ASA 5505 - cannot establish natted VPN - firmware problem ?

[mschlee]

I am new to Cisco. We are about to establish a natted VPN connection to a truck company who operates a bunch of these VPNs to their customers to download and upload confidential data via ftp (cannot be changed to anything else yet). I installed an ASA 5505, did the basic configuration and granted access to the truck company's IT department in order to let them configure the VPN. The truck company's IT guy says that this is usually a matter of 5 minutes and he has successfully installed a test VPN on his test ASA 5505 which works. Then he tried our ASA and worked on it for 2,5 days w/o success (he says). The problem is that after phase 1 has been completed the error 

"Rejecting IPSec tunnel: no matching crypto map entry for remote proxy <IP>,255.255.255.255/0/0 ..."

shows up. Both ASAs have different firmware versions: ours is ASA Version 9.1(6) ADSM Version: 9.5(2) which does not work, the other one has a newer release: ASA Version 9.2(4)22 ADSM Version: 7.6(2)150.

The truck company says that they don't know why our ASA does not work.

So my questions:

Do you think that a firmware issue in ASA Version 9.1(6) can cause this problem ?

If this is the case, am I entitled to download a newer firmware somewhere ?

Thank you very much.

M.

[GioGonza]

Hello @mschlee, 

The problem here is that you are not matching the Security Association on your ASA, you are checking the crypto map configured but you are not matching any ACL in there and that´s why it is not working. What you need to do is to check with the other IT the ACL configured and verify if what you are receiving on your is the configured one. 

If you can, you can share your config and I can take a look... also before that message it should be one showing you that it is checking the crypto map on the based on the sequence number.

HTH

Gio

[mschlee]

Hello Gio,

if I understand correctly you do not see any firmware problem here. My problem is that I only have access to one side of the VPN. The truck company's IT guy can see everything but claims that the problem is impossible to fix. However, he could manage to run the stuff on their test ASA 5505. I hope that this is true.

I requested all information from the IT guy and will continue this post when I know more.

Thanks for your fast response.

M.