Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have two ASA 5505 running 8.4. Both can access the Internet. ASA#1 has a VoIP gateway behind it that is being NATted, hence the extra rules.

This is on ASA #1:

interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 10.10.10.1 255.255.255.224
!

object network server
 host 192.168.1.100
object service voip-range
 service udp source range 9000 9049
object service sip-tcp
 service tcp source eq sip
object service sip-udp
 service udp source eq sip
object service sip-secure
 service tcp source eq 5061
object service sip-tcp-remote
 service tcp source eq 5090
object service sip-udp-remote
 service udp source eq 5090
object network Remote_Network
 subnet 192.168.2.0 255.255.255.0
 description Travis network
object network My_Network
 subnet 192.168.1.0 255.255.255.0

access-list l2l_list extended permit ip object My_Network object Remote_Network
access-list outside_access_in extended permit tcp any object server eq sip log errors
access-list outside_access_in extended permit udp any object server eq sip log errors
access-list outside_access_in extended permit udp any object server range 9000 9049 log errors
access-list outside_access_in extended permit object sip-secure any object server log errors
access-list outside_access_in extended permit object sip-tcp-remote any object server log errors
access-list outside_access_in extended permit object sip-udp-remote any object server log errors
access-list outside_access_in extended deny ip any any log alerts
access-list inside_access_in extended permit ip any any log debugging

nat (inside,outside) source static server interface service voip-range voip-range
nat (inside,outside) source static server interface service sip-tcp sip-tcp
nat (inside,outside) source static server interface service sip-udp sip-udp
nat (inside,outside) source static server interface service sip-secure sip-secure
nat (inside,outside) source static server interface service sip-tcp-remote sip-tcp-remote
nat (inside,outside) source static server interface service sip-udp-remote sip-udp-remote
nat (inside,outside) source dynamic any interface

access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 10.10.10.2 1

crypto ipsec ikev1 transform-set FirstSet esp-3des esp-md5-hmac
crypto ipsec ikev2 ipsec-proposal sec
 protocol esp encryption aes 3des des
 protocol esp integrity sha-1
crypto map kernelvpn 1 match address l2l_list
crypto map kernelvpn 1 set peer 10.10.10.8
crypto map kernelvpn 1 set ikev1 transform-set FirstSet
crypto map kernelvpn 1 set ikev2 ipsec-proposal sec
crypto map kernelvpn interface outside
crypto ikev2 policy 1
 encryption 3des
 integrity sha
 group 2
 prf sha
 lifetime seconds 86400
crypto ikev2 enable outside
crypto ikev1 enable outside
crypto ikev1 policy 1
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
!
tunnel-group 10.10.10.8 type ipsec-l2l
tunnel-group 10.10.10.8 ipsec-attributes
 ikev1 pre-shared-key abcd1234

And this is what's on ASA #2

interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.2.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 10.10.10.8 255.255.255.224
!

object network Remote_Network
 subnet 192.168.1.0 255.255.255.0
 description Travis network
object network My_Network
 subnet 192.168.2.0 255.255.255.0

access-list l2l_list extended permit ip object My_Network object Remote_Network
access-list outside_access_in extended deny ip any any log alerts
access-list inside_access_in extended permit ip any any log debugging

nat (inside,outside) source dynamic any interface
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 10.10.10.9 1

crypto ipsec ikev1 transform-set FirstSet esp-3des esp-md5-hmac
crypto ipsec ikev2 ipsec-proposal sec
 protocol esp encryption aes 3des des
 protocol esp integrity sha-1
crypto map kernelvpn 1 match address l2l_list
crypto map kernelvpn 1 set peer 10.10.10.1
crypto map kernelvpn 1 set ikev1 transform-set FirstSet
crypto map kernelvpn 1 set ikev2 ipsec-proposal sec
crypto map kernelvpn interface outside
crypto ikev2 policy 1
 encryption 3des
 integrity sha
 group 2
 prf sha
 lifetime seconds 86400
crypto ikev2 enable outside
crypto ikev1 enable outside
crypto ikev1 policy 1
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
!
tunnel-group 10.10.10.1 type ipsec-l2l
tunnel-group 10.10.10.1 ipsec-attributes
 ikev1 pre-shared-key *****

Some helpful output:

ciscoasa(config)# show crypto isakmp sa
There are no IKEv1 SAs
There are no IKEv2 SAs

show crypto ipsec sa doesn't show a thing!

Not sure what other options I have here... I've tried to do the following ping with no luck:

ping inside 192.168.2.1 

Packet trace yields the following:

ciscoasa(config)# packet-trace input inside tcp 192.168.1.11 22 192.168.2.1 22

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   0.0.0.0         0.0.0.0         outside

Phase: 2
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group inside_access_in in interface inside
access-list inside_access_in extended permit ip any any log debugging
Additional Information:

Phase: 3
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 4
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (inside,outside) source dynamic any interface
Additional Information:
Dynamic translate 192.168.1.11/22 to 10.10.10.2/22

Phase: 5
Type: HOST-LIMIT
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 6
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 7
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 475091, packet dispatched to next module

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: allow
share|improve this question
1  
What, exactly, is it doing? Some logs would probably help. –  wfaulk May 9 '12 at 21:56
    
Provide the logs that occur when you try to send traffic to the other side of the tunnel, check if the devices can connect directly to each other (ping) on the outside interface, and check show crypto isakmp sa and show crypto ipsec sa right after attempting a connection. –  Shane Madden May 9 '12 at 22:02

1 Answer 1

up vote 1 down vote accepted

I don't see your NAT statements on either ASA for the tunnel. For the new code ASA 8.4 you should have those vpn tunnels entered using "twice nat".

nat (inside,any) source static My_Network My_Network destination static Remote_Network Remote_Network
share|improve this answer
    
That worked Bad Dos. I actually added a nat (inside,outside) command right before you posted this answer, but failed to place it higher in the chain than the dynamic pat rule. Bomb! –  Godzilla74 May 9 '12 at 22:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.