I am trying to setup our Cisco asa 5505 remote VPN access IKEv1 Pre-shared key, so I can access with Windows native VPN client using a L2TP/IPsec tunnel.
We have IKEv1 Pre-shared Key setup with a group ID configured already, but since Windows doesn't support group ID, I need to use the DefaultRA group.
I managed to complete Phase 1 after adding the correct IKEv1 policy. But to fix the mismatch problem at Phase 2, I figured out that I need to make add ESP-3DES-SHA-TRANS transport set to the dynamic crypto map.
The problem is: After adding the correct transform set (ESP-3DES-SHA-TRANS) to the crypto map using asdm, the router refuses to let any traffic out on the Internet… Not just the VPN traffic, but all traffic. I tried two times, needed to restart the Firewall both time to get it running again.
Not sure if I should post any running configuration. We don't have any advanced routing, just a static route outside really. We have another site-to-site VPN using a static crypto map. But it shouldn't affect.
Any idea what could cause this behavior? What is the cli command for adding that transform set to the crypto map?
Preview commands before sending them to the device.
. Then when you make a change, before the change is actually pushed to the ASA it will pop up a window showing what cli command(s) will be pushed. If that doesn't help you to figure it out then please post your running config and the command(s) shown in the preview window.