• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1795
  • Last Modified:

Problems with Site-to-Site VPN between Cisco 877 and ASA 5505

I'm having difficulty re-establishing a VPN connection at a client site that I inherited.

I've posted a previous question with a slightly different configuration but no success

Layout (site1 - site2)
Cisco ASA 5505 (with bridging/PPPoE relay modem) ---| c l o u d |--- bridging modem---Cisco 877 (vlan with pppoe)

Both sites can access internet ok.

Where it broke is when I setup a new internet connection at site1 with a new static IP.

Long story short, I've discovered that one of the routers (the 877) has a bridging modem ahead of it so when I look at the interface state for Dialer0 it says initializing  and down, even though the internet connection is working fine (however not sure if its relevant)

I've tried a bunch of things including:
- updating IPs in pre-shared key, peer etc
- recreating the IPSEC policies from scratch
- associated the IPSEC policy with the VLAN
- setting up easy VPN server (on the 877)
- and more (http://www.experts-exchange.com/Security/Software_Firewalls/Enterprise_Firewalls/Cisco_PIX_Firewall/Q_26879380.html)

I'm fairly green with Cisco (using CLI and SDM) so will not be offended by any comments like "wtf are you doing...?";;)

Also, when I run a packet trace on the ASA, it halts at the VPN step with "(acl-drop) flow is denied by configured rule"

I've attached show run and some other commands from both devices

I'd give any amount of points to have this resolved!!
877-show-run.txt
877-show-others.txt
asa5505-show-run.txt
asa5505-show-others.txt
0
kobalt_systems
Asked:
kobalt_systems
  • 6
  • 4
1 Solution
 
kobalt_systemsAuthor Commented:
UPDATE: I found this

ip route 10.10.10.0 255.255.255.0 Dialer0

and changed it to ip route 192.168.2.0 255.255.255.0 Dialer0

no success
0
 
asavenerCommented:
Your transform sets do not match.

The transform set on the 877 is named "ESP-3DES-SHA" but it actually uses MD5.

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-md5-hmac

On the 877, enter these commands:

crypto map SDM_CMAP_1 1 ipsec-isakmp
no set transform-set ESP-3DES-SHA
set transform-set ESP-3DES-SHA1
0
 
kobalt_systemsAuthor Commented:
hi asavener,

many thanks for your response, it's really appreciated.

I made a mistake with the 877 yesterday and had to reload (latest config attached). I've matched the config again and updated the transform set as you suggested without luck.

there is one difference with access-lists...do I need to run the following?

--------------------------------------
ip access-list extended VPN
permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255


crypto map SDM_CMAP_1 1 ipsec-isakmp
no match address 123
match address VPN

interface Dialer0
no crypto map SDM_CMAP_1
crypto map SDM_CMAP_1


877-update-110318.txt
0
 The Evil-ution of Network Security Threats

What are the hacks that forever changed the security industry? To answer that question, we created an exciting new eBook that takes you on a trip through hacking history. It explores the top hacks from the 80s to 2010s, why they mattered, and how the security industry responded.

 
asavenerCommented:
Yes.
0
 
kobalt_systemsAuthor Commented:
ok, ran the commands but no dice

I'm seeing this on the ASA
"3      Mar 18 2011      00:23:39      713902                   IP = 203.206.180.123, Removing peer from peer table failed, no match!"

and this on the 877
"ISAKMP :(0):deleting SA reason "Death by retransmission P1" state etc etc

is there  anything else you need re debuggin logs, config?
0
 
asavenerCommented:
Can you run "debug crypto isakmp error" and provide the output here?  Preferably from both devices.
0
 
kobalt_systemsAuthor Commented:
###### output from 877 ##########
006994: *Jul 21 08:30:17.060 Sydney: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 203.206.211.229)
006995: *Jul 21 08:30:17.060 Sydney: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 203.206.211.229)
006996: *Jul 21 08:30:50.076 Sydney: ISAKMP:(0):SA is still budding. Attached new ipsec request to it. (local 203.206.180.123, remote 203.206.211.229)
006997: *Jul 21 08:30:50.076 Sydney: ISAKMP: Error while processing SA request: Failed to initialize SA
006998: *Jul 21 08:30:50.076 Sydney: ISAKMP: Error while processing KMI message 0, error 2.
006999: *Jul 21 08:31:20.092 Sydney: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 203.206.211.229)
007000: *Jul 21 08:31:20.092 Sydney: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 203.206.211.229)
007001: *Jul 21 08:31:53.080 Sydney: ISAKMP:(0):SA is still budding. Attached new ipsec request to it. (local 203.206.180.123, remote 203.206.211.229)
007002: *Jul 21 08:31:53.080 Sydney: ISAKMP: Error while processing SA request: Failed to initialize SA
007003: *Jul 21 08:31:53.080 Sydney: ISAKMP: Error while processing KMI message 0, error 2.
007004: *Jul 21 08:32:23.088 Sydney: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 203.206.211.229)
007005: *Jul 21 08:32:23.088 Sydney: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 203.206.211.229)

######### from ASA ##################

6|Mar 18 2011|23:25:57|713219|||IP = 203.206.180.123, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.
4|Mar 18 2011|23:25:56|713903|||IP = 203.206.180.123, Error: Unable to remove PeerTblEntry
3|Mar 18 2011|23:25:56|713902|||IP = 203.206.180.123, Removing peer from peer table failed, no match!
6|Mar 18 2011|23:25:56|713905|||IP = 203.206.180.123, P1 Retransmit msg dispatched to MM FSM
5|Mar 18 2011|23:25:56|713201|||IP = 203.206.180.123, Duplicate Phase 1 packet detected.  Retransmitting last packet.
6|Mar 18 2011|23:25:55|713219|||IP = 203.206.180.123, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.
6|Mar 18 2011|23:25:54|713219|||IP = 203.206.180.123, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.
6|Mar 18 2011|23:25:48|713219|||IP = 203.206.180.123, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.
6|Mar 18 2011|23:25:46|713905|||IP = 203.206.180.123, P1 Retransmit msg dispatched to MM FSM
5|Mar 18 2011|23:25:46|713201|||IP = 203.206.180.123, Duplicate Phase 1 packet detected.  Retransmitting last packet.
6|Mar 18 2011|23:25:43|713219|||IP = 203.206.180.123, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.
4|Mar 18 2011|23:25:42|106023|203.215.17.248|203.206.211.229|Deny icmp src outside:203.215.17.248 dst inside:203.206.211.229 (type 3, code 13) by access-group "outside_access_in" [0x0, 0x0]
6|Mar 18 2011|23:25:40|305012|192.168.2.1|203.206.211.229|Teardown dynamic UDP translation from inside:192.168.2.1/60310 to outside:203.206.211.229/27144 duration 0:02:30
6|Mar 18 2011|23:25:40|305012|192.168.2.1|203.206.211.229|Teardown dynamic UDP translation from inside:192.168.2.1/58431 to outside:203.206.211.229/27143 duration 0:02:30
6|Mar 18 2011|23:25:39|305012|192.168.2.239|203.206.211.229|Teardown dynamic UDP translation from inside:192.168.2.239/52963 to outside:203.206.211.229/27142 duration 0:02:30
6|Mar 18 2011|23:25:37|713219|||IP = 203.206.180.123, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.
5|Mar 18 2011|23:25:31|713041|||IP = 203.206.180.123, IKE Initiator: New Phase 1, Intf inside, IKE Peer 203.206.180.123  local Proxy Address 192.168.2.0, remote Proxy Address 192.168.1.0,  Crypto map (outside_map)
6|Mar 18 2011|23:25:26|302021|195.116.238.242|203.206.211.229|Teardown ICMP connection for faddr 195.116.238.242/768 gaddr 203.206.211.229/0 laddr 203.206.211.229/0
6|Mar 18 2011|23:25:26|302020|195.116.238.242|203.206.211.229|Built inbound ICMP connection for faddr 195.116.238.242/768 gaddr 203.206.211.229/0 laddr 203.206.211.229/0
4|Mar 18 2011|23:25:26|713903|||IP = 203.206.180.123, Error: Unable to remove PeerTblEntry
3|Mar 18 2011|23:25:26|713902|||IP = 203.206.180.123, Removing peer from peer table failed, no match!
6|Mar 18 2011|23:25:26|713905|||IP = 203.206.180.123, P1 Retransmit msg dispatched to MM FSM
5|Mar 18 2011|23:25:26|713201|||IP = 203.206.180.123, Duplicate Phase 1 packet detected.  Retransmitting last packet.
6|Mar 18 2011|23:25:25|302021|195.116.238.242|203.206.211.229|Teardown ICMP connection for faddr 195.116.238.242/768 gaddr 203.206.211.229/0 laddr 203.206.211.229/0
6|Mar 18 2011|23:25:25|302020|195.116.238.242|203.206.211.229|Built inbound ICMP connection for faddr 195.116.238.242/768 gaddr 203.206.211.229/0 laddr 203.206.211.229/0
6|Mar 18 2011|23:25:16|713905|||IP = 203.206.180.123, P1 Retransmit msg dispatched to MM FSM
5|Mar 18 2011|23:25:16|713201|||IP = 203.206.180.123, Duplicate Phase 1 packet detected.  Retransmitting last packet.
6|Mar 18 2011|23:25:12|302016|61.88.88.88|192.168.2.1|Teardown UDP connection 285462 for outside:61.88.88.88/53 to inside:192.168.2.1/60310 duration 0:02:01 bytes 194
6|Mar 18 2011|23:25:12|302016|61.88.88.88|192.168.2.1|Teardown UDP connection 285460 for outside:61.88.88.88/53 to inside:192.168.2.1/58431 duration 0:02:02 bytes 533


0
 
kobalt_systemsAuthor Commented:
well you know what they say....learn by doing...

...and by doing I mean hours of trial and error hacking but in the end I installed CCP, reloaded the config and carefully swapped IP addresses.

many thanks for your input asavener
0
 
asavenerCommented:
Happy to help.  Is it working, now?
0
 
kobalt_systemsAuthor Commented:
yep, forgot to add that in my post...(too excited  ;)

will allocate points shortly
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

  • 6
  • 4
Tackle projects and never again get stuck behind a technical roadblock.
Join Now