Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Site to Site vpn ASA5510 -> SA540

Posted on 2013-12-03
6
Medium Priority
?
547 Views
Last Modified: 2014-01-14
Let me first preface this question with the fact that I have very little ASA experience, and I've mostly been out of the Cisco world for 8+ years, so I know I'm rusty and I think I'm missing something very simple, or something is just broke :p

What I'm trying to do is a relatively simple site to site VPN between a subnet on our company network (172.16.7.0/24) and a remote lab with a partner company (10.64.40.0/21).  Previously we shipped an SA540 to our partner company with a pre-configured setup which I was told was working by the previous network administrator, however this isn't the case.

The tunnel comes up if I initiate from the SA540, but not if I just ping/pass traffic to our partner from my test machine on the .7 network, but no traffic is going across it, and I'm not sure why.  Here's the output from the ASA5510

NOTE: This only comes up if I hit the 'connect' button on the SA540, it will not come up automatically from the ASA5510
BSIASA# sh crypto ipsec sa
interface: Outside
    Crypto map tag: Outside_map, seq num: 5, local addr: 67.136.131.206

      access-list Outside_cryptomap_2 extended permit ip 172.16.7.0 255.255.255.0 10.64.40.0 255.255.248.0
      local ident (addr/mask/prot/port): (172.16.7.0/255.255.255.0/0/0)
      remote ident (addr/mask/prot/port): (10.64.40.0/255.255.248.0/0/0)
      current_peer: 205.168.62.90

      #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
      #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 67.136.131.206, remote crypto endpt.: 205.168.62.90

      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: 010D145A
      current inbound spi : 52260D08

    inbound esp sas:
      spi: 0x52260D08 (1378225416)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 32550912, crypto-map: Outside_map
         sa timing: remaining key lifetime (sec): 2800
         IV size: 8 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00000001
    outbound esp sas:
      spi: 0x010D145A (17634394)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 32550912, crypto-map: Outside_map
         sa timing: remaining key lifetime (sec): 2800
         IV size: 8 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00000001

Open in new window


This is the configuration built on the ASA5510:

crypto map Outside_map 5 match address Outside_cryptomap_2
crypto map Outside_map 5 set pfs
crypto map Outside_map 5 set peer 205.168.62.90
crypto map Outside_map 5 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map Outside_map 5 set reverse-route

tunnel-group 205.168.62.90 type ipsec-l2l
tunnel-group 205.168.62.90 general-attributes
 default-group-policy IPSEC
tunnel-group 205.168.62.90 ipsec-attributes
 pre-shared-key *****

access-list Outside_cryptomap_2 extended permit ip 172.16.7.0 255.255.255.0 10.64.40.0 255.255.248.0

access-list nonat extended permit ip 172.16.7.0 255.255.255.0 10.64.40.0 255.255.255.248

Open in new window


Unfortunately there's no CLI on the SA540 series (which breaks my heart), but the tunnel set up is fairly simple on that end, its all point and click.

Attached are the screenshots from the SA540.

Any insight as to what I'm missing I would appreciate greatly.
ikepolicies.jpg
vpnpolicies.jpg
0
Comment
Question by:rprague
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2
6 Comments
 
LVL 12

Expert Comment

by:Henk van Achterberg
ID: 39696612
is the nonat accesslist actually configured with the nat statement?
0
 

Author Comment

by:rprague
ID: 39697102
Yes, it's listed here under the nat rules:

nat (Inside) 0 access-list nonat

Open in new window

0
 

Author Comment

by:rprague
ID: 39699020
I should mention our ASA is running 8.2(2) currently.  Firmware hasn't been updated in 3.5 years :(
0
Free learning courses: Active Directory Deep Dive

Get a firm grasp on your IT environment when you learn Active Directory best practices with Veeam! Watch all, or choose any amount, of this three-part webinar series to improve your skills. From the basics to virtualization and backup, we got you covered.

 
LVL 12

Expert Comment

by:Henk van Achterberg
ID: 39699053
1. is PFS enabled on the other side?
2. why is a reverse route injected in the ASA?

If you enabld syslog/asdm log, what does it say when you ping to a ip address which is on the other side?
0
 

Accepted Solution

by:
rprague earned 0 total points
ID: 39770369
Going to close this, turns out the problem was that ADSM wasn't putting in the reverse-route statement in the CLI and I just never thought to look for it.
0
 

Author Closing Comment

by:rprague
ID: 39778820
Don't trust ADSM to do everything right, double check that sucker :)
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

On Feb. 28, Amazon’s Simple Storage Service (S3) went down after an employee issued the wrong command during a debugging exercise. Among those affected were big names like Netflix, Spotify and Expedia.
Let’s face it: one of the reasons your organization chose a SaaS solution (whether Microsoft Dynamics 365, Netsuite or SAP) is that it is subscription-based. The upkeep is done. Or so you think.
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Suggested Courses

618 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question