With Marcin Latosiewicz
Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to Get an update on IPsec VPN with Cisco expert Marcin Latosiewicz who will answer questions on the topic of best practices when implementing IPsec VPNs on IOS and ASA. Marcin Latosiewicz is a Customer Support Engineer at the Cisco Technical Assistance Center in Belgium, which over four years of experience with Cisco Security products and technologies including IPSec, VPN, internetworking appliances, network and systems security, internet services and Cisco networking equipment.
Remember to use the rating system to let Marcin know if you have received an adequate response.
Marcin might not be able to answer each question due to the volume expected during this event. Remember that you can continue the conversation on the Security sub-community discussion forum shortly after the event. This event lasts through December 9th, 2011. Visit this forum often to view responses to your questions and the questions of other community members.
Solved! Go to Solution.
Not knowing your settings and assuming some Cisco defaults it could be a problem during phase 1 rekey (86400 seconds is the default).
What I would also look into whether by any chance you do not have vpn idle timeout or vpn session timeout applied for you (what I assume is) Lan to Lan tunnels.
Check logs on ASA (we drop some logs on informational level) on failure.
If you feel like debugging - debug cry isakmp 127 .
What I would suggest regardless is to open a TAC case, there's quite a few problems we saw in the past with Sonicwall.
Mostly smaller problems with (mis)configuration, but occasionally a bug (on either side).
We need more info :-)
HTH and GL,
I have on my pc win7 with Cisco client installed, the vpn to our costumer is working but i can not do a ping to this network. On my pc i have also a vmware with XP and Cisco client installed. at the XP client it is working with the same .pcf file, ping connect ..
what can be happend at the win7 client or pc?
Can you give me some info where is maybe the problem.
thanks a lot
Interesting question, I'm afraid there is no one simple answer.
Places I would start checking:
0) Check if ICMP is the only protocol affected or do we see similar sysmptoms for everything else.
1) Disable firewall on windows 7 and re-test.
We've had quite a few problems with this.
2) Perform sniffer trace on windows 7 physical and VPN adapter interfaces.
We're interested ito see our (ICMP) packets leaving AND coming back.
Note that on the physical interface you will see either ESP or AH, or UDP/4500 packets.
3) Enable logging on VPN client (from GUI you can set it up to level 3, but editing vpnclient.ini will all you to set it to level 15).
While performing testing check "statistics" section (mostly for discarded or bypassed bypassed) but also the logs if you see any packet drop reported.
4) Only once everything seem clear in points 1-3 I would move to checking the VPN headend.
There could be multiple causes with different resolution steps. What you need to do first is to perform some basic checks to know where the problem is located. Typically all our VPN teams in TAC can help you do it very efficiently and they can teach you a few tricks, if you're in the mood :-)
Here's my situation. I have a client with 3 offices and we're trying to use RV120W's in each location to provide IPSec VPN site to site connections. 2 of the offices have internet connections which can provide public IP addresses to the cisco router. The third office is unfortunately using a device that has no option to disable the NAT in their router.
The 2 offices with public IPs on their WAN ports have been configured and are passing along VPN traffic just fine. I can't find any information on how to allow this third office to connect through that NAT'd router. My traffic in the office goes like this, to be clear:
Office PCs (192.168.3.x) -> Cisco LAN (192.168.3.1)
Cisco WAN (192.168.0.2) -> Netgear 4G Turbo Hub (192.168.0.1) -- Netgear gets public IP from cellular network.
My other routers are using 192.168.1.x and 192.168.2.x respectively, so there aren't any common subnets either.
Any help with NAT traversal?? Thanks much.
This is not the Small Business section of forums, so I might not be the best person to respond to this.
But I'll give it a shot.
NAT Traversal requires that communication on port UDP/4500 and UDP/500 is allowed. I checked the device at a glance and I see that it's capable of NAT traversal (at least according to spec).
What you can do I trying to forward those ports to your RV device on the Netgear (if it has this capability), that should actually allow you to both initiate and respond the IPsec VPN.
I would first of all check if there is no place where this setting is disabled (although I would say it makes a sane default to have it on).
Another place (which reminds me of things we had in Linksys routers) is the netgear, it should ideally just allow communication coming to/from those ports. I know some small business devices "inspect" VPN.
Hope this help, but for concrete answer I would check on small business section.
Thanks for your assistance the other day on this and upon further investigation I found out the problem. I was able to determine that the third office that's using a 4G router is actually behind a 10.x.x.x private router on the ISP side. After many phone calls, the provider is not willing/able to provide us with a Public IP service or a Static IP. Port forwarding will also not work in this situation either.
A phone call to the Partner Help Desk and 15 minutes later, I was told that an ASA5505 can be configured to work through a private IP configuration such as this. So, my questions is this. Will this device be able to create an IPSec tunnel to a small business router such as the VR120W or should I get 2 of these devices?
Thanks again for all your help.
ASA's IPsec VPN is based on standards, if you place it behind NAT there should be no problem for it to initiate VPN connection with NAT traversal.
You might also want to add keepalives:
Now if you want to be a responder in IPsec negotiation, that's a bit different story, you will somehow need to allowed UDP/500 and UDP/4500 inside.
TL;DR ASA behind NAT, no problem with IPsec to any standard based device, but only as an initiator.
We have a customer with a basic Hub and spoke IPsec network. At the headend there is a Cisco ASA and the spokes have a Cisco 1812 or a Cisco 881. there are around 100 spokes. The issue there is that when an ISP change an IP address at a spoke location then we have to send a technicican to make changes both on the spoke router and on the ASA. So I was thinking that DMVPN will be a good solution for the customer. But one om my colleague thinks that Easy VPN will be a better solution in this case as it thinks that DMVPN will add too much complexity to the customer network. There is no need for spoke to spoke traffic. But I think that spoke to spoke feature can be disabled in DMVPN. Then the customer network is really simple. The spoke locations only need to reach some servers at the headend location. Then the ASA cannot do DMVPN.
So what do you think? Should we advice DMVPN or EasyVPN?
Then I have seen that there are some new featrues in EasyVPN, is that correct?
What about FlexVPN, could it be a solution there maybe? What is the advantage of FlexVPN over DMVPN? Can it run on ASA?
(I think we could write a chapter in a book about this one )
I'll start in bit different order than you asked your questions.
ASA support for any virtual interfaces (be it Tunnel or VTI) is on the roadmap, but it's not there yet and I would not plan on using it in the first release it's out.
What you see now is just the beginning of Flex more features and capabilities are coming. Suffice to say we took the experience of Eesy and DM VPNs, looked at what customers want, what is missing and what are the painpoints and put that to a good use. I'm afraid I cannot say too much and we will learn more during Cisco Live in January (Look for events involving Fred Detienne, if you're going).
I agree with your colleague, easy VPN would be the technology of choice here:
- simple to implement, widely used, standard based.
It will allow you to add/change config a very flexible way add new spokes and add new config on hub as it's needed.
I would suggest moving only spokes with dynamic IPs to ezvpn, and leave existing Lan-to-Lan configuration in place.
I have considered two alternatives.
Alternative (1) is to run IPsec tunnel between spoke routers and hub ASA and underneath run a GRE tunnel between spoke routers and device behind ASA capable of terminating GRE (you can run GRE from a loopback interface).
- ASA is doing IPsec only
- Still have GRE (in case you want to send IPv6 traffic in future for example).
- Control over routing protocol
- A lot of "moving parts"
- Additional MTU consumed by GRE
- Spokes behind NAT considerations
Alternative (2) DMVPN. As you know I'm a big fan of DMVPN in general, but since ASA cannot do it, I would re-consider if that's the way to go. Unless you have a (minimum) 2800/2900 router there behind ASA?
In which case you could split dynamic peers to terminate DMVPN on router and static IP peers to terminate lan to lan on ASA (at least initially). Start the migration of static peers later.
- Static LAN to LAN tunnels are un-interrupted while you move dynamic peers.
- All advantages of DMVPN
- "Difficult" to manage (at least initially) and justify (financially).
- You might not utilize full power of particular device
- Two difference devices doing "same function" (from end customer's point of view).
As I said it's not an easy topic to say one way or another without more information. There are too many factors to consider :-)
Hope that helps, though.
Thank you so much for your reply. Was really interesting to read you. Tunnel interface on ASA? Sounds really nice;-)
I will follow your advices. I am looking forward to hear more about FlexVPN.
I have configured remote access (Cisco VPN client) on ASA 5510. I can connect, everything works fine (can browse local network etc) but however I'm not able to connect to ASA using ASDM neither telnet.
How to allow ASDM or telnet through VPN?
Tnx in advance
That's not really a best practice question, but I will give this a shot. :-)
If you want to manage your device of VPN, you need to:
1) Allow the VPN IP pool to access the interface of choice (telnet, ssh, http, command)
2) Enable "management-access", as additional parameter you need to give the interface name which you used in step 1)
Typically we terminate management over VPN on "inside" or LAN interface.
Let's say my pool is 172.16.13.0/24 and I want to use HTTP(ASDM) over my inside interface.
http 172.16.13.0 255.255.255.0 inside
Hope this helps,
This looks correct, although if you allow "everything" (0.0.0.0 0.0.0.0) there is no need for additional rule and all you need to add is this:
Finally I had a chance to finish the cisco vpn client software and ASA5505 configuration to connect to office network.
It's working fine, I can connect a laptop anywhere to internet then enable vpn tunneling then use Cisco IP communicator to connect to our phone system and our server.
But I have a problem when I use 3G internet connection using those usb dongles on my laptop. I start VPNclient then it says connected, I can see that is sends packets (they're counting) but there is no receiving packets, it stays 0.
Do you know what could be a problem? Can it be configuration or Service provider problem? Because other internet connections are working fine for vpnclient.
I set up in a Cisco 1801 a site-to-site vpn between site A and site B, also I set up the Cisco 1801 as a Easy VPN server. Everything works fine ...
The site-to-site vpn traffic from A to B has to do a source NAT to xxx.xxx.xxx.xxx address to be able to arrive to B site.
The remote vpn traffic is arriving to the LAN of site A
The problem that i am facing is that i don't know how to set up the Cisco 1801 to manage the remote vpn traffic to site B. I think i have to do a source nat of the remote vpn traffic to xxx.xxx.xxx.xxx address but i don't know how, should i use a ip nat inside or a nat outside command?
Thanks in advanced
What you need to remember is that NAT is done before encryption and after decryption.
So if you NAT traffic you need to most likely take it into consideration for routing and/or VPN.
Let's take this scenario:
X - one network
Y - network two
Z - network I would like X to be visible as on when traversing to Y.
A - device with X on LAN
B - device with Y on LAN
X -----A --- (internet) ---- B ---- Y
What I would typically do is on A.
ip nat inside source static X Z /24 [route-map RMAP1]
Route-map I can use to make sure this translation is only done when going from X to Y.
And when specifying interesting traffic for VPN I woud do on A:
permit ip Z Y
while on B:
permit ip Y Z
ip nat outside source static X Z /24
ACL for VPN on A:
permit X Y
ACL for VPN on B:
permit Y X
Let me know if this answers your question, I might have gotten your scneario wrong.
Thanks for your reply,
I think i expolian myself not very clear. The site-to-site VPN with nat is already in use , that part is ok. The problem that i have is that i Also set up the router as an Easy VPN for remote users.
The traffic of these remote uses is the one that i want to route to site B through the site-to-site VPN.
So remote uses traffic has to be natted into xxxxx in orden to be accepted by site B.
(Remote users-10.0.1.0/24) -----Easy VPN----ROUTER (site A) --------(nat xxxxxx)---------SITE B
The principal problem that i have is that i don't know where to do the nat for the remote users VPN traffic to be translated into address xxxxxx when is routing to site B.
I am not sur e if this escenario is possible.
Gotcha, much more clear now.
What I would suggest is switching to DVTI deployment on router A in your topology.
This will allow you to enable "ip nat inside" on virtual-template and then use normal source NAT for remote users going out to the internet or to site B.
Example confrim (- NAT) is here:
(I made the assumption you have "ip nat outside" on your WAN-facing interface)
From your description it could be a problem with ISP, although I can tell you that it's rare nowadays.
My immediate suggestion is to perform a sniffer trace (wireshark or whathaveyou) on the interface associated with 3g dongle.
You should ESP or UDP/4500 packets leaving, but we're interested if you see anything going back.
What CAN be a problem is the packets coming back but are corrupted (not that uncommon over cellular networks).
If you don't see any return packets coming in you can confirm on the ASA that that you see encapsulations and decapsulations in "show crypto ipsec sa peer IP_ADD_RE_SS". If the values are non-zero it mean that we're processing traffic, if any (or both) are zero, we have some problem on the ASA or on the route to ASA.
I want to assign static IPs to users that login to IPSec VPN using Group Authentication in ASA 8.2. They authenticate through a Windows RADIUS server. Right now, they are connecting just fine and pulling an IP from the pool I have configured in the IPSec policy.
What would the best way to assign static IPs through VPN??
Truth be told, assigning statically to everyone does not scale for large deployments, although it's a neat control mechanism in small and medium setups.
You need to modify/double check two settings.
1) You need to make sure ASA can accept IP addresses for VPN users from AAA servers.
2) Framed-IP-address RADIUS attribute can be sent from RADIUS as an AV pair (
For more information about supported attributes on ASA.
You can also check how you can assign statically from ASA itself (with local AAA auth)
Hope this helps,
Good day Marc.
Please I have a problem that needs urgent help. I have a T1 card installed on my 1841 router but my providers are giving me an E1 link and their complain is that it will not work with the E1 line. But i think it should be possible to use an E1 link with a T1 interface card depending on the configuration. Am really lost. Can you help me?
Good day marc,
i have three asa 5505 and they all share the same problem, vpn over ipsec does work sometimes for week very good, but suddenly it can stop working (clients can always connect but cant ping or connect to remote recourses).
Two of asa's are running 7.2 and yesterday i updated one to 8.42, but no help.
Most of the time when vpn is not working, client can only ping once a remote server. No matter if client is using 3g or wired connection.
Ping statistics for 192.168.100.2:
Packets: Sent = 4, Received = 1, Lost = 3 (75% loss),
Approximate round trip times in milli-seconds:
Minimum = 11ms, Maximum = 11ms, Average = 11ms
then suddenly, after 5min or 2 days..vpn connection all the time open or after reconnect,
Ping statistics for 192.168.100.2:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 12ms, Maximum = 16ms, Average = 13ms
Client use xp and windows 7...no difference.
Second problem is that remote dns name's does not work, so i cannot use for example mapped home folder with server name, i have to use those with server's ip..
Running configuration (of 8.42)
Result of the command: "sh run"
ASA Version 8.4(2)
enable password *** encrypted
passwd *** encrypted
name 213.139.x.x ulkoip description gw
switchport access vlan 2
ip address 192.168.100.1 255.255.255.0
ospf cost 10
ip address 213.139.x.x 255.255.255.248
ospf cost 10
no forward interface Vlan1
ip address 192.168.50.1 255.255.255.0
ospf cost 10
boot system disk0:/asa842-k8.bin
ftp mode passive
clock timezone EEST 2
clock summer-time EEDT recurring last Sun Mar 3:00 last Sun Oct 4:00
dns domain-lookup inside
dns server-group DefaultDNS
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network obj-192.168.100.0
subnet 192.168.100.0 255.255.255.0
object network obj-192.168.1.0
subnet 192.168.1.0 255.255.255.0
object network obj_any-01
subnet 0.0.0.0 0.0.0.0
object network obj_any-02
subnet 0.0.0.0 0.0.0.0
object network obj-0.0.0.0
object network obj_any-03
subnet 0.0.0.0 0.0.0.0
object network obj_any-04
subnet 0.0.0.0 0.0.0.0
object-group network obj_any
access-list inside_nat0_outbound extended permit ip 192.168.100.0 255.255.255.0 192.168.100.0 255.255.255.0
access-list as extended permit ip 192.168.1.0 255.255.255.0 192.168.1.0 255.255.255.192
access-list domainVPN_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0
access-list domainVPN_splitTunnelAcl_1 standard permit 192.168.1.0 255.255.255.0
access-list domainVPN_splitTunnelAcl_2 standard permit 192.168.1.0 255.255.255.0
access-list kissa_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0
access-list Sisaverkko standard permit 192.168.100.0 255.255.255.0
access-list tunneliryhma_splitTunnelAcl standard permit 192.168.100.0 255.255.255.0
access-list inside_nat0_outbound_1 extended permit ip any any
access-list inside_test extended permit icmp any host 192.168.100.2
access-list Outside_In extended permit icmp any any unreachable
access-list Outside_In extended permit icmp any any time-exceeded
access-list Outside_In extended permit icmp any any echo-reply
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu dmz 1500
ip local pool VPNpooli2 192.168.100.20-192.168.100.29 mask 255.255.255.255
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
icmp permit host 192.168.100.21 inside
icmp permit any outside
icmp permit host 192.168.100.21 outside
asdm image disk0:/asdm-645-206.bin
no asdm history enable
arp timeout 14400
nat (inside,any) source static obj-192.168.100.0 obj-192.168.100.0 destination static obj-192.168.100.0 obj-192.168.100.0 no-proxy-arp
nat (inside,inside) source static any any no-proxy-arp route-lookup
object network obj_any-01
nat (inside,outside) dynamic interface
object network obj_any-02
nat (inside,outside) dynamic obj-0.0.0.0
object network obj_any-04
nat (dmz,outside) dynamic obj-0.0.0.0
route outside 0.0.0.0 0.0.0.0 ulkoip 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
user-identity default-domain LOCAL
eou allow none
url-cache dst 10
http server enable
http 192.168.100.0 255.255.255.0 inside
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto dynamic-map outside_dyn_map 1 set pfs
crypto dynamic-map outside_dyn_map 1 set ikev1 transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 20 set pfs
crypto dynamic-map outside_dyn_map 20 set ikev1 transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 40 set pfs
crypto dynamic-map outside_dyn_map 40 set ikev1 transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 60 set pfs
crypto dynamic-map outside_dyn_map 60 set ikev1 transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 80 set pfs
crypto dynamic-map outside_dyn_map 80 set ikev1 transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 100 set pfs
crypto dynamic-map outside_dyn_map 100 set ikev1 transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 120 set pfs
crypto dynamic-map outside_dyn_map 120 set ikev1 transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 140 set pfs
crypto dynamic-map outside_dyn_map 140 set ikev1 transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 160 set pfs
crypto dynamic-map outside_dyn_map 160 set ikev1 transform-set ESP-3DES-SHA
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp nat-traversal 30
crypto ikev1 enable outside
crypto ikev1 policy 10
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd domain domain
dhcpd address 192.168.100.20-192.168.100.149 inside
dhcpd dns 192.168.100.2 22.214.171.124 interface inside
dhcpd wins 192.168.100.2 interface inside
dhcpd domain domain interface inside
dhcpd enable inside
threat-detection statistics host
threat-detection statistics port
threat-detection statistics protocol
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
group-policy domainVPN internal
group-policy domainVPN attributes
vpn-tunnel-protocol ikev1 l2tp-ipsec
split-tunnel-network-list value Sisaverkko
username Vantaa password *** encrypted
username Vantaa attributes
username Hannes password *** encrypted privilege 15
username Hannes attributes
username poysant password *** encrypted
username poysant attributes
tunnel-group domainVPN type remote-access
tunnel-group domainVPN general-attributes
address-pool (inside) VPNpooli2
tunnel-group domainVPN ipsec-attributes
ikev1 pre-shared-key *****
isakmp keepalive disable
policy-map type inspect dns preset_dns_map
message-length maximum 4096
inspect h323 h225
inspect h323 ras
inspect dns preset_dns_map
service-policy global_policy global
prompt hostname context
call-home reporting anonymous prompt 2
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email email@example.com
destination transport-method http
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Neither of the questions is really on best practices in IPsec VPN, but I can give this a shot.
I would suggest opening a TAC case to get to the bottom of this, but here are a few things you can check on your own:
- Check if clients behind NAT and clients with public IP address are affected in the same way.
- Check if ASA is processing those packets and sending replies (show crypto ipsec sa, is a good place to start).
- Since the problem persists between two very distinct ASA versions and on three devices, I would be also interested if same ISP involved.
- Are all clients affected when the problem starts or only a few ones?
- Is there anything in topology that might try to understand ESP or UDP/4500 packets (some firewalls and broadband routers are known to "inspect" VPN flows).
It's not clear to me whether you have problems with name resolution or with connection after name resolution is done.
For example did you check if the names resolve properly in "nslookup" and whethere there is a difference when looking up "server" and "server.mydomain.tld". If you inspect "ipconfig /all" do you see proper DNS and domain suffic applied to interface?
The problem you mention is not related to IPsec VPN best practices :-)
What I would suggest is to open up a TAC case specifying:
1) Information about WIC/module you're using for E1/T1?
2) Purpose of E1/T1 (uplink to ISP for data, voice trunk)?
3) software information about router.
4) "show diag", "show inv", "show logg", "show tech outputs".
I have been a regular viewer of your documents in the forum and appreciate your contribution . Can you please throw some light on how to evaluate performance or calculate the throughput across Site to Site VPN .For eg: usually we calculate the throughput of firewall (ASA) from the output of show interface and using the statistics over there (bytes / sec , pps etc) .But how do we know how much VPN traffic is contributing and if the firewall is getting overwhelmed because of the VPN traffic and not because of the clear text traffic
Thanks for interest in our docs, I hope you're getting meaningful information out of it :-)
Now regarding your question I see several levels here.
1) Are IPsec flows contributing to any soft of "oversubscription" of the ASA.
The answer is "yes, they can". IPsec packets will still occupy interface buffers. But it's treated like any other frame in the buffer.
Packet encryption and decryption is handled by special accelerator engine, so that part should not overwhelm the CPU (which is the shared resource for entire platform).
The best way to monitor whether it is IPsec that is causing the problems is monitor the connection table, to see if there is not abnormally high amount of connections related to particular tunnel.
show conn detail address 192.168.1.1-192.168.1.254
2) Now regarding calculating of throughput.
There are two possible answers here.
a) Maximum throughput.
In which case I suggest running a iperf with UDP of 1400 bytes which should give you a good enough max throughput via tunnel.
Link to iperf http://sourceforge.net/projects/iperf/
b) Plotting current throughput of IPsec and IKE on ASA.
Best to monitor:
(Please note that tunnel index is not persitent - I can't find related enhancement request, will update this post when/if found)
Note that if you want to know what OIDs are supported on ASA you can do.
show snmp-server oidlist !it's a hidden command.
c) Plotting current throughput on IOS.
We already recommend using virtual interfaces. (Tunnel, DVTI or SVTI).
You can monitor tunnel bandwidth by reading interface stats.
Remember to make ifindex persistent over reload
PE2_872(config)#snmp-server ifindex persist
Please note that we can probably write a whole book chapter on this topic I just wanted to provide you a place to start.
I have an question.
My written security policy says that vpn client should be able to connect just from known locations.
customers host network.
I know IPs (ranges, IP addresses aso.) but I dont know how to limit this user to connect from his home office, and another from another home office network.
So my questions are:
1. How to limit ability to login into VPN (IPsec or better SSL VPN) just from specific IPs.
2. How to limit ability to login into VPN just from specific IPs, specified per user.