Solved

Problems with Site-to-Site VPN between Cisco 877 and ASA 5505

Posted on 2011-03-15
10
1,779 Views
Last Modified: 2012-05-11
I'm having difficulty re-establishing a VPN connection at a client site that I inherited.

I've posted a previous question with a slightly different configuration but no success

Layout (site1 - site2)
Cisco ASA 5505 (with bridging/PPPoE relay modem) ---| c l o u d |--- bridging modem---Cisco 877 (vlan with pppoe)

Both sites can access internet ok.

Where it broke is when I setup a new internet connection at site1 with a new static IP.

Long story short, I've discovered that one of the routers (the 877) has a bridging modem ahead of it so when I look at the interface state for Dialer0 it says initializing  and down, even though the internet connection is working fine (however not sure if its relevant)

I've tried a bunch of things including:
- updating IPs in pre-shared key, peer etc
- recreating the IPSEC policies from scratch
- associated the IPSEC policy with the VLAN
- setting up easy VPN server (on the 877)
- and more (http://www.experts-exchange.com/Security/Software_Firewalls/Enterprise_Firewalls/Cisco_PIX_Firewall/Q_26879380.html)

I'm fairly green with Cisco (using CLI and SDM) so will not be offended by any comments like "wtf are you doing...?";;)

Also, when I run a packet trace on the ASA, it halts at the VPN step with "(acl-drop) flow is denied by configured rule"

I've attached show run and some other commands from both devices

I'd give any amount of points to have this resolved!!
877-show-run.txt
877-show-others.txt
asa5505-show-run.txt
asa5505-show-others.txt
0
Comment
Question by:kobalt_systems
  • 6
  • 4
10 Comments
 

Author Comment

by:kobalt_systems
Comment Utility
UPDATE: I found this

ip route 10.10.10.0 255.255.255.0 Dialer0

and changed it to ip route 192.168.2.0 255.255.255.0 Dialer0

no success
0
 
LVL 28

Expert Comment

by:asavener
Comment Utility
Your transform sets do not match.

The transform set on the 877 is named "ESP-3DES-SHA" but it actually uses MD5.

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-md5-hmac

On the 877, enter these commands:

crypto map SDM_CMAP_1 1 ipsec-isakmp
no set transform-set ESP-3DES-SHA
set transform-set ESP-3DES-SHA1
0
 

Author Comment

by:kobalt_systems
Comment Utility
hi asavener,

many thanks for your response, it's really appreciated.

I made a mistake with the 877 yesterday and had to reload (latest config attached). I've matched the config again and updated the transform set as you suggested without luck.

there is one difference with access-lists...do I need to run the following?

--------------------------------------
ip access-list extended VPN
permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255


crypto map SDM_CMAP_1 1 ipsec-isakmp
no match address 123
match address VPN

interface Dialer0
no crypto map SDM_CMAP_1
crypto map SDM_CMAP_1


877-update-110318.txt
0
 
LVL 28

Expert Comment

by:asavener
Comment Utility
Yes.
0
 

Author Comment

by:kobalt_systems
Comment Utility
ok, ran the commands but no dice

I'm seeing this on the ASA
"3      Mar 18 2011      00:23:39      713902                   IP = 203.206.180.123, Removing peer from peer table failed, no match!"

and this on the 877
"ISAKMP :(0):deleting SA reason "Death by retransmission P1" state etc etc

is there  anything else you need re debuggin logs, config?
0
What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

 
LVL 28

Expert Comment

by:asavener
Comment Utility
Can you run "debug crypto isakmp error" and provide the output here?  Preferably from both devices.
0
 

Author Comment

by:kobalt_systems
Comment Utility
###### output from 877 ##########
006994: *Jul 21 08:30:17.060 Sydney: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 203.206.211.229)
006995: *Jul 21 08:30:17.060 Sydney: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 203.206.211.229)
006996: *Jul 21 08:30:50.076 Sydney: ISAKMP:(0):SA is still budding. Attached new ipsec request to it. (local 203.206.180.123, remote 203.206.211.229)
006997: *Jul 21 08:30:50.076 Sydney: ISAKMP: Error while processing SA request: Failed to initialize SA
006998: *Jul 21 08:30:50.076 Sydney: ISAKMP: Error while processing KMI message 0, error 2.
006999: *Jul 21 08:31:20.092 Sydney: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 203.206.211.229)
007000: *Jul 21 08:31:20.092 Sydney: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 203.206.211.229)
007001: *Jul 21 08:31:53.080 Sydney: ISAKMP:(0):SA is still budding. Attached new ipsec request to it. (local 203.206.180.123, remote 203.206.211.229)
007002: *Jul 21 08:31:53.080 Sydney: ISAKMP: Error while processing SA request: Failed to initialize SA
007003: *Jul 21 08:31:53.080 Sydney: ISAKMP: Error while processing KMI message 0, error 2.
007004: *Jul 21 08:32:23.088 Sydney: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 203.206.211.229)
007005: *Jul 21 08:32:23.088 Sydney: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 203.206.211.229)

######### from ASA ##################

6|Mar 18 2011|23:25:57|713219|||IP = 203.206.180.123, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.
4|Mar 18 2011|23:25:56|713903|||IP = 203.206.180.123, Error: Unable to remove PeerTblEntry
3|Mar 18 2011|23:25:56|713902|||IP = 203.206.180.123, Removing peer from peer table failed, no match!
6|Mar 18 2011|23:25:56|713905|||IP = 203.206.180.123, P1 Retransmit msg dispatched to MM FSM
5|Mar 18 2011|23:25:56|713201|||IP = 203.206.180.123, Duplicate Phase 1 packet detected.  Retransmitting last packet.
6|Mar 18 2011|23:25:55|713219|||IP = 203.206.180.123, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.
6|Mar 18 2011|23:25:54|713219|||IP = 203.206.180.123, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.
6|Mar 18 2011|23:25:48|713219|||IP = 203.206.180.123, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.
6|Mar 18 2011|23:25:46|713905|||IP = 203.206.180.123, P1 Retransmit msg dispatched to MM FSM
5|Mar 18 2011|23:25:46|713201|||IP = 203.206.180.123, Duplicate Phase 1 packet detected.  Retransmitting last packet.
6|Mar 18 2011|23:25:43|713219|||IP = 203.206.180.123, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.
4|Mar 18 2011|23:25:42|106023|203.215.17.248|203.206.211.229|Deny icmp src outside:203.215.17.248 dst inside:203.206.211.229 (type 3, code 13) by access-group "outside_access_in" [0x0, 0x0]
6|Mar 18 2011|23:25:40|305012|192.168.2.1|203.206.211.229|Teardown dynamic UDP translation from inside:192.168.2.1/60310 to outside:203.206.211.229/27144 duration 0:02:30
6|Mar 18 2011|23:25:40|305012|192.168.2.1|203.206.211.229|Teardown dynamic UDP translation from inside:192.168.2.1/58431 to outside:203.206.211.229/27143 duration 0:02:30
6|Mar 18 2011|23:25:39|305012|192.168.2.239|203.206.211.229|Teardown dynamic UDP translation from inside:192.168.2.239/52963 to outside:203.206.211.229/27142 duration 0:02:30
6|Mar 18 2011|23:25:37|713219|||IP = 203.206.180.123, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.
5|Mar 18 2011|23:25:31|713041|||IP = 203.206.180.123, IKE Initiator: New Phase 1, Intf inside, IKE Peer 203.206.180.123  local Proxy Address 192.168.2.0, remote Proxy Address 192.168.1.0,  Crypto map (outside_map)
6|Mar 18 2011|23:25:26|302021|195.116.238.242|203.206.211.229|Teardown ICMP connection for faddr 195.116.238.242/768 gaddr 203.206.211.229/0 laddr 203.206.211.229/0
6|Mar 18 2011|23:25:26|302020|195.116.238.242|203.206.211.229|Built inbound ICMP connection for faddr 195.116.238.242/768 gaddr 203.206.211.229/0 laddr 203.206.211.229/0
4|Mar 18 2011|23:25:26|713903|||IP = 203.206.180.123, Error: Unable to remove PeerTblEntry
3|Mar 18 2011|23:25:26|713902|||IP = 203.206.180.123, Removing peer from peer table failed, no match!
6|Mar 18 2011|23:25:26|713905|||IP = 203.206.180.123, P1 Retransmit msg dispatched to MM FSM
5|Mar 18 2011|23:25:26|713201|||IP = 203.206.180.123, Duplicate Phase 1 packet detected.  Retransmitting last packet.
6|Mar 18 2011|23:25:25|302021|195.116.238.242|203.206.211.229|Teardown ICMP connection for faddr 195.116.238.242/768 gaddr 203.206.211.229/0 laddr 203.206.211.229/0
6|Mar 18 2011|23:25:25|302020|195.116.238.242|203.206.211.229|Built inbound ICMP connection for faddr 195.116.238.242/768 gaddr 203.206.211.229/0 laddr 203.206.211.229/0
6|Mar 18 2011|23:25:16|713905|||IP = 203.206.180.123, P1 Retransmit msg dispatched to MM FSM
5|Mar 18 2011|23:25:16|713201|||IP = 203.206.180.123, Duplicate Phase 1 packet detected.  Retransmitting last packet.
6|Mar 18 2011|23:25:12|302016|61.88.88.88|192.168.2.1|Teardown UDP connection 285462 for outside:61.88.88.88/53 to inside:192.168.2.1/60310 duration 0:02:01 bytes 194
6|Mar 18 2011|23:25:12|302016|61.88.88.88|192.168.2.1|Teardown UDP connection 285460 for outside:61.88.88.88/53 to inside:192.168.2.1/58431 duration 0:02:02 bytes 533


0
 

Author Comment

by:kobalt_systems
Comment Utility
well you know what they say....learn by doing...

...and by doing I mean hours of trial and error hacking but in the end I installed CCP, reloaded the config and carefully swapped IP addresses.

many thanks for your input asavener
0
 
LVL 28

Accepted Solution

by:
asavener earned 500 total points
Comment Utility
Happy to help.  Is it working, now?
0
 

Author Comment

by:kobalt_systems
Comment Utility
yep, forgot to add that in my post...(too excited  ;)

will allocate points shortly
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

This article will cover setting up redundant ISPs for outbound connectivity on an ASA 5510 (although the same should work on the 5520s and up as well).  It’s important to note that this covers outbound connectivity only.  The ASA does not have built…
Envision that you are chipping away at another e-business site with a team of pundit developers and designers. Everything seems, by all accounts, to be going easily.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now