Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Help with a site to site VPN using ASA 5505 and third party router

Hello all

I'm very new to VPN configurations.

I am trying to configure a site to site VPN connection between a Cisco ASA 5505 and a Westermo DR-270 router.(http://www.westermo.co.uk/web/web_en_idc_com.nsf/AllDocuments/C9CFF9CF2339026BC1257BF300222A3F)

The ASA is connected on LAN 0 to a BT Voyager ADSL router (192.168.1.1) - http://business.bt.com/pdf/BT_Voyager_tech_spec.pdf

The DR-270 is connected to another BT Voyager (172.16.201.1)

Both BT routers have Dynamic IP addresses.

The outside IP address on the ASA is 192.168.1.3 and 172.16.201.2 on the DR-270.

 

ASA 5505 (192.168.1.3) - - - - BT Voyager(192.168.1.1) - - - - - - - -

                                                                                                      INTERNET

DR-270 (172.16.201.2) - - - - - BT Voyager (172.16.201.1) - - - - - - -

 

These devices are all in one location and its basically a lab setup for me. All I want to achieve is a VPN/tunnel connection between the two devices.

I turned on logging and it seems phase 1 of Ikve1 is failing. I've checked that the settings are the same on both devices but the tunnel wont come up.

 

Section of log from the DR-270:

14:49:00, 16 Oct 2014,(743) IKE SA Removed. Peer: ,Negotiation Failure

14:49:00, 16 Oct 2014,(743) IKE Negotiation Failed. Peer: ,Retries Exceeded

14:48:50, 16 Oct 2014,IKE Request Received From Eroute 0

14:48:45, 16 Oct 2014,PPP 1 down,Max negotiation time

14:48:40, 16 Oct 2014,IKE Request Received From Eroute 0

14:48:30, 16 Oct 2014,(743) New Phase 1 IKE Session 192.168.1.3,Initiator

 

Please could you have a look at the ASA running config below and let me know if anything obvious is missing or needs adjusting?


ciscoasa(config)# show run
: Saved
:
ASA Version 8.4(2)
!
hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
 shutdown
!
interface Ethernet0/3
 shutdown
!
interface Ethernet0/4
 shutdown
!
interface Ethernet0/5
<--- More --->
             
 shutdown
!
interface Ethernet0/6
 shutdown
!
interface Ethernet0/7
 shutdown
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 10.0.0.3 255.0.0.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 192.168.1.3 255.255.255.0
!
ftp mode passive
object-group network Westermo
 network-object 172.16.0.0 255.255.0.0
object-group network CiscoASA
 network-object 192.168.0.0 255.255.255.0
access-list VPN_Westermo extended permit ip object-group CiscoASA object-group Westermo
<--- More --->
             
access-list filter_Westermo extended permit tcp object-group Westermo eq 500 object-group CiscoASA eq 500
access-list filter_Westermo extended permit tcp object-group Westermo eq 1701 object-group CiscoASA eq 1701
access-list filter_Westermo extended permit tcp object-group Westermo eq 4500 object-group CiscoASA eq 4500
pager lines 24
mtu outside 1500
mtu inside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
nat (inside,outside) source static CiscoASA CiscoASA destination static Westermo Westermo
route outside 0.0.0.0 0.0.0.0 192.168.1.3 tunneled
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
<--- More --->
             
crypto dynamic-map outside_map 1 match address VPN_Westermo
crypto dynamic-map outside_map 1 set peer 172.16.201.2
crypto dynamic-map outside_map 1 set ikev1 transform-set ESP-DES-MD5
crypto dynamic-map outside_map 1 set security-association lifetime seconds 86400
crypto dynamic-map outside_map 1 set reverse-route
crypto map outside_map 1 set ikev1 phase1-mode aggressive
crypto map outside_map interface outside
crypto ikev1 enable outside
crypto ikev1 policy 65535
 authentication pre-share
 encryption des
 hash md5
 group 2
 lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
group-policy grp_Westermo internal
group-policy grp_Westermo attributes
 vpn-filter value filter_Westermo
<--- More --->
             
tunnel-group 0.0.0.0 type ipsec-l2l
tunnel-group 0.0.0.0 ipsec-attributes
 ikev1 pre-shared-key *****
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect ip-options
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny 
  inspect esmtp
<--- More --->
             
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip 
  inspect xdmcp
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:24a3cb7677d6a8fb075460a45351089b
: end

 

Many thanks in advance!

 

 

 

2 REPLIES
VIP Green

So traffic goes to the

So traffic goes to the internet before it reaches the remote site?  If that is the case where is NAT happening (I am assuming on the BT router)?

Please verify how the traffic flows between the two routers (since you say they are both located at the same site).

--

Please remember to select a correct answer and rate helpful posts

--

Please remember to rate and select a correct answer
New Member

Hi there Sorry for the late

Hi there

 

Sorry for the late reply!

I have since abandoned this setup to use a VPN concentrator in one of our test labs instead.

The setup is easier and I'm working on it now.

Thanks for your help.

311
Views
5
Helpful
2
Replies
CreatePlease login to create content