Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Cisco ASA S2S VPN

Hi!

I have two Cisco ASA 5505 and S2S VPN tunnel, when tunnel is down( no more traffic,rekey) I have no access to local network of another site until somebody from another site pings my local network, but at the same time "show crypto isakmp sa" and "show crypto ipsec sa" show that everything including the tunnel is working well -  State   : MM_ACTIVE.

What should I do that ping from my local network give me access to another location without ping from another location?

crypto isakmp keepalive doesn't help to resolve this problem

Please help!

Thank you!

Everyone's tags (3)
2 REPLIES
Cisco Employee

Re: Cisco ASA S2S VPN

Need to see the configs of both ends here. Should check to make sure that SA lifetimes match, ensure there are no NAT issues and etc...  Typical site to site VPN would look like this


SITE A:


crypto isakmp policy 10

encr 3des

hash md5

authen pre-sha

!

crypto isakmp key cisco address 2.2.2.2

!

access-list acl_no_nat permit ip 10.10.10.0 255.255.255.0  11.11.11.0 255.255.255.0

access-list acl_match_vpn1 permit ip 10.10.10.0 255.255.255.0  11.11.11.0 255.255.255.0

!

nat (inside) 0 access-list acl_no_nat

!

crypto ipsec transform-set 3DES-SHA esp-3des esp-sha-hmac

!

crypto map vpn_map_outside 10 match address acl_match_vpn1p
crypto map vpn_map_outside 10 set peer 2.2.2.2
crypto map vpn_map_outside 10 set transform-set 3DES-SHA
crypto map vpn_map_outside interface outside

crypto isakmp nat-traversal

!

tunnel-group 2.2.2.2  type ipsec-l2l
tunnel-group 2.2.2.2  ipsec-attributes
   pre-shared-key cisco


SITE B:


crypto isakmp policy 10

encr 3des

hash md5

authen pre-sha

!

crypto isakmp key cisco address 1.1.1.1

!

access-list acl_no_nat permit ip   11.11.11.0 255.255.255.0 10.10.10.0 255.255.255.0

access-list acl_match_vpn1 permit ip  11.11.11.0 255.255.255.0 10.10.10.0 255.255.255.0

!

nat (inside) 0 access-list acl_no_nat

!

crypto ipsec transform-set 3DES-SHA esp-3des esp-sha-hmac

!

crypto map vpn_map_outside 10 match address acl_match_vpn1p
crypto map vpn_map_outside 10 set peer 1.1.1.1
crypto map vpn_map_outside 10 set transform-set 3DES-SHA
crypto map vpn_map_outside interface outside

crypto isakmp nat-traversal

!

tunnel-group 1.1.1.1 type ipsec-l2l
tunnel-group 1.1.1.1  ipsec-attributes
    pre-shared-key cisco

New Member

Re: Cisco ASA S2S VPN

Thanks Joe! My configuration almost identical.

One ASA have nat(inside) 0 0 0

second            no nat-control    and no configuration of nat but other configurations are mirror

1168
Views
0
Helpful
2
Replies