Solved

Cisco ASA Site-to-Site VPN with Dynamic Peer

Posted on 2013-12-16
1
2,145 Views
Last Modified: 2013-12-18
Ok so we have  an ASA that we use for 20 or so VPN sites, and when there is a static IP at the  other end all is well. But in order to save some $$ we have a new site that wants to use a dynamic address.

From reading I should be able to setup a dynamic crypto map. I use ASDM exclusively, so try to keep the CLI to a minimum. I went in to ASDM and created a new entry. Below is the warning I get.

[OK] access-list outside_cryptomap_8 line 1 extended permit ip 192.168.0.0 255.255.254.0 object VPN-KERMIT 
[WARNING] tunnel-group KermitDynamic type ipsec-l2l
	 L2L tunnel-groups that have names which are not an IP
address may only be used if the tunnel authentication
method is Digital Certificates and/or The peer is 
configured to use Aggressive Mode

[OK] tunnel-group KermitDynamic ipsec-attributes
      tunnel-group KermitDynamic ipsec-attributes
[OK] ikev1 pre-shared-key **********
[OK] isakmp keepalive threshold 10 retry 2
[OK] crypto dynamic-map KermitDynamic 8 match address outside_cryptomap_8
[OK] crypto dynamic-map KermitDynamic 8 set  pfs group1
[OK] crypto dynamic-map KermitDynamic 8 set  ikev1 transform-set  ESP-3DES-SHA
[OK] crypto map forsberg 8 ipsec-isakmp dynamic KermitDynamic

Open in new window


So from reading the warning it looks like the dynamic peer needs to be using Aggressive, and it is. However,what group should it be using, usually in ASDM on a staic map I can set the mode (aggressive/main) and the group (group 1, 2, ...). However on ASDM I don't get those options at all.

I cannot get the tunnel to come up. The dynamic peer log shows, Aggressive mode started...Initiate new phase 1 negotiation...IPsec SA request queued due to no phase 1 found.

Any thoughts?
0
Comment
Question by:bhieb
1 Comment
 

Accepted Solution

by:
bhieb earned 0 total points
ID: 39727474
Opened a ticket with cisco. Turns out there was a port forward for port 500 to one of my internal IP's. So the ASA was never handling the packet, killed that and it worked.
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article assumes you have at least one Cisco ASA or PIX configured with working internet and a non-dynamic, public, address on the outside interface. If you need instructions on how to enable your device for internet, or basic configuration info…
Have you experienced traffic destined through a Cisco ASA firewall disappears and you do not know if the traffic stops in the firewall or somewhere else? The solution is the capture feature. This feature was released in 6.2(1) and works in all firew…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

911 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

27 Experts available now in Live!

Get 1:1 Help Now