?
Solved

Problems with Site-to-Site VPN between Cisco 877 and ASA 5505

Posted on 2011-03-15
10
Medium Priority
?
1,792 Views
Last Modified: 2012-05-11
I'm having difficulty re-establishing a VPN connection at a client site that I inherited.

I've posted a previous question with a slightly different configuration but no success

Layout (site1 - site2)
Cisco ASA 5505 (with bridging/PPPoE relay modem) ---| c l o u d |--- bridging modem---Cisco 877 (vlan with pppoe)

Both sites can access internet ok.

Where it broke is when I setup a new internet connection at site1 with a new static IP.

Long story short, I've discovered that one of the routers (the 877) has a bridging modem ahead of it so when I look at the interface state for Dialer0 it says initializing  and down, even though the internet connection is working fine (however not sure if its relevant)

I've tried a bunch of things including:
- updating IPs in pre-shared key, peer etc
- recreating the IPSEC policies from scratch
- associated the IPSEC policy with the VLAN
- setting up easy VPN server (on the 877)
- and more (http://www.experts-exchange.com/Security/Software_Firewalls/Enterprise_Firewalls/Cisco_PIX_Firewall/Q_26879380.html)

I'm fairly green with Cisco (using CLI and SDM) so will not be offended by any comments like "wtf are you doing...?";;)

Also, when I run a packet trace on the ASA, it halts at the VPN step with "(acl-drop) flow is denied by configured rule"

I've attached show run and some other commands from both devices

I'd give any amount of points to have this resolved!!
877-show-run.txt
877-show-others.txt
asa5505-show-run.txt
asa5505-show-others.txt
0
Comment
Question by:kobalt_systems
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 4
10 Comments
 

Author Comment

by:kobalt_systems
ID: 35144392
UPDATE: I found this

ip route 10.10.10.0 255.255.255.0 Dialer0

and changed it to ip route 192.168.2.0 255.255.255.0 Dialer0

no success
0
 
LVL 28

Expert Comment

by:asavener
ID: 35158520
Your transform sets do not match.

The transform set on the 877 is named "ESP-3DES-SHA" but it actually uses MD5.

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-md5-hmac

On the 877, enter these commands:

crypto map SDM_CMAP_1 1 ipsec-isakmp
no set transform-set ESP-3DES-SHA
set transform-set ESP-3DES-SHA1
0
 

Author Comment

by:kobalt_systems
ID: 35161107
hi asavener,

many thanks for your response, it's really appreciated.

I made a mistake with the 877 yesterday and had to reload (latest config attached). I've matched the config again and updated the transform set as you suggested without luck.

there is one difference with access-lists...do I need to run the following?

--------------------------------------
ip access-list extended VPN
permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255


crypto map SDM_CMAP_1 1 ipsec-isakmp
no match address 123
match address VPN

interface Dialer0
no crypto map SDM_CMAP_1
crypto map SDM_CMAP_1


877-update-110318.txt
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 
LVL 28

Expert Comment

by:asavener
ID: 35161170
Yes.
0
 

Author Comment

by:kobalt_systems
ID: 35161697
ok, ran the commands but no dice

I'm seeing this on the ASA
"3      Mar 18 2011      00:23:39      713902                   IP = 203.206.180.123, Removing peer from peer table failed, no match!"

and this on the 877
"ISAKMP :(0):deleting SA reason "Death by retransmission P1" state etc etc

is there  anything else you need re debuggin logs, config?
0
 
LVL 28

Expert Comment

by:asavener
ID: 35167043
Can you run "debug crypto isakmp error" and provide the output here?  Preferably from both devices.
0
 

Author Comment

by:kobalt_systems
ID: 35169575
###### output from 877 ##########
006994: *Jul 21 08:30:17.060 Sydney: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 203.206.211.229)
006995: *Jul 21 08:30:17.060 Sydney: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 203.206.211.229)
006996: *Jul 21 08:30:50.076 Sydney: ISAKMP:(0):SA is still budding. Attached new ipsec request to it. (local 203.206.180.123, remote 203.206.211.229)
006997: *Jul 21 08:30:50.076 Sydney: ISAKMP: Error while processing SA request: Failed to initialize SA
006998: *Jul 21 08:30:50.076 Sydney: ISAKMP: Error while processing KMI message 0, error 2.
006999: *Jul 21 08:31:20.092 Sydney: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 203.206.211.229)
007000: *Jul 21 08:31:20.092 Sydney: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 203.206.211.229)
007001: *Jul 21 08:31:53.080 Sydney: ISAKMP:(0):SA is still budding. Attached new ipsec request to it. (local 203.206.180.123, remote 203.206.211.229)
007002: *Jul 21 08:31:53.080 Sydney: ISAKMP: Error while processing SA request: Failed to initialize SA
007003: *Jul 21 08:31:53.080 Sydney: ISAKMP: Error while processing KMI message 0, error 2.
007004: *Jul 21 08:32:23.088 Sydney: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 203.206.211.229)
007005: *Jul 21 08:32:23.088 Sydney: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 203.206.211.229)

######### from ASA ##################

6|Mar 18 2011|23:25:57|713219|||IP = 203.206.180.123, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.
4|Mar 18 2011|23:25:56|713903|||IP = 203.206.180.123, Error: Unable to remove PeerTblEntry
3|Mar 18 2011|23:25:56|713902|||IP = 203.206.180.123, Removing peer from peer table failed, no match!
6|Mar 18 2011|23:25:56|713905|||IP = 203.206.180.123, P1 Retransmit msg dispatched to MM FSM
5|Mar 18 2011|23:25:56|713201|||IP = 203.206.180.123, Duplicate Phase 1 packet detected.  Retransmitting last packet.
6|Mar 18 2011|23:25:55|713219|||IP = 203.206.180.123, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.
6|Mar 18 2011|23:25:54|713219|||IP = 203.206.180.123, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.
6|Mar 18 2011|23:25:48|713219|||IP = 203.206.180.123, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.
6|Mar 18 2011|23:25:46|713905|||IP = 203.206.180.123, P1 Retransmit msg dispatched to MM FSM
5|Mar 18 2011|23:25:46|713201|||IP = 203.206.180.123, Duplicate Phase 1 packet detected.  Retransmitting last packet.
6|Mar 18 2011|23:25:43|713219|||IP = 203.206.180.123, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.
4|Mar 18 2011|23:25:42|106023|203.215.17.248|203.206.211.229|Deny icmp src outside:203.215.17.248 dst inside:203.206.211.229 (type 3, code 13) by access-group "outside_access_in" [0x0, 0x0]
6|Mar 18 2011|23:25:40|305012|192.168.2.1|203.206.211.229|Teardown dynamic UDP translation from inside:192.168.2.1/60310 to outside:203.206.211.229/27144 duration 0:02:30
6|Mar 18 2011|23:25:40|305012|192.168.2.1|203.206.211.229|Teardown dynamic UDP translation from inside:192.168.2.1/58431 to outside:203.206.211.229/27143 duration 0:02:30
6|Mar 18 2011|23:25:39|305012|192.168.2.239|203.206.211.229|Teardown dynamic UDP translation from inside:192.168.2.239/52963 to outside:203.206.211.229/27142 duration 0:02:30
6|Mar 18 2011|23:25:37|713219|||IP = 203.206.180.123, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.
5|Mar 18 2011|23:25:31|713041|||IP = 203.206.180.123, IKE Initiator: New Phase 1, Intf inside, IKE Peer 203.206.180.123  local Proxy Address 192.168.2.0, remote Proxy Address 192.168.1.0,  Crypto map (outside_map)
6|Mar 18 2011|23:25:26|302021|195.116.238.242|203.206.211.229|Teardown ICMP connection for faddr 195.116.238.242/768 gaddr 203.206.211.229/0 laddr 203.206.211.229/0
6|Mar 18 2011|23:25:26|302020|195.116.238.242|203.206.211.229|Built inbound ICMP connection for faddr 195.116.238.242/768 gaddr 203.206.211.229/0 laddr 203.206.211.229/0
4|Mar 18 2011|23:25:26|713903|||IP = 203.206.180.123, Error: Unable to remove PeerTblEntry
3|Mar 18 2011|23:25:26|713902|||IP = 203.206.180.123, Removing peer from peer table failed, no match!
6|Mar 18 2011|23:25:26|713905|||IP = 203.206.180.123, P1 Retransmit msg dispatched to MM FSM
5|Mar 18 2011|23:25:26|713201|||IP = 203.206.180.123, Duplicate Phase 1 packet detected.  Retransmitting last packet.
6|Mar 18 2011|23:25:25|302021|195.116.238.242|203.206.211.229|Teardown ICMP connection for faddr 195.116.238.242/768 gaddr 203.206.211.229/0 laddr 203.206.211.229/0
6|Mar 18 2011|23:25:25|302020|195.116.238.242|203.206.211.229|Built inbound ICMP connection for faddr 195.116.238.242/768 gaddr 203.206.211.229/0 laddr 203.206.211.229/0
6|Mar 18 2011|23:25:16|713905|||IP = 203.206.180.123, P1 Retransmit msg dispatched to MM FSM
5|Mar 18 2011|23:25:16|713201|||IP = 203.206.180.123, Duplicate Phase 1 packet detected.  Retransmitting last packet.
6|Mar 18 2011|23:25:12|302016|61.88.88.88|192.168.2.1|Teardown UDP connection 285462 for outside:61.88.88.88/53 to inside:192.168.2.1/60310 duration 0:02:01 bytes 194
6|Mar 18 2011|23:25:12|302016|61.88.88.88|192.168.2.1|Teardown UDP connection 285460 for outside:61.88.88.88/53 to inside:192.168.2.1/58431 duration 0:02:02 bytes 533


0
 

Author Comment

by:kobalt_systems
ID: 35195717
well you know what they say....learn by doing...

...and by doing I mean hours of trial and error hacking but in the end I installed CCP, reloaded the config and carefully swapped IP addresses.

many thanks for your input asavener
0
 
LVL 28

Accepted Solution

by:
asavener earned 2000 total points
ID: 35195975
Happy to help.  Is it working, now?
0
 

Author Comment

by:kobalt_systems
ID: 35195984
yep, forgot to add that in my post...(too excited  ;)

will allocate points shortly
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

For months I had no idea how to 'discover' the IP address of the other end of a link (without asking someone who knows), and it drove me batty. Think about it. You can't use Cisco Discovery Protocol (CDP) because it's not implemented on the ASAs.…
WARNING:   If you follow the instructions here, you will wipe out your VTP and VLAN configurations.  Make sure you have backed up your switch!!! I recently had some issues with a few low-end Cisco routers (RV325) and I opened a case with Cisco TA…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…
Suggested Courses

800 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question