I currently have an issue passing traffic from an ASA 5520 to a 877W. The traffic is being encrypted from the router to the ASA (as shown below) however the ASA is not sending any encrypted traffic. I have tried upgrading from 8.4(7) to 9.1(5), wiping the config and starting fresh, configuring the VPN's via CLI and using the ASDM wizard. I've also tried a 1841 and experience the same issue.
Any ideas before I log a TAC case? Pulling my hair out with this one!
877W Config:
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
lifetime 28800
crypto isakmp key psk address ASA-EXTERNAL
crypto ipsec transform-set TS esp-3des esp-sha-hmac
crypto map CMAP 10 ipsec-isakmp
set peer ASA-EXTERNAL
set security-association lifetime seconds 28800
set transform-set TS
match address VPN-TRAFFIC
interface Dialer0
crypto map CMAP
ip route 0.0.0.0 0.0.0.0 Dialer0
ip nat inside source list 100 interface Dialer0 overload
ip access-list extended VPN-TRAFFIC
permit ip 192.168.20.0 0.0.0.255 172.16.250.0 0.0.0.255
access-list 100 remark Define NAT
access-list 100 deny ip 192.168.20.0 0.0.0.255 172.16.250.0 0.0.0.255
access-list 100 remark
access-list 100 deny ip 192.168.20.0 0.0.0.255 10.0.0.0 0.255.255.255
access-list 100 permit ip 192.168.20.0 0.0.0.255 any
ASA:
interface GigabitEthernet0/0
nameif outside
security-level 0
ip address ASA-EXTERNAL-IP
!
interface GigabitEthernet0/1
nameif inside
security-level 100
ip address 172.16.250.247 255.255.255.0
!
same-security-traffic permit inter-interface
object network VPNLocal
subnet 172.16.250.0 255.255.255.0
object network VPNRemote
subnet 192.168.20.0 255.255.255.0
access-list outside_cryptomap extended permit ip 172.16.250.0 255.255.255.0 object VPNRemote
access-list outside_access_in extended permit ip object VPNRemote 172.16.250.0 255.255.255.0 log disable
access-list inside_access_in extended permit ip 172.16.250.0 255.255.255.0 object VPNRemote
icmp permit any outside
icmp permit any inside
nat (inside,outside) source static VPNLocal VPNLocal destination static VPNRemote VPNRemote no-proxy-arp route-lookup
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 ISP-GATEWAY-IP 1
route inside 10.0.0.0 255.0.0.0 CORE-ROUTER 1
sysopt connection preserve-vpn-flows
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association pmtu-aging infinite
crypto map outside_map 1 match address outside_cryptomap
crypto map outside_map 1 set peer 877W-IP
crypto map outside_map 1 set ikev1 transform-set ESP-3DES-SHA
crypto map outside_map 1 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
crypto map outside_map 1 set reverse-route
crypto map outside_map interface outside
crypto ikev1 enable outside
crypto ikev1 policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
group-policy GroupPolicy_877W-IP internal
group-policy GroupPolicy_877W-IP attributes
vpn-tunnel-protocol ikev1
tunnel-group 877W-IP type ipsec-l2l
tunnel-group 877W-IP general-attributes
default-group-policy GroupPolicy_81.133.227.150
tunnel-group 877W-IP ipsec-attributes
ikev1 pre-shared-key *****
ikev2 remote-authentication pre-shared-key *****
ikev2 local-authentication pre-shared-key *****
!
class-map global-class
match default-inspection-traffic
!
!
policy-map global_policy
policy-map global-policy
class global-class
inspect icmp
inspect icmp error
!
service-policy global-policy global
prompt hostname context
877W sh crypto ipsec sa
interface: Dialer0
Crypto map tag: CMAP, local addr 877W-IP
protected vrf: (none)
local ident (addr/mask/prot/port): (192.168.20.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (172.16.250.0/255.255.255.0/0/0)
current_peer ASA-EXTERNAL port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 1771, #pkts encrypt: 1771, #pkts digest: 1771
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 17, #recv errors 0
local crypto endpt.: 877W-IP, remote crypto endpt.: ASA-EXTERNAL
path mtu 1500, ip mtu 1500, ip mtu idb Dialer0
current outbound spi: 0xD82FD3CE(3627013070)
inbound esp sas:
spi: 0x31F9F14C(838463820)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 29, flow_id: Motorola SEC 1.0:29, crypto map: CMAP
sa timing: remaining key lifetime (k/sec): (4544227/24786)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0xD82FD3CE(3627013070)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 30, flow_id: Motorola SEC 1.0:30, crypto map: CMAP
sa timing: remaining key lifetime (k/sec): (4544168/24786)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
interface: Virtual-Access2
Crypto map tag: CMAP, local addr 0.0.0.0
protected vrf: (none)
local ident (addr/mask/prot/port): (192.168.20.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (172.16.250.0/255.255.255.0/0/0)
current_peer ASA-EXTERNAL port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 0.0.0.0, remote crypto endpt.: ASA-EXTERNAL
path mtu 1500, ip mtu 1500, ip mtu idb Virtual-Access2
current outbound spi: 0x0(0)
inbound esp sas:
inbound ah sas:
inbound pcp sas:
outbound esp sas:
outbound ah sas:
outbound pcp sas:
ASA sh crypto ipsec sa
peer address: 877W-IP
Crypto map tag: outside_map, seq num: 1, local addr: ASA-EXERNAL
access-list outside_cryptomap extended permit ip 172.16.250.0 255.255.255.0 192.168.20.0 255.255.255.0
local ident (addr/mask/prot/port): (172.16.250.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.20.0/255.255.255.0/0/0)
current_peer: 877W-IP
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 539, #pkts decrypt: 539, #pkts verify: 539
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#TFC rcvd: 0, #TFC sent: 0
#Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: ASA-EXERNAL/0, remote crypto endpt.: 877W-IP/0
path mtu 1500, ipsec overhead 58(36), media mtu 1500
PMTU time remaining (sec): 0, DF policy: copy-df
ICMP error validation: disabled, TFC packets: disabled
current outbound spi: 31F9F14C
current inbound spi : D82FD3CE
inbound esp sas:
spi: 0xD82FD3CE (3627013070)
transform: esp-3des esp-sha-hmac no compression
in use settings ={L2L, Tunnel, IKEv1, }
slot: 0, conn_id: 81920, crypto-map: outside_map
sa timing: remaining key lifetime (kB/sec): (4373968/24993)
IV size: 8 bytes
replay detection support: Y
Anti replay bitmap:
0xFFFFFFFF 0xFFFFFFFF
outbound esp sas:
spi: 0x31F9F14C (838463820)
transform: esp-3des esp-sha-hmac no compression
in use settings ={L2L, Tunnel, IKEv1, }
slot: 0, conn_id: 81920, crypto-map: outside_map
sa timing: remaining key lifetime (kB/sec): (4374000/24993)
IV size: 8 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
