Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Site to Site VPN with ASA 5505 and PIX 501

I am set up a site-to-site vpn with an ASA 5505 at one end and a PIX 501 at the other.

I followed the section titled Configuring LAN-to-LAN IPsec VPNs from the Command Line Configuration Guide and added these line to the ASA config:

isakmp policy 10 authentication pre-share

isakmp policy 10 encryption 3des

isakmp policy 10 hash sha

isakmp policy 10 group 2

isakmp policy 10 lifetime 43200

isakmp enable outside

crypto ipsec transform-set TRANSFORM_SET esp-3des esp-sha-hmac

access-list l2l_list extended permit ip 10.0.1.0 255.255.255.0 192.168.1.0 255.255.255.0

tunnel-group yyy.yyy.yyy.yyy type ipsec-l2l

tunnel-group yyy.yyy.yyy.yyy ipsec-attributes

pre-shared-key ****

crypto map CRYPTO_MAP 10 match address l2l_list

crypto map CRYPTO_MAP 10 set peer yyy.yyy.yyy.yyy

crypto map CRYPTO_MAP 10 set transform-set TRANSFORM_SET

crypto map CRYPTO_MAP interface outside

For the PIX I followed the example config in Richard Deal's book Cisco PIX Firewalls and added these lines to the PIX config:

access-list l2l_list permit ip 192.168.1.0 255.255.255.0 10.0.1.0 255.255.255.0

nat (inside) 0 access-list l2l_list

access-list IPSEC permit udp host yyy.yyy.yyy.yyy host xxx.xxx.xxx.xxx eq isakmp

access-list IPSEC permit ah host yyy.yyy.yyy.yyy host xxx.xxx.xxx.xxx

access-list IPSEC permit esp host yyy.yyy.yyy.yyy host xxx.xxx.xxx.xxx

access-group IPSEC in interface outside

isakmp policy 10 authentication pre-share

isakmp policy 10 encryption 3des

isakmp policy 10 group 2

isakmp policy 10 hash sha

isakmp key **** address xxx.xxx.xxx.xxx

crypto ipsec transform-set TRANSFORM_SET esp-3des esp-sha-hmac

crypto map GHA_CRYPTO_MAP 10 ipsec-isakmp

crypto map GHA_CRYPTO_MAP 10 set peer xxx.xxx.xxx.xxx

crypto map GHA_CRYPTO_MAP 10 match address l2l_list

crypto map GHA_CRYPTO_MAP 10 set transform-set TRANSFORM_SET

crypto map GHA_CRYPTO_MAP interface outside

I have not been able to establish a connection between the two devices.  I just don't see what I am missing.  Maybe it is not even possible with these two devices.  The ASA has version is 7.2(4) and I believe the PIX is running version 6.3 (I will have to double check later).

Thanks for your help.

26 REPLIES

Re: Site to Site VPN with ASA 5505 and PIX 501

Hi,

Sure that you can establish an IPSec tunnel between both devices.

You're missing the NAT0 statement on the ASA (just like you have it on the PIX, referring the ACL)

Then, you can check if the tunnel is trying to establish with the commands:

sh cry isa sa

sh cry ips sa

Federico.

New Member

Re: Site to Site VPN with ASA 5505 and PIX 501

I added this to the ASA
nat (inside) 0 access-list l2l_list

This is the result:

ASA(config)# sh cry is sa

   Active SA: 1

    Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)

Total IKE SA: 1

1   IKE Peer: yyy.yyy.yyy.yyy

    Type    : user            Role    : initiator

    Rekey   : no              State   : MM_WAIT_MSG2

ASA(config)# sh cry ips sa

There are no ipsec sas

Re: Site to Site VPN with ASA 5505 and PIX 501

The tunnel from the PIX is landing on the wrong tunnel-group because it's being recognized on the ASA as a ''user''
connection. Should be a LAN-to-LAN.

Could you post both configs?

Federico.

New Member

Re: Site to Site VPN with ASA 5505 and PIX 501

ASA Version 7.2(4)

!

hostname ASA

domain-name xxx.com

enable password **** encrypted

passwd **** encrypted

names

!

interface Vlan1

nameif inside

security-level 100

ip address 10.0.1.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address xxx.xxx.xxx.xxx 255.255.255.240

!

interface Vlan3

no forward interface Vlan1

nameif dmz

security-level 50

no ip address

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

banner exec Authorized Access Only!!

ftp mode passive

clock timezone CST -6

clock summer-time CDT recurring

dns server-group DefaultDNS

domain-name xxx.com

object-group protocol TCPUDP

protocol-object udp

protocol-object tcp

access-list outside_in extended permit icmp any any echo-reply

access-list outside_in extended permit icmp any any time-exceeded

access-list outside_in extended permit tcp any interface outside eq pptp

access-list outside_in extended permit tcp any interface outside eq 3389

access-list outside_in extended permit tcp any interface outside eq ftp

access-list outside_in extended permit tcp any interface outside eq www

access-list outside_in extended permit tcp any interface outside eq https

access-list outside_in extended permit tcp any interface outside eq 3101

access-list split_tunnel extended permit ip 172.17.3.0 255.255.255.0 any

access-list split_tunnel extended permit ip 192.168.0.0 255.255.255.0 any

access-list no_nat extended permit ip 192.168.0.0 255.255.255.0 172.16.49.0 255.255.255.0

access-list no_nat extended permit ip 192.168.0.0 255.255.255.0 172.17.3.0 255.255.255.0

access-list l2l_list extended permit ip 10.0.1.0 255.255.255.0 192.168.1.0 255.255.255.0

pager lines 24

logging asdm informational

mtu inside 1500

mtu outside 1500

mtu dmz 1500

ip local pool dynamic_vpn_pool 172.17.3.1-172.17.3.254 mask 255.255.255.0

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-524.bin

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list l2l_list

nat (inside) 1 0.0.0.0 0.0.0.0

static (inside,outside) tcp interface ftp 10.0.1.5 ftp netmask 255.255.255.255

static (inside,outside) tcp interface pptp 10.0.1.10 pptp netmask 255.255.255.255

static (inside,outside) tcp interface smtp 10.0.1.11 smtp netmask 255.255.255.255

static (inside,outside) tcp interface www 10.0.1.11 www netmask 255.255.255.255

static (inside,outside) tcp interface https 10.0.1.11 https netmask 255.255.255.255

static (inside,outside) tcp interface 3389 10.0.1.11 3389 netmask 255.255.255.255

access-group outside_in in interface outside

route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

aaa authentication http console LOCAL

aaa authentication telnet console LOCAL

aaa authentication ssh console LOCAL

http server enable

http 192.168.1.0 255.255.255.0 inside

http 10.0.1.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set TRANSFORM_SET esp-3des esp-sha-hmac

crypto map CRYPTO_MAP 10 match address l2l_list

crypto map CRYPTO_MAP 10 set peer yyy.yyy.yyy.yyy

crypto map CRYPTO_MAP 10 set transform-set TRANSFORM_SET

crypto map CRYPTO_MAP interface outside

crypto isakmp enable outside

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 43200

telnet 10.0.1.0 255.255.255.0 inside

telnet 172.17.3.0 255.255.255.0 inside

telnet timeout 5

ssh 66.226.222.16 255.255.255.240 outside

ssh timeout 5

console timeout 0

group-policy employees internal

group-policy employees attributes

dns-server value 10.0.1.15

vpn-idle-timeout 720

split-tunnel-policy tunnelspecified

split-tunnel-network-list value split_tunnel

default-domain value xxx.com

username twistadmin password ***** encrypted privilege 15

username administrator password ***** encrypted privilege 15

tunnel-group employees type ipsec-ra

tunnel-group employees general-attributes

address-pool dynamic_vpn_pool

authentication-server-group (outside) LOCAL

default-group-policy employees

tunnel-group employees ipsec-attributes

pre-shared-key *

tunnel-group yyy.yyy.yyy.yyy type ipsec-l2l

tunnel-group yyy.yyy.yyy.yyy ipsec-attributes

pre-shared-key ****

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map global_policy

class inspection_default

  inspect pptp

  inspect ftp

!

service-policy global_policy global

prompt hostname context

Cryptochecksum:8aab3de376588b71bb7ac1c89f9d07ca

: end

Message was edited by: jerryfreeman

New Member

Re: Site to Site VPN with ASA 5505 and PIX 501

Here is the PIX config.
PIX Version 6.3(1)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password **** encrypted
passwd **** encrypted
hostname PIX
domain-name xxx.com
clock timezone CST -6
clock summer-time CDT recurring 2 Sun Mar 2:00 1 Sun Nov 2:00
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
names
access-list l2l_list permit ip 192.168.1.0 255.255.255.0 10.0.1.0 255.255.255.0
access-list IPSEC permit udp host yyy.yyy.yyy.yyy host xxx.xxx.xxx.xxx eq isakmp
access-list IPSEC permit ah host yyy.yyy.yyy.yyy host xxx.xxx.xxx.xxx
access-list IPSEC permit esp host yyy.yyy.yyy.yyy host xxx.xxx.xxx.xxx
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside dhcp setroute
ip address inside 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list l2l_list
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group IPSEC in interface outside
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
crypto ipsec transform-set TRANSFORM_SET esp-3des esp-sha-hmac
crypto map CRYPTO_MAP 10 ipsec-isakmp
crypto map CRYPTO_MAP 10 match address l2l_list
crypto map CRYPTO_MAP 10 set peer xxx.xxx.xxx.xxx
crypto map CRYPTO_MAP 10 set transform-set TRANSFORM_SET
crypto map CRYPTO_MAP interface outside
isakmp enable outside
isakmp key ******** address xxx.xxx.xxx.xxx netmask 255.255.255.255
isakmp identity address
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash sha
isakmp policy 10 group 2
isakmp policy 10 lifetime 7200
telnet 192.168.1.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.1.100-192.168.1.120 inside
dhcpd dns 8.8.8.8 8.8.4.4
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
dhcpd enable inside
terminal width 80
Cryptochecksum:8f870843699a2bc0307a73eb8eafd4f2
: end

Re: Site to Site VPN with ASA 5505 and PIX 501

On both sides, phase 1 is the same.

So, please make sure that the peer IPs are matching as well.

On the ASA:

tunnel-group yyy.yyy.yyy.yyy type ipsec-l2l
tunnel-group yyy.yyy.yyy.yyy ipsec-attributes
pre-shared-key ****

The IP defined above should be the public IP where the tunnel is going to terminate (outside IP of the PIX)

The pre-shared-key should match the pre-shared key on the PIX.

On the PIX:

isakmp key ******** address xxx.xxx.xxx.xxx netmask 255.255.255.255

Check that the IP and key defined also match the outside IP of the ASA.

If everything above is correct, also verify the peer statement under the crypto maps, that the're pointing to the correct IPs.

Federico.

New Member

Re: Site to Site VPN with ASA 5505 and PIX 501

I've verified the IP addresses and keys on both devices and I'm still not able to get them to link up.  I really have no idea why this is not working.

Re: Site to Site VPN with ASA 5505 and PIX 501

Could you please post the debugs from the ASA when trying to establish the tunnel?

debug cry isa 127

debug cry ips 127

Federico.

New Member

Re: Site to Site VPN with ASA 5505 and PIX 501

Thanks for your patience with me, Federico.

ASA(config)# debug cry isa 127

ASA(config)# Apr 29 13:57:45 [IKEv1 DEBUG]: Pitcher: received a key acquiremessage, spi 0x0

Apr 29 13:57:45 [IKEv1]: IP = 76.183.133.235, IKE Initiator: New Phase 1, Intf inside, IKE Peer 76.183.133.235  local Proxy Address 10.0.1.0, remote Proxy Addre

ss 192.168.1.0,  Crypto map (CRYPTO_MAP)

Apr 29 13:57:45 [IKEv1 DEBUG]: IP = OutsidePIXAddress, constructing ISAKMP SA paylo

ad

Apr 29 13:57:45 [IKEv1 DEBUG]: IP = OutsidePIXAddress, constructing Fragmentation V

ID + extended capabilities payload

Apr 29 13:57:45 [IKEv1]: IP = OutsidePIXAddress, IKE_DECODE SENDING Message (msgid=

0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

Apr 29 13:57:50 [IKEv1 DEBUG]: Pitcher: received a key acquire message, spi 0x0

Apr 29 13:57:50 [IKEv1]: IP = OutsidePIXAddress, Queuing KEY-ACQUIRE messages to be

processed when P1 SA is complete.

Apr 29 13:57:53 [IKEv1]: IP = OutsidePIXAddress, IKE_DECODE RESENDING Message (msgi

d=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

Apr 29 13:57:56 [IKEv1 DEBUG]: Pitcher: received a key acquire message, spi 0x0

Apr 29 13:57:56 [IKEv1]: IP = OutsidePIXAddress, Queuing KEY-ACQUIRE messages to be

processed when P1 SA is complete.

Apr 29 13:58:01 [IKEv1]: IP = OutsidePIXAddress, IKE_DECODE RESENDING Message (msgi

d=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

Apr 29 13:58:01 [IKEv1 DEBUG]: Pitcher: received a key acquire message, spi 0x0

Apr 29 13:58:01 [IKEv1]: IP = OutsidePIXAddress, Queuing KEY-ACQUIRE messages to be

processed when P1 SA is complete.

Apr 29 13:58:09 [IKEv1]: IP = 76.183.133.235, IKE_DECODE RESENDING Message (msgi

d=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

Apr 29 13:58:17 [IKEv1 DEBUG]: IP = OutsidePIXAddress, IKE MM Initiator FSM error h

istory (struct &0x42ee820)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG2,

EV_RETRY-->MM_WAIT_MSG2, EV_TIMEOUT-->MM_WAIT_MSG2, NullEvent-->MM_SND_MSG1, EV

_SND_MSG-->MM_SND_MSG1, EV_START_TMR-->MM_SND_MSG1, EV_RESEND_MSG-->MM_WAIT_MSG2

, EV_RETRY

Apr 29 13:58:17 [IKEv1 DEBUG]: IP = OutsidePIXAddress, IKE SA MM:87862c4c terminati

ng:  flags 0x01000022, refcnt 0, tuncnt 0

Apr 29 13:58:17 [IKEv1 DEBUG]: IP = OutsidePIXAddress, sending delete/delete with r

eason message

Apr 29 13:58:17 [IKEv1]: IP = OutsidePIXAddress, Removing peer from peer table fail

ed, no match!

Apr 29 13:58:17 [IKEv1]: IP = OutsidePIXAddress, Error: Unable to remove PeerTblEnt

ry

ASA(config)# debug cry ips 127

ASA(config)# Apr 29 14:01:07 [IKEv1 DEBUG]: Pitcher: received a key acquire

message, spi 0x0

Apr 29 14:01:07 [IKEv1]: IP = OutsidePIXAddress, IKE Initiator: New Phase 1, Intf i

nside, IKE Peer OutsidePIXAddress local Proxy Address 10.0.1.0, remote Proxy Addre

ss 192.168.1.0,  Crypto map (CRYPTO_MAP)

Apr 29 14:01:07 [IKEv1 DEBUG]: IP = OutsidePIXAddress, constructing ISAKMP SA paylo

ad

Apr 29 14:01:07 [IKEv1 DEBUG]: IP = OutsidePIXAddress, constructing Fragmentation V

ID + extended capabilities payload

Apr 29 14:01:07 [IKEv1]: IP = OutsidePIXAddress, IKE_DECODE SENDING Message (msgid=

0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

Apr 29 14:01:12 [IKEv1 DEBUG]: Pitcher: received a key acquire message, spi 0x0

Apr 29 14:01:12 [IKEv1]: IP = OutsidePIXAddress, Queuing KEY-ACQUIRE messages to be

processed when P1 SA is complete.

Apr 29 14:01:15 [IKEv1]: IP = 76.183.133.235, IKE_DECODE RESENDING Message (msgi

d=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

Apr 29 14:01:18 [IKEv1 DEBUG]: Pitcher: received a key acquire message, spi 0x0

Apr 29 14:01:18 [IKEv1]: IP = 76.183.133.235, Queuing KEY-ACQUIRE messages to be

processed when P1 SA is complete.

Apr 29 14:01:23 [IKEv1]: IP = OutsidePIXAddress, IKE_DECODE RESENDING Message (msgi

d=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

Apr 29 14:01:23 [IKEv1 DEBUG]: Pitcher: received a key acquire message, spi 0x0

Apr 29 14:01:23 [IKEv1]: IP = 76.183.133.235, Queuing KEY-ACQUIRE messages to be

processed when P1 SA is complete.

Apr 29 14:01:31 [IKEv1]: IP = 76.183.133.235, IKE_DECODE RESENDING Message (msgi

d=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

Apr 29 14:01:36 [IKEv1 DEBUG]: Pitcher: received a key acquire message, spi 0x0

Apr 29 14:01:36 [IKEv1]: IP = OutsidePIXAddress, Queuing KEY-ACQUIRE messages to be

processed when P1 SA is complete.

Apr 29 14:01:38 [IKEv1 DEBUG]: Pitcher: received a key acquire message, spi 0x0

Apr 29 14:01:38 [IKEv1]: IP = OutsidePIXAddress, Queuing KEY-ACQUIRE messages to be

processed when P1 SA is complete.

Apr 29 14:01:39 [IKEv1 DEBUG]: Pitcher: received a key acquire message, spi 0x0

Apr 29 14:01:39 [IKEv1]: IP = OutsidePIXAddress, Queuing KEY-ACQUIRE messages to be

processed when P1 SA is complete.

Apr 29 14:01:39 [IKEv1 DEBUG]: IP = OutsidePIXAddress, IKE MM Initiator FSM error h

istory (struct &0x4123368)  , :  MM_DONE, EV_ERROR-->MM_WAIT_MSG2,

EV_RETRY-->MM_WAIT_MSG2, EV_TIMEOUT-->MM_WAIT_MSG2, NullEvent-->MM_SND_MSG1, EV

_SND_MSG-->MM_SND_MSG1, EV_START_TMR-->MM_SND_MSG1, EV_RESEND_MSG-->MM_WAIT_MSG2

, EV_RETRY

Apr 29 14:01:39 [IKEv1 DEBUG]: IP = OutsidePIXAddress, IKE SA MM:2eaca391 terminati

ng:  flags 0x01000022, refcnt 0, tuncnt 0

Apr 29 14:01:39 [IKEv1 DEBUG]: IP = OutsidePIXAddress, sending delete/delete with r

eason message

Apr 29 14:01:39 [IKEv1]: IP = OutsidePIXAddress, Removing peer from peer table fail

ed, no match!

Apr 29 14:01:39 [IKEv1]: IP = OutsidePIXAddress, Error: Unable to remove PeerTblEnt

ry

Apr 29 14:01:41 [IKEv1 DEBUG]: Pitcher: received a key acquire message, spi 0x0

Apr 29 14:01:41 [IKEv1]: IP = OutsidePIXAddress, IKE Initiator: New Phase 1, Intf i

nside, IKE Peer OutsidePIXAddress local Proxy Address 10.0.1.0, remote Proxy Addre

ss 192.168.1.0,  Crypto map (CRYPTO_MAP)

Apr 29 14:01:41 [IKEv1 DEBUG]: IP = OutsidePIXAddress, constructing ISAKMP SA paylo

ad

Apr 29 14:01:41 [IKEv1 DEBUG]: IP = OutsidePIXAddress, constructing Fragmentation V

ID + extended capabilities payload

Apr 29 14:01:41 [IKEv1]: IP = OutsidePIXAddress, IKE_DECODE SENDING Message (msgid=

0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

Apr 29 14:01:44 [IKEv1 DEBUG]: Pitcher: received a key acquire message, spi 0x0

Apr 29 14:01:44 [IKEv1]: IP = OutsidePIXAddress, Queuing KEY-ACQUIRE messages to be

processed when P1 SA is complete.

Apr 29 14:01:49 [IKEv1]: IP = OutsidePIXAddress, IKE_DECODE RESENDING Message (msgi

d=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

Apr 29 14:01:50 [IKEv1 DEBUG]: Pitcher: received a key acquire message, spi 0x0

Apr 29 14:01:50 [IKEv1]: IP = OutsidePIXAddress, Queuing KEY-ACQUIRE messages to be

processed when P1 SA is complete.

ASA(config)# Apr 29 14:01:57 [IKEv1]: IP = OutsidePIXAddress, IKE_DECODE RESEND

ING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) tota

l length : 108

Apr 29 14:02:05 [IKEv1]: IP = OutsidePIXAddress, IKE_DECODE RESENDING Message (msgi

d=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108

ASA(config)#

ASA(config)# Apr 29 14:02:13 [IKEv1 DEBUG]: IP = OutsidePIXAddress, IKE MM Init

iator FSM error history (struct &0x41dff08)  , :  MM_DONE, EV_ERRO

R-->MM_WAIT_MSG2, EV_RETRY-->MM_WAIT_MSG2, EV_TIMEOUT-->MM_WAIT_MSG2, NullEvent-

->MM_SND_MSG1, EV_SND_MSG-->MM_SND_MSG1, EV_START_TMR-->MM_SND_MSG1, EV_RESEND_M

SG-->MM_WAIT_MSG2, EV_RETRY

Apr 29 14:02:13 [IKEv1 DEBUG]: IP = OutsidePIXAddress, IKE SA MM:83d9df69 terminati

ng:  flags 0x01000022, refcnt 0, tuncnt 0

Apr 29 14:02:13 [IKEv1 DEBUG]: IP = OutsidePIXAddress, sending delete/delete with r

eason message

Apr 29 14:02:13 [IKEv1]: IP = OutsidePIXAddress, Removing peer from peer table fail

ed, no match!

Apr 29 14:02:13 [IKEv1]: IP = OutsidePIXAddress, Error: Unable to remove PeerTblEnt

ry

Re: Site to Site VPN with ASA 5505 and PIX 501

The only thing that I've noticed is that the outside IP of the PIX is given by DHCP.

Is this IP dynamic or static?

Normally with DHCP, you require a dynamic-to-static IPsec configuration on the ASA (if the outside IP of the PIX changes).

Have you checked that the outside IP of the PIX is the same as the peer's IP on the ASA?

Do you have any other tunnels currently active on either side? sh cry isa sa

Federico.

New Member

Re: Site to Site VPN with ASA 5505 and PIX 501

The outside address of the PIX is dynamic and the address of the ASA is static.

So should I change these lines on the ASA from this

crypto map CRYPTO_MAP 10 match address l2l_list

crypto map CRYPTO_MAP 10 set peer yyy.yyy.yyy.yyy

crypto map CRYPTO_MAP 10 set transform-set TRANSFORM_SET

crypto map CRYPTO_MAP interface outside

to this?

crypto dynamic-map DYN_MAP 10 match address l2l_list

crypto dynamic-map DYN_MAP 10 set transform-set TRANSFORM_SET

crypto map CRYPTO_MAP 10 ipsec-isakmp dynamic DYN_MAP

crypto map DYN_MAP interface outside

Are there any other changes I need to make to the ASA or the PIX to use the dynamic address of the PIX?

Re: Site to Site VPN with ASA 5505 and PIX 501

That's what you need correct.

Please try with that configuration.

The ASA side will have a dynamic map and the PIX will still use a static map configuration.

Federico.

New Member

Re: Site to Site VPN with ASA 5505 and PIX 501

Still not having any luck getting this figured out.  Here are the configs for the ASA and PIX.  I am sure I am missing something simple, but I can't find it.

When I try to ping from the 10.0.1.0 network to 192.168.1.0 network, I get no response.

This is the output I get when I use sh cry ip sa on the ASA:

There are no ipsec sas

This is the output I get when I use sh cry is sa on the ASA:

There are no isakmp sas

ASA Version 7.2(4)

!

hostname ASA

domain-name xxx.com

enable password removed encrypted

passwd removed encrypted

names

!

interface Vlan1

nameif inside

security-level 100

ip address 10.0.1.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address xxx.xxx.xxx.xxx 255.255.255.240

!

interface Vlan3

no forward interface Vlan1

nameif dmz

security-level 50

no ip address

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

banner exec Authorized Access Only!!

ftp mode passive

clock timezone CST -6

clock summer-time CDT recurring

dns server-group DefaultDNS

domain-name xxx.com

object-group protocol TCPUDP

protocol-object udp

protocol-object tcp

access-list outside_in extended permit icmp any any echo-reply

access-list outside_in extended permit icmp any any time-exceeded

access-list outside_in extended permit tcp any interface outside eq pptp

access-list outside_in extended permit tcp any interface outside eq 3389

access-list outside_in extended permit tcp any interface outside eq ftp

access-list outside_in extended permit tcp any interface outside eq www

access-list outside_in extended permit tcp any interface outside eq https

access-list outside_in extended permit tcp 64.18.0.0 255.255.240.0 interface outside eq smtp

access-list split_tunnel extended permit ip 172.17.3.0 255.255.255.0 any

access-list split_tunnel extended permit ip 192.168.0.0 255.255.255.0 any

access-list no_nat extended permit ip 192.168.0.0 255.255.255.0 172.16.49.0 255.255.255.0

access-list no_nat extended permit ip 192.168.0.0 255.255.255.0 172.17.3.0 255.255.255.0

access-list l2l_list extended permit ip 10.0.1.0 255.255.255.0 192.168.1.0 255.255.255.0

pager lines 24

logging asdm informational

mtu inside 1500

mtu outside 1500

mtu dmz 1500

ip local pool dynamic_vpn_pool 172.17.3.1-172.17.3.254 mask 255.255.255.0

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-524.bin

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list l2l_list

nat (inside) 1 0.0.0.0 0.0.0.0

static (inside,outside) tcp interface ftp 10.0.1.5 ftp netmask 255.255.255.255

static (inside,outside) tcp interface pptp 10.0.1.10 pptp netmask 255.255.255.255

static (inside,outside) tcp 65.44.73.211 ftp 10.0.1.91 ftp netmask 255.255.255.255

static (inside,outside) tcp interface 5000 10.0.1.39 5000 netmask 255.255.255.255

static (inside,outside) tcp interface 5003 10.0.1.39 5003 netmask 255.255.255.255

static (inside,outside) tcp interface 5200 10.0.1.39 5200 netmask 255.255.255.255

static (inside,outside) tcp interface telnet 10.0.1.40 telnet netmask 255.255.255.255

static (inside,outside) tcp interface smtp 10.0.1.11 smtp netmask 255.255.255.255

static (inside,outside) tcp interface www 10.0.1.11 www netmask 255.255.255.255

static (inside,outside) tcp interface https 10.0.1.11 https netmask 255.255.255.255

static (inside,outside) tcp interface 3389 10.0.1.11 3389 netmask 255.255.255.255

access-group outside_in in interface outside

route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.209 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

aaa authentication http console LOCAL

aaa authentication telnet console LOCAL

aaa authentication ssh console LOCAL

http server enable

http 192.168.1.0 255.255.255.0 inside

http 10.0.1.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set TRANSFORM_SET esp-3des esp-sha-hmac

crypto dynamic-map DYN_MAP 10 match address l2l_list

crypto dynamic-map DYN_MAP 10 set transform-set TRANSFORM_SET

crypto map CRYPTO_MAP 10 match address l2l_list

crypto map CRYPTO_MAP 10 set transform-set TRANSFORM_SET

crypto map CRYPTO_MAP 99 ipsec-isakmp dynamic DYN_MAP

crypto map CRYPTO_MAP interface outside

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

telnet 10.0.1.0 255.255.255.0 inside

telnet 172.17.3.0 255.255.255.0 inside

telnet timeout 60

ssh 66.226.222.16 255.255.255.240 outside

ssh timeout 5

console timeout 0

group-policy employees internal

group-policy employees attributes

dns-server value 10.0.1.15

vpn-idle-timeout 720

split-tunnel-policy tunnelspecified

split-tunnel-network-list value split_tunnel

default-domain value xxx.com

username twistadmin password removed encrypted privilege 15

username administrator password removed encrypted privilege 15

tunnel-group DefaultL2LGroup ipsec-attributes

pre-shared-key *

tunnel-group employees type ipsec-ra

tunnel-group employees general-attributes

address-pool dynamic_vpn_pool

authentication-server-group (outside) LOCAL

default-group-policy employees

tunnel-group employees ipsec-attributes

pre-shared-key *

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map global_policy

class inspection_default

  inspect pptp

  inspect ftp

!

service-policy global_policy global

prompt hostname context

Cryptochecksum:6fa6e6b3e629202b55a6cbd06be0df0b

: end

PIX Version 6.3(1)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password removed encrypted
passwd removed encrypted
hostname PIX
domain-name xxx.com
clock timezone CST -6
clock summer-time CDT recurring 2 Sun Mar 2:00 1 Sun Nov 2:00
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol pptp 1723
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
names
access-list l2l_list permit ip 192.168.1.0 255.255.255.0 10.0.1.0 255.255.255.0
access-list IPSEC permit udp host yyy.yyy.yyy.yyy host xxx.xxx.xxx.xxx eq isakmp
access-list IPSEC permit ah host yyy.yyy.yyy.yyy host xxx.xxx.xxx.xxx
access-list IPSEC permit esp host yyy.yyy.yyy.yyy host xxx.xxx.xxx.xxx
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside dhcp setroute
ip address inside 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list l2l_list
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group IPSEC in interface outside
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
crypto ipsec transform-set TRANSFORM_SET esp-3des esp-sha-hmac
crypto map CRYPTO_MAP 10 ipsec-isakmp
crypto map CRYPTO_MAP 10 match address l2l_list
crypto map CRYPTO_MAP 10 set peer xxx.xxx.xxx.xxx
crypto map CRYPTO_MAP 10 set transform-set TRANSFORM_SET
crypto map CRYPTO_MAP interface outside
isakmp key ******** address xxx.xxx.xxx.xxx netmask 255.255.255.255
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash sha
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
telnet 192.168.1.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.1.100-192.168.1.120 inside
dhcpd dns 8.8.8.8 8.8.4.4
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
dhcpd enable inside
terminal width 80
Cryptochecksum:88882f95e4ea5623e1ae6b3a24af1a01
: end

Re: Site to Site VPN with ASA 5505 and PIX 501

On the ASA, remove these two lines and try again please:

no crypto map CRYPTO_MAP 10 match address l2l_list

no crypto map CRYPTO_MAP 10 set transform-set TRANSFORM_SET

Federico.

New Member

Re: Site to Site VPN with ASA 5505 and PIX 501

I don't think he needs dynamic-to-static because he has the peer explicitly defined, he'd just have to change it.... when the lease expires .  Can both the crypto map & nonat call upon the same list? I'm wondering if that might be an issue.

Re: Site to Site VPN with ASA 5505 and PIX 501

I don't think you want to be changing the VPN peer configuration everytime the lease expires ;-)
That's exactly the reason of being able to configure a static-to-dynamic VPN.

Both crypto ACL and nonat ACL can be called the same as long as you have a single tunnel.
When you have more than one tunnel, there has to be different ACLs.

Federico.

New Member

Re: Site to Site VPN with ASA 5505 and PIX 501

I agree, I'm just saying that there's no reason why it shouldn't work  the way it is (even though it doesn't make the most sense).  He can then also initiate traffic from both sides instead of just the dynamic.  It would be nice if you could define peer using dynamic dns.

New Member

Re: Site to Site VPN with ASA 5505 and PIX 501

I've removed both of those lines from the ASA and still cannot access anything on the other side.  I have talked to the ISP that the PIX is attached to and they say that incoming VPNs are not blocked.  When I do the debug cry is 127 and debug cry ip 127 now nothing shows up at all when I ping the other network.

Cisco Employee

Re: Site to Site VPN with ASA 5505 and PIX 501

Since PIX is the dynamic site, you would need to ping from the PIX LAN towards the ASA LAN. If you try to ping from ASA towards the PIX, it will not initiate the VPN tunnel as you can only initiate the tunnel from the dynamic end towards the static end.

Base on the output of the first debug you posted, it's waiting for Phase 1 message 2, but that was when ping was initiated from the ASA end, instead of PIX end. However, it's worth to double check if UDP/500 is being blocked on either the router in front of your PIX or ASA.

New Member

Re: Site to Site VPN with ASA 5505 and PIX 501

This is the output from the PIX when I try to ping the ASA.

PIX# sh cry isa sa

Total     : 1

Embryonic : 1

        dst                       src                       state                        pending     created

        xxx.xxx.xxx.xxx   yyy.yyy.yyy.yyy    MM_NO_STATE           0               0

PIX# sh cry ip sa

interface: outside

    Crypto map tag: CRYPTO_MAP, local addr. yyy,yyy,yyy,yyy

   local  ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)

   remote ident (addr/mask/prot/port): (10.0.1.0/255.255.255.0/0/0)

   current_peer: xxx.xxx.xxx.xxx:0

     PERMIT, flags={origin_is_acl,}

    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0

    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0

    #pkts compressed: 0, #pkts decompressed: 0

    #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0

    #send errors 91, #recv errors 0

     local crypto endpt.: yyy.yyy.yyy.yyy, remote crypto endpt.: xxx.xxx.xxx.xxx

     path mtu 1500, ipsec overhead 0, media mtu 1500

     current outbound spi: 0

     inbound esp sas:

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:

     outbound ah sas:

     outbound pcp sas:

Cisco Employee

Re: Site to Site VPN with ASA 5505 and PIX 501

Did you try to ping from the PIX or from LAN behind the PIX?

If you tried to ping from the PIX, please try to ping as follows: ping inside 10.0.1.1

Also try to remove the static crypto map completely from the ASA as follows:

no crypto map CRYPTO_MAP 10 match address l2l_list

no crypto map  CRYPTO_MAP 10 set transform-set TRANSFORM_SET

no crypto dynamic-map DYN_MAP 10 match address l2l_list

New Member

Re: Site to Site VPN with ASA 5505 and PIX 501

I've removed those three lines from the ASA and then tried pinging the ASA from the PIX and these are the response I get.

PIX# ping inside 10.0.1.1

        10.0.1.1 NO response received -- 1000ms

        10.0.1.1 NO response received -- 1000ms

        10.0.1.1 NO response received -- 1000ms

PIX# ping outside 10.0.1.1

        10.0.1.1 response received -- 10ms

        10.0.1.1 response received -- 10ms

        10.0.1.1 response received -- 10ms

Cisco Employee

Re: Site to Site VPN with ASA 5505 and PIX 501

Not too sure how you are getting a response when ping is initiated from the outside interface of the PIX.

After you tried to ping from the PIX, is the tunnel up? what is the status of "show crypto isa sa" and "show crypto ipsec sa"?

New Member

Re: Site to Site VPN with ASA 5505 and PIX 501

PIX# sh cry isa sa

Total     : 1

Embryonic : 1

        dst                       src                       state                        pending     created

        xxx.xxx.xxx.xxx   yyy.yyy.yyy.yyy    MM_NO_STATE           0               0

PIX# sh cry ip sa

interface: outside

    Crypto map tag: CRYPTO_MAP, local addr. yyy,yyy,yyy,yyy

   local  ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)

   remote ident (addr/mask/prot/port): (10.0.1.0/255.255.255.0/0/0)

   current_peer: xxx.xxx.xxx.xxx:0

     PERMIT, flags={origin_is_acl,}

    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0

    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0

    #pkts compressed: 0, #pkts decompressed: 0

    #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0

    #send errors 91, #recv errors 0

     local crypto endpt.: yyy.yyy.yyy.yyy, remote crypto endpt.: xxx.xxx.xxx.xxx

     path mtu 1500, ipsec overhead 0, media mtu 1500

     current outbound spi: 0

     inbound esp sas:

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:

     outbound ah sas:

     outbound pcp sas:

New Member

Re: Site to Site VPN with ASA 5505 and PIX 501

I added isakmp enable outside to both devices and now I can ping and browse the systems on the 10.0.1.0 network from the PIX side.

I still don't receive a response when I try to ping the ASA which is 10.0.1.1, but when I ping the other address I get a response.  I cannot browse the computer's on the ASA side by name but I can get to them by their ip addresses.

Cisco Employee

Re: Site to Site VPN with ASA 5505 and PIX 501

OK, great, now the VPN tunnel is up and running.

To ping the ASA inside interface, you would need to add "management-access inside" on the ASA.

If you can't browse the computer by name on the ASA side from the PIX side, you would need to configure either the ASA side DNS or WINS server on the PIX hosts so it can resolve the name.

3696
Views
0
Helpful
26
Replies
CreatePlease to create content