Site to Site VPN Cisco ASA and Cisco Router

Posted on 2013-08-27
Medium Priority
Last Modified: 2013-08-31
Hello Experts,
I have configured  Site to Site IPSec VPN between our Cisco ASA and Cisco Router. The VPN is up but I cannot ping the devices each other from both sites. I dont know what's wrong with the configuration I have Remote Access VPN configured on our ASA for Cisco Anyconnect and Cisco VPN Client

Router Configuration

hostname Router

ip cef
username admin privilege 15 password 0 come$takeit
crypto isakmp policy 2
 encr aes
 authentication pre-share
crypto isakmp key cisco123 address
crypto ipsec transform-set test esp-aes esp-sha-hmac
crypto map SDM_CMAP_1 1 ipsec-isakmp
 description Tunnel to1.1.1.1
 set peer
 set transform-set test
 match address 100
 log config
interface ATM0
 no ip address
 no atm ilmi-keepalive
 pvc 0/35
  pppoe-client dial-pool-number 1
 dsl operating-mode auto
interface FastEthernet0
interface FastEthernet1
interface FastEthernet2
interface FastEthernet3
interface Vlan1
 ip address
 ip nat inside
 ip virtual-reassembly
interface Dialer1
 ip address negotiated
 ip access-group 101 out
 ip mtu 1492
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 ip tcp adjust-mss 1452
 dialer pool 1
 dialer-group 1
 ppp authentication pap chap callin
 ppp chap hostname **************
 ppp chap password 7 ************************
 ppp pap sent-username ********************************
 ppp ipcp dns request
 ppp ipcp wins request
 crypto map SDM_CMAP_1
ip forward-protocol nd
ip route Dialer1
no ip http server
ip http authentication local
ip http secure-server
ip nat inside source route-map SDM_RMAP_1 interface Dialer1 overload
access-list 100 remark SDM_ACL Category=4
access-list 100 remark IPSec Rule
access-list 100 permit ip
access-list 101 remark SDM_ACL Category=19
access-list 101 remark IPSec Rule
access-list 101 deny   ip
access-list 101 permit ip any
route-map SDM_RMAP_1 permit 1
 match ip address 101
line con 0
 no modem enable
line aux 0
line vty 0 4
 login local
scheduler max-task-time 5000

ASA Configuration

      access-list Outside_1_cryptomap line 1 extended permit ip
      tunnel-group type ipsec-l2l
      tunnel-group ipsec-attributes
        pre-shared-key **********
        isakmp keepalive threshold 10 retry 2
      crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
      crypto map Outside_map 1 match address Outside_1_cryptomap
      crypto map Outside_map 1 set  peer
      crypto map Outside_map 1 set  transform-set  ESP-AES-128-SHA

Any help please?

Question by:cciedreamer

Expert Comment

ID: 39441784
Security Appliance license must be enabled for Data Encryption Standard (DES) encryption

Check if you have ASDM Configured on ASA interface

else download and install cisco asmd

Once its installed you have plenty of ways to configure.

check this and reply back

Author Comment

ID: 39441847
I have no idea what you are talking about

I have problem pinging the sites.
LVL 58

Expert Comment

by:Pete Long
ID: 39442214
>>I have no idea what you are talking about


Don't forget that ping is disabled on the ASA unless you have enabled ICMP in the inspection map

I'm quite weak on the router IOS (sorry)

Try to bring up the tunnel, then on the ASA issue a show cry isa command to see if phase 1 has esablished.
We Need Your Input!

WatchGuard is currently running a beta program for our new macOS Host Sensor for our Threat Detection and Response service. We're looking for more macOS users to help provide insight and feedback to help us make the product even better. Please sign up for our beta program today!

LVL 18

Expert Comment

ID: 39442425
Check if the "interesting traffic" (the 2 networks communicating) are exempted from NAT

Run a capture on the ASA and see if you see traffic on the inside and outside interface. If you see, both, then the traffic is not passing through the tunnel. You should only see traffic on the inside.

The tunnel formation is one thing (between 2 end points), while the traffic passing through the tunnel is another.
LVL 14

Expert Comment

ID: 39442488
few things we have to check

a) do you have NAT enabled on the ASA  , if so  exempt the VPN  traffic from the NAT  and try the connectivity
b) check the  routing on both side Lan devices are proper ..  both side devices should have proper gateway to reach each other LAN  .
c)  only ping is not working :  inspect icmp in ASA  and try
d) enable Nat-traversal on ASA  and try :  crypto isakmp nat-trav 60
c) remove the access-list 101 from router dialer interface and try

even after doing all workaround still facing issues, kindly show the output of
show crypto isakmp sa  and show crypto ipsec sa  from router and ASA

Accepted Solution

mannyfernandez earned 1500 total points
ID: 39442509
PeteLong is correct, if you do not have 'inspect icmp' it will not keep state.

you can also try a packet-tracer from the ASA.

packet tracer inside icmp %ASA-side-IP-of-any-host% 0 8 %ROUTER-side-IP-of-any-host% detailed

Open in new window

this will give you a glimpse as to the phases the packet is going.  If you do not see the "VPN" phase in the packet, they crypto-map should be reviewed, if you see the "NAT" phase and it is NAT to the outside, then you are missing a "NAT exempt or NONAT rule" (differs from version 8.2 and below and 8.3 and above.


access-list nonat extended permit ip %ASA-Networks% %Router-Networks%
nat (inside) 0 access-list nonat

Open in new window

nat (inside,outside) source static %ASA-Networks% %ASA-Networks% destination static  %Router-Networks% %Router-Networks%

Open in new window

Another thing to look at is
sh crypto ipsec sa 

Open in new window

look for decrypt and encrypt if they are not growing while you ping, something is up.  If you see encrypt but no decrypt, look at the other side and/or routing.

do a packet capture on the ASA side to see if you see the packets existing the inside interface:

access-l capture extended permit ip %Router-Networks% %ASA-Networks% 

capture cap1 access-l capture interface inside

sh cap cap1

Open in new window


Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

For months I had no idea how to 'discover' the IP address of the other end of a link (without asking someone who knows), and it drove me batty. Think about it. You can't use Cisco Discovery Protocol (CDP) because it's not implemented on the ASAs.…
Considering cloud tradeoffs and determining the right mix for your organization.
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…

627 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question