We currently have L2L using cisco (2) ASA 5505’s setup between our main office and new location. We have recently moved our DC from our 192.168.1.0 network to our 192.168.2.0 network. This server provides dhcp for the new location and DNS for both sites. We are currently experience a high percentage of drop packets close to 25%. When we try to ping the DC (192.168.2.10) from the .1.0 network we have a high percentage of drop packets but pinging to outside address (4.2.2.2) we have about a 5% drop packets. It seems that something is wrong with the VPN tunnel which is causing the dropped packets. This was first noticed because pcs are taking extremely long time to authenticate to the domain and contact the DC for files.
Thanks ahead of time for any assistance. If more info is needed, just ask.
I may be missing something on the asa’s that could mean an easy fix but I am unable to figure this out. The config is as followed:
Config for Site A (new site - w/ DC 192.168.2.0):
login as: admin
admin@*.*.*.* password:
Type help or '?' for a list of available commands.
LSCMainCar-asa> en
Password: **************
LSCMainCar-asa# sh conf
: Saved
!
ASA Version 8.2(5)
!
hostname LSCMainCar-asa
domain-name *.local
enable password VPIGZJE/slohtM0G encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
name 192.168.2.10 lsc-dc01
!
interface Ethernet0/0
switchport access vlan 2
speed 10
duplex full
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
description LSC Internal Interface
nameif inside
security-level 100
ip address 192.168.2.254 255.255.255.0
!
interface Vlan2
description LSC External Interface
nameif outside
security-level 0
ip address *.*.*.* 255.255.255.252
!
ftp mode passive
dns server-group DefaultDNS
domain-name *.local
access-list CarMain2Laf extended permit ip 192.168.2.0 255.255.255.0 192.168.0.0 255.255.255.0
access-list CarMain2C extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list nonat extended permit ip 192.168.2.0 255.255.255.0 192.168.0.0 255.255.255.0
access-list nonat extended permit ip 192.168.2.0 255.255.255.0 192.168.5.0 255.255.255.0
access-list nonat extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list outside_in extended permit tcp any any eq 3389
access-list LSC_sACL extended permit ip 192.168.2.0 255.255.255.0 any
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp interface 3389 lsc-dc01 3389 netmask 255.255.255.255
access-group outside_in in interface outside
route outside 0.0.0.0 0.0.0.0 *.*.*.* 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server aaa_group2 protocol radius
aaa-server aaa_group2 (inside) host 192.168.1.10
key *
radius-common-pw *
aaa authentication ssh console LOCAL
aaa authentication telnet console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
http 192.168.2.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set myset esp-3des esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map outside_map 20 match address CarMain2C
crypto map outside_map 20 set pfs
crypto map outside_map 20 set peer <*.*.*.*66>
crypto map outside_map 20 set transform-set myset
crypto map outside_map 30 match address CarMain2Laf
crypto map outside_map 30 set pfs
crypto map outside_map 30 set peer (*.*.*.*173)
crypto map outside_map 30 set transform-set myset
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
telnet 192.168.2.0 255.255.255.0 inside
telnet 192.168.1.0 255.255.255.0 inside
telnet 192.168.0.0 255.255.255.0 inside
telnet timeout 5
ssh 192.168.0.0 255.255.255.0 inside
ssh 192.168.1.0 255.255.255.0 inside
ssh 192.168.2.0 255.255.255.0 inside
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
username admin password * encrypted
tunnel-group DefaultL2LGroup ipsec-attributes
isakmp keepalive threshold 60 retry 10
tunnel-group DefaultRAGroup ipsec-attributes
isakmp keepalive threshold 60 retry 10
tunnel-group DefaultWEBVPNGroup ipsec-attributes
isakmp keepalive threshold 60 retry 10
tunnel-group *.*.*.*66 type ipsec-l2l
tunnel-group *.*.*.*66 ipsec-attributes
pre-shared-key *
isakmp keepalive threshold 60 retry 10
tunnel-group *.*.*.*173 type ipsec-l2l
tunnel-group *.*.*.*173 ipsec-attributes
pre-shared-key *
isakmp keepalive threshold 60 retry 10
!
!
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:c23927f0cd44c433db6d7ccec039d6ed
Config for Site B (old site - 192.168.1.0):
login as: admin
admin@*.*.*.*66 password:
Type help or '?' for a list of available commands.
lsc-asa> en
Password: **************
lsc-asa# sh conf
: Saved
!
ASA Version 8.2(1)
!
hostname lsc-asa
domain-name * .local
enable password VPIGZJE/slohtM0G encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
name 192.168.2.10 lsc-dc01
!
interface Vlan1
description LSC Internal Interface
nameif inside
security-level 100
ip address 192.168.1.254 255.255.255.0
!
interface Vlan2
description LSC External Interface
nameif outside
security-level 0
ip address *.*.*.*66 255.255.255.252
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
boot system disk0:/asa821-k8.bin
ftp mode passive
dns server-group DefaultDNS
domain-name *.local
access-list C2LAF extended permit ip 192.168.1.0 255.255.255.0 192.168.0.0 255.255.255.0
access-list nonat extended permit ip 192.168.1.0 255.255.255.0 192.168.0.0 255.255.255.0
access-list nonat extended permit ip 192.168.1.0 255.255.255.0 192.168.5.0 255.255.255.0
access-list nonat extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list outside_in extended permit tcp any any eq 3389
access-list LSC_sACL extended permit ip 192.168.1.0 255.255.255.0 any
access-list CarMain2C extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list from_outside extended permit icmp any any echo
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
ip local pool LSCpool 192.168.5.175-192.168.5.200 mask 255.255.255.0
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-642.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp interface 3389 192.168.1.10 3389 netmask 255.255.255.255
access-group outside_in in interface outside
route outside 0.0.0.0 0.0.0.0 *.*.*.*66 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server aaa_group2 protocol radius
aaa-server aaa_group2 (inside) host 192.168.1.10
key *
radius-common-pw *
aaa authentication ssh console LOCAL
aaa authentication telnet console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set myset esp-3des esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map outside_dyn_map 101 set pfs group1
crypto dynamic-map outside_dyn_map 101 set transform-set myset
crypto map outside_map 20 match address C2LAF
crypto map outside_map 20 set peer *.*.*.*173
crypto map outside_map 20 set transform-set myset
crypto map outside_map 30 match address CarMain2C
crypto map outside_map 30 set pfs
crypto map outside_map 30 set peer *.*.*.*66
crypto map outside_map 30 set transform-set myset
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
crypto isakmp nat-traversal 60
telnet 192.168.1.0 255.255.255.0 inside
telnet *.*.*.*66 255.255.255.255 outside
telnet timeout 5
ssh 192.168.1.0 255.255.255.0 inside
ssh timeout 5
console timeout 0
vpdn group pppoe_group request dialout pppoe
vpdn group pppoe_group localname *@static.att.net
vpdn group pppoe_group ppp authentication pap
vpdn username *@static.att.net password *
dhcpd dns lsc-dc01
dhcpd auto_config outside
!
dhcpd address 192.168.1.100-192.168.1.150 inside
dhcpd dns lsc-dc01 interface inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
group-policy LSCvpn internal
group-policy LSCvpn attributes
dns-server value 192.168.2.10
vpn-idle-timeout none
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value LSC_sACL
default-domain value *.local
username admin password * encrypted privilege 15
tunnel-group LSCvpn type remote-access
tunnel-group LSCvpn general-attributes
address-pool LSCpool
authentication-server-group aaa_group2
default-group-policy LSCvpn
tunnel-group LSCvpn ipsec-attributes
pre-shared-key *
tunnel-group *.*.*.*173 type ipsec-l2l
tunnel-group *.*.*.*173 ipsec-attributes
pre-shared-key *
tunnel-group *.*.*.*216 type ipsec-l2l
tunnel-group *.*.*.*216 ipsec-attributes
pre-shared-key *
tunnel-group-map default-group LSCvpn
!
class-map inspection_default
!
!
policy-map global_policy
class inspection_default
inspect icmp
!
prompt hostname context
Cryptochecksum:9d508111536d875dda252f29bc8a49f1
