0
votes
0answers
26 views

Cisco ASA 5505: PAT / NAT between 2 IPSec Tunnels

I've the following Setup: Customer <-> HQ <-> Branchoffice The Customer has a 192.168.1.0/24 subnet. On the HQ only the VPN Gateway is in my context, 172.20.10.1 . And on the Branchoffice ...
1
vote
1answer
370 views

Openswan Cisco ASA 9.1 — cannot resopnd to IPsec SA request because no connection is known for

Ok, so I have a simple VPN IPSEC setup with a single Linux host that has a public IP address and a loopback interface of 172.16.255.1. On the right side I have a Cisco ASA 5505 9.1. the issue is the ...
0
votes
0answers
181 views

OpenSwan VPN Connected but can't ping or connect to anything on right side

On my end is an Ubuntu AWS EC2 VM and on the other end is a Cisco ASA 5500 router. Phase 1 and Phase 2 come up but I cannot access anything on the other end. It would seem there's a routing problem, ...
2
votes
3answers
431 views

VLAN over VPN (ASA 5520)? if not any other options available?

Is it possible to extend the local VLANs to a Remote site connected by IPSEC VPN using ASA 5520 / Cisco 1841 DSL router. can we have many VPN tunnels between the ASAs? (from every VLAN one vpn ...
4
votes
2answers
409 views

IPSec tunnel on ASA keeps disconnecting

I have an ASA IPSec tunnel configured between an ASA5505 and Microsoft TMG 2010 SP2. The tunnel sometimes works for a few hours, and then disconnects, and other times it works for 5 minutes and then ...
1
vote
0answers
450 views

Cannot access L2L VPN from RA VPN connected client on Cisco ASA 5510

We have a Cisco 1921 router running IOS 15.1 at one of our branches which is connected via a L2L IPsec VPN to a ASA5510 running ASA 7.2 at our headquarters. The ASA also provides IPSec Remote Access ...
0
votes
1answer
289 views

How to NAT behind public IP on pFsense before IPSEC to Cisco ASA?

I have two networks: Local 192.168.1.0/24 and Remote 10.8.8.8/24. On the local network I have installed pFsense as gateway. On the remote network there is a Cisco ASA that I don't have control over. ...
1
vote
0answers
538 views

ASA Slow IPSec Performance with Inconsistent Window Size

I have a IPSec link between two sites over ASA 5520s running 8.4(3) and I am getting extremely poor performance when traffic passes over the IPSec VPN. CPU on the devices is ~13%, Memory at 408 MB, ...
1
vote
1answer
355 views

How can I NAT traffic for one VPN to come from a different IP on Cisco ASA?

I have a Cisco ASA firewall between our private network (10.1.0.0/16) and the outside world, and multiple VPNS going to client sites. Existing: [10.1.0.2...] = source client | [10.1.0.1 ASA ...
0
votes
0answers
315 views

Cisco ASA IPSec Mobile VPN Drops After Inactivity

When I connect to my Cisco ASA 5510 via the built in IPSec VPN on my ipad (over both 3G and Wifi) the connection drops without error (the icon just disappears once I go into settings to check on time ...
3
votes
0answers
118 views

Cisco ASA ipsec vs Anyconnect client issue

So I have an iPad that has a IPSec VPN created. I am able to connect from the outside fine and I can access my local LAN files just fine. When I connect with the Cisco AnyConnect client from the same ...
0
votes
1answer
98 views

IPsec with various subnets on one side

I have the following situation: Client subnet(192.168.0.0 /24) ----> Router ----> Internet ----> ASA(172.17.0.2 /24) ----> (172.17.0.1 /24)Gateway ----> (10.0.0.0 ...
2
votes
1answer
277 views

ASA 5505 VPN setup. VPN works but still unable to reach devices in the inside network.

I've setup a Remote Access VPN on my Cisco ASA 5505. I'm able to connect to my ASA via my phone or the Cisco client, but I'm unable to reach devices in my inside LAN when connected via VPN. The ...
1
vote
1answer
317 views

Barracuda/ASA IPSEC tunnel is closing (which is ok, on idle) but can only be raised from the Barracuda side

We have a IPSEC tunnel set up between our ASA and a Barracuda NG on the other side. The tunnel is functional, except it seems to have a very short idle time-out (couple of seconds) and it can only be ...
4
votes
1answer
522 views

Cisco ASA ipsec IKEv1 remote access for Avaya VPN phone - no client address assigned

I'm having a strange issue with remote access VPN connectivity on our ASA cluster. Normal site-to-site tunnels and AnyConnect connections works just fine. However, a special ipsec ikev1 tunnel does ...
2
votes
1answer
368 views

Cisco ASA dropping IPsec VPN between istself and CentOS server

Currently we're trying to set up an IPsec VPN between a Cisco ASA Version 8.0(4) and a CentOS Linux server. The tunnel comes up successfully, but for some reason that we can't figure out, the ...
1
vote
0answers
468 views

Partial VPN connections on Cisco ASA

Cisco ASA 5505 in remote site, connecting as Easy VPN client to ASA 5510 at HQ. VPN light is green, and sh crypto isakmp sa shows active security association. However connectivity to some of our ...
4
votes
1answer
2k views

L2TP/IPSec from Windows 7 to ASA 5520

I am trying to setup L2TP/IPSec on our ASA5520 to support a fringe case for one of our developers. The Windows VPN subsystem apparently stores the kerberos or NTLM cookie for the login when you use ...
5
votes
1answer
3k views

ASA site-to-site IPSec vpn to linux ipsec-tools endpoints stops working after a random period of time

We swapped to ASA's over the weekend, and we replaced our VPN infrastructure which was previously based on openvpn and are now using IPSec between our ASA 5520's and our other sites that have linux ...
2
votes
2answers
1k views

Problems with ipsec betwen Cisco ASA 5505 and Juniper ssg5

I am trying to set up an ipsec tunnel between our ASA 5505 and a Juniper ssg5. The tunnel is up and running, but I cannot get any data through it. The local network I am on is 172.16.1.0 and the ...
0
votes
0answers
1k views

IPsec VPN tunnel between Windows 2008 R2 and CISCO ASA?

I need to create a VPN IPsec tunnel between my Windows 2008 R2 server and a CISCO ASA device. I want my server to be both the end of the tunnel, and the server that connects to the other side (no ...
1
vote
0answers
2k views

Cisco ASA - Duplicate ISAKMP SA - REKEYs

I have an issue with IPSEC VPNs where a single endpoint generates multiple ISAKMP SAs. (in my examples I have replaced the IPs - 1.1.1.1 is the remote endpoint, 10.10.10.10 is an object on the remote ...
1
vote
1answer
434 views

Add Port Forward to ASA5505 with IPSEC Tunnel

I have an ASA 5505 on 8.2 in the field already working. It has two interfaces, LAN/inside and WAN/outside. There is an L2 site-to-site IPSec tunnel configured from the outside interface of the local ...
0
votes
1answer
2k views

ASA IPSec tunnel up, but logging errors?

I am getting the following errors on an ASA; Jan 24 2012 17:15:13 ASA1 : %ASA-7-714003: IP = 1.2.3.4, IKE Responder starting QM: msg id = 5293ff7c Jan 24 2012 17:15:13 ASA1 : %ASA-7-713236: IP = ...
0
votes
0answers
425 views

Route based IPSec VPN Between IOS and ASA

I'd like to do a route based VPN between two sites. The purpose of this is to get remote site traffic passing through a transparent gateway at the headend, instead of using a proxy. So currently it ...
3
votes
1answer
2k views

Is there a way of setting an MTU lower for traffic destined to a specific IP address on Cisco ASA?

I have a number of VPN sites where the MTU is lower than standard (1500). I have had at least one site where fragmentation of packets has had an effect on the success of building an IPSEC tunnel. ...
0
votes
1answer
269 views

Cisco AnyConnect or IPSec user/ip authentication restriction

I'm trying to restrict some users from authenticating and accessing the VPN from home. I have a Cisco ASA5505, they use AnyConnect or IPSec, and I only want them to gain access to the VPN when ...
1
vote
1answer
874 views

Is turning off Perfect Forward Secrecy a security threat?

I had to disable PFS in the IPsec rules on one of our ASAs to allow Android Gingerbread clients to connect. Does doing so compromise the security of the VPN? Communications are AES-256 or AES-128 with ...
4
votes
4answers
2k views

Cisco ASA 5505 - need more site-to-site VPNs

I'm using a Cisco ASA 5505 50-user firewall in a co-location facility. The systems at this location are performing monitoring of additional remote sites (also running Pix or ASA devices) I've ...
3
votes
3answers
3k views

What might prevent IKE handshake success in building an IPSEC tunnel?

We use Cisco ASA for our IPSEC VPNs, using the EZVPN method. From time to time we encounter problems where an ISP has made a change to their network and our VPN stops working. Nine times out of ten ...
0
votes
1answer
789 views

Cisco ASA 5505 8.0(5): specifying IPSec mode in the tunnel-group or group-policy

Documentation states that you can (I'm assuming) globally disable aggressive mode with: isakmp am-disable Not exactly clear on the behavior when two peers are negotiating phase 1 in Cisco land, but ...
1
vote
4answers
6k views

Phase 2 Mismatch when connecting Windows 7 to ASA5505 VPN

I'm trying to stand up a new ASA5505 on our network (previously we used IPCop), and I'm having a bit of an issue getting the VPN to work. I ran through the IPSec VPN wizard in ASDM (6.3) on the ASA ...
1
vote
1answer
640 views

Cisco ASA 5510 <-> Sonicwall Pro 2040 - IPSec half working

Ok... I'm having a really strange IPSec issue (at least strange to me :-) ). I have a Sonicwall Pro 2040 connected to an ASA 5510. When the traffic initiated from the Sonicwall side of the network, it ...
0
votes
3answers
840 views

Could my GPRS connection be too slow for IPSec connection?

I'm setting up an IPSec connection from an Westermo MRD310 to our company Cisco ASA5510. We've had many successful setups using this method, creating a tunnel network between a remote location and ...
1
vote
2answers
9k views

How do I allow IPSec over TCP through a Cisco ASA?

I have a internal user that needs to connect via VPN to an external company. The external company's vpn is using IPSec over TCP on port 57369. When my user tries to connect it fails. The logs on my ...
3
votes
1answer
7k views

Cisco ASA 5505 - L2TP over IPsec

I have followed this document on cisco site to set up the L2TP over IPsec connection. When I try to establish a VPN to ASA 5505 from my Windows XP, after I click on "connect" button, the "Connecting ...