Solved

Cisco VPN with ASA5505 and PIX506E

Posted on 2008-10-16
9
1,350 Views
Last Modified: 2008-10-23
Hello
I have to configure a vpn between a CISCO ASA5505 and PIX506E. I''ve done some research on the net and configured the vpn to some extent. My vpn is up but I cannot ping the other side of the vpn. My network looks like this:
On the cisco asa5505 external ip 81.196.151.170, internal ip 192.168.2.1
On the cisco pix 506e external ip: 195.225.64.6, internal ip 192.168.1.1
In front of the cisco asa5505 i have a linux server. Using tcpdump i came to the conclusion that when I send a ping to the other end(192.168.1.1) the packet does not go through the tunnel. I have no experience in configuring cisco routers but i have good knowledge on linux networking.
I should mention that there was a vpn configured between the two routers and I made my configuration on top of that using this link: http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805c5ad9.shtml
The previous ip address of the pix506e was 82.76.17.127 so it shows up on the configuration.
After configuring the vpn all the unnecessary configuration has to be removed.
Here is the configuration of the ASA5505:
ciscoasa(config)# sh run
: Saved
:
ASA Version 7.2(3) 
!
hostname ciscoasa
domain-name default.domain.invalid
enable password fXX82h2lCH4Xtjpp encrypted
names
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.2.1 255.255.255.0 
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 81.196.151.170 255.255.255.0 
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!             
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
dns server-group DefaultDNS
 domain-name default.domain.invalid
access-list ssh extended permit ip host 195.225.64.6 host 82.76.17.127 
access-list vpn_traffic extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0 
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
icmp permit any outside
asdm image disk0:/asdm-523.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list vpn_traffic
nat (inside) 1 192.168.2.0 255.255.255.0
access-group ssh in interface outside
route outside 0.0.0.0 0.0.0.0 81.196.151.161 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
aaa authentication ssh console LOCAL 
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set PORTAL esp-3des esp-sha-hmac 
crypto map static 10 match address vpn_traffic
crypto map static 10 set peer 195.225.64.6 
crypto map static 10 set transform-set PORTAL
crypto map static interface outside
crypto isakmp identity address 
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption des
 hash md5
 group 2
 lifetime 8640
crypto isakmp nat-traversal  10
telnet timeout 5
ssh 192.168.2.0 255.255.255.0 inside
ssh 195.225.64.6 255.255.255.255 outside
ssh 89.137.14.129 255.255.255.255 outside
ssh 89.137.17.237 255.255.255.255 outside
ssh timeout 60
ssh version 2
console timeout 0
management-access inside
dhcpd dns 4.2.2.2
dhcpd wins 192.168.1.2
dhcpd auto_config outside
!
dhcpd address 192.168.2.2-192.168.2.20 inside
dhcpd wins 192.168.1.2 interface inside
dhcpd enable inside
!
              
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect esmtp 
  inspect sqlnet 
  inspect skinny 
  inspect sunrpc 
  inspect xdmcp 
  inspect sip 
  inspect netbios 
  inspect tftp 
!
service-policy global_policy global
username portal password lkzHotDKgBQnMeX6 encrypted
tunnel-group 195.225.64.6 type ipsec-l2l
tunnel-group 195.225.64.6 ipsec-attributes
 pre-shared-key *
prompt hostname context 
 
 
 
Here is the PIX506E configuration:
 
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password fXX82h2lCH4Xtjpp encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname portalPIX
domain-name blablabla.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names         
name 192.168.1.2 fileserver
name 192.168.1.3 mailserver
name 195.225.64.6 portal
access-list acl_out permit tcp any host portal eq www 
access-list acl_out permit tcp any host portal eq https 
access-list acl_out permit tcp any host portal eq smtp 
access-list acl_out permit icmp any any 
access-list acl_out deny tcp host 195.225.64.122 host portal eq 20022 
access-list acl_out permit tcp host 89.137.17.237 interface outside 
access-list acl_out permit udp host 82.76.17.127 interface outside 
access-list acl_out permit tcp host 78.96.155.223 interface outside 
access-list acl_out permit udp any host portal eq 11194 
access-list acl_out permit udp host 82.79.151.202 interface outside 
access-list acl_out permit tcp host 82.79.151.202 interface outside 
access-list acl_out permit udp 81.196.151.160 255.255.255.224 interface outside 
access-list acl_out permit tcp 81.196.151.160 255.255.255.224 interface outside 
access-list 110 permit ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.0 
access-list nonat permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0 
access-list 150 permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0 
pager lines 24
logging on
logging timestamp
logging standby
logging buffered debugging
logging trap critical
logging history debugging
logging facility 22
logging host inside mailserver
icmp permit any outside
icmp permit any inside
mtu outside 1500
mtu inside 1500
ip address outside portal 255.255.255.252
ip address inside 192.168.1.1 255.255.255.0
ip audit name INFOPOLICY info action alarm
ip audit name ACTIONPOLICY attack action alarm drop
ip audit interface outside INFOPOLICY
ip audit interface outside ACTIONPOLICY
ip audit info action alarm
ip audit attack action alarm
ip local pool Remote_access 192.168.100.1-192.168.100.10 mask 255.255.255.0
pdm location mailserver 255.255.255.255 inside
pdm location 192.168.1.254 255.255.255.255 inside
pdm location 195.225.64.122 255.255.255.255 outside
pdm location 192.168.2.0 255.255.255.0 outside
pdm location 192.168.10.0 255.255.255.0 outside
pdm location 89.137.14.129 255.255.255.255 outside
pdm location fileserver 255.255.255.255 inside
pdm location 89.137.17.237 255.255.255.255 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 0.0.0.0 0.0.0.0 0 0
alias (inside) mailserver portal 255.255.255.255
static (inside,outside) tcp portal smtp mailserver smtp netmask 255.255.255.255 0 80 
static (outside,inside) tcp mailserver https portal https netmask 255.255.255.255 0 80 
static (inside,outside) tcp interface www mailserver www dns netmask 255.255.255.255 0 100 
static (inside,outside) tcp interface 20022 mailserver ssh dns netmask 255.255.255.255 0 100 
static (inside,outside) tcp interface 30022 fileserver ssh dns netmask 255.255.255.255 0 100 
static (inside,outside) udp interface 11194 fileserver 11194 dns netmask 255.255.255.255 0 0 
static (inside,outside) udp interface 21194 fileserver 21194 dns netmask 255.255.255.255 0 0 
access-group acl_out in interface outside
route outside 0.0.0.0 0.0.0.0 195.225.64.5 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+ 
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10 
aaa-server RADIUS protocol radius 
aaa-server RADIUS max-failed-attempts 3 
aaa-server RADIUS deadtime 10 
aaa-server LOCAL protocol local 
aaa authentication secure-http-client
aaa authentication ssh console LOCAL
ntp server 82.76.121.165 source outside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
virtual telnet 192.168.1.100
floodguard enable
sysopt connection permit-ipsec
sysopt noproxyarp inside
crypto map static 10 ipsec-isakmp
crypto map static 10 match address 110
! Incomplete
crypto map static 20 ipsec-isakmp
crypto map static 20 match address 150
crypto map static 20 set peer 82.76.17.127
crypto map static client configuration address initiate
crypto map static client configuration address respond
isakmp key ******** address 82.76.17.127 netmask 255.255.255.255 no-xauth 
isakmp identity address
vpngroup portal idle-time 1800
telnet timeout 5
ssh 89.137.17.237 255.255.255.255 outside
ssh 82.79.151.202 255.255.255.255 outside
ssh 81.196.151.160 255.255.255.224 outside
ssh 192.168.1.0 255.255.255.0 inside
ssh 192.168.2.0 255.255.255.0 inside
ssh timeout 60
management-access inside
console timeout 0
dhcpd address 192.168.1.200-192.168.1.253 inside
dhcpd lease 3600
dhcpd ping_timeout 750
username portal password lkzHotDKgBQnMeX6 encrypted privilege 2
vpnclient server 81.196.151.170
vpnclient mode network-extension-mode
vpnclient vpngroup mytunnel password ********
vpnclient username portal password ********
vpnclient enable
terminal width 80

Open in new window

0
Comment
Question by:gabos_denes
  • 6
  • 2
9 Comments
 
LVL 8

Expert Comment

by:Jay_Gridley
ID: 22741525
If I understand correctly you get the tunnel up, but you can't get traffic to the other side.
This would seem like a NAT problem.

The ASA side looks fine, however the NAT on the PIX side looks a bit iffy. I'd make the following changes:
First delete the current NAT0 with the following:
no nat (inside) 0 0.0.0.0 0.0.0.0 0 0

Then add the new rules:
nat (inside) 1 192.168.1.0 255.255.255.0 0 0
nat (inside) 0 access-list nonat

Also, I don't think it will matter a lot in this case, but your crypto map 10 is incomplete and therefore won't work. I'd delete it if I were you:
no crypto map static 10 ipsec-isakmp
0
 

Author Comment

by:gabos_denes
ID: 22748482
When i issue nat (inside) 0 access-list nonat it gives me: ERROR: Policy NAT cannot be be configured with VPN Client enabled.

And when I start the vpn client with vpnclient enable, the internet stops working on the computers behind the PIX and the ports forwarded stop working also.
0
 

Author Comment

by:gabos_denes
ID: 22751720
Here is the latest configuration of my routers. I think one of the tunnel-groups should be removed from the asa5505 configuration.
Here is the ASA5505 configuration
 
ciscoasa(config)# sh run
: Saved
:
ASA Version 7.2(3)
!
hostname ciscoasa
domain-name default.domain.invalid
enable password fXX82h2lCH4Xtjpp encrypted
names
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.2.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 81.196.151.170 255.255.255.0
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
dns server-group DefaultDNS
 domain-name default.domain.invalid
access-list ssh extended permit ip host 195.225.64.6 host 81.196.151.170
access-list vpn_traffic extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list nonat extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list ezvpn1 extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
icmp permit any outside
icmp permit any echo-reply outside
asdm image disk0:/asdm-523.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 0.0.0.0 0.0.0.0
route outside 0.0.0.0 0.0.0.0 81.196.151.161 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
aaa authentication ssh console LOCAL
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set mySET esp-des esp-md5-hmac
crypto dynamic-map myDYN-MAP 5 set transform-set mySET
crypto map static 10 match address vpn_traffic
crypto map myMAP 60 ipsec-isakmp dynamic myDYN-MAP
crypto map myMAP interface outside
crypto isakmp enable outside
crypto isakmp policy 1
 authentication pre-share
 encryption des
 hash md5
 group 2
 lifetime 86400
crypto isakmp policy 65535
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
telnet timeout 5
ssh 192.168.2.0 255.255.255.0 inside
ssh 195.225.64.6 255.255.255.255 outside
ssh 89.137.14.129 255.255.255.255 outside
ssh 89.137.17.237 255.255.255.255 outside
ssh timeout 60
ssh version 2
console timeout 0
management-access inside
dhcpd dns 4.2.2.2
dhcpd wins 192.168.1.2
dhcpd auto_config outside
!
dhcpd address 192.168.2.2-192.168.2.20 inside
dhcpd wins 192.168.1.2 interface inside
dhcpd enable inside
!
 
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
group-policy myGROUP internal
group-policy myGROUP attributes
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value ezvpn1
 nem enable
username portal password lkzHotDKgBQnMeX6 encrypted
tunnel-group 195.225.64.6 type ipsec-l2l
tunnel-group 195.225.64.6 ipsec-attributes
 pre-shared-key *
tunnel-group mytunnel type ipsec-ra
tunnel-group mytunnel general-attributes
 default-group-policy myGROUP
tunnel-group mytunnel ipsec-attributes
 pre-shared-key *
prompt hostname context
 
 
 
 
 
PIX506E config:
 
portalPIX(config)# sh run
: Saved
:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password fXX82h2lCH4Xtjpp encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname portalPIX
domain-name portalleasing.ro
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 192.168.1.2 fileserver
name 192.168.1.3 mailserver
name 195.225.64.6 portal
access-list acl_out permit tcp any host portal eq www
access-list acl_out permit tcp any host portal eq https
access-list acl_out permit tcp any host portal eq smtp
access-list acl_out permit icmp any any
access-list acl_out permit tcp host 89.137.17.237 interface outside
access-list acl_out permit udp host 82.76.17.127 interface outside
access-list acl_out permit tcp host 78.96.155.223 interface outside
access-list acl_out permit udp any host portal eq 11194
access-list acl_out permit udp host 82.79.151.202 interface outside
access-list acl_out permit tcp host 82.79.151.202 interface outside
access-list acl_out permit udp 81.196.151.160 255.255.255.224 interface outside
access-list acl_out permit tcp 81.196.151.160 255.255.255.224 interface outside
access-list 110 permit ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list nonat permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list 150 permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
pager lines 24
logging on
logging timestamp
logging standby
logging buffered debugging
logging trap critical
logging history debugging
logging facility 22
logging host inside mailserver
icmp permit any outside
icmp permit any inside
mtu outside 1500
mtu inside 1500
ip address outside portal 255.255.255.252
ip address inside 192.168.1.1 255.255.255.0
ip audit name INFOPOLICY info action alarm
ip audit name ACTIONPOLICY attack action alarm drop
ip audit interface outside INFOPOLICY
ip audit interface outside ACTIONPOLICY
ip audit info action alarm
ip audit attack action alarm
ip local pool Remote_access 192.168.100.1-192.168.100.10 mask 255.255.255.0
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 0.0.0.0 0.0.0.0 dns 0 0
alias (inside) mailserver portal 255.255.255.255
static (inside,outside) tcp portal smtp mailserver smtp netmask 255.255.255.255 0 80
static (outside,inside) tcp mailserver https portal https netmask 255.255.255.255 0 80
static (inside,outside) tcp interface www mailserver www dns netmask 255.255.255.255 0 100
static (inside,outside) tcp interface 20022 mailserver ssh dns netmask 255.255.255.255 0 100
static (inside,outside) tcp interface 30022 fileserver ssh dns netmask 255.255.255.255 0 100
static (inside,outside) udp interface 11194 fileserver 11194 dns netmask 255.255.255.255 0 0
static (inside,outside) udp interface 21194 fileserver 21194 dns netmask 255.255.255.255 0 0
access-group acl_out in interface outside
route outside 0.0.0.0 0.0.0.0 195.225.64.5 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
aaa authentication secure-http-client
aaa authentication ssh console LOCAL
ntp server 82.76.121.165 source outside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
virtual telnet 192.168.1.100
floodguard enable
sysopt connection permit-ipsec
sysopt noproxyarp inside
vpngroup portal idle-time 1800
telnet timeout 5
ssh 89.137.17.237 255.255.255.255 outside
ssh 82.79.151.202 255.255.255.255 outside
ssh 81.196.151.160 255.255.255.224 outside
ssh 192.168.1.0 255.255.255.0 inside
ssh 192.168.2.0 255.255.255.0 inside
ssh timeout 60
management-access inside
console timeout 0
dhcpd address 192.168.1.200-192.168.1.253 inside
dhcpd lease 3600
dhcpd ping_timeout 750
username portal password lkzHsdDKgBQnMeX6 encrypted privilege 2
terminal width 80

Open in new window

0
Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

 
LVL 28

Accepted Solution

by:
batry_boy earned 500 total points
ID: 22752141
You have two crypto maps defined on your ASA, but you can only have one crypto map applied to any interface at the same time, so we will need to decide on which crypto map to use, either "static" or "myMAP".  I will choose "myMAP" since it will be fewer changes.

Put in these statements into the ASA:

crypto map myMAP 10 match address vpn_traffic
crypto map myMAP 10 set peer 195.225.64.6
crypto map myMAP 10 set transform-set mySET

The above commands assume that you have already configured the "pre-shared-key" command with the correct pre-shared key you wish to use for the tunnel.  You can leave the multiple tunnel groups alone for now.  After it is working, you can remove extraneous commands and I can help with that too.

Put these statements into the PIX:

access-list vpn_traffic permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
crypto ipsec transform-set myset esp-des esp-md5-hmac  
crypto map mymap 10 ipsec-isakmp
crypto map mymap 10 match address vpn_traffic
crypto map mymap 10 set peer 81.196.151.170
crypto map mymap 10 set transform-set myset
crypto map mymap interface outside
isakmp enable outside
isakmp key <pre-shared-key-value> address 81.196.151.170 netmask 255.255.255.255  
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400

Try a ping test from 192.168.1.x to 192.168.2.x or the other way around after you put these in and see if that works...
0
 

Author Comment

by:gabos_denes
ID: 22752591
I have no ping reply from the other ends.
Here is my complete configuration and some debug messages.
portalPIX(config)# sh run
: Saved
:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password fXX82h2lCH4Xtjpp encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname portalPIX
domain-name blabla.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 192.168.1.2 fileserver
name 192.168.1.3 mailserver
name 195.225.64.6 portal
access-list acl_out permit tcp any host portal eq www
access-list acl_out permit tcp any host portal eq https
access-list acl_out permit tcp any host portal eq smtp
access-list acl_out permit icmp any any
access-list acl_out permit tcp host 89.137.17.237 interface outside
access-list acl_out permit udp host 82.76.17.127 interface outside
access-list acl_out permit tcp host 78.96.155.223 interface outside
access-list acl_out permit udp any host portal eq 11194
access-list acl_out permit udp host 82.79.151.202 interface outside
access-list acl_out permit tcp host 82.79.151.202 interface outside
access-list acl_out permit udp 81.196.151.160 255.255.255.224 interface outside
access-list acl_out permit tcp 81.196.151.160 255.255.255.224 interface outside
access-list 110 permit ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list nonat permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list 150 permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list vpn_traffic permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
pager lines 24
logging on
logging timestamp
logging standby
logging buffered debugging
logging trap critical
logging history debugging
logging facility 22
logging host inside mailserver
icmp permit any outside
icmp permit any inside
mtu outside 1500
mtu inside 1500
ip address outside portal 255.255.255.252
ip address inside 192.168.1.1 255.255.255.0
ip audit name INFOPOLICY info action alarm
ip audit name ACTIONPOLICY attack action alarm drop
ip audit interface outside INFOPOLICY
ip audit interface outside ACTIONPOLICY
ip audit info action alarm
ip audit attack action alarm
ip local pool Remote_access 192.168.100.1-192.168.100.10 mask 255.255.255.0
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 0.0.0.0 0.0.0.0 dns 0 0
alias (inside) mailserver portal 255.255.255.255
static (inside,outside) tcp portal smtp mailserver smtp netmask 255.255.255.255 0 80
static (outside,inside) tcp mailserver https portal https netmask 255.255.255.255 0 80
static (inside,outside) tcp interface www mailserver www dns netmask 255.255.255.255 0 100
static (inside,outside) tcp interface 20022 mailserver ssh dns netmask 255.255.255.255 0 100
static (inside,outside) tcp interface 30022 fileserver ssh dns netmask 255.255.255.255 0 100
static (inside,outside) udp interface 11194 fileserver 11194 dns netmask 255.255.255.255 0 0
static (inside,outside) udp interface 21194 fileserver 21194 dns netmask 255.255.255.255 0 0
access-group acl_out in interface outside
route outside 0.0.0.0 0.0.0.0 195.225.64.5 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
aaa authentication secure-http-client
aaa authentication ssh console LOCAL
ntp server 82.76.121.165 source outside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
virtual telnet 192.168.1.100
floodguard enable
sysopt connection permit-ipsec
sysopt noproxyarp inside
crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto map mymap 10 ipsec-isakmp
crypto map mymap 10 match address vpn_traffic
crypto map mymap 10 set peer 81.196.151.170
crypto map mymap 10 set transform-set myset
crypto map mymap interface outside
isakmp enable outside
isakmp key ******** address 81.196.151.170 netmask 255.255.255.255
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup portal idle-time 1800
telnet timeout 5
ssh 89.137.17.237 255.255.255.255 outside
ssh 82.79.151.202 255.255.255.255 outside
ssh 81.196.151.160 255.255.255.224 outside
ssh 192.168.1.0 255.255.255.0 inside
ssh 192.168.2.0 255.255.255.0 inside
ssh timeout 60
management-access inside
console timeout 0
dhcpd address 192.168.1.200-192.168.1.253 inside
dhcpd lease 3600
dhcpd ping_timeout 750
username portal password lkzHddDKgBQnMeX7 encrypted privilege 2
terminal width 80
 
------------------------------------------------------------------------
 
ciscoasa(config)# sh run
: Saved
:
ASA Version 7.2(3)
!
hostname ciscoasa
domain-name default.domain.invalid
enable password fXX82h2lCH4Xtjpp encrypted
names
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.2.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 81.196.151.170 255.255.255.0
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
dns server-group DefaultDNS
 domain-name default.domain.invalid
access-list ssh extended permit ip host 195.225.64.6 host 81.196.151.170
access-list vpn_traffic extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list nonat extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list ezvpn1 extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
icmp permit any outside
icmp permit any echo-reply outside
asdm image disk0:/asdm-523.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 0.0.0.0 0.0.0.0
route outside 0.0.0.0 0.0.0.0 81.196.151.161 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
aaa authentication ssh console LOCAL
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set mySET esp-des esp-md5-hmac
crypto dynamic-map myDYN-MAP 5 set transform-set mySET
crypto map static 10 match address vpn_traffic
crypto map myMAP 10 match address vpn_traffic
crypto map myMAP 10 set peer 195.225.64.6
crypto map myMAP 10 set transform-set mySET
crypto map myMAP 60 ipsec-isakmp dynamic myDYN-MAP
crypto map myMAP interface outside
crypto isakmp enable outside
crypto isakmp policy 1
 authentication pre-share
 encryption des
 hash md5
 group 2
 lifetime 86400
crypto isakmp policy 65535
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
telnet timeout 5
ssh 192.168.2.0 255.255.255.0 inside
ssh 195.225.64.6 255.255.255.255 outside
ssh 89.137.14.129 255.255.255.255 outside
ssh 89.137.17.237 255.255.255.255 outside
ssh timeout 60
ssh version 2
console timeout 0
management-access inside
dhcpd dns 4.2.2.2
dhcpd wins 192.168.1.2
dhcpd auto_config outside
!
dhcpd address 192.168.2.2-192.168.2.20 inside
dhcpd wins 192.168.1.2 interface inside
dhcpd enable inside
!
 
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
group-policy myGROUP internal
group-policy myGROUP attributes
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value ezvpn1
 nem enable
username portal password zq6sEW3VKcYqMVe/ encrypted
tunnel-group 195.225.64.6 type ipsec-l2l
tunnel-group 195.225.64.6 ipsec-attributes
 pre-shared-key *
tunnel-group mytunnel type ipsec-ra
tunnel-group mytunnel general-attributes
 default-group-policy myGROUP
tunnel-group mytunnel ipsec-attributes
 pre-shared-key *
prompt hostname context
 
------------------------------------------------------------------------
 
portalPIX(config)# show crypto ipsec sa
 
 
interface: outside
    Crypto map tag: mymap, local addr. portal
 
   local  ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)
   current_peer: 81.196.151.170:500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 12, #pkts encrypt: 12, #pkts digest 12
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0
    #send errors 97, #recv errors 0
 
     local crypto endpt.: portal, remote crypto endpt.: 81.196.151.170
     path mtu 1500, ipsec overhead 56, media mtu 1500
     current outbound spi: f003ba8f
 
     inbound esp sas:
      spi: 0xb9ccf8ac(3117217964)
        transform: esp-des esp-md5-hmac ,
        in use settings ={Tunnel, }
        slot: 0, conn id: 1, crypto map: mymap
        sa timing: remaining key lifetime (k/sec): (4608000/27903)
        IV size: 8 bytes
        replay detection support: Y
 
 
     inbound ah sas:
 
 
     inbound pcp sas:
 
 
     outbound esp sas:
      spi: 0xf003ba8f(4026776207)
        transform: esp-des esp-md5-hmac ,
        in use settings ={Tunnel, }
        slot: 0, conn id: 2, crypto map: mymap
        sa timing: remaining key lifetime (k/sec): (4607999/27903)
        IV size: 8 bytes
        replay detection support: Y
 
 
     outbound ah sas:
 
 
     outbound pcp sas:
 
 
portalPIX(config)# show crypto isakmp sa
Total     : 1
Embryonic : 0
        dst               src        state     pending     created
          portal   81.196.151.170    QM_IDLE         0           1
 
 
 
ciscoasa(config)# show crypto ipsec sa
interface: outside
    Crypto map tag: myMAP, seq num: 10, local addr: 81.196.151.170
 
      access-list vpn_traffic permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
      local ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)
      remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
      current_peer: 195.225.64.6
 
      #pkts encaps: 29, #pkts encrypt: 29, #pkts digest: 29
      #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 29, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0
 
      local crypto endpt.: 81.196.151.170, remote crypto endpt.: 195.225.64.6
 
      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: B9CCF8AC
 
    inbound esp sas:
      spi: 0xF003BA8F (4026776207)
         transform: esp-des esp-md5-hmac none
         in use settings ={L2L, Tunnel, }
         slot: 0, conn_id: 1, crypto-map: myMAP
         sa timing: remaining key lifetime (kB/sec): (4275000/27756)
         IV size: 8 bytes
         replay detection support: Y
    outbound esp sas:
      spi: 0xB9CCF8AC (3117217964)
         transform: esp-des esp-md5-hmac none
         in use settings ={L2L, Tunnel, }
         slot: 0, conn_id: 1, crypto-map: myMAP
         sa timing: remaining key lifetime (kB/sec): (4274998/27756)
         IV size: 8 bytes
         replay detection support: Y
 
ciscoasa(config)# show crypto isakmp sa
 
   Active SA: 1
    Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1
 
1   IKE Peer: 195.225.64.6
    Type    : L2L             Role    : initiator
    Rekey   : no              State   : MM_ACTIVE
 
 
 
 
 
After debug crypto ipsec 10 and debug crypto isakmp 10 on both routers i got this message repeating over and over on the ASA5505:
 
Oct 19 06:59:06 [IKEv1 DEBUG]: Group = 195.225.64.6, IP = 195.225.64.6, processing hash payload
Oct 19 06:59:06 [IKEv1 DEBUG]: Group = 195.225.64.6, IP = 195.225.64.6, processing notify payload
Oct 19 06:59:06 [IKEv1 DEBUG]: Group = 195.225.64.6, IP = 195.225.64.6, Received keep-alive of type DPD R-U-THERE-ACK (seq number 0x6404d71)
Oct 19 06:59:16 [IKEv1 DEBUG]: Group = 195.225.64.6, IP = 195.225.64.6, Sending keep-alive of type DPD R-U-THERE (seq number 0x6404d72)
Oct 19 06:59:16 [IKEv1 DEBUG]: Group = 195.225.64.6, IP = 195.225.64.6, constructing blank hash payload
Oct 19 06:59:16 [IKEv1 DEBUG]: Group = 195.225.64.6, IP = 195.225.64.6, constructing qm hash payload
Oct 19 06:59:16 [IKEv1]: IP = 195.225.64.6, IKE_DECODE SENDING Message (msgid=e4e65555) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total leng    th : 80
Oct 19 06:59:16 [IKEv1]: IP = 195.225.64.6, IKE_DECODE RECEIVED Message (msgid=55349d4) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total leng    th : 80
 
On the PIX i got no debug messages.

Open in new window

0
 
LVL 28

Expert Comment

by:batry_boy
ID: 22753389
Please post the output of the "sh ver" command from the ASA and PIX.
0
 

Author Comment

by:gabos_denes
ID: 22753966
ciscoasa# sh ver

Cisco Adaptive Security Appliance Software Version 7.2(3)
Device Manager Version 5.2(3)

Compiled on Wed 15-Aug-07 16:08 by builders
System image file is "disk0:/asa723-k8.bin"
Config file at boot was "startup-config"

ciscoasa up 6 hours 37 mins

Hardware:   ASA5505, 256 MB RAM, CPU Geode 500 MHz
Internal ATA Compact Flash, 128MB
BIOS Flash M50FW080 @ 0xffe00000, 1024KB

Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
                             Boot microcode   : CNlite-MC-Boot-Cisco-1.2
                             SSL/IKE microcode: CNlite-MC-IPSEC-Admin-3.03
                             IPSec microcode  : CNlite-MC-IPSECm-MAIN-2.04
 0: Int: Internal-Data0/0    : address is 001e.4a3c.ee51, irq 11
 1: Ext: Ethernet0/0         : address is 001e.4a3c.ee49, irq 255
 2: Ext: Ethernet0/1         : address is 001e.4a3c.ee4a, irq 255
 3: Ext: Ethernet0/2         : address is 001e.4a3c.ee4b, irq 255
 4: Ext: Ethernet0/3         : address is 001e.4a3c.ee4c, irq 255
 5: Ext: Ethernet0/4         : address is 001e.4a3c.ee4d, irq 255
 6: Ext: Ethernet0/5         : address is 001e.4a3c.ee4e, irq 255
 7: Ext: Ethernet0/6         : address is 001e.4a3c.ee4f, irq 255
 8: Ext: Ethernet0/7         : address is 001e.4a3c.ee50, irq 255
 9: Int: Internal-Data0/1    : address is 0000.0003.0002, irq 255
10: Int: Not used            : irq 255
11: Int: Not used            : irq 255

Licensed features for this platform:
Maximum Physical Interfaces : 8
VLANs                       : 3, DMZ Restricted
Inside Hosts                : 10
Failover                    : Disabled
VPN-DES                     : Enabled
VPN-3DES-AES                : Enabled
VPN Peers                   : 10
WebVPN Peers                : 2
Dual ISPs                   : Disabled
VLAN Trunk Ports            : 0

This platform has a Base license.



portalPIX(config)# sh ver

Cisco PIX Firewall Version 6.3(5)
Cisco PIX Device Manager Version 3.0(4)

Compiled on Thu 04-Aug-05 21:40 by morlee

portalPIX up 7 hours 1 min

Hardware:   PIX-506E, 32 MB RAM, CPU Pentium II 300 MHz
Flash E28F640J3 @ 0x300, 8MB
BIOS Flash AM29F400B @ 0xfffd8000, 32KB

0: ethernet0: address is 0018.ba14.a45c, irq 10
1: ethernet1: address is 0018.ba14.a45d, irq 11
Licensed Features:
Failover:                    Disabled
VPN-DES:                     Enabled
VPN-3DES-AES:                Enabled
Maximum Physical Interfaces: 2
Maximum Interfaces:          4
Cut-through Proxy:           Enabled
Guards:                      Enabled
URL-filtering:               Enabled
Inside Hosts:                Unlimited
Throughput:                  Unlimited
IKE peers:                   Unlimited

This PIX has a Restricted (R) license.
0
 

Author Comment

by:gabos_denes
ID: 22764525
I tried pinging from the routers and also from the lan computers with no success. Here is my latest config on the routers.
ciscoasa(config)# no crypto dynamic-map myDYN-MAP 5 set transform-set mySET
WARNING: The crypto map entry will be incomplete!
ciscoasa(config)# no crypto map static 10 match address vpn_traffic
ciscoasa(config)# no crypto map myMAP 60 ipsec-isakmp dynamic myDYN-MAP
WARNING: The crypto map entry is incomplete!
ciscoasa(config)# clear crypto is sa
ciscoasa(config)# clear crypto ip sa
ciscoasa(config)# ping 192.168.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
?????
Success rate is 0 percent (0/5)
ciscoasa(config)# ping 192.168.1.254
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.254, timeout is 2 seconds:
?????
Success rate is 0 percent (0/5)
 
 
 
 
portalPIX(config)# clear crypto is sa
portalPIX(config)# clear crypto ip sa
portalPIX(config)# ping 192.168.2.1
        192.168.2.1 NO response received -- 1000ms
        192.168.2.1 NO response received -- 1000ms
        192.168.2.1 NO response received -- 1000ms
 
--------------------------------------------------------------
 
ciscoasa(config)# show cryp is sa
 
   Active SA: 1
    Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1
 
1   IKE Peer: 195.225.64.6
    Type    : L2L             Role    : initiator
    Rekey   : no              State   : MM_ACTIVE
 
 
 
portalPIX(config)# show cryp is sa
Total     : 1
Embryonic : 0
        dst               src        state     pending     created
          portal   81.196.151.170    QM_IDLE         0           1
 
--------------------------------------------------------------
 
 
ciscoasa(config)# sh cryp ip sa
interface: outside
    Crypto map tag: myMAP, seq num: 10, local addr: 81.196.151.170
 
      access-list vpn_traffic permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
      local ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)
      remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
      current_peer: 195.225.64.6
 
      #pkts encaps: 147, #pkts encrypt: 147, #pkts digest: 147
      #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 147, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0
 
      local crypto endpt.: 81.196.151.170, remote crypto endpt.: 195.225.64.6
 
      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: E81E717F
 
    inbound esp sas:
      spi: 0x0056CF34 (5689140)
         transform: esp-des esp-md5-hmac none
         in use settings ={L2L, Tunnel, }
         slot: 0, conn_id: 6, crypto-map: myMAP
         sa timing: remaining key lifetime (kB/sec): (4275000/28432)
         IV size: 8 bytes
         replay detection support: Y
    outbound esp sas:
      spi: 0xE81E717F (3894309247)
         transform: esp-des esp-md5-hmac none
         in use settings ={L2L, Tunnel, }
         slot: 0, conn_id: 6, crypto-map: myMAP
         sa timing: remaining key lifetime (kB/sec): (4274963/28432)
         IV size: 8 bytes
         replay detection support: Y
 
 
 
 
 
portalPIX(config)# sh cryp ip sa
 
 
interface: outside
    Crypto map tag: mymap, local addr. portal
 
   local  ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)
   current_peer: 81.196.151.170:500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 4, #pkts encrypt: 4, #pkts digest 4
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0
 
     local crypto endpt.: portal, remote crypto endpt.: 81.196.151.170
     path mtu 1500, ipsec overhead 56, media mtu 1500
     current outbound spi: 56cf34
 
     inbound esp sas:
      spi: 0xe81e717f(3894309247)
        transform: esp-des esp-md5-hmac ,
        in use settings ={Tunnel, }
        slot: 0, conn id: 1, crypto map: mymap
        sa timing: remaining key lifetime (k/sec): (4608000/28445)
        IV size: 8 bytes
        replay detection support: Y
 
 
     inbound ah sas:
 
 
     inbound pcp sas:
 
 
     outbound esp sas:
      spi: 0x56cf34(5689140)
        transform: esp-des esp-md5-hmac ,
        in use settings ={Tunnel, }
        slot: 0, conn id: 2, crypto map: mymap
        sa timing: remaining key lifetime (k/sec): (4607999/28436)
        IV size: 8 bytes
        replay detection support: Y
 
 
     outbound ah sas:
 
 
     outbound pcp sas:
 
 
--------------------------------------------------------------
 
Full config on asa:
ciscoasa(config)#  sh run
: Saved
:
ASA Version 7.2(3)
!
hostname ciscoasa
domain-name default.domain.invalid
names
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.2.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 81.196.151.170 255.255.255.0
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
dns server-group DefaultDNS
 domain-name default.domain.invalid
access-list ssh extended permit ip host 195.225.64.6 host 81.196.151.170
access-list vpn_traffic extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list nonat extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list ezvpn1 extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
icmp permit any outside
icmp permit any echo-reply outside
asdm image disk0:/asdm-523.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 0.0.0.0 0.0.0.0
route outside 0.0.0.0 0.0.0.0 81.196.151.161 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
aaa authentication ssh console LOCAL
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set mySET esp-des esp-md5-hmac
crypto map myMAP 10 match address vpn_traffic
crypto map myMAP 10 set peer 195.225.64.6
crypto map myMAP 10 set transform-set mySET
crypto map myMAP interface outside
crypto isakmp enable outside
crypto isakmp policy 1
 authentication pre-share
 encryption des
 hash md5
 group 2
 lifetime 86400
crypto isakmp policy 65535
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
telnet timeout 5
ssh 192.168.2.0 255.255.255.0 inside
ssh 195.225.64.6 255.255.255.255 outside
ssh 89.137.14.129 255.255.255.255 outside
ssh 89.137.17.237 255.255.255.255 outside
ssh timeout 60
ssh version 2
console timeout 0
management-access inside
dhcpd dns 4.2.2.2
dhcpd wins 192.168.1.2
dhcpd auto_config outside
!
dhcpd address 192.168.2.2-192.168.2.20 inside
dhcpd wins 192.168.1.2 interface inside
dhcpd enable inside
!
 
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
group-policy myGROUP internal
group-policy myGROUP attributes
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value ezvpn1
 nem enable
username portal password zq6sEW3VKcYqMVe/ encrypted
tunnel-group 195.225.64.6 type ipsec-l2l
tunnel-group 195.225.64.6 ipsec-attributes
 pre-shared-key *
tunnel-group mytunnel type ipsec-ra
tunnel-group mytunnel general-attributes
 default-group-policy myGROUP
tunnel-group mytunnel ipsec-attributes
 pre-shared-key *
prompt hostname context
 
 
--------------------------------------------------------------
 
Full config on PIX:
portalPIX(config)# sh run
: Saved
:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
hostname portalPIX
domain-name blabla.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 192.168.1.2 fileserver
name 192.168.1.3 mailserver
name 195.225.64.6 portal
access-list acl_out permit tcp any host portal eq www
access-list acl_out permit tcp any host portal eq https
access-list acl_out permit tcp any host portal eq smtp
access-list acl_out permit icmp any any
access-list acl_out permit tcp host 89.137.17.237 interface outside
access-list acl_out permit udp host 82.76.17.127 interface outside
access-list acl_out permit tcp host 78.96.155.223 interface outside
access-list acl_out permit udp any host portal eq 11194
access-list acl_out permit udp host 82.79.151.202 interface outside
access-list acl_out permit tcp host 82.79.151.202 interface outside
access-list acl_out permit udp 81.196.151.160 255.255.255.224 interface outside
access-list acl_out permit tcp 81.196.151.160 255.255.255.224 interface outside
access-list 110 permit ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list nonat permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list 150 permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list vpn_traffic permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
pager lines 24
logging on
logging timestamp
logging standby
logging buffered debugging
logging trap critical
logging history debugging
logging facility 22
logging host inside mailserver
icmp permit any outside
icmp permit any inside
mtu outside 1500
mtu inside 1500
ip address outside portal 255.255.255.252
ip address inside 192.168.1.1 255.255.255.0
ip audit name INFOPOLICY info action alarm
ip audit name ACTIONPOLICY attack action alarm drop
ip audit interface outside INFOPOLICY
ip audit interface outside ACTIONPOLICY
ip audit info action alarm
ip audit attack action alarm
ip local pool Remote_access 192.168.100.1-192.168.100.10 mask 255.255.255.0
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 0.0.0.0 0.0.0.0 dns 0 0
alias (inside) mailserver portal 255.255.255.255
static (inside,outside) tcp portal smtp mailserver smtp netmask 255.255.255.255 0 80
static (outside,inside) tcp mailserver https portal https netmask 255.255.255.255 0 80
static (inside,outside) tcp interface www mailserver www dns netmask 255.255.255.255 0 100
static (inside,outside) tcp interface 20022 mailserver ssh dns netmask 255.255.255.255 0 100
static (inside,outside) tcp interface 30022 fileserver ssh dns netmask 255.255.255.255 0 100
static (inside,outside) udp interface 11194 fileserver 11194 dns netmask 255.255.255.255 0 0
static (inside,outside) udp interface 21194 fileserver 21194 dns netmask 255.255.255.255 0 0
access-group acl_out in interface outside
route outside 0.0.0.0 0.0.0.0 195.225.64.5 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
aaa authentication secure-http-client
aaa authentication ssh console LOCAL
ntp server 82.76.121.165 source outside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
virtual telnet 192.168.1.100
floodguard enable
sysopt connection permit-ipsec
sysopt noproxyarp inside
crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto map mymap 10 ipsec-isakmp
crypto map mymap 10 match address vpn_traffic
crypto map mymap 10 set peer 81.196.151.170
crypto map mymap 10 set transform-set myset
crypto map mymap interface outside
isakmp enable outside
isakmp key ******** address 81.196.151.170 netmask 255.255.255.255
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup portal idle-time 1800
telnet timeout 5
ssh 89.137.17.237 255.255.255.255 outside
ssh 82.79.151.202 255.255.255.255 outside
ssh 81.196.151.160 255.255.255.224 outside
ssh 192.168.1.0 255.255.255.0 inside
ssh 192.168.2.0 255.255.255.0 inside
ssh timeout 60
management-access inside
console timeout 0
dhcpd address 192.168.1.200-192.168.1.253 inside
dhcpd lease 3600
dhcpd ping_timeout 750
terminal width 80

Open in new window

0
 

Author Comment

by:gabos_denes
ID: 22767854
Here is the output of the sh cryp ipsec sa command.

 
ciscoasa# sh cryp ipsec sa
interface: outside
    Crypto map tag: myMAP, seq num: 10, local addr: 81.196.151.170
 
      access-list vpn_traffic permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
      local ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)
      remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
      current_peer: 195.225.64.6
 
      #pkts encaps: 8321, #pkts encrypt: 8321, #pkts digest: 8321
      #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 8321, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0
 
      local crypto endpt.: 81.196.151.170, remote crypto endpt.: 195.225.64.6
 
      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: D4CFAEFA
 
    inbound esp sas:
      spi: 0x165EDE7F (375316095)
         transform: esp-des esp-md5-hmac none
         in use settings ={L2L, Tunnel, }
         slot: 0, conn_id: 6, crypto-map: myMAP
         sa timing: remaining key lifetime (kB/sec): (4275000/15697)
         IV size: 8 bytes
         replay detection support: Y
    outbound esp sas:
      spi: 0xD4CFAEFA (3570380538)
         transform: esp-des esp-md5-hmac none
         in use settings ={L2L, Tunnel, }
         slot: 0, conn_id: 6, crypto-map: myMAP
         sa timing: remaining key lifetime (kB/sec): (4274806/15697)
         IV size: 8 bytes
         replay detection support: Y
 
 
 
--------------------------------------------------------------------------------------------------
 
portalPIX# sh cryp ipsec sa
 
 
interface: outside
    Crypto map tag: mymap, local addr. portal
 
   local  ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)
   current_peer: 81.196.151.170:500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 126, #pkts encrypt: 126, #pkts digest 126
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0
 
     local crypto endpt.: portal, remote crypto endpt.: 81.196.151.170
     path mtu 1500, ipsec overhead 56, media mtu 1500
     current outbound spi: 165ede7f
 
     inbound esp sas:
      spi: 0xd4cfaefa(3570380538)
        transform: esp-des esp-md5-hmac ,
        in use settings ={Tunnel, }
        slot: 0, conn id: 4, crypto map: mymap
        sa timing: remaining key lifetime (k/sec): (4608000/15656)
        IV size: 8 bytes
        replay detection support: Y
 
 
     inbound ah sas:
 
 
     inbound pcp sas:
 
 
     outbound esp sas:
      spi: 0x165ede7f(375316095)
        transform: esp-des esp-md5-hmac ,
        in use settings ={Tunnel, }
        slot: 0, conn id: 3, crypto map: mymap
        sa timing: remaining key lifetime (k/sec): (4607989/15647)
        IV size: 8 bytes
        replay detection support: Y
 
 
     outbound ah sas:
 
 
     outbound pcp sas:

Open in new window

0

Featured Post

Free Tool: Postgres Monitoring System

A PHP and Perl based system to collect and display usage statistics from PostgreSQL databases.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When I upgraded my ASA 8.2 to 8.3, I realized that my nonat statement was failing!   The log showed the following error:     %ASA-5-305013: Asymmetric NAT rules matched for forward and reverse flows It was caused by the config upgrade, because t…
I recently updated from an old PIX platform to the new ASA platform.  While upgrading, I was tremendously confused about how the VPN and AnyConnect licensing works.  It turns out that the ASA has 3 different VPN licensing schemes. "site-to-site" …
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

856 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question