2

I am trying to set up an ipsec tunnel between our ASA 5505 and a Juniper ssg5. The tunnel is up and running, but I cannot get any data through it.

The local network I am on is 172.16.1.0 and the remote is 192.168.70.0. But I cannot ping anything on their network. I receive a "Phase 2 OK" when I set up the ipsec.

I think this is the part of the config that is applicable. It seems like the data is not routed through the tunnel, but I am not sure...

object network our-network
 subnet 172.16.1.0 255.255.255.0
object network their-network
 subnet 192.168.70.0 255.255.255.0
access-list outside_cryptomap extended permit ip object our-network object their-network 
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac 
crypto map outside_map 1 match address outside_cryptomap
crypto map outside_map 1 set pfs 
crypto map outside_map 1 set peer THEIR_IP
crypto map outside_map 1 set ikev1 phase1-mode aggressive 
crypto map outside_map 1 set ikev1 transform-set ESP-3DES-MD5
crypto map outside_map 1 set ikev2 pre-shared-key *****
crypto map outside_map 1 set reverse-route
crypto map outside_map interface outside

webvpn
group-policy GroupPolicy_THEIR_IP internal
group-policy GroupPolicy_THEIR_IP attributes
 vpn-filter value outside_cryptomap
 ipv6-vpn-filter none
 vpn-tunnel-protocol ikev1 
tunnel-group THEIR_IP type ipsec-l2l
tunnel-group THEIR_IP general-attributes
 default-group-policy GroupPolicy_THEIR_IP
tunnel-group THEIR_IP ipsec-attributes
 ikev1 pre-shared-key *****
 ikev2 remote-authentication pre-shared-key *****
 ikev2 local-authentication pre-shared-key *****
crypto ikev1 enable outside
crypto ikev1 policy 10
 authentication crack
 encryption aes-256
 hash sha
 group 2
 lifetime 86400

Tihis is the output of the packet tracer. I user my ip as source, their firewall as destination and IP with protocol 0 on interface OUR

ROUTE-LOOKUP
Type -ROUTE-LOOKUP Action -ALLOW
Info
in 0.0.0.0 0.0.0.0 outsied
IT-OPTIONS
Type -IP-OPtions Action -ALLOW
NAT
Tyope -NAT Action -DROP Show rule in NAT Rules table.
Config
object network obj_any
nat (any,outside) dynamic interface
RESULT - The packet is dropped
Input Interface: OUR
Output  Interface:outside
Info: (acl-drop) Flow is denied by configured rule
Improve this question
0

2 Answers 2

Reset to default
2

You config looks sane at first glance, even though I don't see the need for the reverse-route. You forgot to add the isakmp policy which starts with "crypto isakmp policy ", although entering Phase 2 obviously means Phase 1 completed.

1) Do you let it bypass the normal ACL (by config: sysopt connection permit-vpn)?

2) Can you do a packet-tracer and paste the result?

Improve this answer
4
  • Thanks a lot for your reply. I tried the sysopt connection permit-vpn but it didn't seem to accept that command. I pasted the result of packet tracer above
    – Oskar Kjellin
    Mar 25, 2012 at 8:56
  • I think I am missing a NAT exempt
    – Oskar Kjellin
    Mar 25, 2012 at 9:01
  • Good call, completely neglected NAT.
    – 3molo
    Mar 25, 2012 at 9:49
  • I fixed the nat part. However, the problem is still there. I am wondering if the site-to-site tunnel is on the wrong interface. Perhaps it should be our and not outside? If I packet trace from outside, it is sent through the tunnel. But if I packet trace from our (which I should, right?) it isn't sent through the tunnel
    – Oskar Kjellin
    Mar 25, 2012 at 10:34
0

Okay, so there was two things I needed to fix:

1) UN-NAT the traffic going through the tunnel nat (any,any) source static their-network their-network no-proxy-arp

2) Update the ACL so it went both ways:

access-list outside_cryptomap extended permit ip object our-network object their-network 
access-list outside_cryptomap extended permit ip object their-network object our-network

Now it works just fine.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .