cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
513
Views
0
Helpful
5
Replies

ASA 5505 OS 8.0 VPN Not Working

harishb
Level 1
Level 1

Dear All

I have configured remote access VPN through ADSM wizard, but its not working. Its showing peer not responding. I am pasting my configuration below, please go though.

I will be rating for the suggestions.

Regards

Harish

sh run

: Saved

:

ASA Version 8.0(3)

!

hostname ciscoasa

domain-name cisco.com

enable password 2KFQnbNIdI.2KYOU encrypted

names

!

interface Vlan1

nameif inside

security-level 100

ip address 192.5.15.200 255.255.255.0

!

interface Vlan10

nameif outside

security-level 0

ip address x.x.x.x x.x.x.x

!

interface Ethernet0/0

switchport access vlan 10

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

passwd xxxxxxxx encrypted

boot system disk0:/asa803-k8.bin

ftp mode passive

dns server-group DefaultDNS

domain-name cisco.com

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

access-list inside_access_in extended permit ip 192.5.15.0 255.255.255.0 any

access-list inside_access_in extended permit tcp 192.5.15.0 255.255.255.0 any

access-list inside_access_in extended permit udp any any

access-list outside_access_in extended permit tcp any any

access-list outside_access_in extended permit ip any any

access-list outside_access_in extended permit udp any any

access-list inside_nat0_outbound extended permit ip any 192.168.1.96 255.255.255.240

pager lines 24

logging enable

logging asdm informational

mtu inside 1500

mtu outside 1500

ip local pool pool 192.168.1.100-192.168.1.110 mask 255.255.255.0

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-603.bin

no asdm history enable

arp timeout 14400

global (outside) 101 interface

nat (inside) 0 access-list inside_nat0_outbound

nat (inside) 101 0.0.0.0 0.0.0.0

static (inside,outside) tcp x.x.x.x https 192.5.15.4 https netmask 255.255.255.255

access-group inside_access_in in interface inside

access-group outside_access_in in interface outside

route outside 0.0.0.0 0.0.0.0 x.x.x.x 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout uauth 0:05:00 absolute

dynamic-access-policy-record DfltAccessPolicy

aaa authentication ssh console LOCAL

http server enable

http 0.0.0.0 0.0.0.0 outside

http 192.5.15.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-DES-SHA ESP-DES-MD5

crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map outside_map interface outside

crypto isakmp enable outside

crypto isakmp policy 10

authentication pre-share

encryption des

hash sha

group 2

lifetime 86400

telnet timeout 5

ssh 0.0.0.0 0.0.0.0 outside

ssh timeout 60

console timeout 0

threat-detection basic-threat

threat-detection statistics access-list

username cisco password ffIRPGpDSOJh9YLq encrypted privilege 15

tunnel-group test type remote-access

tunnel-group test general-attributes

address-pool pool

tunnel-group test ipsec-attributes

pre-shared-key *

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect netbios

inspect rsh

inspect rtsp

inspect skinny

inspect esmtp

inspect sqlnet

inspect sunrpc

inspect tftp

inspect sip

inspect xdmcp

!

service-policy global_policy global

prompt hostname context

Cryptochecksum:234e89d1dc372221b8ef0e14f17538aa

: end

5 Replies 5

andrew.prince
Level 10
Level 10

What is shown in the logs of the Cisco VPN client?

Dear Prince

Thank you for your response, please go though the attached logs generated by VPN client & ASA.

Regards

Harish Babu

The issue is:-

Aug 20 14:12:02 [IKEv1 DEBUG]: Group = test, IP = x.x.x.x, All SA proposals found unacceptable

Aug 20 14:12:02 [IKEv1]: IP = x.x.x.x, All IKE SA proposals found unacceptable!

The client and the ASA cannot agree on the Security Association options.

What version of Cisco VPN client are you using? What OS is it installed on?

VPN Client version is 5.0.00.0340, OS is Windows XP SP3

I cannot see where you are authenticating a username and password? try putting in the config below and test again:-

username test password test

access-list inside_nat0_outbound extended permit ip any 192.168.1.96 255.255.255.240

ip local pool pool 192.168.1.100-192.168.1.110 mask 255.255.255.0

group-policy test-rvpn internal

group-policy test-rvpn attributes

vpn-tunnel-protocol IPSec

dns-server value <>

default-domain value <>

tunnel-group test-rvpn type ipsec-ra

tunnel-group test-rvpn general-attributes

default-group-policy test-rvpn

authentication-server-group local

address-pool pool

tunnel-group test-rvpn ipsec-attributes

pre-shared-key <>

crypto isakmp policy 10 authen pre-share

crypto isakmp policy 10 encrypt des

crypto isakmp policy 10 hash sha

crypto isakmp policy 10 group 2

crypto isakmp policy 10 lifetime 86400

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA

crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map

crypto map outside_map interface outside

nat (inside) 0 access-list inside_nat0_outbound tcp 0 0 udp 0

HTH>

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: