Cisco ASA 5520 can't ping between VPN Tunnels

[sarnovait]

I have main site and site A and B.  A connects to main and B connects to main.  I can ping from main to A and A to main.  I can ping from main to B and B to main.  However I can't ping from A to B.  A and B are sonicwall 2040's and main is a 5520.  The issue has to be with the 5520 no allowing traffic between the two VPN Tunnels but I can't figure out why it's not working.  Can anyone give some insight on this?  Thanks in advance.

[Jouni Forss]

Hi,

Provided that you have configured the appropriate NAT configurations and also defined the interesting traffic in both MAIN SITE to SITE A and MAIN SITE to SITE B L2L VPN configurations to enable traffic between the remote sites then you might only be missing

same-security-traffic permit intra-interface

Which is required for the ASA to allow traffic to enter an interface and leave through that same interface. In this case its probably "outside" or whatever you have chosen for the interface.

- Jouni

[sarnovait]

I just added that line and no dice.  I did just realize that from the ASA CLI I can't ping the interfaces of the sonicwall A or B sites.

But all of my computers that sit in the MAIN site can ping all the interfaces in A and B.

[Jouni Forss]

Hi,

Do notice that when you ping from the ASA towards either of the remote LAN networks then the ASA will use the "outside" interface IP address as the source address. Typically this is something that is not included in the L2L VPN configuration and therefore fails. Actual connectivity tests should usually be done from actual hosts or network devices behind the ASA.

Naturally since we havent seen any configuration on the ASA its impossible to say what you might be missing.

If the interesting traffic is defined so that LAN A can access LAN B through the 2 L2L VPN connections then you might be missing NAT0 configuration on the ASA "outside" interface. Or you might simply be missing some configuration related to interesting traffic.

- Jouni

[sarnovait]

Here is the config that is currently on the unit.

ASA Version 9.1(1)

!

names

ip local pool IPsec-VPN-DHCP 172.23.100.150-172.23.100.200 mask 255.255.255.0

!

interface GigabitEthernet0/0

nameif inside

security-level 100

ip address 10.7.1.2 255.255.0.0

!

interface GigabitEthernet0/0.10

vlan 10

nameif VoIP

security-level 100

ip address 10.8.0.2 255.255.255.0

!

interface GigabitEthernet0/1

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet0/2

nameif outside2

security-level 0

ip address 75.XXX.XXX.58 255.255.255.248

!

interface GigabitEthernet0/3

nameif outside

security-level 0

ip address 75.XXX.XXX.186 255.255.255.248

!

interface Management0/0

management-only

nameif management

security-level 100

ip address 192.168.1.1 255.255.255.0

!

boot system disk0:/asa911-k8.bin

ftp mode passive

clock timezone EST -5

clock summer-time EDT recurring

dns server-group DefaultDNS

same-security-traffic permit intra-interface

object network Euro

host 10.7.5.9

description Customer201110010001 - Euro - 10.7.5.9 - 75.XXX.XXX.189

object network Euro-External-IP

host 75.XXX.XXX.189

description Customer201110010001 - Euro - 10.7.5.9 - 75.XXX.XXX.189

object network Colo-Subnet

subnet 10.7.0.0 255.255.0.0

object network ThreadJacked

host 10.7.5.8

description Customer201106150001 - Chris - 10.7.5.8 - 75.XXX.XXX.188

object network Thread-External-IP

host 75.XXX.XXX.188

description Customer201106150001 - Chris - 10.7.5.8 - 75.XXX.XXX.188

object network Lanczak

host 10.7.5.3

description Customer201104090001 - Brandon - 10.7.5.3 - 75.XXX.XXX.186

object network 2790-Subnet

subnet 10.217.0.0 255.255.255.0

object network 2790-VoIP-Subnet

subnet 10.217.1.0 255.255.255.0

object network 3820-Subnets

subnet 10.216.0.0 255.255.255.0

object network 3820-VoIP-Subnet

subnet 10.216.1.0 255.255.255.0

object network Colo-VoIP-Subnet

subnet 10.8.0.0 255.255.255.0

object network NETWORK_OBJ_172.23.100.128_25

subnet 172.23.100.128 255.255.255.128

object-group network DM_INLINE_NETWORK_1

network-object object Euro

network-object object Thread

network-object object Lanczak

object-group network 2790-VPN-Subnets

network-object object 2790-Subnet

network-object object 2790-VoIP-Subnet

object-group network 3820-VPn-Subnets

network-object object 3820-Subnets

network-object object 3820-VoIP-Subnet

object-group network Colo-Subnets

network-object object Colo-Subnet

object-group network 2790-Colo-VPN-Subnets

group-object 3820-VPn-Subnets

group-object Colo-Subnets

object-group network 3820-Colo-VPN-Subnets

group-object 2790-VPN-Subnets

group-object Colo-Subnets

object-group network DM_INLINE_NETWORK_2

network-object object 2790-Subnet

network-object object 3820-Subnets

network-object object Colo-Subnet

object-group network DM_INLINE_NETWORK_3

network-object object 2790-Subnet

network-object object Colo-Subnet

network-object object 2790-VoIP-Subnet

object-group network DM_INLINE_NETWORK_5

network-object object 3820-Subnets

network-object object 3820-VoIP-Subnet

object-group network DM_INLINE_NETWORK_4

network-object object 3820-Subnets

network-object object 3820-VoIP-Subnet

network-object object Colo-Subnet

object-group network DM_INLINE_NETWORK_6

network-object object 2790-Subnet

network-object object 2790-VoIP-Subnet

object-group network DM_INLINE_NETWORK_7

network-object object 3820-Subnets

network-object object 3820-VoIP-Subnet

network-object object Colo-Subnet

object-group network DM_INLINE_NETWORK_8

network-object object 2790-Subnet

network-object object 2790-VoIP-Subnet

object-group network DM_INLINE_NETWORK_10

network-object object 2790-Subnet

network-object object 2790-VoIP-Subnet

object-group network DM_INLINE_NETWORK_11

network-object object 2790-Subnet

network-object object 2790-VoIP-Subnet

network-object object Colo-Subnet

object-group network DM_INLINE_NETWORK_12

network-object object 3820-Subnets

network-object object 3820-VoIP-Subnet

object-group network DM_INLINE_NETWORK_9

network-object object 3820-Subnets

network-object object 3820-VoIP-Subnet

network-object object Colo-Subnet

access-list outside_access_in extended permit icmp any4 any

access-list outside_access_in extended permit tcp any object-group DM_INLINE_NETWORK_1 eq www

access-list outside_access_in extended deny ip any any

access-list inside_access_in extended permit ip object-group DM_INLINE_NETWORK_2 any

access-list inside_access_in extended deny ip any any

access-list outside_cryptomap extended permit ip object-group DM_INLINE_NETWORK_4 object-group DM_INLINE_NETWORK_6

access-list outside_cryptomap_1 extended permit ip object-group DM_INLINE_NETWORK_3 object-group DM_INLINE_NETWORK_5

access-list outside2_access_in extended permit icmp any4 any

access-list outside2_access_in extended deny ip any any

pager lines 24

logging enable

logging asdm informational

mtu inside 1500

mtu VoIP 1500

mtu outside2 1500

mtu outside 1500

mtu management 1500

no failover

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-713.bin

no asdm history enable

arp timeout 14400

no arp permit-nonconnected

nat (inside,outside) source static DM_INLINE_NETWORK_9 DM_INLINE_NETWORK_9 destination static DM_INLINE_NETWORK_10 DM_INLINE_NETWORK_10 no-proxy-arp route-lookup

nat (inside,outside) source static DM_INLINE_NETWORK_11 DM_INLINE_NETWORK_11 destination static DM_INLINE_NETWORK_12 DM_INLINE_NETWORK_12 no-proxy-arp route-lookup

nat (inside,outside) source static any any destination static NETWORK_OBJ_172.23.100.128_25 NETWORK_OBJ_172.23.100.128_25 no-proxy-arp route-lookup

!

object network Euro

nat (any,any) static Euro-External-IP

object network ThreadJacked

nat (any,any) static ThreadJacked-External-IP

object network Lanczak

nat (any,outside) static interface service tcp www www

!

nat (inside,outside) after-auto source dynamic any interface

nat (inside,outside2) after-auto source dynamic any interface

access-group inside_access_in in interface inside

access-group outside2_access_in in interface outside2

access-group outside_access_in in interface outside

route outside 0.0.0.0 0.0.0.0 75.XXX.XXX.185 1

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

http server enable

http 10.217.0.0 255.255.255.0 inside

http 10.7.0.0 255.255.0.0 inside

http 107.XXX.XXX.232 255.255.255.255 outside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport

crypto ipsec ikev2 ipsec-proposal AES256

protocol esp encryption aes-256

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal AES192

protocol esp encryption aes-192

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal AES

protocol esp encryption aes

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal 3DES

protocol esp encryption 3des

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal DES

protocol esp encryption des

protocol esp integrity sha-1 md5

crypto ipsec security-association pmtu-aging infinite

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-192-SHA ESP-AES-256-SHA ESP-3DES-SHA ESP-DES-SHA ESP-AES-128-SHA-TRANS ESP-AES-192-SHA-TRANS ESP-AES-256-SHA-TRANS ESP-3DES-SHA-TRANS ESP-DES-SHA-TRANS

crypto map outside_map 1 match address outside_cryptomap

crypto map outside_map 1 set peer 107.XXX.XXX.232 66.XXX.XXX.194

crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

crypto map outside_map 1 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES

crypto map outside_map 2 match address outside_cryptomap_1

crypto map outside_map 2 set peer 173.XXX.XXX.209

crypto map outside_map 2 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

crypto map outside_map 2 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES

crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map outside_map interface outside

crypto ca trustpool policy

crypto ikev2 policy 1

encryption aes-256

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 10

encryption aes-192

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 20

encryption aes

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 30

encryption 3des

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 40

encryption des

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 enable outside

crypto ikev1 enable outside

crypto ikev1 policy 10

authentication crack

encryption aes-256

hash sha

group 2

lifetime 86400

crypto ikev1 policy 20

authentication rsa-sig

encryption aes-256

hash sha

group 2

lifetime 86400

crypto ikev1 policy 30

authentication pre-share

encryption aes-256

hash sha

group 2

lifetime 86400

crypto ikev1 policy 40

authentication crack

encryption aes-192

hash sha

group 2

lifetime 86400

crypto ikev1 policy 50

authentication rsa-sig

encryption aes-192

hash sha

group 2

lifetime 86400

crypto ikev1 policy 60

authentication pre-share

encryption aes-192

hash sha

group 2

lifetime 86400

crypto ikev1 policy 70

authentication crack

encryption aes

hash sha

group 2

lifetime 86400

crypto ikev1 policy 80

authentication rsa-sig

encryption aes

hash sha

group 2

lifetime 86400

crypto ikev1 policy 90

authentication pre-share

encryption aes

hash sha

group 2

lifetime 86400

crypto ikev1 policy 100

authentication crack

encryption 3des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 110

authentication rsa-sig

encryption 3des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 120

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 130

authentication crack

encryption des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 140

authentication rsa-sig

encryption des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 150

authentication pre-share

encryption des

hash sha

group 2

lifetime 86400

telnet 10.217.0.0 255.255.255.0 inside

telnet 10.7.0.0 255.255.0.0 inside

telnet 107.XXX.XXX.232 255.255.255.255 outside

telnet timeout 5

ssh timeout 5

console timeout 0

dhcpd address 10.7.10.200-10.7.10.250 inside

dhcpd dns 10.7.4.5 10.7.4.4 interface inside

dhcpd lease 1440 interface inside

dhcpd domain woodomain.priv interface inside

dhcpd enable inside

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

ntp server 10.7.4.5 source inside

group-policy DefaultRAGroup internal

group-policy DefaultRAGroup attributes

dns-server value 10.7.4.5 10.7.4.4

vpn-tunnel-protocol l2tp-ipsec

default-domain value woodomain.priv

group-policy GroupPolicy_173.XXX.XXX.209 internal

group-policy GroupPolicy_173.XXX.XXX.209 attributes

vpn-tunnel-protocol ikev1 ikev2

group-policy GroupPolicy_107.XXX.XXX.232 internal

group-policy GroupPolicy_107.XXX.XXX.232 attributes

vpn-tunnel-protocol ikev1 ikev2

vpn-group-policy DefaultRAGroup

tunnel-group DefaultRAGroup general-attributes

address-pool IPsec-VPN-DHCP

default-group-policy DefaultRAGroup

tunnel-group DefaultRAGroup ipsec-attributes

ikev1 pre-shared-key thewoodomain

tunnel-group 107.XXX.XXX.232 type ipsec-l2l

tunnel-group 107.XXX.XXX.232 general-attributes

default-group-policy GroupPolicy_107.XXX.XXX.232

tunnel-group 107.XXX.XXX.232 ipsec-attributes

ikev1 pre-shared-key XXXXXXXXXXX

ikev2 remote-authentication pre-shared-key XXXXXXXXXXX

ikev2 local-authentication pre-shared-key XXXXXXXXXXX

tunnel-group 173.XXX.XXX.209 type ipsec-l2l

tunnel-group 173.XXX.XXX.209 general-attributes

default-group-policy GroupPolicy_173.XXX.XXX.209

tunnel-group 173.XXX.XXX.209 ipsec-attributes

ikev1 pre-shared-key XXXXXXXXXXX

ikev2 remote-authentication pre-shared-key XXXXXXXXXXX

ikev2 local-authentication pre-shared-key XXXXXXXXXXX

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny 

  inspect sunrpc

  inspect xdmcp

  inspect sip 

  inspect netbios

  inspect tftp

  inspect ip-options

!

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

Cryptochecksum:0

: end

[Jouni Forss · Accepted solution]

Hi,

I see you use ASDM. Always makes my eyes bleed when I need to watch the DM_INLINE named objects and try to make sense of them in CLI format

Would seem to me that there is atleast problem with the NAT.

If you dont mind a small outage between the Main Site and Remote Sites I would suggest modifying some of the NAT configuration with the following way

Remove Old

no nat (inside,outside) source static DM_INLINE_NETWORK_9  DM_INLINE_NETWORK_9 destination static DM_INLINE_NETWORK_10  DM_INLINE_NETWORK_10 no-proxy-arp route-lookup

no nat  (inside,outside) source static DM_INLINE_NETWORK_11 DM_INLINE_NETWORK_11  destination static DM_INLINE_NETWORK_12 DM_INLINE_NETWORK_12  no-proxy-arp route-lookup

Add New

object-group network NETWORK-2790

network-object 10.217.0.0 255.255.255.0

network-object 10.217.1.0 255.255.255.0

object-group network NETWORK-3820

network-object 10.216.0.0 255.255.255.0

network-object 10.216.1.0 255.255.255.0

object-group network NETWORK-COLO

network-object 10.8.0.0 255.255.255.0

nat (outside,outside) source static NETWORK-2790 NETWORK-2790 destination static NETWORK-3820 NETWORK-3820

nat (inside,outside) source static NETWORK-COLO NETWORK-COLO destination static NETWORK-2790 NETWORK-2790

nat (inside,outside) source static NETWORK-COLO NETWORK-COLO destination static NETWORK-3820 NETWORK-3820

The first new NAT configuration line handles the NAT0 configuration for traffic going between SiteA and SiteB. The following 2 NAT configurations handle the NAT0 for traffic going between Main Site - SiteA and Main Site - SiteB

- Jouni

[sarnovait]

ok so this worked.  Was it because I was missing the nat (outside,outside) ?  I feel thats really the only thing that is diffferent besides seperating everything out?

[Jouni Forss]

Hi,

I would imagine that was the problem.

The other NAT configurations I posted were (as you said) simply included to make the configuration clearer to read in CLI configuration format.

- Jouni

[sarnovait]

so my last thing I need to get working and when I had an all sonicwall enviroment all I had to do is enable multicating support on the VPN connections.  I'm trying to get appleTV's at all locations to be seen by all iOS devices regardless of location.  So someone could airplay a presentation from their device at site A to site B.  Any idea on that?