ASA OS 7 - 8 migration - vpn issue

Antonio Brandao · ‎10-21-2010

Hi All,

I have a asa in my company using OS 7 and upgraded to version 8, after reboot that a lot commands are not on the conf anymore, as I saw on cisco web site a lot commands used on version are no longer supported on version 8.

Most of things I could translate to the new version, but my VPN configured to my main site is no working anymore.

Can some body see some mistake during the translation of conf to new version to be the reason for this issue ???

MY OLD CONF - VERSION 7

asa# sh run
: Saved
:
ASA Version 7.0(8)
!

hostname asa
domain-name acme
enable password 2KFQnbNIdI.2KYOU encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
name 10.0.0.0 acme-Lisboa
dns-guard

!

interface Ethernet0/0
description ***Outside***
nameif outside
security-level 0
ip address 196.32.199.134 255.255.255.252

!

interface Ethernet0/1
description ***Inside***
nameif inside
security-level 100
ip address 10.123.120.1 255.255.252.0

!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
no nameif
no security-level
ip address 10.10.200.1 255.0.0.0
management-only
!
ftp mode passive
object-group service Ports-tcp tcp
port-object eq 537
port-object eq 1755
port-object eq 1790
port-object eq 2979
object-group service Ports-udp udp
port-object eq 537
port-object eq 1755
port-object eq 1790
port-object eq 2979
object-group network acme_A
network-object host 10.123.123.250
network-object host 10.123.123.251
network-object host 10.123.123.252
network-object host 10.123.123.253
network-object host 10.123.123.254
object-group network acme_Local_B
network-object host 10.123.120.3
network-object host 10.123.120.10
network-object host 10.123.120.11
network-object host 10.123.120.14
network-object host 10.123.120.20
object-group network acme_Local_C
network-object host 10.123.121.10
network-object host 10.123.121.11
object-group network acme_Ext_D
network-object host 62.48.242.131
object-group network acme_E
network-object 10.123.120.0 255.255.252.0
access-list inside extended deny tcp host 10.123.120.14 any object-group Ports-tcp
access-list inside extended permit ip object-group acme_Local_C any
access-list inside extended permit ip object-group acme_A any
access-list inside extended permit ip object-group acme_Local_B any
access-list inside extended permit ip object-group acme_E any
access-list outside extended permit icmp any any
access-list outside extended permit icmp any any echo-reply
access-list outside_cryptomap_20 extended permit ip 10.123.120.0 255.255.252.0 acme-Lisboa 255.0.0.0
access-list inside_outbound_nat0_acl extended permit ip 10.123.120.0 255.255.252.0 acme-Lisboa 255.0.0.0
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu inside 1500
icmp permit any echo outside
icmp permit any echo-reply outside
icmp permit host 10.123.74.13 inside
icmp permit host 10.123.120.12 inside
icmp permit any echo-reply inside
icmp permit any echo inside
icmp permit any inside
asdm image disk0:/asdm-508.bin
asdm history enable
arp timeout 14400

global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0

access-group outside in interface outside
access-group inside in interface inside

route outside 0.0.0.0 0.0.0.0 196.32.199.133 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
username acme password vwK.cqS6Zg/lrW79 encrypted privilege 15
username admin password LkxkEEBDwYHUUSj9 encrypted privilege 15
username firewall password lqs3WEsQ2y5//6d1 encrypted
aaa authentication ssh console LOCAL
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
service resetoutside

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000

crypto map outside_map 20 match address outside_cryptomap_20
crypto map outside_map 20 set peer 62.48.242.131
crypto map outside_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 20 set security-association lifetime seconds 28800
crypto map outside_map 20 set security-association lifetime kilobytes 4608000
crypto map outside_map interface outside

isakmp enable outside
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
isakmp policy 65535 authentication pre-share
isakmp policy 65535 encryption 3des
isakmp policy 65535 hash sha
isakmp policy 65535 group 2
isakmp policy 65535 lifetime 86400
tunnel-group 62.48.242.131 type ipsec-l2l
tunnel-group 62.48.242.131 ipsec-attributes
pre-shared-key *

telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 5

console timeout 0
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
inspect dns maximum-length 512
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
!
service-policy global_policy global
Cryptochecksum:7c1059881870d4d2f8e8ce10985bf3e2

MY NEW CONF - VERSION 8

asa# sh run
: Saved
:
ASA Version 8.3(2)
!
hostname asa
domain-name acme
enable password 2KFQnbNIdI.2KYOU encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
name 10.0.0.0 acme-Lisboa
dns-guard
!
interface Ethernet0/0
description ***Outside***
nameif outside
security-level 0
ip address 196.32.199.134 255.255.255.252
!
interface Ethernet0/1
description ***Inside***
nameif inside
security-level 100
ip address 10.123.120.1 255.255.252.0
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
no nameif
no security-level
ip address 10.10.200.1 255.0.0.0
management-only
!
boot system disk0:/asa832-k8.bin
ftp mode passive
dns server-group DefaultDNS
domain-name acme
object network obj-any
subnet 0.0.0.0 0.0.0.0
object network obj-inside
subnet 10.123.120.0 255.255.252.0
object network obj-lisbon
subnet 10.0.0.0 255.0.0.0
object-group network obj-10.123.120.0
object-group network acme-Lisboa
object-group network obj_any
object-group service Ports-tcp tcp
port-object eq 537
port-object eq 1755
port-object eq 1790
port-object eq 2979
object-group service Ports-udp udp
port-object eq 537
port-object eq 1755
port-object eq 1790
port-object eq 2979
object-group network acme_A
network-object host 10.123.123.250
network-object host 10.123.123.251
network-object host 10.123.123.252
network-object host 10.123.123.253
network-object host 10.123.123.254
object-group network acme_Local_B
network-object host 10.123.120.3
network-object host 10.123.120.10
network-object host 10.123.120.11
network-object host 10.123.120.14
network-object host 10.123.120.20
object-group network acme_Local_C
network-object host 10.123.121.10
network-object host 10.123.121.11
object-group network acme_Ext_D
network-object host 62.48.242.131
object-group network acme_E
network-object 10.123.120.0 255.255.252.0
access-list inside extended deny tcp host 10.123.120.14 any object-group Ports-tcp
access-list inside extended permit ip object-group acme_Local_C any
access-list inside extended permit ip object-group acme_A any
access-list inside extended permit ip object-group acme_Local_B any
access-list inside extended permit ip object-group acme_E any
access-list outside extended permit icmp any any
access-list outside extended permit icmp any any echo-reply
access-list outside_cryptomap_20 extended permit ip 10.123.120.0 255.255.252.0 10.0.0.0 255.0.0.0
access-list inside_outbound_nat0_acl extended permit ip 10.123.120.0 255.255.252.0 10.0.0.0 255.0.0.0
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu inside 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any echo outside
icmp permit any echo-reply outside
icmp permit host 10.123.74.13 inside
icmp permit host 10.123.120.12 inside
icmp permit any echo-reply inside
icmp permit any echo inside
icmp permit any inside
asdm image disk0:/asdm-634.bin
asdm history enable
arp timeout 14400
nat (inside,outside) source static obj-inside obj-lisbon
!
object network obj-any
nat (inside,outside) dynamic interface
access-group outside in interface outside
access-group inside in interface inside
route outside 0.0.0.0 0.0.0.0 196.32.199.133 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa authentication ssh console LOCAL
http server enable
http 62.48.242.129 255.255.255.255 outside
http 0.0.0.0 0.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
service resetoutside
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map outside_map 20 match address outside_cryptomap_20
crypto map outside_map 20 set peer 62.48.242.131
crypto map outside_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 20 set security-association lifetime seconds 28800
crypto map outside_map 20 set security-association lifetime kilobytes 4608000
crypto map outside_map interface outside
crypto isakmp identity hostname
crypto isakmp enable outside
crypto isakmp policy 20
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
no crypto isakmp nat-traversal
telnet 0.0.0.0 0.0.0.0 inside
telnet 0.0.0.0 255.255.255.255 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 5
ssh version 2
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
username acme password vwK.cqS6Zg/lrW79 encrypted privilege 15
username admin password LkxkEEBDwYHUUSj9 encrypted privilege 15
username firewall password lqs3WEsQ2y5//6d1 encrypted
tunnel-group 62.48.242.131 type ipsec-l2l
tunnel-group 62.48.242.131 ipsec-attributes
pre-shared-key *****
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
inspect ip-options
!
service-policy global_policy global
prompt hostname context
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:cbd9507b36b7da4329d0af2861762922
: end

Jennifer Halim · ‎10-21-2010

Yup, the following configuration is incorrect (pls kindly remove):

nat (inside,outside) source static obj-inside obj-lisbon

And change it to the following:

nat (inside,outside) source static obj-inside obj-inside destination static obj-lisbon obj-lisbon

"clear xlate" after the above changes, and VPN should work again.

Hope that helps.

Antonio Brandao · ‎10-21-2010

Hi Jennifer,

I´ll try that hint and see if work.

What is most strange is that i have other site with same ASA model and with old image aswell. But I didn´t get the same issue.

I uploaded the image to the asa flash and I did set the new image for version 8 firmware image, after that I did the upload the new ASDM 6.

After I checked the conf and everything was changed automatically. I don´t know if the new ASDM when I accessed 1st time runned some routine to migrate the configuration to the new sintax.

Anyway will try change these lines and see what happens.

thanks for now

Antonio

Jennifer Halim · ‎10-21-2010

Great, let us know how it goes.

Seems like that particular line doesn't get converted successfully on this particular ASA. In any case, please change it to the one suggested and let us know how it goes.