network-extension-mode
vpnclient vpngroup mytunnel password ********
vpnclient username portal password ********
vpnclient enable
terminal width 80ASKER
When i issue nat (inside) 0 access-list nonat it gives me: ERROR: Policy NAT cannot be be configured with VPN Client enabled.
And when I start the vpn client with vpnclient enable, the internet stops working on the computers behind the PIX and the ports forwarded stop working also.
And when I start the vpn client with vpnclient enable, the internet stops working on the computers behind the PIX and the ports forwarded stop working also.
ASKER
Here is the latest configuration of my routers. I think one of the tunnel-groups should be removed from the asa5505 configuration.
Here is the ASA5505 configuration
ciscoasa(config)# sh run
: Saved
:
ASA Version 7.2(3)
!
hostname ciscoasa
domain-name default.domain.invalid
enable password fXX82h2lCH4Xtjpp encrypted
names
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.2.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 81.196.151.170 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
dns server-group DefaultDNS
domain-name default.domain.invalid
access-list ssh extended permit ip host 195.225.64.6 host 81.196.151.170
access-list vpn_traffic extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list nonat extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list ezvpn1 extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
icmp permit any outside
icmp permit any echo-reply outside
asdm image disk0:/asdm-523.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 0.0.0.0 0.0.0.0
route outside 0.0.0.0 0.0.0.0 81.196.151.161 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
aaa authentication ssh console LOCAL
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set mySET esp-des esp-md5-hmac
crypto dynamic-map myDYN-MAP 5 set transform-set mySET
crypto map static 10 match address vpn_traffic
crypto map myMAP 60 ipsec-isakmp dynamic myDYN-MAP
crypto map myMAP interface outside
crypto isakmp enable outside
crypto isakmp policy 1
authentication pre-share
encryption des
hash md5
group 2
lifetime 86400
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh 192.168.2.0 255.255.255.0 inside
ssh 195.225.64.6 255.255.255.255 outside
ssh 89.137.14.129 255.255.255.255 outside
ssh 89.137.17.237 255.255.255.255 outside
ssh timeout 60
ssh version 2
console timeout 0
management-access inside
dhcpd dns 4.2.2.2
dhcpd wins 192.168.1.2
dhcpd auto_config outside
!
dhcpd address 192.168.2.2-192.168.2.20 inside
dhcpd wins 192.168.1.2 interface inside
dhcpd enable inside
!
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
group-policy myGROUP internal
group-policy myGROUP attributes
split-tunnel-policy tunnelspecified
split-tunnel-network-list value ezvpn1
nem enable
username portal password lkzHotDKgBQnMeX6 encrypted
tunnel-group 195.225.64.6 type ipsec-l2l
tunnel-group 195.225.64.6 ipsec-attributes
pre-shared-key *
tunnel-group mytunnel type ipsec-ra
tunnel-group mytunnel general-attributes
default-group-policy myGROUP
tunnel-group mytunnel ipsec-attributes
pre-shared-key *
prompt hostname context
PIX506E config:
portalPIX(config)# sh run
: Saved
:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password fXX82h2lCH4Xtjpp encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname portalPIX
domain-name portalleasing.ro
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 192.168.1.2 fileserver
name 192.168.1.3 mailserver
name 195.225.64.6 portal
access-list acl_out permit tcp any host portal eq www
access-list acl_out permit tcp any host portal eq https
access-list acl_out permit tcp any host portal eq smtp
access-list acl_out permit icmp any any
access-list acl_out permit tcp host 89.137.17.237 interface outside
access-list acl_out permit udp host 82.76.17.127 interface outside
access-list acl_out permit tcp host 78.96.155.223 interface outside
access-list acl_out permit udp any host portal eq 11194
access-list acl_out permit udp host 82.79.151.202 interface outside
access-list acl_out permit tcp host 82.79.151.202 interface outside
access-list acl_out permit udp 81.196.151.160 255.255.255.224 interface outside
access-list acl_out permit tcp 81.196.151.160 255.255.255.224 interface outside
access-list 110 permit ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list nonat permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list 150 permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
pager lines 24
logging on
logging timestamp
logging standby
logging buffered debugging
logging trap critical
logging history debugging
logging facility 22
logging host inside mailserver
icmp permit any outside
icmp permit any inside
mtu outside 1500
mtu inside 1500
ip address outside portal 255.255.255.252
ip address inside 192.168.1.1 255.255.255.0
ip audit name INFOPOLICY info action alarm
ip audit name ACTIONPOLICY attack action alarm drop
ip audit interface outside INFOPOLICY
ip audit interface outside ACTIONPOLICY
ip audit info action alarm
ip audit attack action alarm
ip local pool Remote_access 192.168.100.1-192.168.100.10 mask 255.255.255.0
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 0.0.0.0 0.0.0.0 dns 0 0
alias (inside) mailserver portal 255.255.255.255
static (inside,outside) tcp portal smtp mailserver smtp netmask 255.255.255.255 0 80
static (outside,inside) tcp mailserver https portal https netmask 255.255.255.255 0 80
static (inside,outside) tcp interface www mailserver www dns netmask 255.255.255.255 0 100
static (inside,outside) tcp interface 20022 mailserver ssh dns netmask 255.255.255.255 0 100
static (inside,outside) tcp interface 30022 fileserver ssh dns netmask 255.255.255.255 0 100
static (inside,outside) udp interface 11194 fileserver 11194 dns netmask 255.255.255.255 0 0
static (inside,outside) udp interface 21194 fileserver 21194 dns netmask 255.255.255.255 0 0
access-group acl_out in interface outside
route outside 0.0.0.0 0.0.0.0 195.225.64.5 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
aaa authentication secure-http-client
aaa authentication ssh console LOCAL
ntp server 82.76.121.165 source outside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
virtual telnet 192.168.1.100
floodguard enable
sysopt connection permit-ipsec
sysopt noproxyarp inside
vpngroup portal idle-time 1800
telnet timeout 5
ssh 89.137.17.237 255.255.255.255 outside
ssh 82.79.151.202 255.255.255.255 outside
ssh 81.196.151.160 255.255.255.224 outside
ssh 192.168.1.0 255.255.255.0 inside
ssh 192.168.2.0 255.255.255.0 inside
ssh timeout 60
management-access inside
console timeout 0
dhcpd address 192.168.1.200-192.168.1.253 inside
dhcpd lease 3600
dhcpd ping_timeout 750
username portal password lkzHsdDKgBQnMeX6 encrypted privilege 2
terminal width 80ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
I have no ping reply from the other ends.
Here is my complete configuration and some debug messages.
Here is my complete configuration and some debug messages.
portalPIX(config)# sh run
: Saved
:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password fXX82h2lCH4Xtjpp encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname portalPIX
domain-name blabla.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 192.168.1.2 fileserver
name 192.168.1.3 mailserver
name 195.225.64.6 portal
access-list acl_out permit tcp any host portal eq www
access-list acl_out permit tcp any host portal eq https
access-list acl_out permit tcp any host portal eq smtp
access-list acl_out permit icmp any any
access-list acl_out permit tcp host 89.137.17.237 interface outside
access-list acl_out permit udp host 82.76.17.127 interface outside
access-list acl_out permit tcp host 78.96.155.223 interface outside
access-list acl_out permit udp any host portal eq 11194
access-list acl_out permit udp host 82.79.151.202 interface outside
access-list acl_out permit tcp host 82.79.151.202 interface outside
access-list acl_out permit udp 81.196.151.160 255.255.255.224 interface outside
access-list acl_out permit tcp 81.196.151.160 255.255.255.224 interface outside
access-list 110 permit ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list nonat permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list 150 permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list vpn_traffic permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
pager lines 24
logging on
logging timestamp
logging standby
logging buffered debugging
logging trap critical
logging history debugging
logging facility 22
logging host inside mailserver
icmp permit any outside
icmp permit any inside
mtu outside 1500
mtu inside 1500
ip address outside portal 255.255.255.252
ip address inside 192.168.1.1 255.255.255.0
ip audit name INFOPOLICY info action alarm
ip audit name ACTIONPOLICY attack action alarm drop
ip audit interface outside INFOPOLICY
ip audit interface outside ACTIONPOLICY
ip audit info action alarm
ip audit attack action alarm
ip local pool Remote_access 192.168.100.1-192.168.100.10 mask 255.255.255.0
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 0.0.0.0 0.0.0.0 dns 0 0
alias (inside) mailserver portal 255.255.255.255
static (inside,outside) tcp portal smtp mailserver smtp netmask 255.255.255.255 0 80
static (outside,inside) tcp mailserver https portal https netmask 255.255.255.255 0 80
static (inside,outside) tcp interface www mailserver www dns netmask 255.255.255.255 0 100
static (inside,outside) tcp interface 20022 mailserver ssh dns netmask 255.255.255.255 0 100
static (inside,outside) tcp interface 30022 fileserver ssh dns netmask 255.255.255.255 0 100
static (inside,outside) udp interface 11194 fileserver 11194 dns netmask 255.255.255.255 0 0
static (inside,outside) udp interface 21194 fileserver 21194 dns netmask 255.255.255.255 0 0
access-group acl_out in interface outside
route outside 0.0.0.0 0.0.0.0 195.225.64.5 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
aaa authentication secure-http-client
aaa authentication ssh console LOCAL
ntp server 82.76.121.165 source outside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
virtual telnet 192.168.1.100
floodguard enable
sysopt connection permit-ipsec
sysopt noproxyarp inside
crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto map mymap 10 ipsec-isakmp
crypto map mymap 10 match address vpn_traffic
crypto map mymap 10 set peer 81.196.151.170
crypto map mymap 10 set transform-set myset
crypto map mymap interface outside
isakmp enable outside
isakmp key ******** address 81.196.151.170 netmask 255.255.255.255
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup portal idle-time 1800
telnet timeout 5
ssh 89.137.17.237 255.255.255.255 outside
ssh 82.79.151.202 255.255.255.255 outside
ssh 81.196.151.160 255.255.255.224 outside
ssh 192.168.1.0 255.255.255.0 inside
ssh 192.168.2.0 255.255.255.0 inside
ssh timeout 60
management-access inside
console timeout 0
dhcpd address 192.168.1.200-192.168.1.253 inside
dhcpd lease 3600
dhcpd ping_timeout 750
username portal password lkzHddDKgBQnMeX7 encrypted privilege 2
terminal width 80
------------------------------------------------------------------------
ciscoasa(config)# sh run
: Saved
:
ASA Version 7.2(3)
!
hostname ciscoasa
domain-name default.domain.invalid
enable password fXX82h2lCH4Xtjpp encrypted
names
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.2.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 81.196.151.170 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
dns server-group DefaultDNS
domain-name default.domain.invalid
access-list ssh extended permit ip host 195.225.64.6 host 81.196.151.170
access-list vpn_traffic extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list nonat extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list ezvpn1 extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
icmp permit any outside
icmp permit any echo-reply outside
asdm image disk0:/asdm-523.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 0.0.0.0 0.0.0.0
route outside 0.0.0.0 0.0.0.0 81.196.151.161 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
aaa authentication ssh console LOCAL
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set mySET esp-des esp-md5-hmac
crypto dynamic-map myDYN-MAP 5 set transform-set mySET
crypto map static 10 match address vpn_traffic
crypto map myMAP 10 match address vpn_traffic
crypto map myMAP 10 set peer 195.225.64.6
crypto map myMAP 10 set transform-set mySET
crypto map myMAP 60 ipsec-isakmp dynamic myDYN-MAP
crypto map myMAP interface outside
crypto isakmp enable outside
crypto isakmp policy 1
authentication pre-share
encryption des
hash md5
group 2
lifetime 86400
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh 192.168.2.0 255.255.255.0 inside
ssh 195.225.64.6 255.255.255.255 outside
ssh 89.137.14.129 255.255.255.255 outside
ssh 89.137.17.237 255.255.255.255 outside
ssh timeout 60
ssh version 2
console timeout 0
management-access inside
dhcpd dns 4.2.2.2
dhcpd wins 192.168.1.2
dhcpd auto_config outside
!
dhcpd address 192.168.2.2-192.168.2.20 inside
dhcpd wins 192.168.1.2 interface inside
dhcpd enable inside
!
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
group-policy myGROUP internal
group-policy myGROUP attributes
split-tunnel-policy tunnelspecified
split-tunnel-network-list value ezvpn1
nem enable
username portal password zq6sEW3VKcYqMVe/ encrypted
tunnel-group 195.225.64.6 type ipsec-l2l
tunnel-group 195.225.64.6 ipsec-attributes
pre-shared-key *
tunnel-group mytunnel type ipsec-ra
tunnel-group mytunnel general-attributes
default-group-policy myGROUP
tunnel-group mytunnel ipsec-attributes
pre-shared-key *
prompt hostname context
------------------------------------------------------------------------
portalPIX(config)# show crypto ipsec sa
interface: outside
Crypto map tag: mymap, local addr. portal
local ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)
current_peer: 81.196.151.170:500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 12, #pkts encrypt: 12, #pkts digest 12
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0
#send errors 97, #recv errors 0
local crypto endpt.: portal, remote crypto endpt.: 81.196.151.170
path mtu 1500, ipsec overhead 56, media mtu 1500
current outbound spi: f003ba8f
inbound esp sas:
spi: 0xb9ccf8ac(3117217964)
transform: esp-des esp-md5-hmac ,
in use settings ={Tunnel, }
slot: 0, conn id: 1, crypto map: mymap
sa timing: remaining key lifetime (k/sec): (4608000/27903)
IV size: 8 bytes
replay detection support: Y
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0xf003ba8f(4026776207)
transform: esp-des esp-md5-hmac ,
in use settings ={Tunnel, }
slot: 0, conn id: 2, crypto map: mymap
sa timing: remaining key lifetime (k/sec): (4607999/27903)
IV size: 8 bytes
replay detection support: Y
outbound ah sas:
outbound pcp sas:
portalPIX(config)# show crypto isakmp sa
Total : 1
Embryonic : 0
dst src state pending created
portal 81.196.151.170 QM_IDLE 0 1
ciscoasa(config)# show crypto ipsec sa
interface: outside
Crypto map tag: myMAP, seq num: 10, local addr: 81.196.151.170
access-list vpn_traffic permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
local ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
current_peer: 195.225.64.6
#pkts encaps: 29, #pkts encrypt: 29, #pkts digest: 29
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 29, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: 81.196.151.170, remote crypto endpt.: 195.225.64.6
path mtu 1500, ipsec overhead 58, media mtu 1500
current outbound spi: B9CCF8AC
inbound esp sas:
spi: 0xF003BA8F (4026776207)
transform: esp-des esp-md5-hmac none
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 1, crypto-map: myMAP
sa timing: remaining key lifetime (kB/sec): (4275000/27756)
IV size: 8 bytes
replay detection support: Y
outbound esp sas:
spi: 0xB9CCF8AC (3117217964)
transform: esp-des esp-md5-hmac none
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 1, crypto-map: myMAP
sa timing: remaining key lifetime (kB/sec): (4274998/27756)
IV size: 8 bytes
replay detection support: Y
ciscoasa(config)# show crypto isakmp sa
Active SA: 1
Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1
1 IKE Peer: 195.225.64.6
Type : L2L Role : initiator
Rekey : no State : MM_ACTIVE
After debug crypto ipsec 10 and debug crypto isakmp 10 on both routers i got this message repeating over and over on the ASA5505:
Oct 19 06:59:06 [IKEv1 DEBUG]: Group = 195.225.64.6, IP = 195.225.64.6, processing hash payload
Oct 19 06:59:06 [IKEv1 DEBUG]: Group = 195.225.64.6, IP = 195.225.64.6, processing notify payload
Oct 19 06:59:06 [IKEv1 DEBUG]: Group = 195.225.64.6, IP = 195.225.64.6, Received keep-alive of type DPD R-U-THERE-ACK (seq number 0x6404d71)
Oct 19 06:59:16 [IKEv1 DEBUG]: Group = 195.225.64.6, IP = 195.225.64.6, Sending keep-alive of type DPD R-U-THERE (seq number 0x6404d72)
Oct 19 06:59:16 [IKEv1 DEBUG]: Group = 195.225.64.6, IP = 195.225.64.6, constructing blank hash payload
Oct 19 06:59:16 [IKEv1 DEBUG]: Group = 195.225.64.6, IP = 195.225.64.6, constructing qm hash payload
Oct 19 06:59:16 [IKEv1]: IP = 195.225.64.6, IKE_DECODE SENDING Message (msgid=e4e65555) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total leng th : 80
Oct 19 06:59:16 [IKEv1]: IP = 195.225.64.6, IKE_DECODE RECEIVED Message (msgid=55349d4) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total leng th : 80
On the PIX i got no debug messages.
Please post the output of the "sh ver" command from the ASA and PIX.
ASKER
ciscoasa# sh ver
Cisco Adaptive Security Appliance Software Version 7.2(3)
Device Manager Version 5.2(3)
Compiled on Wed 15-Aug-07 16:08 by builders
System image file is "disk0:/asa723-k8.bin"
Config file at boot was "startup-config"
ciscoasa up 6 hours 37 mins
Hardware: ASA5505, 256 MB RAM, CPU Geode 500 MHz
Internal ATA Compact Flash, 128MB
BIOS Flash M50FW080 @ 0xffe00000, 1024KB
Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
Boot microcode : CNlite-MC-Boot-Cisco-1.2
SSL/IKE microcode: CNlite-MC-IPSEC-Admin-3.03
IPSec microcode : CNlite-MC-IPSECm-MAIN-2.04
0: Int: Internal-Data0/0 : address is 001e.4a3c.ee51, irq 11
1: Ext: Ethernet0/0 : address is 001e.4a3c.ee49, irq 255
2: Ext: Ethernet0/1 : address is 001e.4a3c.ee4a, irq 255
3: Ext: Ethernet0/2 : address is 001e.4a3c.ee4b, irq 255
4: Ext: Ethernet0/3 : address is 001e.4a3c.ee4c, irq 255
5: Ext: Ethernet0/4 : address is 001e.4a3c.ee4d, irq 255
6: Ext: Ethernet0/5 : address is 001e.4a3c.ee4e, irq 255
7: Ext: Ethernet0/6 : address is 001e.4a3c.ee4f, irq 255
8: Ext: Ethernet0/7 : address is 001e.4a3c.ee50, irq 255
9: Int: Internal-Data0/1 : address is 0000.0003.0002, irq 255
10: Int: Not used : irq 255
11: Int: Not used : irq 255
Licensed features for this platform:
Maximum Physical Interfaces : 8
VLANs : 3, DMZ Restricted
Inside Hosts : 10
Failover : Disabled
VPN-DES : Enabled
VPN-3DES-AES : Enabled
VPN Peers : 10
WebVPN Peers : 2
Dual ISPs : Disabled
VLAN Trunk Ports : 0
This platform has a Base license.
portalPIX(config)# sh ver
Cisco PIX Firewall Version 6.3(5)
Cisco PIX Device Manager Version 3.0(4)
Compiled on Thu 04-Aug-05 21:40 by morlee
portalPIX up 7 hours 1 min
Hardware: PIX-506E, 32 MB RAM, CPU Pentium II 300 MHz
Flash E28F640J3 @ 0x300, 8MB
BIOS Flash AM29F400B @ 0xfffd8000, 32KB
0: ethernet0: address is 0018.ba14.a45c, irq 10
1: ethernet1: address is 0018.ba14.a45d, irq 11
Licensed Features:
Failover: Disabled
VPN-DES: Enabled
VPN-3DES-AES: Enabled
Maximum Physical Interfaces: 2
Maximum Interfaces: 4
Cut-through Proxy: Enabled
Guards: Enabled
URL-filtering: Enabled
Inside Hosts: Unlimited
Throughput: Unlimited
IKE peers: Unlimited
This PIX has a Restricted (R) license.
Cisco Adaptive Security Appliance Software Version 7.2(3)
Device Manager Version 5.2(3)
Compiled on Wed 15-Aug-07 16:08 by builders
System image file is "disk0:/asa723-k8.bin"
Config file at boot was "startup-config"
ciscoasa up 6 hours 37 mins
Hardware: ASA5505, 256 MB RAM, CPU Geode 500 MHz
Internal ATA Compact Flash, 128MB
BIOS Flash M50FW080 @ 0xffe00000, 1024KB
Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
Boot microcode : CNlite-MC-Boot-Cisco-1.2
SSL/IKE microcode: CNlite-MC-IPSEC-Admin-3.03
IPSec microcode : CNlite-MC-IPSECm-MAIN-2.04
0: Int: Internal-Data0/0 : address is 001e.4a3c.ee51, irq 11
1: Ext: Ethernet0/0 : address is 001e.4a3c.ee49, irq 255
2: Ext: Ethernet0/1 : address is 001e.4a3c.ee4a, irq 255
3: Ext: Ethernet0/2 : address is 001e.4a3c.ee4b, irq 255
4: Ext: Ethernet0/3 : address is 001e.4a3c.ee4c, irq 255
5: Ext: Ethernet0/4 : address is 001e.4a3c.ee4d, irq 255
6: Ext: Ethernet0/5 : address is 001e.4a3c.ee4e, irq 255
7: Ext: Ethernet0/6 : address is 001e.4a3c.ee4f, irq 255
8: Ext: Ethernet0/7 : address is 001e.4a3c.ee50, irq 255
9: Int: Internal-Data0/1 : address is 0000.0003.0002, irq 255
10: Int: Not used : irq 255
11: Int: Not used : irq 255
Licensed features for this platform:
Maximum Physical Interfaces : 8
VLANs : 3, DMZ Restricted
Inside Hosts : 10
Failover : Disabled
VPN-DES : Enabled
VPN-3DES-AES : Enabled
VPN Peers : 10
WebVPN Peers : 2
Dual ISPs : Disabled
VLAN Trunk Ports : 0
This platform has a Base license.
portalPIX(config)# sh ver
Cisco PIX Firewall Version 6.3(5)
Cisco PIX Device Manager Version 3.0(4)
Compiled on Thu 04-Aug-05 21:40 by morlee
portalPIX up 7 hours 1 min
Hardware: PIX-506E, 32 MB RAM, CPU Pentium II 300 MHz
Flash E28F640J3 @ 0x300, 8MB
BIOS Flash AM29F400B @ 0xfffd8000, 32KB
0: ethernet0: address is 0018.ba14.a45c, irq 10
1: ethernet1: address is 0018.ba14.a45d, irq 11
Licensed Features:
Failover: Disabled
VPN-DES: Enabled
VPN-3DES-AES: Enabled
Maximum Physical Interfaces: 2
Maximum Interfaces: 4
Cut-through Proxy: Enabled
Guards: Enabled
URL-filtering: Enabled
Inside Hosts: Unlimited
Throughput: Unlimited
IKE peers: Unlimited
This PIX has a Restricted (R) license.
ASKER
I tried pinging from the routers and also from the lan computers with no success. Here is my latest config on the routers.
ciscoasa(config)# no crypto dynamic-map myDYN-MAP 5 set transform-set mySET
WARNING: The crypto map entry will be incomplete!
ciscoasa(config)# no crypto map static 10 match address vpn_traffic
ciscoasa(config)# no crypto map myMAP 60 ipsec-isakmp dynamic myDYN-MAP
WARNING: The crypto map entry is incomplete!
ciscoasa(config)# clear crypto is sa
ciscoasa(config)# clear crypto ip sa
ciscoasa(config)# ping 192.168.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
?????
Success rate is 0 percent (0/5)
ciscoasa(config)# ping 192.168.1.254
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.254, timeout is 2 seconds:
?????
Success rate is 0 percent (0/5)
portalPIX(config)# clear crypto is sa
portalPIX(config)# clear crypto ip sa
portalPIX(config)# ping 192.168.2.1
192.168.2.1 NO response received -- 1000ms
192.168.2.1 NO response received -- 1000ms
192.168.2.1 NO response received -- 1000ms
--------------------------------------------------------------
ciscoasa(config)# show cryp is sa
Active SA: 1
Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1
1 IKE Peer: 195.225.64.6
Type : L2L Role : initiator
Rekey : no State : MM_ACTIVE
portalPIX(config)# show cryp is sa
Total : 1
Embryonic : 0
dst src state pending created
portal 81.196.151.170 QM_IDLE 0 1
--------------------------------------------------------------
ciscoasa(config)# sh cryp ip sa
interface: outside
Crypto map tag: myMAP, seq num: 10, local addr: 81.196.151.170
access-list vpn_traffic permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
local ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
current_peer: 195.225.64.6
#pkts encaps: 147, #pkts encrypt: 147, #pkts digest: 147
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 147, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: 81.196.151.170, remote crypto endpt.: 195.225.64.6
path mtu 1500, ipsec overhead 58, media mtu 1500
current outbound spi: E81E717F
inbound esp sas:
spi: 0x0056CF34 (5689140)
transform: esp-des esp-md5-hmac none
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 6, crypto-map: myMAP
sa timing: remaining key lifetime (kB/sec): (4275000/28432)
IV size: 8 bytes
replay detection support: Y
outbound esp sas:
spi: 0xE81E717F (3894309247)
transform: esp-des esp-md5-hmac none
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 6, crypto-map: myMAP
sa timing: remaining key lifetime (kB/sec): (4274963/28432)
IV size: 8 bytes
replay detection support: Y
portalPIX(config)# sh cryp ip sa
interface: outside
Crypto map tag: mymap, local addr. portal
local ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)
current_peer: 81.196.151.170:500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 4, #pkts encrypt: 4, #pkts digest 4
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: portal, remote crypto endpt.: 81.196.151.170
path mtu 1500, ipsec overhead 56, media mtu 1500
current outbound spi: 56cf34
inbound esp sas:
spi: 0xe81e717f(3894309247)
transform: esp-des esp-md5-hmac ,
in use settings ={Tunnel, }
slot: 0, conn id: 1, crypto map: mymap
sa timing: remaining key lifetime (k/sec): (4608000/28445)
IV size: 8 bytes
replay detection support: Y
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x56cf34(5689140)
transform: esp-des esp-md5-hmac ,
in use settings ={Tunnel, }
slot: 0, conn id: 2, crypto map: mymap
sa timing: remaining key lifetime (k/sec): (4607999/28436)
IV size: 8 bytes
replay detection support: Y
outbound ah sas:
outbound pcp sas:
--------------------------------------------------------------
Full config on asa:
ciscoasa(config)# sh run
: Saved
:
ASA Version 7.2(3)
!
hostname ciscoasa
domain-name default.domain.invalid
names
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.2.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 81.196.151.170 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
dns server-group DefaultDNS
domain-name default.domain.invalid
access-list ssh extended permit ip host 195.225.64.6 host 81.196.151.170
access-list vpn_traffic extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list nonat extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list ezvpn1 extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
icmp permit any outside
icmp permit any echo-reply outside
asdm image disk0:/asdm-523.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 0.0.0.0 0.0.0.0
route outside 0.0.0.0 0.0.0.0 81.196.151.161 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
aaa authentication ssh console LOCAL
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set mySET esp-des esp-md5-hmac
crypto map myMAP 10 match address vpn_traffic
crypto map myMAP 10 set peer 195.225.64.6
crypto map myMAP 10 set transform-set mySET
crypto map myMAP interface outside
crypto isakmp enable outside
crypto isakmp policy 1
authentication pre-share
encryption des
hash md5
group 2
lifetime 86400
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh 192.168.2.0 255.255.255.0 inside
ssh 195.225.64.6 255.255.255.255 outside
ssh 89.137.14.129 255.255.255.255 outside
ssh 89.137.17.237 255.255.255.255 outside
ssh timeout 60
ssh version 2
console timeout 0
management-access inside
dhcpd dns 4.2.2.2
dhcpd wins 192.168.1.2
dhcpd auto_config outside
!
dhcpd address 192.168.2.2-192.168.2.20 inside
dhcpd wins 192.168.1.2 interface inside
dhcpd enable inside
!
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
group-policy myGROUP internal
group-policy myGROUP attributes
split-tunnel-policy tunnelspecified
split-tunnel-network-list value ezvpn1
nem enable
username portal password zq6sEW3VKcYqMVe/ encrypted
tunnel-group 195.225.64.6 type ipsec-l2l
tunnel-group 195.225.64.6 ipsec-attributes
pre-shared-key *
tunnel-group mytunnel type ipsec-ra
tunnel-group mytunnel general-attributes
default-group-policy myGROUP
tunnel-group mytunnel ipsec-attributes
pre-shared-key *
prompt hostname context
--------------------------------------------------------------
Full config on PIX:
portalPIX(config)# sh run
: Saved
:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
hostname portalPIX
domain-name blabla.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 192.168.1.2 fileserver
name 192.168.1.3 mailserver
name 195.225.64.6 portal
access-list acl_out permit tcp any host portal eq www
access-list acl_out permit tcp any host portal eq https
access-list acl_out permit tcp any host portal eq smtp
access-list acl_out permit icmp any any
access-list acl_out permit tcp host 89.137.17.237 interface outside
access-list acl_out permit udp host 82.76.17.127 interface outside
access-list acl_out permit tcp host 78.96.155.223 interface outside
access-list acl_out permit udp any host portal eq 11194
access-list acl_out permit udp host 82.79.151.202 interface outside
access-list acl_out permit tcp host 82.79.151.202 interface outside
access-list acl_out permit udp 81.196.151.160 255.255.255.224 interface outside
access-list acl_out permit tcp 81.196.151.160 255.255.255.224 interface outside
access-list 110 permit ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list nonat permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list 150 permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list vpn_traffic permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
pager lines 24
logging on
logging timestamp
logging standby
logging buffered debugging
logging trap critical
logging history debugging
logging facility 22
logging host inside mailserver
icmp permit any outside
icmp permit any inside
mtu outside 1500
mtu inside 1500
ip address outside portal 255.255.255.252
ip address inside 192.168.1.1 255.255.255.0
ip audit name INFOPOLICY info action alarm
ip audit name ACTIONPOLICY attack action alarm drop
ip audit interface outside INFOPOLICY
ip audit interface outside ACTIONPOLICY
ip audit info action alarm
ip audit attack action alarm
ip local pool Remote_access 192.168.100.1-192.168.100.10 mask 255.255.255.0
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 0.0.0.0 0.0.0.0 dns 0 0
alias (inside) mailserver portal 255.255.255.255
static (inside,outside) tcp portal smtp mailserver smtp netmask 255.255.255.255 0 80
static (outside,inside) tcp mailserver https portal https netmask 255.255.255.255 0 80
static (inside,outside) tcp interface www mailserver www dns netmask 255.255.255.255 0 100
static (inside,outside) tcp interface 20022 mailserver ssh dns netmask 255.255.255.255 0 100
static (inside,outside) tcp interface 30022 fileserver ssh dns netmask 255.255.255.255 0 100
static (inside,outside) udp interface 11194 fileserver 11194 dns netmask 255.255.255.255 0 0
static (inside,outside) udp interface 21194 fileserver 21194 dns netmask 255.255.255.255 0 0
access-group acl_out in interface outside
route outside 0.0.0.0 0.0.0.0 195.225.64.5 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
aaa authentication secure-http-client
aaa authentication ssh console LOCAL
ntp server 82.76.121.165 source outside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
virtual telnet 192.168.1.100
floodguard enable
sysopt connection permit-ipsec
sysopt noproxyarp inside
crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto map mymap 10 ipsec-isakmp
crypto map mymap 10 match address vpn_traffic
crypto map mymap 10 set peer 81.196.151.170
crypto map mymap 10 set transform-set myset
crypto map mymap interface outside
isakmp enable outside
isakmp key ******** address 81.196.151.170 netmask 255.255.255.255
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup portal idle-time 1800
telnet timeout 5
ssh 89.137.17.237 255.255.255.255 outside
ssh 82.79.151.202 255.255.255.255 outside
ssh 81.196.151.160 255.255.255.224 outside
ssh 192.168.1.0 255.255.255.0 inside
ssh 192.168.2.0 255.255.255.0 inside
ssh timeout 60
management-access inside
console timeout 0
dhcpd address 192.168.1.200-192.168.1.253 inside
dhcpd lease 3600
dhcpd ping_timeout 750
terminal width 80ASKER
Here is the output of the sh cryp ipsec sa command.
ciscoasa# sh cryp ipsec sa
interface: outside
Crypto map tag: myMAP, seq num: 10, local addr: 81.196.151.170
access-list vpn_traffic permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
local ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
current_peer: 195.225.64.6
#pkts encaps: 8321, #pkts encrypt: 8321, #pkts digest: 8321
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 8321, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: 81.196.151.170, remote crypto endpt.: 195.225.64.6
path mtu 1500, ipsec overhead 58, media mtu 1500
current outbound spi: D4CFAEFA
inbound esp sas:
spi: 0x165EDE7F (375316095)
transform: esp-des esp-md5-hmac none
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 6, crypto-map: myMAP
sa timing: remaining key lifetime (kB/sec): (4275000/15697)
IV size: 8 bytes
replay detection support: Y
outbound esp sas:
spi: 0xD4CFAEFA (3570380538)
transform: esp-des esp-md5-hmac none
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 6, crypto-map: myMAP
sa timing: remaining key lifetime (kB/sec): (4274806/15697)
IV size: 8 bytes
replay detection support: Y
--------------------------------------------------------------------------------------------------
portalPIX# sh cryp ipsec sa
interface: outside
Crypto map tag: mymap, local addr. portal
local ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)
current_peer: 81.196.151.170:500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 126, #pkts encrypt: 126, #pkts digest 126
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: portal, remote crypto endpt.: 81.196.151.170
path mtu 1500, ipsec overhead 56, media mtu 1500
current outbound spi: 165ede7f
inbound esp sas:
spi: 0xd4cfaefa(3570380538)
transform: esp-des esp-md5-hmac ,
in use settings ={Tunnel, }
slot: 0, conn id: 4, crypto map: mymap
sa timing: remaining key lifetime (k/sec): (4608000/15656)
IV size: 8 bytes
replay detection support: Y
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x165ede7f(375316095)
transform: esp-des esp-md5-hmac ,
in use settings ={Tunnel, }
slot: 0, conn id: 3, crypto map: mymap
sa timing: remaining key lifetime (k/sec): (4607989/15647)
IV size: 8 bytes
replay detection support: Y
outbound ah sas:
outbound pcp sas:
This would seem like a NAT problem.
The ASA side looks fine, however the NAT on the PIX side looks a bit iffy. I'd make the following changes:
First delete the current NAT0 with the following:
no nat (inside) 0 0.0.0.0 0.0.0.0 0 0
Then add the new rules:
nat (inside) 1 192.168.1.0 255.255.255.0 0 0
nat (inside) 0 access-list nonat
Also, I don't think it will matter a lot in this case, but your crypto map 10 is incomplete and therefore won't work. I'd delete it if I were you:
no crypto map static 10 ipsec-isakmp