Have an odd issue with a Cisco ASA 5505 (8.05).
I'm testing out an IPSec tunnel between a pfSense box and the Cisco; both outside interfaces are on the same LAN subnet (my real LAN).
Cisco: outside: 192.168.100.100/24
pfSense: WAN: 192.168.100.200/24
real LAN gateway: 192.168.100.1/24
ran debug crypto isakmp on the Cisco and I'm seeing the following:
[IKEv1]: Group = 192.168.100.1, IP = 192.168.100.1, Can't find a valid tunnel group, aborting...!
Dec 09 13:30:44 [IKEv1]: Group = 192.168.100.1, IP = 192.168.100.1, Removing peer from peer table failed, no match!
Dec 09 13:30:44 [IKEv1]: Group = 192.168.100.1, IP = 192.168.100.1, Error: Unable to remove PeerTblEntry
Why would I be seeing "Group = 192.168.100.1, IP = 192.168.100.1" if the outside interface and the pfSense WAN interface are on the same broadcast domain? I can ping the pfSense WAN interface from the Cisco as well and the ARP entries look correct on both devices.
Here's my relative crypto config on the Cisco:
interface Vlan3
nameif outside
security-level 0
ip address 192.168.100.100 255.255.255.0
!
route outside 0.0.0.0 0.0.0.0 192.168.100.1
!
crypto ipsec transform-set myset esp-aes-256 esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto ipsec df-bit clear-df outside
crypto map IPSECMAP 100 match address encrypt_acl
crypto map IPSECMAP 100 set peer 192.168.100.200
crypto map IPSECMAP 100 set transform-set myset
crypto map IPSECMAP interface outside
crypto isakmp enable outside
crypto isakmp policy 100
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
tunnel-group 192.168.100.200 type ipsec-l2l
tunnel-group 192.168.100.200 ipsec-attributes
pre-shared-key *
