ASA-5505 Site-to-Site Not Working

kbillingham · ‎10-18-2013

I am somewhat new to Cisco but to do have some experience. I am trying to connect two ASA 5505's together via site-to-site VPN. They are configured with public IPs and all other services are working. I have used the VPN wizard on both boxes successfully but the tunnels are not working. The two devices are on the Comcast network. Any help would be appreacited.

Site A: ASA 5505 w/50 User license

Site B: ASA 5505 w/10 User license

Site A Config:

ASA Version 8.2(5)

!

hostname *********************

enable password 6.De4e7UzES9wBPg encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

name 192.168.100.10 Web_Server

name 10.0.6.0 Ghost_Flower_Inside

name 10.0.5.0 San_Mateo_Inside

name 10.0.5.100 Any_Connect_100

name 10.0.5.101 Any_Connect_101

name 10.0.5.102 Any_Connect_102

name 10.0.5.103 Any_Connect_103

name 10.0.5.104 Any_Connect_104

name 10.0.5.105 Any_Connect_105

name 10.0.5.106 Any_Connect_106

name 10.0.5.107 Any_Connect_107

name 10.0.5.108 Any_Connect_108

name 10.0.5.109 Any_Connect_109

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

switchport access vlan 12

!

interface Ethernet0/6

!

interface Ethernet0/7

!

interface Vlan1

nameif inside

security-level 100

ip address 10.0.5.201 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address 173.10.XXX.XXX 255.255.255.252

!

interface Vlan12

no forward interface Vlan1

nameif dmz

security-level 50

ip address 192.168.100.1 255.255.255.0

!

ftp mode passive

dns domain-lookup outside

dns server-group DefaultDNS

name-server 75.75.75.75

object-group protocol TCPUDP

protocol-object udp

protocol-object tcp

object-group network Any_Connect_DHCP

network-object host Any_Connect_100

network-object host Any_Connect_101

network-object host Any_Connect_102

network-object host Any_Connect_103

network-object host Any_Connect_104

network-object host Any_Connect_105

network-object host Any_Connect_106

network-object host Any_Connect_107

network-object host Any_Connect_108

network-object host Any_Connect_109

access-list outside_access_in extended permit tcp any interface outside eq www

access-list outside_access_in extended permit tcp any interface outside eq ssh

access-list outside_1_cryptomap extended permit ip San_Mateo_Inside 255.255.255.0 Ghost_Flower_Inside 255.255.255.0

access-list inside_nat0_outbound extended permit ip San_Mateo_Inside 255.255.255.0 Ghost_Flower_Inside 255.255.255.0

access-list inside_nat0_outbound extended permit ip object-group Any_Connect_DHCP any

pager lines 24

logging enable

logging asdm informational

mtu inside 1500

mtu outside 1500

mtu dmz 1500

ip local pool AnyConnectDHCPPool Any_Connect_100-10.0.5.110 mask 255.255.255.0

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

global (outside) 1 interface

global (dmz) 1 192.168.100.2 netmask 255.255.255.255

nat (inside) 0 access-list inside_nat0_outbound

nat (inside) 1 0.0.0.0 0.0.0.0

static (dmz,outside) tcp interface www Web_Server www netmask 255.255.255.255

access-group outside_access_in in interface outside

route outside 0.0.0.0 0.0.0.0 173.10.XXX.XXX 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

aaa authentication http console LOCAL

aaa authentication ssh console LOCAL

http server enable

http 192.168.1.0 255.255.255.0 inside

http 10.0.1.0 255.255.255.0 inside

http 10.1.10.0 255.255.255.0 outside

http San_Mateo_Inside 255.255.255.255 inside

http San_Mateo_Inside 255.255.255.0 inside

http 0.0.0.0 0.0.0.0 outside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto map outside_map 1 match address outside_1_cryptomap

crypto map outside_map 1 set peer 173.12.XXX.XXX

crypto map outside_map 1 set transform-set ESP-3DES-SHA

crypto map outside_map interface outside

crypto isakmp enable outside

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

vpn-sessiondb max-webvpn-session-limit 10

telnet timeout 5

ssh 192.168.1.0 255.255.255.0 inside

ssh 10.0.1.0 255.255.255.0 inside

ssh San_Mateo_Inside 255.255.255.0 inside

ssh 10.1.10.0 255.255.255.0 outside

ssh 0.0.0.0 0.0.0.0 outside

ssh timeout 5

console timeout 0

dhcpd auto_config outside

!

dhcpd address 10.0.5.10-10.0.5.30 inside

dhcpd dns 75.75.75.75 75.75.76.76 interface inside

dhcpd enable inside

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

anyconnect-essentials

svc image disk0:/anyconnect-macosx-i386-2.5.2014-k9.pkg 1 regex "Intel Mac OS X"

svc profiles CATS disk0:/cats.xml

svc enable

tunnel-group-list enable

group-policy DfltGrpPolicy attributes

dns-server value 75.75.75.75

vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn