• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 357
  • Last Modified:

revive site to site cisco VPN Tunnel

I have 2 firewalls that I have inherited.  Unfortunately I only really understand the ASDM and ever then not to well.

These 2 firewall did have a tunnel between them at one time.  However it was deleted.

However it was not deleted completely, there are still elements of the old tunnel in both firewalls.  Becuase of this ASDM will not let me create a new tunnel as some of the IP Addresses overlap.

What components are necessary for a site to site tunnel?  All the documentation either points to using ASDM, but how to I manually add the missing pieces?

What CLI commands do I run to figure out what is missing, so that I can add them via the CLI?
1 Solution
You should start from collecting information about each side.
What information is present and what information is missing for each from the other?
The missing information could be the peer on each side, preshared key, certificate, etc..

Istvan KalmarHead of IT Security Division Commented:
You sholud look booth side:

sh cry isakmp policy
sh cry isakmp key
sh cry ipsec transform-set
sh cry ipsec security-association

It is good if are same on booth side

after you shuld look access-list configs:

ip access-list extended FSZEK_IPSEC
 permit ip x.x.x.x wildcard network address z.z.z.z wildcard network

after you shuld look crypto map configs:

crypto map xxx10 ipsec-isakmp
 set peer zz.zz.zz.zz
 set security-association lifetime seconds 28800
 set transform-set myset
 match address zzzzz_IPSEC

After you should put the outside interface!

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now