12-17-2008 12:00 PM - edited 03-11-2019 07:27 AM
I am trying to set up a site to site VPN tunnel from a asa 5510 to a 5505. I am useing the GUI wizard to set it up with out much luck. Here is the running config for the 5510. I dont have the config from the remote site 5505 but it was set up the same way.
: Saved
:
ASA Version 7.2(4)18
!
hostname Paetec
domain-name Paetec.thelandlcompany.com
enable password nRkrK2UDMhbxbMqH encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
dns-guard
!
interface Ethernet0/0
nameif Outside
security-level 0
ip address 74.9.142.210 255.255.255.240
!
interface Ethernet0/1
nameif Inside
security-level 100
ip address 10.11.0.242 255.255.0.0
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
management-only
!
boot system disk0:/asa724-18-k8.bin
ftp mode passive
dns server-group DefaultDNS
domain-name Paetec.thelandlcompany.com
access-list Inside_nat0_outbound extended permit ip 10.11.0.0 255.255.0.0 10.50.0.0 255.255.0.0
access-list Outside_1_cryptomap extended permit ip 10.11.0.0 255.255.0.0 10.50.0.0 255.255.0.0
pager lines 24
logging enable
logging asdm informational
mtu Outside 1500
mtu Inside 1500
mtu management 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-52450.bin
no asdm history enable
arp timeout 14400
global (Outside) 101 interface
nat (Inside) 0 access-list Inside_nat0_outbound
nat (Inside) 101 0.0.0.0 0.0.0.0
nat (management) 101 0.0.0.0 0.0.0.0
no threat-detection statistics tcp-intercept
route Outside 0.0.0.0 0.0.0.0 74.9.142.209 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
http server enable
http 192.168.1.0 255.255.255.0 management
http 10.11.0.0 255.255.0.0 Inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map Outside_map 1 match address Outside_1_cryptomap
crypto map Outside_map 1 set peer 162.83.93.74
crypto map Outside_map 1 set transform-set ESP-3DES-SHA
crypto map Outside_map interface Outside
crypto isakmp enable Outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet 10.11.0.0 255.255.0.0 Inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd enable management
!
tunnel-group 162.83.93.74 type ipsec-l2l
tunnel-group 162.83.93.74 ipsec-attributes
pre-shared-key *
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:a75cc847840c7454f60b84da2e519aca
: end
asdm image disk0:/asdm-52450.bin
no asdm history enable
also, what do I have to do to bring up the VPN, will a ping do it?
Thanks for any help.
12-17-2008 12:27 PM
A ping to the private network on the other side will bring the VPN up.
Your config looks right, so it's hard to tell what the problem is. What is it doing? Does it not bring the tunnel up?
Make sure that the encryption matches the other end (3des/sha for ipsec, and 3des/sha for isakmp). Also, make sure that your acl is reversed on the other end:
This end: 10.11.0.0 255.255.0.0 10.50.0.0 255.255.0.0
The other end: 10.50.0.0 255.255.255.0 10.11.0.0 255.255.0.0
HTH,
John
12-17-2008 01:16 PM
The ping fails and no tunnel is opened. The internet is up and working at both sites. T1 at host and Verizon static DSL at remote.here is the remote config.
Saved:ASA Version 7.2(4) !hostname Culpeperdomain-name Culpeper.thelandlcompany.comenable password nRkrK2UDMhbxbMqH encryptedpasswd Lowik8FFent8v7l9 encryptednames!interface Vlan1 nameif inside security-level 100 ip address 10.50.0.5 255.255.0.0 !interface Vlan2 nameif outside security-level 0 ip address 162.83.93.74 255.255.255.0 !interface Vlan3 no forward interface Vlan1 nameif dmz security-level 50 ip address 10.32.0.10 255.255.0.0 !interface Ethernet0/0 switchport access vlan 2!interface Ethernet0/1!interface Ethernet0/2!interface Ethernet0/3!interface Ethernet0/4!interface Ethernet0/5!interface Ethernet0/6!interface Ethernet0/7 switchport access vlan 3!ftp mode passivedns domain-lookup insidedns domain-lookup outsidedns server-group DefaultDNS domain-name Culpeper.thelandlcompany.comaccess-list inside_nat0_outbound extended permit ip 10.50.0.0 255.255.0.0 10.11.0.0 255.255.0.0 access-list outside_1_cryptomap extended permit ip 10.50.0.0 255.255.0.0 10.11.0.0 255.255.0.0 pager lines 24logging enablelogging asdm informationalmtu inside 1500mtu outside 1500mtu dmz 1500ip local pool Cul 10.50.0.10-10.50.0.30 mask 255.255.0.0icmp unreachable rate-limit 1 burst-size 1icmp deny any outsideasdm image disk0:/asdm-524.binno asdm history enablearp timeout 14400nat-controlglobal (outside) 1 interfacenat (inside) 0 access-list inside_nat0_outboundnat (inside) 1 0.0.0.0 0.0.0.0route outside 0.0.0.0 0.0.0.0 162.83.93.1 1timeout xlate 3:00:00timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolutehttp server enablehttp 10.11.0.0 255.255.0.0 dmzhttp 10.32.0.0 255.255.0.0 dmzhttp 10.50.0.0 255.255.0.0 insideno snmp-server locationno snmp-server contactsnmp-server enable traps snmp authentication linkup linkdown coldstartcrypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto map outside_map 1 match address outside_1_cryptomapcrypto map outside_map 1 set peer 74.9.142.210 crypto map outside_map 1 set transform-set ESP-3DES-SHAcrypto map outside_map interface outsidecrypto isakmp enable outsidecrypto isakmp policy 10 authentication pre-share encryption 3des hash sha group 2 lifetime 86400no vpn-addr-assign aaano vpn-addr-assign dhcptelnet 10.50.0.0 255.255.0.0 insidetelnet timeout 5ssh timeout 5console timeout 0dhcpd auto_config outside! tunnel-group 74.9.142.210 type ipsec-l2ltunnel-group 74.9.142.210 ipsec-attributes pre-shared-key *!class-map inspection_default match default-inspection-traffic!!policy-map type inspect dns preset_dns_map parameters message-length maximum 512policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp !service-policy global_policy globalprompt hostname context Cryptochecksum:2005003b9cea63c18a605e291f62f63f: endasdm image disk0:/asdm-524.binno asdm history enable
12-17-2008 02:01 PM
Wow sorry about that formating. Here is the remote config again.
: Saved
:
ASA Version 7.2(4)
!
hostname Culpeper
domain-name Culpeper.thelandlcompany.com
enable password nRkrK2UDMhbxbMqH encrypted
passwd Lowik8FFent8v7l9 encrypted
names
!
interface Vlan1
nameif inside
security-level 100
ip address 10.50.0.5 255.255.0.0
!
interface Vlan2
nameif outside
security-level 0
ip address 162.83.93.74 255.255.255.0
!
interface Vlan3
no forward interface Vlan1
nameif dmz
security-level 50
ip address 10.32.0.10 255.255.0.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
switchport access vlan 3
!
ftp mode passive
dns domain-lookup inside
dns domain-lookup outside
dns server-group DefaultDNS
domain-name Culpeper.thelandlcompany.com
access-list inside_nat0_outbound extended permit ip 10.50.0.0 255.255.0.0 10.11.0.0 255.255.0.0
access-list outside_1_cryptomap extended permit ip 10.50.0.0 255.255.0.0 10.11.0.0 255.255.0.0
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu dmz 1500
ip local pool Cul 10.50.0.10-10.50.0.30 mask 255.255.0.0
icmp unreachable rate-limit 1 burst-size 1
icmp deny any outside
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
nat-control
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
route outside 0.0.0.0 0.0.0.0 162.83.93.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
http server enable
http 10.11.0.0 255.255.0.0 dmz
http 10.32.0.0 255.255.0.0 dmz
http 10.50.0.0 255.255.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set peer 74.9.142.210
crypto map outside_map 1 set transform-set ESP-3DES-SHA
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
no vpn-addr-assign aaa
no vpn-addr-assign dhcp
telnet 10.50.0.0 255.255.0.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!
tunnel-group 74.9.142.210 type ipsec-l2l
tunnel-group 74.9.142.210 ipsec-attributes
pre-shared-key *
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:2005003b9cea63c18a605e291f62f63f
: end
asdm image disk0:/asdm-524.bin
no asdm history enable
12-17-2008 02:22 PM
What errors do you get when it tries to connect?
12-17-2008 02:32 PM
I will have to try tommorow when I am back at work. It doesnt even apear to try to open a tunnel. I see it try to ping in the log file but it fails. I never see anything in the log about VPN tunnel. I will dobble check tomorrow.
Thanks for the help.
12-18-2008 04:32 AM
I am going to move this post to the VPN forums that I didn't see before.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide