Solved

Site to Site vpn ASA5510 -> SA540

Posted on 2013-12-03
6
533 Views
Last Modified: 2014-01-14
Let me first preface this question with the fact that I have very little ASA experience, and I've mostly been out of the Cisco world for 8+ years, so I know I'm rusty and I think I'm missing something very simple, or something is just broke :p

What I'm trying to do is a relatively simple site to site VPN between a subnet on our company network (172.16.7.0/24) and a remote lab with a partner company (10.64.40.0/21).  Previously we shipped an SA540 to our partner company with a pre-configured setup which I was told was working by the previous network administrator, however this isn't the case.

The tunnel comes up if I initiate from the SA540, but not if I just ping/pass traffic to our partner from my test machine on the .7 network, but no traffic is going across it, and I'm not sure why.  Here's the output from the ASA5510

NOTE: This only comes up if I hit the 'connect' button on the SA540, it will not come up automatically from the ASA5510
BSIASA# sh crypto ipsec sa
interface: Outside
    Crypto map tag: Outside_map, seq num: 5, local addr: 67.136.131.206

      access-list Outside_cryptomap_2 extended permit ip 172.16.7.0 255.255.255.0 10.64.40.0 255.255.248.0
      local ident (addr/mask/prot/port): (172.16.7.0/255.255.255.0/0/0)
      remote ident (addr/mask/prot/port): (10.64.40.0/255.255.248.0/0/0)
      current_peer: 205.168.62.90

      #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
      #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 67.136.131.206, remote crypto endpt.: 205.168.62.90

      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: 010D145A
      current inbound spi : 52260D08

    inbound esp sas:
      spi: 0x52260D08 (1378225416)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 32550912, crypto-map: Outside_map
         sa timing: remaining key lifetime (sec): 2800
         IV size: 8 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00000001
    outbound esp sas:
      spi: 0x010D145A (17634394)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 32550912, crypto-map: Outside_map
         sa timing: remaining key lifetime (sec): 2800
         IV size: 8 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00000001

Open in new window


This is the configuration built on the ASA5510:

crypto map Outside_map 5 match address Outside_cryptomap_2
crypto map Outside_map 5 set pfs
crypto map Outside_map 5 set peer 205.168.62.90
crypto map Outside_map 5 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map Outside_map 5 set reverse-route

tunnel-group 205.168.62.90 type ipsec-l2l
tunnel-group 205.168.62.90 general-attributes
 default-group-policy IPSEC
tunnel-group 205.168.62.90 ipsec-attributes
 pre-shared-key *****

access-list Outside_cryptomap_2 extended permit ip 172.16.7.0 255.255.255.0 10.64.40.0 255.255.248.0

access-list nonat extended permit ip 172.16.7.0 255.255.255.0 10.64.40.0 255.255.255.248

Open in new window


Unfortunately there's no CLI on the SA540 series (which breaks my heart), but the tunnel set up is fairly simple on that end, its all point and click.

Attached are the screenshots from the SA540.

Any insight as to what I'm missing I would appreciate greatly.
ikepolicies.jpg
vpnpolicies.jpg
0
Comment
Question by:rprague
  • 4
  • 2
6 Comments
 
LVL 12

Expert Comment

by:Henk van Achterberg
Comment Utility
is the nonat accesslist actually configured with the nat statement?
0
 

Author Comment

by:rprague
Comment Utility
Yes, it's listed here under the nat rules:

nat (Inside) 0 access-list nonat

Open in new window

0
 

Author Comment

by:rprague
Comment Utility
I should mention our ASA is running 8.2(2) currently.  Firmware hasn't been updated in 3.5 years :(
0
What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

 
LVL 12

Expert Comment

by:Henk van Achterberg
Comment Utility
1. is PFS enabled on the other side?
2. why is a reverse route injected in the ASA?

If you enabld syslog/asdm log, what does it say when you ping to a ip address which is on the other side?
0
 

Accepted Solution

by:
rprague earned 0 total points
Comment Utility
Going to close this, turns out the problem was that ADSM wasn't putting in the reverse-route statement in the CLI and I just never thought to look for it.
0
 

Author Closing Comment

by:rprague
Comment Utility
Don't trust ADSM to do everything right, double check that sucker :)
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

I recently updated from an old PIX platform to the new ASA platform.  While upgrading, I was tremendously confused about how the VPN and AnyConnect licensing works.  It turns out that the ASA has 3 different VPN licensing schemes. "site-to-site" …
Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now