Site-to-Site VPN connectivity issues

[Joel Fox]

Good morning - I have a Cisco ASA5505 that I am trying to establish a vpn connection to a remote site, and I cannot get phase 1 to establish.  When I execute the command sh crypto isakmp sa I get the following output: There are no isakmp sas. I am running ver 8.2(5).  Is there another command I can run to se why Phase 1 is not even attempting connection?  The configuration is posted below.  Any suggestions are greatly appreciated!

ASA Version 8.2(5)
!
hostname ASA5505
enable password
passwd
names
**omitted**
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.0 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 5.6.7.8 255.255.255.252
!
ftp mode passive
object-group network Remote_Sites
!
access-list outside_access_in extended permit ip any any
access-list outside_access_in extended permit icmp any any
access-list inside_access_in extended permit icmp any any
access-list inside_access_in extended permit ip any any
access-list outside_cryptomap_1 extended permit ip 192.168.1.0 255.255.255.0 any
access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 any
no pager
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 Outside 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication enable console LOCAL
aaa authentication ssh console LOCAL
aaa authentication telnet console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map outside_map 1 match address outside_cryptomap_1
crypto map outside_map 1 set pfs
crypto map outside_map 1 set peer 1.2.3.4
crypto map outside_map 1 set transform-set ESP-AES-256-SHA
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400
crypto isakmp policy 20
authentication rsa-sig
encryption aes-256
hash sha
group 2
lifetime 86400
crypto isakmp policy 40
authentication crack
encryption aes-192
hash sha
group 2
lifetime 86400
crypto isakmp policy 50
authentication rsa-sig
encryption aes-192
hash sha
group 2
lifetime 86400
crypto isakmp policy 60
authentication pre-share
encryption aes-192
hash sha
group 2
lifetime 86400
crypto isakmp policy 70
authentication crack
encryption aes
hash sha
group 2
lifetime 86400
crypto isakmp policy 80
authentication rsa-sig
encryption aes
hash sha
group 2
lifetime 86400
crypto isakmp policy 90
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
crypto isakmp policy 100
authentication crack
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 110
authentication rsa-sig
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 120
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 130
authentication crack
encryption des
hash sha
group 2
lifetime 86400
crypto isakmp policy 140
authentication rsa-sig
encryption des
hash sha
group 2
lifetime 86400
crypto isakmp policy 150
authentication pre-share
encryption des
hash sha
group 2
lifetime 86400
crypto isakmp policy 170
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400

console timeout 0

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
tunnel-group 1.2.3.4 type ipsec-l2l
tunnel-group 1.2.3.4 ipsec-attributes
pre-shared-key *****
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny 
  inspect sunrpc
  inspect xdmcp
  inspect sip 
  inspect netbios
  inspect tftp
  inspect ip-options
  inspect icmp
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:d7cefbdc12dc95062b7567572e704b14
: end

[mvsheik123]

Hi Joel,

Looks like your default route statement is not correct..

no route outside 0.0.0.0 0.0.0.0 Outside 1

route outside 0.0.0.0 0.0.0.0 1

This might bring up the VPN.

Couple of other points.. The NAT0 statements has destination of any. Your internet access may not work from internal hosts. Again, its hard to tell without knowledge of your network/requirements.

iam not quite sure if you need ip any any ACLs on the putside/inside internfaces. Especially on outside- you are allowing everything- not a good idea. Again, its my openion.

hth

MS

[Artem Tkachov]

Hi Joel,

Good point regarding checking static route, but I believe it should work.

Please have a look for this ACL -->

access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 any

I'm not really sure that it should be like this, unless you have some other networks behind 192.168.1.0/24. Better to define some perticular IP address/network as destination. Because, if you will have ACL like this, your 192.168.1.0/24 subnet will not be able to reach internet.

Once you will finish with this one, please try to generate a traffic with packet tracer:

# packet-tra in inside icmp 192.168.1.100 8 0 $remote side ip$ detail

Output you can post here.

Other thing, that you can use folowwing debugs:

# debug crypto isa 140

# debug crypto ips 140

From this you will be able to understand background process of ISAKMP/IKE negotiation.

If your tunnel will not brings up till now, please also attach outputs from this debug commands.

Thank you.

[Joel Fox]

Thank you both for responding!  The acl-inside is set to "any" because this is to our access provider's network firewall.  Unfortunately, there is no way around directing all traffic, including internet traffic through them.  While on support with them, I could not get them to provide their inside IP, so I had to use the "any" option.  I really do not want internet traffic governed by our provider, but in this scenario I have no option!

As for Phase 1 not establishing, that was my fault - I was trying to use the GUI because I needed it done quickly, and the authentication was set to "crack" not pre-share" as it was on the other end.  It is correct in the output above because I made the change right before posting this thread.  Apparently I wasn't patient enough, because the session established shortly thereafter.

Thank you,

Joel

[Artem Tkachov]

Hi Joel,

That's good news, that you was able to find the solution.

Next time you can use previously mentioned debug commands for troubleshooting.

They should help you a lot.

Cheers,

Artem.

[mvsheik123]

Thanks for the update. Please mark the question answered, if your issue is resolved.

Thx

MS