Re: 5505 and 5510 l2l vpn tunnel not up - Page 2

Azubuike Obiora · ‎07-17-2013

Hi Experts!

Having a funny issue I'm experience, just thinking to myself what I could be doing wrong. I have 2 ASA's with software code 8.4.5 running on both of them, ASA1 is a 5510 that I have two active vpn connections on it a l2l with another ASA 5505 and Remote VPN for remote users. see attached the topology

Now I am trying to introduce another ASA to do a site to site vpn connection on it. Call it ASA3, since I have an already established l2l VPN configuration on ASA2.

See the config for ASA1 & 2 l2l VPN that's working:

object network Creek_net
subnet 10.10.0.0 255.255.255.0
object network river_net
subnet 192.168.200.192 255.255.255.224
access-list outside_1_cryptomap permit ip 10.10.0.0 255.255.255.0 192.168.200.192 255.255.255.224
tunnel-group 11.11.11.11 type ipsec-l2l
tunnel-group 11.11.11.11 ipsec-attributes
pre-shared-key ratrace1!
isakmp keepalive threshold 10 retry 2
crypto isakmp enable outside
crypto isakmp policy 10 authentication pre-share
crypto isakmp policy 10 encrypt aes
crypto isakmp policy 10 hash sha
crypto isakmp policy 10 group 2
crypto isakmp policy 10 lifetime 86400
crypto ipsec transform-set ESP-AES-SHA esp-aes esp-sha-hmac
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set pfs group1
crypto map outside_map 1 set peer 11.11.11.11
crypto map outside_map 1 set transform-set ESP-AES-SHA
crypto map outside_map interface outside
nat (inside,outside) 1 source static Creek_net Creek_net  destination static river_net river_net



object network river_net
subnet 192.168.200.192 255.255.255.224
object network creek_net
subnet 10.10.0.0 255.255.255.0
access-list outside_1_cryptomap permit ip 192.168.200.192 255.255.255.224 10.10.0.0 255.255.255.0
tunnel-group 12.12.12.12 type ipsec-l2l
tunnel-group 12.12.12.12 ipsec-attributes
pre-shared-key ratrace1!
isakmp keepalive threshold 10 retry 2
crypto isakmp enable outside
crypto isakmp policy 10 authentication pre-share
crypto isakmp policy 10 encrypt aes
crypto isakmp policy 10 hash sha
crypto isakmp policy 10 group 2
crypto isakmp policy 10 lifetime 86400
crypto ipsec transform-set ESP-AES-SHA esp-aes esp-sha-hmac
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set pfs group1
crypto map outside_map 1 set peer 80.248.11.15
crypto map outside_map 1 set transform-set ESP-AES-SHA
crypto map outside_map interface outside
nat (inside,outside) 1 source static river_net river_net  destination static Creek_net Creek_net

Above is the working VPN configuration that is perfectly fine! No issue whatsoever.

===============================================================================================================

Then i tried introducing ASA3 for a branch office with the below configuration.

ASA3

object network dallas_net
subnet 10.10.0.0 255.255.255.0
object network river_net
subnet 192.168.200.192 255.255.255.224
access-list outside_1_cryptomap permit ip 10.10.0.0 255.255.255.0 192.168.200.192 255.255.255.224
tunnel-group 11.11.11.11 type ipsec-l2l
tunnel-group 11.11.11.11 ipsec-attributes
pre-shared-key mouserace1!
isakmp keepalive threshold 10 retry 2
crypto isakmp enable outside
crypto isakmp policy 10 authentication pre-share
crypto isakmp policy 10 encrypt aes
crypto isakmp policy 10 hash sha
crypto isakmp policy 10 group 2
crypto isakmp policy 10 lifetime 86400
crypto ipsec transform-set ESP-AES-SHA esp-aes esp-sha-hmac
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set pfs group1
crypto map outside_map 1 set peer 11.11.11.11
crypto map outside_map 1 set transform-set ESP-AES-SHA
crypto map outside_map interface outside
nat (inside,outside) 1 source static dallas_net dallas_net  destination static river_net river_net

ASA1

object network river_net
subnet 192.168.200.192 255.255.255.224
object network dallas_net
subnet 10.10.4.0 255.255.255.0
access-list outside_2_cryptomap permit ip 192.168.200.192 255.255.255.224 10.10.0.0 255.255.255.0
tunnel-group 13.13.13.13 type ipsec-l2l
tunnel-group 13.13.13.13 ipsec-attributes
pre-shared-key mousrace1!
isakmp keepalive threshold 10 retry 2
crypto isakmp enable outside
crypto isakmp policy 10 authentication pre-share
crypto isakmp policy 10 encrypt aes
crypto isakmp policy 10 hash sha
crypto isakmp policy 10 group 2
crypto isakmp policy 10 lifetime 86400
crypto ipsec transform-set ESP-AES-SHA esp-aes esp-sha-hmac
crypto map outside_map 12 match address outside_2_cryptomap
crypto map outside_map 12 set pfs group1
crypto map outside_map 12 set peer 13.13.13.13
crypto map outside_map 12 set transform-set ESP-AES-SHA
crypto map outside_map interface outside
nat (inside,outside) 1 source static river_net river_net  destination static dallas_net dallas_net

I would appreciate someone pointing out my mistake.

Thanks

Teddy

Jouni Forss · ‎07-18-2013

Hi,

Would seem that they match.

I am not sure why the other one shows so many translate/untranslate hits.

Have you monitored the VPN negotiation through ASDM to see if there are any clear indications where the negotiation fails?

Can you take some additional outputs during the generating traffic for the L2L VPN

show crypto ikev1 sa detail

This should more information on which policy was chosen.

Did you issue the "packet-tracer" command twice? As I said the first one always fails if the tunnel isnt up during the test.

What are you using to test the connectivity? ICMP?

I think we might need to see the device configurations if there is no clear reason found for this problem.

- Jouni

Azubuike Obiora · ‎07-18-2013

Hey Jouni!

Ok I replied other post not looking at mine to see you've said something. Sad enough for ASA3 I can't use ASDM link is to slow to initiate ASDM connection. I decided to take screen shot just for you to see the different mode this get into! I feel there's something flapping in the link I can't tell, I give all the state modes you can think of within 1 - 2mins interval. To your point device configuration might add to it!

Yes I did use the packet tracer this time not ICMP but tcp cos I have a cisco 2960 switch behind ASA3.

packet-tracer input inside tcp 192.168.200.196 22 10.10.4.253 22

That's why I said I might need to contact TAC for see if they could help me resolve this!! before then I want to configure a remote vpn on ASA3 to get into the switch and check the configs making sure it has the ASA as it's default gateway! I have done this before troubleshooting at last what resolved the problem was just to configure the ip default-gateway for the switch to the ASA and my connection came through! So that's the last resort for me before I go ahead to do this with TAC.

Thanks all the say.....I still look fwd to your thoughts on the snap shot

Teddy

Artem Tkachov · ‎07-18-2013

Hi Teddy,

I think I'm little bit "fresh" with your situation, but from your output, it seems that you have been established Phase 1 with ASA 3. What about Phase 2 ?

Azubuike Obiora · ‎07-18-2013

Hi Artem!

For me I think the issue is with routing! Why i think so? Ok here's what I did! I configured RA VPN on ASA3 see attached the following show command outputs + the topology of the network too! I would appreciate candid view.

If you notice, on the client side, packets encrypts and doesn't decrypt, on the ASA3 it Decrypts and doesn't Encrypts. So what do you make if such! It's fairly a straigh fwd topology as you can see there are no many hops in the network. ASA3 is the defaultgateway to the network.

Thanks

Teddy

Artem Tkachov · ‎07-18-2013

Hello Teddy,

Can you make a capture on inside interface with interested traffic ? If you will see that traffic is hitting inside interface of ASA, it will proof that there is not problem with routing...

And from your output, seems that traffic is :

1. Not hitting interface

2. ASA doesn't encrypt.

Let's investigate routing firts, since we need to be shure that ASA receives this traffic.

Thank you.

Azubuike Obiora · ‎07-19-2013

Hi All!

I have figured out what the problem is! with l2l vpn! BANDWIDTH yes the monster bandwidth. Fact is I was configuring both VPN remotely, now the site where ASA3 is located had bandwidth problem.....in the day time I couldn't achieve this, so while it was night time at the site. I was able to establist the tunnel.

Funny right?! This is my very first time configuring VPN with bandwidth related issues! So it was the bandwidth that was triggering the connections to come on and off! A day ago! Also the bandwidth problem has been taken care of by the customer too! I pointed that out to them.

I have learnt a vital lesson from this! Thanks to everyone who contributed in one way or the other! I do appreciate you all, best forum ever.

Have a good one people.

Teddy

Artem Tkachov · ‎07-19-2013

Hey Teddy,

Nice to hear that you was able to solve this problem. =)

And thank you raised that discussion here. I think It was helpfull for all of us.

Cheers,

Artem.

Azubuike Obiora · ‎07-19-2013

Jouni & Artem!

Thanks guys for your support! Glad it's all working fine now! We all learn from the forum so yes it's expected to give back!

Have a good one guys!

Teddy

Jouni Forss · ‎07-18-2013

Hi Teddy,

As with many problems related to ASAs, it might be sometime easier to go through the situation if we saw the device configurations. While we did see the VPN configurations there are still some things on the ASA configurations that can cause problems.

In your ASA3 site it would seem that there cant be that many things that could prevent the traffic from being forwarded to the ASA. Actually probably only one thing and that is incorrect default gateway. But I would imagine that this is not the case here since noone on the ASA3 site would be able to use the Internet then.

So is it possible to see the actual configurations. Maybe even just the ASA3 configurations for starters?

- Jouni

Azubuike Obiora · ‎07-20-2013

Ok after a day of the tunnel being up! Next i got a call they can't ping across the tunnel! data wasn't going via the tunnel at all! I wasn't getting the MM_ACTIVE as shown in my screen shoot above! Tunnel kept going from MM_ACTIVE to MM_WAIT_MSG2 - 6 basically the tunnel was droping. I had to debug crypto isakmp to see the below msg.

Jul 20 12:39:52 [IKEv1]Group = 13.13.13.13, IP =13.13.13.13, Static Crypto Map check, map = outside_map, seq = 1, ACL does not match proxy IDs src:10.10.4.0 dst:192.168.200.192

Jul 20 12:39:52 [IKEv1]Group =13.13.13.13, IP = 13.13.13.13, IKE Remote Peer configured for crypto map: BUAGROUP_MAP

Jul 20 12:39:52 [IKEv1 DEBUG]Group =13.13.13.13, IP = 13.13.13.13, processing IPSec SA payload

Jul 20 12:39:52 [IKEv1]Group = 13.13.13.13, IP = 13.13.13.13, All IPSec SA proposals found unacceptable!

I did troubleshooting till the last breath! I just didn't figure it out! After a while I had to take timeout to look at my

crypto map [crypto map name] placement on ASA1!

Only to find out that the crypto maps I had configured for on ASA1 was the problem. I had 3 Crypto maps placed like this

crypto map outside_map 1 set pfs group1 (this is for the first l2l to ASA2 that's working perfectly.)

crypto map outside_map 7 ipsec-isakmp dynamic our_map ( for RA VPN on ASA1 also working perfectly too!)

crypto map outside_map 10 set pfs group1 (for l2l vpn to ASA3 that keep changing modes)

It never crossed my mind that crypto maps acts like acl's! how you place them determines how the ASA would negotiate your tunnels with it. To fix this I had to bring crypto map for ASA3 and place it above the dynamic crypto map for the RA vpn with cryptomap number 2. That sorted out my problem finally.

A hard lesson there to learn but it was worth the troubleshooting.

Cheers everyone

Teddy.