hi, i am jonathan rivero.
i have an ASA 5520 Version 8.0(2), i configured the VPN site to site and works fine, in the other apliance i configured the VPN Client for remote users, and works fine, but i try to cofigure the 2 VPNs on ASA 5520 on the same outside interface and i have the line "crypto map outside_map interface outside (for VPN client)", but when I configure the "crypto map VPNL2L interface outside, it overwrites the command", and therefore I can only have one connection.
the show run.
ASA1(config)# sh run
: Saved
:
ASA Version 8.0(2)
!
hostname ASA1
enable password 7esAUjZmKQSFDCZX encrypted
names
!
interface Ethernet0/0
nameif inside
security-level 100
ip address 172.16.3.2 255.255.255.0
!
interface Ethernet0/1
nameif outside
security-level 0
ip address 200.20.20.1 255.255.255.0
!
interface Ethernet0/1.1
vlan 1
nameif outside1
security-level 0
no ip address
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/4
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/5
shutdown
no nameif
no security-level
no ip address
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
object-group network net-local
network-object 172.16.0.0 255.255.255.0
network-object 172.16.1.0 255.255.255.0
network-object 172.16.2.0 255.255.255.0
network-object 172.16.3.0 255.255.255.0
object-group network net-remote
network-object 172.16.100.0 255.255.255.0
network-object 172.16.101.0 255.255.255.0
network-object 172.16.102.0 255.255.255.0
network-object 172.16.103.0 255.255.255.0
object-group network net-poolvpn
network-object 192.168.11.0 255.255.255.0
access-list nat-outside extended permit ip object-group net-local any
access-list nonat extended permit ip object-group net-local object-group net-remote
access-list nonat extended permit ip object-group net-local object-group net-poolvpn
access-list splittun-vpngroup1 extended permit ip object-group net-local object-group net-poolvpn
pager lines 24
mtu inside 1500
mtu outside 1500
mtu outside1 1500
ip local pool ippool 192.168.11.1-192.168.11.100 mask 255.255.255.0
no failover
icmp unreachable rate-limit 100 burst-size 10
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 access-list nat-outside
route outside 0.0.0.0 0.0.0.0 200.20.20.1 1
route inside 172.16.0.0 255.255.255.0 172.16.3.2 1
route inside 172.16.1.0 255.255.255.0 172.16.3.2 1
route inside 172.16.2.0 255.255.255.0 172.16.3.2 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
aaa authentication ssh console LOCAL
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 86400
crypto ipsec security-association lifetime kilobytes 400000
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map VPNL2L 1 match address nonat
crypto map VPNL2L 1 set peer 200.30.30.1
crypto map VPNL2L 1 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 20
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
crypto isakmp policy 30
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
!
!
group-policy vpngroup1 internal
group-policy vpngroup1 attributes
banner value ++++Welcome to Cisco Systems 7.0.+++++
dns-server value 192.168.0.1 192.168.1.1
split-tunnel-policy tunnelspecified
split-tunnel-network-list value splittun-vpngroup1
default-domain value ad-domain.local
split-dns value ad-domain.local
address-pools value ippool
username asa1 password VRTlLlJ48/PoDKjS encrypted privilege 15
tunnel-group 200.30.30.1 type ipsec-l2l
tunnel-group 200.30.30.1 ipsec-attributes
pre-shared-key *
tunnel-group vpngroup1 type remote-access
tunnel-group vpngroup1 general-attributes
address-pool ippool
default-group-policy vpngroup1
tunnel-group vpngroup1 ipsec-attributes
pre-shared-key *
prompt hostname context
Cryptochecksum:00000000000000000000000000000000
: end
ASA2(config)#sh run
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec security-association lifetime seconds 86400
crypto ipsec security-association lifetime kilobytes 400000
crypto map VPNL2L 1 match address nonat
crypto map VPNL2L 1 set peer 200.30.30.1
crypto map VPNL2L 1 set transform-set ESP-3DES-MD5
crypto map VPNL2L interface outside
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 20
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
tunnel-group 200.30.30.1 type ipsec-l2l
tunnel-group 200.30.30.1 ipsec-attributes
pre-shared-key cisco
my topology:
i try with the next links but didn`t work
http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080912cfd.shtml
http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a00807e0aca.shtml
Best Regards...
Accepted Solutions
ok I changue the route on TresASA2, add the inpect ICMP in both ASA5520 and send the ping to both ASAs.
thk for you help....
no, the tunnel is down.
you thing so of the trouble is the version, I can try with asa844-k8 version but I don't know configure NAT and VPN site to site on this version. Between try with enable the debug crypto isa and debug crypto ipsec but no show me information.
