Solved

Site to Site vpn ASA5510 -> SA540

Posted on 2013-12-03
6
540 Views
Last Modified: 2014-01-14
Let me first preface this question with the fact that I have very little ASA experience, and I've mostly been out of the Cisco world for 8+ years, so I know I'm rusty and I think I'm missing something very simple, or something is just broke :p

What I'm trying to do is a relatively simple site to site VPN between a subnet on our company network (172.16.7.0/24) and a remote lab with a partner company (10.64.40.0/21).  Previously we shipped an SA540 to our partner company with a pre-configured setup which I was told was working by the previous network administrator, however this isn't the case.

The tunnel comes up if I initiate from the SA540, but not if I just ping/pass traffic to our partner from my test machine on the .7 network, but no traffic is going across it, and I'm not sure why.  Here's the output from the ASA5510

NOTE: This only comes up if I hit the 'connect' button on the SA540, it will not come up automatically from the ASA5510
BSIASA# sh crypto ipsec sa
interface: Outside
    Crypto map tag: Outside_map, seq num: 5, local addr: 67.136.131.206

      access-list Outside_cryptomap_2 extended permit ip 172.16.7.0 255.255.255.0 10.64.40.0 255.255.248.0
      local ident (addr/mask/prot/port): (172.16.7.0/255.255.255.0/0/0)
      remote ident (addr/mask/prot/port): (10.64.40.0/255.255.248.0/0/0)
      current_peer: 205.168.62.90

      #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
      #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 67.136.131.206, remote crypto endpt.: 205.168.62.90

      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: 010D145A
      current inbound spi : 52260D08

    inbound esp sas:
      spi: 0x52260D08 (1378225416)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 32550912, crypto-map: Outside_map
         sa timing: remaining key lifetime (sec): 2800
         IV size: 8 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00000001
    outbound esp sas:
      spi: 0x010D145A (17634394)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 32550912, crypto-map: Outside_map
         sa timing: remaining key lifetime (sec): 2800
         IV size: 8 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00000001

Open in new window


This is the configuration built on the ASA5510:

crypto map Outside_map 5 match address Outside_cryptomap_2
crypto map Outside_map 5 set pfs
crypto map Outside_map 5 set peer 205.168.62.90
crypto map Outside_map 5 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map Outside_map 5 set reverse-route

tunnel-group 205.168.62.90 type ipsec-l2l
tunnel-group 205.168.62.90 general-attributes
 default-group-policy IPSEC
tunnel-group 205.168.62.90 ipsec-attributes
 pre-shared-key *****

access-list Outside_cryptomap_2 extended permit ip 172.16.7.0 255.255.255.0 10.64.40.0 255.255.248.0

access-list nonat extended permit ip 172.16.7.0 255.255.255.0 10.64.40.0 255.255.255.248

Open in new window


Unfortunately there's no CLI on the SA540 series (which breaks my heart), but the tunnel set up is fairly simple on that end, its all point and click.

Attached are the screenshots from the SA540.

Any insight as to what I'm missing I would appreciate greatly.
ikepolicies.jpg
vpnpolicies.jpg
0
Comment
Question by:rprague
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2
6 Comments
 
LVL 12

Expert Comment

by:Henk van Achterberg
ID: 39696612
is the nonat accesslist actually configured with the nat statement?
0
 

Author Comment

by:rprague
ID: 39697102
Yes, it's listed here under the nat rules:

nat (Inside) 0 access-list nonat

Open in new window

0
 

Author Comment

by:rprague
ID: 39699020
I should mention our ASA is running 8.2(2) currently.  Firmware hasn't been updated in 3.5 years :(
0
Surfing Is Meant To Be Done Outdoors

Featuring its rugged IP67 compliant exterior and delivering broad, fast, and reliable Wi-Fi coverage, the AP322 is the ideal solution for the outdoors. Manage this AP with either a Firebox as a gateway controller, or with the Wi-Fi Cloud for an expanded set of management features

 
LVL 12

Expert Comment

by:Henk van Achterberg
ID: 39699053
1. is PFS enabled on the other side?
2. why is a reverse route injected in the ASA?

If you enabld syslog/asdm log, what does it say when you ping to a ip address which is on the other side?
0
 

Accepted Solution

by:
rprague earned 0 total points
ID: 39770369
Going to close this, turns out the problem was that ADSM wasn't putting in the reverse-route statement in the CLI and I just never thought to look for it.
0
 

Author Closing Comment

by:rprague
ID: 39778820
Don't trust ADSM to do everything right, double check that sucker :)
0

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Clarification about access via WAN 6 45
BGP DUAL ISP with IP SLA 10 46
Home firewall recommendations 11 90
VPN Server Configuration in windows 7 7 39
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
Concerto Cloud Services, a provider of fully managed private, public and hybrid cloud solutions, announced today it was named to the 20 Coolest Cloud Infrastructure Vendors Of The 2017 Cloud  (http://www.concertocloud.com/about/in-the-news/2017/02/0…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

749 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question