Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

ASA 5505 Cannot Establish Tunnel

I'm establishing a hub and spoke setup with ASA 5505's filtering traffic between 5 sites, with a central hub. I've utilized this setup previously, but for some reason we are running into issues with new ASA's (version 8.2.5). I'm working with just 2 sites right now, basically peer to peer, and cannot ping the inside IP's from either end, and cannot ping the inside gateway unless through the console.

Here's what I've got (I took out the first two octets of the outside address, assume they are the same throughout): 


ASA Version 8.2(5)
hostname xxxxxxx
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
interface Ethernet0/0
 description outside interface
 switchport access vlan 2
interface Ethernet0/1
 description inside interface
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
interface Vlan1
 nameif inside
 security-level 100
 ip address
interface Vlan2
 nameif outside
 security-level 0
 ip address xx.xx.214.130
ftp mode passive
same-security-traffic permit intra-interface
access-list outside_in extended permit icmp any any echo-reply
access-list 100 extended permit ip
access-list nonat extended permit ip
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1
route outside 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set Tset1 esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map VPN_TUN 10 match address 100
crypto map VPN_TUN 10 set peer xx.xx.214.34
crypto map VPN_TUN 10 set transform-set Tset1
crypto map VPN_TUN interface outside
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 65535
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
telnet inside
telnet outside
telnet outside
telnet timeout 5
ssh xx.xx.214.34 outside

ssh timeout 5
console timeout 0
dhcpd address inside

no threat-detection basic-threat
no threat-detection statistics access-list
no threat-detection statistics tcp-intercept
tunnel-group xx.xx.214.34 type ipsec-l2l
tunnel-group xx.xx.214.34 ipsec-attributes
 pre-shared-key *
 isakmp keepalive threshold 30 retry 5
class-map inspection_default
 match default-inspection-traffic
policy-map type inspect dns preset_dns_map
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect ip-options
  inspect http
prompt hostname context
no call-home reporting anonymous


You can't ping because you

You can't ping because you don't allow ping on ASA, try adding icmp permit any any outside for testing purpose. Your VPN config looks ok to me. Try enabling the debug crypto isakmp and debug crypto ipsec, to see why it's not establishing the tunnel. After you enable the debug, generate a packet that matches your crypto ACL and post the output here.

New Member

There is no need to

There is no need to specifically define ICMP on the ACL's anymore

policy-map global_policy

class inspection_default

inspect icmp.


That aside I would suggest you verify that the VPN tunnel is up.

sh isakmp sa

sh ipsec sa

when sanitizing you config remove the route outside 1  <--



CreatePlease to create content