Solved

Site to Site vpn ASA5510 -> SA540

Posted on 2013-12-03
6
538 Views
Last Modified: 2014-01-14
Let me first preface this question with the fact that I have very little ASA experience, and I've mostly been out of the Cisco world for 8+ years, so I know I'm rusty and I think I'm missing something very simple, or something is just broke :p

What I'm trying to do is a relatively simple site to site VPN between a subnet on our company network (172.16.7.0/24) and a remote lab with a partner company (10.64.40.0/21).  Previously we shipped an SA540 to our partner company with a pre-configured setup which I was told was working by the previous network administrator, however this isn't the case.

The tunnel comes up if I initiate from the SA540, but not if I just ping/pass traffic to our partner from my test machine on the .7 network, but no traffic is going across it, and I'm not sure why.  Here's the output from the ASA5510

NOTE: This only comes up if I hit the 'connect' button on the SA540, it will not come up automatically from the ASA5510
BSIASA# sh crypto ipsec sa
interface: Outside
    Crypto map tag: Outside_map, seq num: 5, local addr: 67.136.131.206

      access-list Outside_cryptomap_2 extended permit ip 172.16.7.0 255.255.255.0 10.64.40.0 255.255.248.0
      local ident (addr/mask/prot/port): (172.16.7.0/255.255.255.0/0/0)
      remote ident (addr/mask/prot/port): (10.64.40.0/255.255.248.0/0/0)
      current_peer: 205.168.62.90

      #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
      #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 67.136.131.206, remote crypto endpt.: 205.168.62.90

      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: 010D145A
      current inbound spi : 52260D08

    inbound esp sas:
      spi: 0x52260D08 (1378225416)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 32550912, crypto-map: Outside_map
         sa timing: remaining key lifetime (sec): 2800
         IV size: 8 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00000001
    outbound esp sas:
      spi: 0x010D145A (17634394)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 32550912, crypto-map: Outside_map
         sa timing: remaining key lifetime (sec): 2800
         IV size: 8 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00000001

Open in new window


This is the configuration built on the ASA5510:

crypto map Outside_map 5 match address Outside_cryptomap_2
crypto map Outside_map 5 set pfs
crypto map Outside_map 5 set peer 205.168.62.90
crypto map Outside_map 5 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map Outside_map 5 set reverse-route

tunnel-group 205.168.62.90 type ipsec-l2l
tunnel-group 205.168.62.90 general-attributes
 default-group-policy IPSEC
tunnel-group 205.168.62.90 ipsec-attributes
 pre-shared-key *****

access-list Outside_cryptomap_2 extended permit ip 172.16.7.0 255.255.255.0 10.64.40.0 255.255.248.0

access-list nonat extended permit ip 172.16.7.0 255.255.255.0 10.64.40.0 255.255.255.248

Open in new window


Unfortunately there's no CLI on the SA540 series (which breaks my heart), but the tunnel set up is fairly simple on that end, its all point and click.

Attached are the screenshots from the SA540.

Any insight as to what I'm missing I would appreciate greatly.
ikepolicies.jpg
vpnpolicies.jpg
0
Comment
Question by:rprague
  • 4
  • 2
6 Comments
 
LVL 12

Expert Comment

by:Henk van Achterberg
ID: 39696612
is the nonat accesslist actually configured with the nat statement?
0
 

Author Comment

by:rprague
ID: 39697102
Yes, it's listed here under the nat rules:

nat (Inside) 0 access-list nonat

Open in new window

0
 

Author Comment

by:rprague
ID: 39699020
I should mention our ASA is running 8.2(2) currently.  Firmware hasn't been updated in 3.5 years :(
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 12

Expert Comment

by:Henk van Achterberg
ID: 39699053
1. is PFS enabled on the other side?
2. why is a reverse route injected in the ASA?

If you enabld syslog/asdm log, what does it say when you ping to a ip address which is on the other side?
0
 

Accepted Solution

by:
rprague earned 0 total points
ID: 39770369
Going to close this, turns out the problem was that ADSM wasn't putting in the reverse-route statement in the CLI and I just never thought to look for it.
0
 

Author Closing Comment

by:rprague
ID: 39778820
Don't trust ADSM to do everything right, double check that sucker :)
0

Featured Post

Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
ASA Troubleshooting: Easy way to determine an interface's next hop 18 72
Download Logs File from Cisco Switch 1 41
Radius ASA Authentication Failed 4 72
ASA Tunnel 18 29
From Cisco ASA version 8.3, the Network Address Translation (NAT) configuration has been completely redesigned and it may be helpful to have the syntax configuration for both at a glance. You may as well want to read official Cisco published AS…
I've written this article to illustrate how we can implement a Dynamic Multipoint VPN (DMVPN) with both hub and spokes having a dynamically assigned non-broadcast multiple-access (NBMA) network IP (public IP). Here is the basic setup of DMVPN Pha…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

786 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question