Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Asa to Asa , one fixed , one dynamic IP, tunnel doesn't establish

Asa fixed IP <> Asa Dynamic IP

Tunnel works fine if i configure with the vpn wizard,

I configure this ipsec-site2site on de HQ (fixed ip) as follow :

peer adress "emty" (couse the ip address is unknown)

connection name "vpn_s2s"

local and remote adress

and the psk

I configure this ipsec-site2site on de Branch Office (dynamic ip) as follow :

peer address "ip address hq"

connectionname "vpn_s2s"

local and remote adress

and the psk

by advanced :

ike negotiation mode agressivve

each time i see in de logging from the ASA on the HQ that the BO uses his external ip adress as a tunnel group id, the messages .....unknown tunnel group "external ip " appears,

Who can help me ?

6 REPLIES
New Member

Asa to Asa , one fixed , one dynamic IP, tunnel doesn't establis

Hi Adriaan,

Maybe you can post your configs here..Since I am not getting the information you put here...

Are you using name for the tunnel-group ?

HTH,

Vikram

New Member

Re: Asa to Asa , one fixed , one dynamic IP, tunnel doesn't esta

LOGGING :

3|Nov 14 2011|23:37:36|752006|||||Tunnel Manager failed to dispatch a KEY_ACQUIRE message.  Probable mis-configuration of the crypto map or tunnel-group.  Map Tag = Unknown.  Map Sequence Number = 0.

4|Nov 14 2011|23:37:36|713255|||||IP = >>WAN_IP_ASA2<<, Received ISAKMP Aggressive Mode message 1 with unknown tunnel group name '>>WAN_IP_ASA2<<'.

3|Nov 14 2011|23:37:31|752006|||||Tunnel Manager failed to dispatch a KEY_ACQUIRE message.  Probable mis-configuration of the crypto map or tunnel-group.  Map Tag = Unknown.  Map Sequence Number = 0.

6|Nov 14 2011|23:37:31|302016|8.8.8.8|53|192.168.1.199|51754|Teardown UDP connection 17447 for Outside:8.8.8.8/53 to Inside:192.168.1.199/51754 duration 0:02:08 bytes 215

6|Nov 14 2011|23:37:28|302016|8.8.8.8|53|192.168.1.199|51755|Teardown UDP connection 17451 for Outside:8.8.8.8/53 to Inside:192.168.1.199/51755 duration 0:02:01 bytes 32

4|Nov 14 2011|23:37:28|713255|||||IP = >>WAN_IP_ASA2<<, Received ISAKMP Aggressive Mode message 1 with unknown tunnel group name '>>WAN_IP_ASA2<<'.

6|Nov 14 2011|23:37:26|302015|192.168.1.199|49896|8.8.8.8|53|Built outbound UDP connection 17491 for Outside:8.8.8.8/53 (8.8.8.8/53) to Inside:192.168.1.199/49896 (192.168.1.199/49896)

3|Nov 14 2011|23:37:26|752006|||||Tunnel Manager failed to dispatch a KEY_ACQUIRE message.  Probable mis-configuration of the crypto map or tunnel-group.  Map Tag = Unknown.  Map Sequence Number = 0.

ASA1 (FIXED IP)

ASA Version 8.4(2)

!

hostname ASA1

names

!

interface Ethernet0/0

nameif Outside

security-level 0

ip address >>WAN_IP_ASA1<< 255.255.255.248

!

interface Ethernet0/1

nameif Inside

security-level 100

ip address 192.168.1.1 255.255.255.0

!

interface Ethernet0/2

shutdown

no nameif

no security-level

no ip address

!

interface Ethernet0/3

shutdown

no nameif

no security-level

no ip address

!

interface Management0/0

nameif management

security-level 100

ip address dhcp

management-only

!

boot system disk0:/asa842-k8.bin

ftp mode passive

access-list Outside_cryptomap extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0

pager lines 24

logging enable

logging asdm informational

mtu Outside 1500

mtu Inside 1500

mtu management 1500

no failover

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-645-206.bin

no asdm history enable

arp timeout 14400

route Outside 0.0.0.0 0.0.0.0 x.x.x.x 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

aaa authentication http console LOCAL

aaa authentication ssh console LOCAL

http server enable

http 192.168.1.0 255.255.255.0 management

http 172.16.0.0 255.255.0.0 management

http x.x.x.x 255.255.255.255 Outside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec ikev2 ipsec-proposal AES256

protocol esp encryption aes-256

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal AES192

protocol esp encryption aes-192

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal AES

protocol esp encryption aes

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal 3DES

protocol esp encryption 3des

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal DES

protocol esp encryption des

protocol esp integrity sha-1 md5

crypto dynamic-map S2S-VPN 1 match address Outside_cryptomap

crypto dynamic-map S2S-VPN 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

crypto map Outside_map0 1 ipsec-isakmp dynamic S2S-VPN

crypto map Outside_map0 interface Outside

crypto ikev2 policy 1

encryption aes-256

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 10

encryption aes-192

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 20

encryption aes

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 30

encryption 3des

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 40

encryption des

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 enable Outside

crypto ikev1 enable Outside

crypto ikev1 policy 10

authentication crack

encryption aes-256

hash sha

group 2

lifetime 86400

crypto ikev1 policy 20

authentication rsa-sig

encryption aes-256

hash sha

group 2

lifetime 86400

crypto ikev1 policy 30

authentication pre-share

encryption aes-256

hash sha

group 2

lifetime 86400

crypto ikev1 policy 40

authentication crack

encryption aes-192

hash sha

group 2

lifetime 86400

crypto ikev1 policy 50

authentication rsa-sig

encryption aes-192

hash sha

group 2

lifetime 86400

crypto ikev1 policy 60

authentication pre-share

encryption aes-192

hash sha

group 2

lifetime 86400

crypto ikev1 policy 70

authentication crack

encryption aes

hash sha

group 2

lifetime 86400

crypto ikev1 policy 80

authentication rsa-sig

encryption aes

hash sha

group 2

lifetime 86400

crypto ikev1 policy 90

authentication pre-share

encryption aes

hash sha

group 2

lifetime 86400

crypto ikev1 policy 100

authentication crack

encryption 3des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 110

authentication rsa-sig

encryption 3des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 120

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 130

authentication crack

encryption des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 140

authentication rsa-sig

encryption des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 150

authentication pre-share

encryption des

hash sha

group 2

lifetime 86400

telnet timeout 5

ssh x.x.x.x 255.255.255.255 Outside

ssh 172.16.0.0 255.255.0.0 management

ssh timeout 30

console timeout 0

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

group-policy GroupPolicy_S2S-VPN internal

group-policy GroupPolicy_S2S-VPN attributes

vpn-tunnel-protocol ikev1

group-policy GroupPolicy1 internal

group-policy GroupPolicy1 attributes

vpn-tunnel-protocol ikev1

tunnel-group S2S-VPN type ipsec-l2l

tunnel-group S2S-VPN general-attributes

default-group-policy GroupPolicy_S2S-VPN

tunnel-group S2S-VPN ipsec-attributes

ikev1 pre-shared-key *****

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny 

  inspect sunrpc

  inspect xdmcp

  inspect sip 

  inspect netbios

  inspect tftp

  inspect ip-options

!

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

Cryptochecksum:be2da903f1700f7cccd739e8737d74a7

: end

asdm image disk0:/asdm-645-206.bin

no asdm history enable

-----------------------

ASA2 (Dynamic IP)

ASA Version 8.4(2)

!

hostname ASA2

names

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

switchport access vlan 3

!

interface Vlan1

nameif inside

security-level 100

ip address 192.168.2.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address dhcp setroute

!

interface Vlan3

no forward interface Vlan2

nameif management

security-level 100

ip address dhcp

!

boot system disk0:/asa842-k8.bin

ftp mode passive

object network obj_any

subnet 0.0.0.0 0.0.0.0

object network NETWORK_OBJ_192.168.1.0_24

subnet 192.168.1.0 255.255.255.0

object network NETWORK_OBJ_192.168.2.0_24

subnet 192.168.2.0 255.255.255.0

access-list outside_cryptomap extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0

pager lines 24

logging enable

logging asdm informational

mtu inside 1500

mtu outside 1500

mtu management 1500

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-645-206.bin

no asdm history enable

arp timeout 14400

nat (inside,outside) source static NETWORK_OBJ_192.168.2.0_24 NETWORK_OBJ_192.168.2.0_24 destination static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 no-proxy-arp route-lookup

!

object network obj_any

nat (inside,outside) dynamic interface

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

aaa authentication http console LOCAL

aaa authentication ssh console LOCAL

http server enable

http 192.168.1.0 255.255.255.0 inside

http 172.16.0.0 255.255.0.0 management

http x.x.x.x 255.255.255.255 outside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec ikev2 ipsec-proposal DES

protocol esp encryption des

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal 3DES

protocol esp encryption 3des

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal AES

protocol esp encryption aes

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal AES192

protocol esp encryption aes-192

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal AES256

protocol esp encryption aes-256

protocol esp integrity sha-1 md5

crypto map outside_map2 1 match address outside_cryptomap

crypto map outside_map2 1 set peer >>WAN_IP_ASA1<<

crypto map outside_map2 1 set ikev1 phase1-mode aggressive

crypto map outside_map2 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

crypto map outside_map2 interface outside

crypto ikev2 policy 1

encryption aes-256

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 10

encryption aes-192

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 20

encryption aes

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 30

encryption 3des

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 40

encryption des

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev1 enable outside

crypto ikev1 policy 10

authentication crack

encryption aes-256

hash sha

group 2

lifetime 86400

crypto ikev1 policy 20

authentication rsa-sig

encryption aes-256

hash sha

group 2

lifetime 86400

crypto ikev1 policy 30

authentication pre-share

encryption aes-256

hash sha

group 2

lifetime 86400

crypto ikev1 policy 40

authentication crack

encryption aes-192

hash sha

group 2

lifetime 86400

crypto ikev1 policy 50

authentication rsa-sig

encryption aes-192

hash sha

group 2

lifetime 86400

crypto ikev1 policy 60

authentication pre-share

encryption aes-192

hash sha

group 2

lifetime 86400

crypto ikev1 policy 70

authentication crack

encryption aes

hash sha

group 2

lifetime 86400

crypto ikev1 policy 80

authentication rsa-sig

encryption aes

hash sha

group 2

lifetime 86400

crypto ikev1 policy 90

authentication pre-share

encryption aes

hash sha

group 2

lifetime 86400

crypto ikev1 policy 100

authentication crack

encryption 3des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 110

authentication rsa-sig

encryption 3des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 120

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 130

authentication crack

encryption des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 140

authentication rsa-sig

encryption des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 150

authentication pre-share

encryption des

hash sha

group 2

lifetime 86400

telnet timeout 5

ssh x.x.x.x 255.255.255.255 outside

ssh 172.16.0.0 255.255.0.0 management

ssh timeout 30

console timeout 0

dhcpd auto_config outside

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

group-policy GroupPolicy2 internal

group-policy GroupPolicy2 attributes

vpn-tunnel-protocol ikev1

group-policy GroupPolicy1 internal

group-policy GroupPolicy1 attributes

vpn-tunnel-protocol ikev1

tunnel-group S2S-VPN type ipsec-l2l

tunnel-group S2S-VPN general-attributes

default-group-policy GroupPolicy2

tunnel-group S2S-VPN ipsec-attributes

ikev1 pre-shared-key *****

!

!

prompt hostname context

no call-home reporting anonymous

Cryptochecksum:0317fb744600131cddb06591a6d5791a

: end

asdm image disk0:/asdm-645-206.bin

no asdm history enable

New Member

Asa to Asa , one fixed , one dynamic IP, tunnel doesn't establis

Hi,

the log says :

4|Nov 14 2011|23:37:36|713255|||||IP = >>WAN_IP_ASA2<<, Received ISAKMP Aggressive Mode message 1 with unknown tunnel group name '>>WAN_IP_ASA2<<'.

it sending the WAN_IP_ASA2 as the name of tunnel-group

usually for dynamic ip address, we are using FQDN as tunnel group if we are using pre-shared key..

try for ASA1, change the tunnel-group to use tunnel-group

example :

if your domain is abc.com

then

tunnel-group ASA2.abc.com type ipsec-l2l

tunnel-group ASA2.abc.com ipsec-att

pre-shared

and in ASA2 try add command cry isa id hostname

HTH,

Vikram

New Member

Asa to Asa , one fixed , one dynamic IP, tunnel doesn't establis

Hi Vikram

i've changed the log, >>WAN_IP_ASA2<< = the external ip x.x.x.x

x.x.x.x. Received ISAKMP Aggressive Mode message 1 with unknown tunnel group name 'x.x.x.x'

New Member

Asa to Asa , one fixed , one dynamic IP, tunnel doesn't establis

Hi Adriaan,

I notice that...Okay, I have a question here :

ASA2 is using dynamic IP, that's why in ASA1 tunnel-group we can't use ASA2 ip address,..hence that's why I have advise to use FQDN...

The logg issue here is that ASA1 can not find the proper tunnel-group to land the connection...

other solution is to use rsa sig authentication

HTH,

Vikram

Bronze

Re: Asa to Asa , one fixed , one dynamic IP, tunnel doesn't esta

You're going about it all wrong.  Instead of trying to identify the peer using a FQDN, you need to use the DefaultL2LGroup.

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00807ea936.shtml

I understand that you are using 8.4 but the concepts are the same. 

3732
Views
0
Helpful
6
Replies
CreatePlease to create content