Solved

Problems with Site-to-Site VPN between Cisco 877 and ASA 5505

Posted on 2011-03-15
10
1,782 Views
Last Modified: 2012-05-11
I'm having difficulty re-establishing a VPN connection at a client site that I inherited.

I've posted a previous question with a slightly different configuration but no success

Layout (site1 - site2)
Cisco ASA 5505 (with bridging/PPPoE relay modem) ---| c l o u d |--- bridging modem---Cisco 877 (vlan with pppoe)

Both sites can access internet ok.

Where it broke is when I setup a new internet connection at site1 with a new static IP.

Long story short, I've discovered that one of the routers (the 877) has a bridging modem ahead of it so when I look at the interface state for Dialer0 it says initializing  and down, even though the internet connection is working fine (however not sure if its relevant)

I've tried a bunch of things including:
- updating IPs in pre-shared key, peer etc
- recreating the IPSEC policies from scratch
- associated the IPSEC policy with the VLAN
- setting up easy VPN server (on the 877)
- and more (http://www.experts-exchange.com/Security/Software_Firewalls/Enterprise_Firewalls/Cisco_PIX_Firewall/Q_26879380.html)

I'm fairly green with Cisco (using CLI and SDM) so will not be offended by any comments like "wtf are you doing...?";;)

Also, when I run a packet trace on the ASA, it halts at the VPN step with "(acl-drop) flow is denied by configured rule"

I've attached show run and some other commands from both devices

I'd give any amount of points to have this resolved!!
877-show-run.txt
877-show-others.txt
asa5505-show-run.txt
asa5505-show-others.txt
0
Comment
Question by:kobalt_systems
  • 6
  • 4
10 Comments
 

Author Comment

by:kobalt_systems
ID: 35144392
UPDATE: I found this

ip route 10.10.10.0 255.255.255.0 Dialer0

and changed it to ip route 192.168.2.0 255.255.255.0 Dialer0

no success
0
 
LVL 28

Expert Comment

by:asavener
ID: 35158520
Your transform sets do not match.

The transform set on the 877 is named "ESP-3DES-SHA" but it actually uses MD5.

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-md5-hmac

On the 877, enter these commands:

crypto map SDM_CMAP_1 1 ipsec-isakmp
no set transform-set ESP-3DES-SHA
set transform-set ESP-3DES-SHA1
0
 

Author Comment

by:kobalt_systems
ID: 35161107
hi asavener,

many thanks for your response, it's really appreciated.

I made a mistake with the 877 yesterday and had to reload (latest config attached). I've matched the config again and updated the transform set as you suggested without luck.

there is one difference with access-lists...do I need to run the following?

--------------------------------------
ip access-list extended VPN
permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255


crypto map SDM_CMAP_1 1 ipsec-isakmp
no match address 123
match address VPN

interface Dialer0
no crypto map SDM_CMAP_1
crypto map SDM_CMAP_1


877-update-110318.txt
0
 
LVL 28

Expert Comment

by:asavener
ID: 35161170
Yes.
0
 

Author Comment

by:kobalt_systems
ID: 35161697
ok, ran the commands but no dice

I'm seeing this on the ASA
"3      Mar 18 2011      00:23:39      713902                   IP = 203.206.180.123, Removing peer from peer table failed, no match!"

and this on the 877
"ISAKMP :(0):deleting SA reason "Death by retransmission P1" state etc etc

is there  anything else you need re debuggin logs, config?
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 28

Expert Comment

by:asavener
ID: 35167043
Can you run "debug crypto isakmp error" and provide the output here?  Preferably from both devices.
0
 

Author Comment

by:kobalt_systems
ID: 35169575
###### output from 877 ##########
006994: *Jul 21 08:30:17.060 Sydney: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 203.206.211.229)
006995: *Jul 21 08:30:17.060 Sydney: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 203.206.211.229)
006996: *Jul 21 08:30:50.076 Sydney: ISAKMP:(0):SA is still budding. Attached new ipsec request to it. (local 203.206.180.123, remote 203.206.211.229)
006997: *Jul 21 08:30:50.076 Sydney: ISAKMP: Error while processing SA request: Failed to initialize SA
006998: *Jul 21 08:30:50.076 Sydney: ISAKMP: Error while processing KMI message 0, error 2.
006999: *Jul 21 08:31:20.092 Sydney: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 203.206.211.229)
007000: *Jul 21 08:31:20.092 Sydney: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 203.206.211.229)
007001: *Jul 21 08:31:53.080 Sydney: ISAKMP:(0):SA is still budding. Attached new ipsec request to it. (local 203.206.180.123, remote 203.206.211.229)
007002: *Jul 21 08:31:53.080 Sydney: ISAKMP: Error while processing SA request: Failed to initialize SA
007003: *Jul 21 08:31:53.080 Sydney: ISAKMP: Error while processing KMI message 0, error 2.
007004: *Jul 21 08:32:23.088 Sydney: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 203.206.211.229)
007005: *Jul 21 08:32:23.088 Sydney: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer 203.206.211.229)

######### from ASA ##################

6|Mar 18 2011|23:25:57|713219|||IP = 203.206.180.123, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.
4|Mar 18 2011|23:25:56|713903|||IP = 203.206.180.123, Error: Unable to remove PeerTblEntry
3|Mar 18 2011|23:25:56|713902|||IP = 203.206.180.123, Removing peer from peer table failed, no match!
6|Mar 18 2011|23:25:56|713905|||IP = 203.206.180.123, P1 Retransmit msg dispatched to MM FSM
5|Mar 18 2011|23:25:56|713201|||IP = 203.206.180.123, Duplicate Phase 1 packet detected.  Retransmitting last packet.
6|Mar 18 2011|23:25:55|713219|||IP = 203.206.180.123, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.
6|Mar 18 2011|23:25:54|713219|||IP = 203.206.180.123, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.
6|Mar 18 2011|23:25:48|713219|||IP = 203.206.180.123, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.
6|Mar 18 2011|23:25:46|713905|||IP = 203.206.180.123, P1 Retransmit msg dispatched to MM FSM
5|Mar 18 2011|23:25:46|713201|||IP = 203.206.180.123, Duplicate Phase 1 packet detected.  Retransmitting last packet.
6|Mar 18 2011|23:25:43|713219|||IP = 203.206.180.123, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.
4|Mar 18 2011|23:25:42|106023|203.215.17.248|203.206.211.229|Deny icmp src outside:203.215.17.248 dst inside:203.206.211.229 (type 3, code 13) by access-group "outside_access_in" [0x0, 0x0]
6|Mar 18 2011|23:25:40|305012|192.168.2.1|203.206.211.229|Teardown dynamic UDP translation from inside:192.168.2.1/60310 to outside:203.206.211.229/27144 duration 0:02:30
6|Mar 18 2011|23:25:40|305012|192.168.2.1|203.206.211.229|Teardown dynamic UDP translation from inside:192.168.2.1/58431 to outside:203.206.211.229/27143 duration 0:02:30
6|Mar 18 2011|23:25:39|305012|192.168.2.239|203.206.211.229|Teardown dynamic UDP translation from inside:192.168.2.239/52963 to outside:203.206.211.229/27142 duration 0:02:30
6|Mar 18 2011|23:25:37|713219|||IP = 203.206.180.123, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.
5|Mar 18 2011|23:25:31|713041|||IP = 203.206.180.123, IKE Initiator: New Phase 1, Intf inside, IKE Peer 203.206.180.123  local Proxy Address 192.168.2.0, remote Proxy Address 192.168.1.0,  Crypto map (outside_map)
6|Mar 18 2011|23:25:26|302021|195.116.238.242|203.206.211.229|Teardown ICMP connection for faddr 195.116.238.242/768 gaddr 203.206.211.229/0 laddr 203.206.211.229/0
6|Mar 18 2011|23:25:26|302020|195.116.238.242|203.206.211.229|Built inbound ICMP connection for faddr 195.116.238.242/768 gaddr 203.206.211.229/0 laddr 203.206.211.229/0
4|Mar 18 2011|23:25:26|713903|||IP = 203.206.180.123, Error: Unable to remove PeerTblEntry
3|Mar 18 2011|23:25:26|713902|||IP = 203.206.180.123, Removing peer from peer table failed, no match!
6|Mar 18 2011|23:25:26|713905|||IP = 203.206.180.123, P1 Retransmit msg dispatched to MM FSM
5|Mar 18 2011|23:25:26|713201|||IP = 203.206.180.123, Duplicate Phase 1 packet detected.  Retransmitting last packet.
6|Mar 18 2011|23:25:25|302021|195.116.238.242|203.206.211.229|Teardown ICMP connection for faddr 195.116.238.242/768 gaddr 203.206.211.229/0 laddr 203.206.211.229/0
6|Mar 18 2011|23:25:25|302020|195.116.238.242|203.206.211.229|Built inbound ICMP connection for faddr 195.116.238.242/768 gaddr 203.206.211.229/0 laddr 203.206.211.229/0
6|Mar 18 2011|23:25:16|713905|||IP = 203.206.180.123, P1 Retransmit msg dispatched to MM FSM
5|Mar 18 2011|23:25:16|713201|||IP = 203.206.180.123, Duplicate Phase 1 packet detected.  Retransmitting last packet.
6|Mar 18 2011|23:25:12|302016|61.88.88.88|192.168.2.1|Teardown UDP connection 285462 for outside:61.88.88.88/53 to inside:192.168.2.1/60310 duration 0:02:01 bytes 194
6|Mar 18 2011|23:25:12|302016|61.88.88.88|192.168.2.1|Teardown UDP connection 285460 for outside:61.88.88.88/53 to inside:192.168.2.1/58431 duration 0:02:02 bytes 533


0
 

Author Comment

by:kobalt_systems
ID: 35195717
well you know what they say....learn by doing...

...and by doing I mean hours of trial and error hacking but in the end I installed CCP, reloaded the config and carefully swapped IP addresses.

many thanks for your input asavener
0
 
LVL 28

Accepted Solution

by:
asavener earned 500 total points
ID: 35195975
Happy to help.  Is it working, now?
0
 

Author Comment

by:kobalt_systems
ID: 35195984
yep, forgot to add that in my post...(too excited  ;)

will allocate points shortly
0

Featured Post

What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
cisco nexus experiance 2 57
Remove username and revert back to Password prompt only (on  TTY Lines)? 8 39
Trunk and Port Security 4 39
Using VLAN Interface in ASA 5 21
How to configure Site to Site VPN on a Cisco ASA.     (version: 1.1 - updated August 6, 2009) Index          [Preface]   1.    [Introduction]   2.    [The situation]   3.    [Getting started]   4.    [Interesting traffic]   5.    [NAT0]   6.…
This article will cover setting up redundant ISPs for outbound connectivity on an ASA 5510 (although the same should work on the 5520s and up as well).  It’s important to note that this covers outbound connectivity only.  The ASA does not have built…
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

911 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now