Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Problem vpn ipsec

We have to configure our firewall cisco Asa 505 (ASA Version 8.3(1)) in order to establish a ipsec vpn between our office

site and another external site.

Vpn has been established successfully between our ip site 172.16.69.24 and other vpn ip site 172.16.23.23.

Our server (192.168.100.25) behind firewall cisco (sk lan 192.168.100.254) manages to ping server 172.16.23.23 on other

site through a static route add on windows so server (route add 172.16.23.0 MAK 255.255.255.0 192.168.100.254).

On the other site, server with ip 172.16.23.23 doesn't ping our vpn ip site (172.16.69.24) which has to be natted to our

server 192.168.100.25.

How can you do this, I would be grateful to anyone who can suggest a solution.

thanks a lot.

2 REPLIES
New Member

Problem vpn ipsec

there is no one to help me?

We have to configure our firewall cisco Asa 505 (ASA Version 8.3(1)) in order to establish a ipsec vpn between our office

site and another external site.

Vpn has been established successfully between our ip site 172.16.69.24 and other vpn ip site 172.16.23.23.

Our server (192.168.100.25) behind firewall cisco (sk lan 192.168.100.254) manages to ping server 172.16.23.23 on other

site through a static route add on windows so server (route add 172.16.23.0 MAK 255.255.255.0 192.168.100.254).

On the other site, server with ip 172.16.23.23 doesn't ping our vpn ip site (172.16.69.24) which has to be natted to our

server 192.168.100.25.

How can you do this, I would be grateful to anyone who can suggest a solution.

thanks a lot.

ASA Version 8.3(1)

!

hostname ciscoasa

domain-name default.domain.invalid

enable password xxxxxxxxxxxxxxx encrypted

passwd xxxxxxxxxxxxxxx encrypted

names

!

interface Vlan1

nameif inside

security-level 100

ip address 192.168.100.254 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address 62.149.x.x 255.255.224.0

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

boot system disk0:/asa831-k8.bin

ftp mode passive

dns server-group DefaultDNS

domain-name default.domain.invalid

object network obj-172.16.23.23

host 172.16.23.23

object network obj_any

subnet 0.0.0.0 0.0.0.0

object-group service DM_INLINE_TCP_1 tcp

port-object eq www

port-object eq ftp

port-object eq ftp-data

object-group network CLIENT-VPN

description client per server

network-object host 192.168.100.25

object-group network SERVER-PS

network-object host 172.16.23.23

object-group network IP-NAT-PER-VPN

description IP di presentazione  verso server qs

network-object host 172.16.69.24

access-list outside_1_cryptomap extended permit ip host 172.16.69.24 172.16.23.0 255.255.255.0

access-list inside_nat0_outbound extended permit ip host 172.16.69.24 172.16.23.0 255.255.255.0

access-list VPN extended permit ip host 192.168.100.25 host 172.16.23.23

access-list per-nat-vpn extended permit ip host 172.16.69.24 172.16.23.0 255.255.255.0

access-list acl-outside remark Migration: End of expansion

access-list capture extended permit ip host 192.168.100.25 host 172.16.23.23

pager lines 24

logging enable

logging asdm informational

mtu inside 1500

mtu outside 1500

no failover

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-631.bin

no asdm history enable

arp timeout 14400

nat (inside,any) source static CLIENT-VPN CLIENT-VPN destination static obj-172.16.23.23 obj-172.16.23.23

!

object network obj_any

nat (inside,outside) dynamic interface

route outside 0.0.0.0 0.0.0.0 62.149.x.x 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-record DfltAccessPolicy

aaa authentication ssh console LOCAL

aaa authentication serial console LOCAL

aaa authentication telnet console LOCAL

http server enable

http 0.0.0.0 0.0.0.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec transform-set T-T esp-aes-256 esp-sha-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto map outside_map 1 match address VPN

crypto map outside_map 1 set peer 195.120.182.61

crypto map outside_map 1 set transform-set T-T

crypto map outside_map 1 set security-association lifetime seconds 3600

crypto map outside_map 1 set security-association lifetime kilobytes 100000

crypto map outside_map interface outside

crypto isakmp identity address

crypto isakmp enable outside

crypto isakmp policy 30

authentication pre-share

encryption aes-256

hash sha

group 2

lifetime 28800

no crypto isakmp nat-traversal

telnet 0.0.0.0 0.0.0.0 inside

telnet timeout 5

ssh 0.0.0.0 0.0.0.0 inside

ssh timeout 5

ssh version 2

console timeout 0

dhcpd auto_config outside

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

csd image disk0:/csd_3.5.841-k9.pkg

username admin password xxxxxxxxxxx encrypted

username mbuonfiglio password xxxxxxxxxxxxxxx encrypted

tunnel-group 195.120.x.x type ipsec-l2l

tunnel-group 195.120.x.x ipsec-attributes

pre-shared-key ***********

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny

  inspect sunrpc

  inspect xdmcp

  inspect sip

  inspect netbios

  inspect tftp

  inspect ip-options

!

service-policy global_policy global

prompt hostname context

call-home

profile CiscoTAC-1

  no active

  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

  destination address email callhome@cisco.com

  destination transport-method http

  subscribe-to-alert-group diagnostic

  subscribe-to-alert-group environment

  subscribe-to-alert-group inventory periodic monthly

  subscribe-to-alert-group configuration periodic monthly

  subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:3767bae16e27d3d50f1b21e2c6c82e49

: end

Bronze

Problem vpn ipsec

Hi Matteo,

This need a bit clarification..

Your server at the remote site,  what is the actual IP of the remote server ? is the remote server being NATed as well?

Your issue is : From the remote server, you cant ping the your local server (192.168.100.25) ??

Shamal

653
Views
0
Helpful
2
Replies
CreatePlease login to create content