Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Need help with site-to-site VPN ikev1

Hi Guys,

I have 2 asa's 5505, both running 8.4(4), with ASDM 6.4(9).

I've rebuild the config probalby 6 times now, with no clues what I'm doing wrong.

My main concer is, why asa aren't even initiating VPN negiotiation, no traffic at all.

I can ping both devices on their outside interfaces ok.

IKEv1 is enabled on outside interfaces.

I've checked connection profile, tunnel group, crypto maps, IKE policies, etc.

Still nothing withing the logs, that would indicate any negotiation attempts.

Please help!

Everyone's tags (2)
1 ACCEPTED SOLUTION

Accepted Solutions
Super Bronze

Need help with site-to-site VPN ikev1

Hi,

Well it depends on your setup really. Mostly in the amount of networks that are at each site that use the L2L VPN.

But generally you could configure it with

object-group network LOCAL

network-object

object-group network REMOTE

network-object

nat (inside,outside) source static LOCAL LOCAL destination static REMOTE REMOTE

Naturally the "object-group" names can be different and your interfaces might not be named "inside" and "outside"

- Jouni

7 REPLIES
Super Bronze

Need help with site-to-site VPN ikev1

Hi,

We would need to see configurations of both units to check for any problems with the configurations.

If your L2L VPN connections is configured correctly but there is no negotiation at all between the units then it would usually mean that there might be problems with the NAT configurations so that the traffic initiated from the LAN wont match the L2L VPN configurations and therefore wont initiate the negotiation.

- Jouni

New Member

Need help with site-to-site VPN ikev1

Hi Jouni,

How do I exempt lan traffic from NAT on this Cisco ASA version via crypto map?

Martin

Super Bronze

Need help with site-to-site VPN ikev1

Hi,

Well it depends on your setup really. Mostly in the amount of networks that are at each site that use the L2L VPN.

But generally you could configure it with

object-group network LOCAL

network-object

object-group network REMOTE

network-object

nat (inside,outside) source static LOCAL LOCAL destination static REMOTE REMOTE

Naturally the "object-group" names can be different and your interfaces might not be named "inside" and "outside"

- Jouni

New Member

Need help with site-to-site VPN ikev1

Hi Jouni,

Thank you for your  help, it gave enought info to troubleshoot the vpn.

I 've factory defaulted the device which I susspected to be the problem, and rebuild the config, adn VPN came up, still have to sort ACL issue, but I'm getting somewhere.

I'll let you know soon.

Thanks again

Martin

New Member

Need help with site-to-site VPN ikev1

Hi Jouni,

I got the tunnel up, but traffic is not passing through, when i run packet tracer, it all seems fine, whe i try to ping from inside interface of one asa to other  i get:









Routing failed to locate next hop for icmp from NP Identity Ifc:192.168.0.250/0 to inside:192.168.8.10/0

Do I have to allow ICMP through for that?

Is that problem with a defualt route?

Super Bronze

Need help with site-to-site VPN ikev1

Hi,

If you want to ping an internal ASA interface through the L2L VPN then you need the command "management-access " command on the ASA to which you want to ICMP. Naturally you will have to replace the "nameif" in the command with the actual "nameif" of the internal interface. This can be configured only for a single interface.

You will also possibly need to have a look at the NAT0 configuration if it doesnt work after this.

By default you should no need access rules for traffic incoming from VPN

- Jouni

New Member

Need help with site-to-site VPN ikev1

Hi Jouni,

That's great it worked.

Thank you very much fro your help.

Kind rehards

Martin

245
Views
0
Helpful
7
Replies
CreatePlease login to create content