Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

OUTSIDE_cryptomap_65535.65535

Helo,

i have a problem with vpn on my ASA 5520

If i enable OUTSIDE_cryptomap_65535.65535 in the access list, the clients outside cann make vpn and

access the network, but everything els ( internet, site 2 site vpn, web access, ping ....) is disabled.

If i disable OUTSIDE_cryptomap_65535.65535 everything runs well, but clients can not make vpn.

Any help?

Thanks

3 REPLIES
Super Bronze

OUTSIDE_cryptomap_65535.65535

Hi,

We would need to see more configurations.

At the very least we should see the output of

show run crypto

To get some idea of your setup.

- Jouni

New Member

OUTSIDE_cryptomap_65535.65535

here is the log :

crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set TRANS_ESP_3DES_SHA mode transport
crypto ipsec ikev1 transform-set EZ-L2L-SET-1 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set DIPLEXA-SET esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set Bechtle esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set Westtours-Transform esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set RETARUS-SET esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set Company-RA-SET esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set Lambdalogic-IPsec-Policy esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set DSGV-BL-BX-SET esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set MR-Transfer-Set esp-aes-256 esp-sha-hmac
crypto ipsec ikev2 ipsec-proposal AES256
protocol esp encryption aes-256
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
protocol esp encryption aes-192
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
protocol esp encryption aes
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
protocol esp encryption 3des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal DES
protocol esp encryption des
protocol esp integrity sha-1 md5
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 match address OUTSIDE_cryptomap_65535.65535
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set Company-RA-SET
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
crypto map OUTSIDE_map 1 match address OUTSIDE_cryptomap_1
crypto map OUTSIDE_map 1 set peer x.x.x.x
crypto map OUTSIDE_map 1 set ikev1 transform-set Lambdalogic-IPsec-Policy
crypto map OUTSIDE_map 2 match address OUTSIDE_2_cryptomap
crypto map OUTSIDE_map 2 set pfs
crypto map OUTSIDE_map 2 set peer x.x.x.x
crypto map OUTSIDE_map 2 set ikev1 transform-set DIPLEXA-SET
crypto map OUTSIDE_map 2 set security-association lifetime kilobytes 9608000
crypto map OUTSIDE_map 3 match address OUTSIDE_cryptomap_2
crypto map OUTSIDE_map 3 set pfs group5
crypto map OUTSIDE_map 3 set peer x.x.x.x
crypto map OUTSIDE_map 3 set ikev1 transform-set Company-BL-BX-SET
crypto map OUTSIDE_map 3 set ikev2 pre-shared-key *****
crypto map OUTSIDE_map 4 match address OUTSIDE_cryptomap
crypto map OUTSIDE_map 4 set pfs group5
crypto map OUTSIDE_map 4 set peer x.x.x.x
crypto map OUTSIDE_map 4 set ikev1 transform-set Westtours-Transform
crypto map OUTSIDE_map 4 set nat-t-disable
crypto map OUTSIDE_map 5 match address OUTSIDE_5_cryptomap
crypto map OUTSIDE_map 5 set peer x.x.x.x
crypto map OUTSIDE_map 5 set ikev1 transform-set Bechtle ESP-3DES-SHA
crypto map OUTSIDE_map 6 match address OUTSIDE_6_cryptomap
crypto map OUTSIDE_map 6 set pfs
crypto map OUTSIDE_map 6 set peer x.x.x.x
crypto map OUTSIDE_map 6 set ikev1 transform-set ESP-AES-256-SHA
crypto map OUTSIDE_map 6 set reverse-route
crypto map OUTSIDE_map 7 match address OUTSIDE_cryptomap_3
crypto map OUTSIDE_map 7 set peer x.x.x.x
crypto map OUTSIDE_map 7 set ikev1 transform-set MR-Transfer-Set
crypto map OUTSIDE_map 8 match address OUTSIDE_cryptomap_4
crypto map OUTSIDE_map 8 set peer x.x.x.x
crypto map OUTSIDE_map 8 set ikev1 transform-set MR-Transfer-Set
crypto map OUTSIDE_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map OUTSIDE_map interface OUTSIDE


crypto ikev2 policy 1
encryption aes-256
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 10
encryption aes-192
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 20
encryption aes
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 30
encryption 3des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 40
encryption des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 enable OUTSIDE
crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
crypto ikev1 enable OUTSIDE
crypto ikev1 policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 29
authentication pre-share
encryption aes
hash sha
group 2
lifetime none
crypto ikev1 policy 30
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400
crypto ikev1 policy 31
authentication pre-share
encryption aes-256
hash sha
group 5
lifetime 86400
crypto ikev1 policy 32
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 3600

Super Bronze

OUTSIDE_cryptomap_65535.65535

Hi,

This configuration line should not be configured

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 match address OUTSIDE_cryptomap_65535.65535

First you would need to tell me what your aim with this is?

If you want to tell the ASA what traffic should be tunneled for a VPN Client connection then you would have to use Split Tunnel configurations under the "group-policy" of the VPN Client configuration.

So would need to know what you are trying to accomplish and then take a look at your current ASA configuration to determine the correct configurations needed to get this working.

- Jouni

179
Views
0
Helpful
3
Replies
CreatePlease login to create content