Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions

Site to Site vpn ASA5510 -> SA540

Posted on 2013-12-03
Last Modified: 2014-01-14
Let me first preface this question with the fact that I have very little ASA experience, and I've mostly been out of the Cisco world for 8+ years, so I know I'm rusty and I think I'm missing something very simple, or something is just broke :p

What I'm trying to do is a relatively simple site to site VPN between a subnet on our company network ( and a remote lab with a partner company (  Previously we shipped an SA540 to our partner company with a pre-configured setup which I was told was working by the previous network administrator, however this isn't the case.

The tunnel comes up if I initiate from the SA540, but not if I just ping/pass traffic to our partner from my test machine on the .7 network, but no traffic is going across it, and I'm not sure why.  Here's the output from the ASA5510

NOTE: This only comes up if I hit the 'connect' button on the SA540, it will not come up automatically from the ASA5510
BSIASA# sh crypto ipsec sa
interface: Outside
    Crypto map tag: Outside_map, seq num: 5, local addr:

      access-list Outside_cryptomap_2 extended permit ip
      local ident (addr/mask/prot/port): (
      remote ident (addr/mask/prot/port): (

      #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
      #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.:, remote crypto endpt.:

      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: 010D145A
      current inbound spi : 52260D08

    inbound esp sas:
      spi: 0x52260D08 (1378225416)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 32550912, crypto-map: Outside_map
         sa timing: remaining key lifetime (sec): 2800
         IV size: 8 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00000001
    outbound esp sas:
      spi: 0x010D145A (17634394)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 32550912, crypto-map: Outside_map
         sa timing: remaining key lifetime (sec): 2800
         IV size: 8 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00000001

Open in new window

This is the configuration built on the ASA5510:

crypto map Outside_map 5 match address Outside_cryptomap_2
crypto map Outside_map 5 set pfs
crypto map Outside_map 5 set peer
crypto map Outside_map 5 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map Outside_map 5 set reverse-route

tunnel-group type ipsec-l2l
tunnel-group general-attributes
 default-group-policy IPSEC
tunnel-group ipsec-attributes
 pre-shared-key *****

access-list Outside_cryptomap_2 extended permit ip

access-list nonat extended permit ip

Open in new window

Unfortunately there's no CLI on the SA540 series (which breaks my heart), but the tunnel set up is fairly simple on that end, its all point and click.

Attached are the screenshots from the SA540.

Any insight as to what I'm missing I would appreciate greatly.
Question by:rprague
  • 4
  • 2
LVL 12

Expert Comment

by:Henk van Achterberg
ID: 39696612
is the nonat accesslist actually configured with the nat statement?

Author Comment

ID: 39697102
Yes, it's listed here under the nat rules:

nat (Inside) 0 access-list nonat

Open in new window


Author Comment

ID: 39699020
I should mention our ASA is running 8.2(2) currently.  Firmware hasn't been updated in 3.5 years :(
Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

LVL 12

Expert Comment

by:Henk van Achterberg
ID: 39699053
1. is PFS enabled on the other side?
2. why is a reverse route injected in the ASA?

If you enabld syslog/asdm log, what does it say when you ping to a ip address which is on the other side?

Accepted Solution

rprague earned 0 total points
ID: 39770369
Going to close this, turns out the problem was that ADSM wasn't putting in the reverse-route statement in the CLI and I just never thought to look for it.

Author Closing Comment

ID: 39778820
Don't trust ADSM to do everything right, double check that sucker :)

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
How to choose hardware firewall 5 60
sonicwall content filter on vpn 13 42
Sonicwall SHA issue 4 39
Cisco ASA VPN Client Routing 8 40
Secure VPN Connection terminated locally by the Client.  Reason 442: Failed to enable Virtual Adapter. If you receive this error on Windows 8 or Windows 8.1 while trying to connect with the Cisco VPN Client then the solution is a simple registry f…
I've written this article to illustrate how we can implement a Dynamic Multipoint VPN (DMVPN) with both hub and spokes having a dynamically assigned non-broadcast multiple-access (NBMA) network IP (public IP). Here is the basic setup of DMVPN Pha…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

792 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question