Hello all
I'm very new to VPN configurations.
I am trying to configure a site to site VPN connection between a Cisco ASA 5505 and a Westermo DR-270 router.(http://www.westermo.co.uk/web/web_en_idc_com.nsf/AllDocuments/C9CFF9CF2339026BC1257BF300222A3F)
The ASA is connected on LAN 0 to a BT Voyager ADSL router (192.168.1.1) - http://business.bt.com/pdf/BT_Voyager_tech_spec.pdf
The DR-270 is connected to another BT Voyager (172.16.201.1)
Both BT routers have Dynamic IP addresses.
The outside IP address on the ASA is 192.168.1.3 and 172.16.201.2 on the DR-270.
ASA 5505 (192.168.1.3) - - - - BT Voyager(192.168.1.1) - - - - - - - -
INTERNET
DR-270 (172.16.201.2) - - - - - BT Voyager (172.16.201.1) - - - - - - -
These devices are all in one location and its basically a lab setup for me. All I want to achieve is a VPN/tunnel connection between the two devices.
I turned on logging and it seems phase 1 of Ikve1 is failing. I've checked that the settings are the same on both devices but the tunnel wont come up.
Section of log from the DR-270:
14:49:00, 16 Oct 2014,(743) IKE SA Removed. Peer: ,Negotiation Failure
14:49:00, 16 Oct 2014,(743) IKE Negotiation Failed. Peer: ,Retries Exceeded
14:48:50, 16 Oct 2014,IKE Request Received From Eroute 0
14:48:45, 16 Oct 2014,PPP 1 down,Max negotiation time
14:48:40, 16 Oct 2014,IKE Request Received From Eroute 0
14:48:30, 16 Oct 2014,(743) New Phase 1 IKE Session 192.168.1.3,Initiator
Please could you have a look at the ASA running config below and let me know if anything obvious is missing or needs adjusting?
ciscoasa(config)# show run
: Saved
:
ASA Version 8.4(2)
!
hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
shutdown
!
interface Ethernet0/3
shutdown
!
interface Ethernet0/4
shutdown
!
interface Ethernet0/5
<--- More --->
shutdown
!
interface Ethernet0/6
shutdown
!
interface Ethernet0/7
shutdown
!
interface Vlan1
nameif inside
security-level 100
ip address 10.0.0.3 255.0.0.0
!
interface Vlan2
nameif outside
security-level 0
ip address 192.168.1.3 255.255.255.0
!
ftp mode passive
object-group network Westermo
network-object 172.16.0.0 255.255.0.0
object-group network CiscoASA
network-object 192.168.0.0 255.255.255.0
access-list VPN_Westermo extended permit ip object-group CiscoASA object-group Westermo
<--- More --->
access-list filter_Westermo extended permit tcp object-group Westermo eq 500 object-group CiscoASA eq 500
access-list filter_Westermo extended permit tcp object-group Westermo eq 1701 object-group CiscoASA eq 1701
access-list filter_Westermo extended permit tcp object-group Westermo eq 4500 object-group CiscoASA eq 4500
pager lines 24
mtu outside 1500
mtu inside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
nat (inside,outside) source static CiscoASA CiscoASA destination static Westermo Westermo
route outside 0.0.0.0 0.0.0.0 192.168.1.3 tunneled
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
<--- More --->
crypto dynamic-map outside_map 1 match address VPN_Westermo
crypto dynamic-map outside_map 1 set peer 172.16.201.2
crypto dynamic-map outside_map 1 set ikev1 transform-set ESP-DES-MD5
crypto dynamic-map outside_map 1 set security-association lifetime seconds 86400
crypto dynamic-map outside_map 1 set reverse-route
crypto map outside_map 1 set ikev1 phase1-mode aggressive
crypto map outside_map interface outside
crypto ikev1 enable outside
crypto ikev1 policy 65535
authentication pre-share
encryption des
hash md5
group 2
lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
group-policy grp_Westermo internal
group-policy grp_Westermo attributes
vpn-filter value filter_Westermo
<--- More --->
tunnel-group 0.0.0.0 type ipsec-l2l
tunnel-group 0.0.0.0 ipsec-attributes
ikev1 pre-shared-key *****
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
<--- More --->
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:24a3cb7677d6a8fb075460a45351089b
: end
Many thanks in advance!
