Avatar of Techrunner
Techrunner asked on

Site to Site VPN Cisco ASA and Cisco Router

Hello Experts,
I have configured  Site to Site IPSec VPN between our Cisco ASA and Cisco Router. The VPN is up but I cannot ping the devices each other from both sites. I dont know what's wrong with the configuration I have Remote Access VPN configured on our ASA for Cisco Anyconnect and Cisco VPN Client


Router Configuration

hostname Router
!

!
!
ip cef
!
!
!
username admin privilege 15 password 0 come$takeit
!
!
crypto isakmp policy 2
 encr aes
 authentication pre-share
crypto isakmp key cisco123 address 1.1.1.1
!
!
crypto ipsec transform-set test esp-aes esp-sha-hmac
!
crypto map SDM_CMAP_1 1 ipsec-isakmp
 description Tunnel to1.1.1.1
 set peer 1.1.1.1
 set transform-set test
 match address 100
!
archive
 log config
  hidekeys
!
!
!
!
!
interface ATM0
 no ip address
 no atm ilmi-keepalive
 pvc 0/35
  pppoe-client dial-pool-number 1
 !
 dsl operating-mode auto
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Vlan1
 ip address 192.168.16.8 255.255.252.0
 ip nat inside
 ip virtual-reassembly
!
interface Dialer1
 ip address negotiated
 ip access-group 101 out
 ip mtu 1492
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 ip tcp adjust-mss 1452
 dialer pool 1
 dialer-group 1
 ppp authentication pap chap callin
 ppp chap hostname **************
 ppp chap password 7 ************************
 ppp pap sent-username ********************************
 ppp ipcp dns request
 ppp ipcp wins request
 crypto map SDM_CMAP_1
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer1
!
no ip http server
ip http authentication local
ip http secure-server
ip nat inside source route-map SDM_RMAP_1 interface Dialer1 overload
!
access-list 100 remark SDM_ACL Category=4
access-list 100 remark IPSec Rule
access-list 100 permit ip 192.168.16.0 0.0.3.255 10.1.2.0 0.0.0.255
access-list 101 remark SDM_ACL Category=19
access-list 101 remark IPSec Rule
access-list 101 deny   ip 192.168.16.0 0.0.3.255 10.1.2.0 0.0.0.255
access-list 101 permit ip 192.168.16.0 0.0.3.255 any
route-map SDM_RMAP_1 permit 1
 match ip address 101
!
!
control-plane
!
!
line con 0
 no modem enable
line aux 0
line vty 0 4
 login local
!
scheduler max-task-time 5000
end


ASA Configuration

      access-list Outside_1_cryptomap line 1 extended permit ip 10.1.2.0 255.255.255.0 192.168.16.0 255.255.252.0
      tunnel-group 2.2.2.2 type ipsec-l2l
      tunnel-group 2.2.2.2 ipsec-attributes
        pre-shared-key **********
        isakmp keepalive threshold 10 retry 2
      crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
      crypto map Outside_map 1 match address Outside_1_cryptomap
      crypto map Outside_map 1 set  peer  2.2.2.2
      crypto map Outside_map 1 set  transform-set  ESP-AES-128-SHA


Any help please?

Thanks
CiscoRoutersVPN

Avatar of undefined
Last Comment
mannyfernandez

8/22/2022 - Mon
lisarao

Security Appliance license must be enabled for Data Encryption Standard (DES) encryption

Check if you have ASDM Configured on ASA interface

else download and install cisco asmd

Once its installed you have plenty of ways to configure.

check this and reply back
ASKER
Techrunner

I have no idea what you are talking about

I have problem pinging the sites.
Pete Long

>>I have no idea what you are talking about

<grin>

Don't forget that ping is disabled on the ASA unless you have enabled ICMP in the inspection map

I'm quite weak on the router IOS (sorry)

Try to bring up the tunnel, then on the ASA issue a show cry isa command to see if phase 1 has esablished.
All of life is about relationships, and EE has made a viirtual community a real community. It lifts everyone's boat
William Peck
Akinsd

Check if the "interesting traffic" (the 2 networks communicating) are exempted from NAT

Run a capture on the ASA and see if you see traffic on the inside and outside interface. If you see, both, then the traffic is not passing through the tunnel. You should only see traffic on the inside.

The tunnel formation is one thing (between 2 end points), while the traffic passing through the tunnel is another.
anoopkmr

few things we have to check

a) do you have NAT enabled on the ASA  , if so  exempt the VPN  traffic from the NAT  and try the connectivity
b) check the  routing on both side Lan devices are proper ..  both side devices should have proper gateway to reach each other LAN  .
c)  only ping is not working :  inspect icmp in ASA  and try
d) enable Nat-traversal on ASA  and try :  crypto isakmp nat-trav 60
c) remove the access-list 101 from router dialer interface and try

even after doing all workaround still facing issues, kindly show the output of
show crypto isakmp sa  and show crypto ipsec sa  from router and ASA
ASKER CERTIFIED SOLUTION
mannyfernandez

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
See how we're fighting big data
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question