IPSec VPN site-to-site setup using PIX and ASA

[cisco.bml]

I am doing a IPSec VPN site-to-site  setup using a PIX515E at site A and ASA5520 at Site B.

I have attach the lab diagram. Consider PIX and ASA are in default configuration meaning nothing is configured on both devices.

According to the diagram

ASA5520

Outside interface is 11.11.10.1/248 security level 0

Inside interface is 172.16.9.2/24 security level 100

Default route is 0.0.0.0 0.0.0.0 11.11.10.2   1

PIX515E

Outside interface is 123.123.10.2/248 security level 0

Inside interface is 172.16.10.1/24 security level 100

Default route is 0.0.0.0 0.0.0.0 123.123.10.1   1

Could anyone tell me how to configure this setup? I have tried but didnt workout. Below are the IKE I used.

IKE information:

IKE Encrytion DES

Authentication method MD5

Diffie-Helman group 2

Lifetime default

IPSEC information:

IPsec encryption DES

Authentication method MD5

Lifetime default

[Jitendriya Athavale]

please follow the below doc

http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/site2sit.html

[cisco.bml]

Still doesnt work. Below is the configuration of both ASA and PIX. Pls let me know what is wrong with this configuration.

ASA

interface GigabitEthernet0/0
nameif outside            
security-level 0
ip address11.11.10.1 255.255.255.248
!                                        
interface GigabitEthernet0/1
nameif inside             
security-level 100
ip address 172.16.9.1 255.255.255.0
!                                     
interface GigabitEthernet0/2
nameif dmz                
security-level 50
ip address 172.17.1.1 255.255.255.0
!                                     
interface GigabitEthernet0/3
shutdown                  
no nameif
no security-level
no ip address   
!            
interface Management0/0
nameif management    
security-level 100
ip address 192.168.0.1 255.255.255.0
management-only                     
!              
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive                
dns server-group DefaultDNS
domain-name bml.com.mv   
access-list inside_nat0_outbound extended permit ip 172.16.9.0 255.255.255.0 172.16.10.0 255.255.255.0
access-list outside_1_cryptomap extended permit ip 172.16.9.0 255.255.255.0 172.16.10.0 255.255.255.0 
pager lines 24                                                                                          
logging asdm informational
mtu management 1500      
mtu inside 1500   
mtu dmz 1500  
mtu outside 1500
no failover    
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-523.bin           
no asdm history enable       
arp timeout 14400    
nat (management) 0 0.0.0.0 0.0.0.0
nat (inside) 0 access-list inside_nat0_outbound
route outside 0.0.0.0 0.0.0.0 11.11.10.2 1 
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac          
crypto map outside_map 1 match address outside_1_cryptomap 
crypto map outside_map 1 set peer 123.123.10.2           
crypto map outside_map 1 set transform-set ESP-DES-MD5
crypto map outside_map interface outside             
crypto isakmp enable outside           
crypto isakmp policy 10    
authentication pre-share
encryption des         
hash md5     
group 2
lifetime 86400
service-policy global_policy global
tunnel-group 123.123.10.2 type ipsec-l2l
tunnel-group 123.123.10.2 ipsec-attributes
pre-shared-key *

PIX

PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto shutdown
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 intf2 security4  
enable password nSYhUXeQ67Bn.qPG encrypted
passwd 2KFQnbNIdI.2KYOU encrypted        
hostname siteA                    
domain-name sitea.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21               
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80          
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25   
fixup protocol sqlnet 1521
fixup protocol tftp 69   
names                
access-list 101 permit ip 172.16.101.0 255.255.255.0 10.10.10.0 255.255.255.248
pager lines 24                                                                 
mtu outside 1500
mtu inside 1500
mtu intf2 1500
ip address outside 123.123.10.2 255.255.255.248
ip address inside 172.16.10.1 255.255.255.0  
no ip address intf2                        
ip audit info action alarm
ip audit attack action alarm
pdm history enable         
arp timeout 14400
nat (inside) 0 access-list 101
route outside 0.0.0.0 0.0.0.0 123.123.10.1
timeout xlate 3:00:00                      
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00             
timeout sip-disconnect 0:02:00 sip-invite 0:03:00             
timeout uauth 0:05:00 absolute                  
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10          
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10          
aaa-server LOCAL protocol local
no snmp-server location                 
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable         
crypto ipsec transform-set ESP-DES-MD5-HMAC esp-des esp-md5-hmac
crypto map outside_map 20 ipsec-isakmp                          
crypto map outside_map 20 match address 101
crypto map outside_map 20 set peer 11.11.10.1
crypto map outside_map 20 set transform-set ESP-DES-MD5-HMAC
crypto map outside_map interface outside                   
isakmp enable outside                  
isakmp key ******** address 11.11.10.1 netmask 255.255.255.255
isakmp policy 10 authentication pre-share                        
isakmp policy 10 encryption des         
isakmp policy 10 hash md5     
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
telnet timeout 5              
ssh timeout 5  
console timeout 0
terminal width 80
Cryptochecksum:76882a561bcdb430a52467accd8fa57f
: end

[Jitendriya Athavale · Accepted solution]

please enter the following command

on asa

sysopt connection permit-vpn

and on pix not sure of the syntax i think it is

sysopt connection permit-ipsec

what we are trying to do here is basically allowing vpn ports to be open

alternatively you can open udp 500 and esp (or ip port 50) from out to in on both firewalls

[cisco.bml]

Thanks everyone. It really help and now its working after i run thoses

commands on both the ASA and PIX firewall.

Now I want to run ACL on VPN tunnel. Suppose i want to create an ACL to allow only to port 80, says there is a webserver running on SITEA. SITEB should only access that service from VPN tunnel. How should i create this ACL?

[Jitendriya Athavale]

keep only the required traffic in these acls outside_1_cryptomap and 101

for example if you want from A to access only 1 server on site B say c

access-list outside_1_cryptomap extended permit ip host c

and on the other side

access-list 101 extended permit ip host c

hope it helps