2

Currently we're trying to set up an IPsec VPN between a Cisco ASA Version 8.0(4) and a CentOS Linux server.

The tunnel comes up successfully, but for some reason that we can't figure out, the firewall is dropping packets from the VPN.

The IPsec settings in the ASA sre as follows:

crypto ipsec transform-set up-transform-set esp-3des esp-md5-hmac

crypto ipsec transform-set up-transform-set2 esp-3des esp-sha-hmac

crypto ipsec transform-set up-transform-set3 esp-aes esp-md5-hmac

crypto ipsec transform-set up-transform-set4 esp-aes esp-sha-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto map linuxserver 10 match address filtro-encrypt-linuxserver


crypto map linuxserver 10 set peer linuxserver

crypto map linuxserver 10 set transform-set up-transform-set2 up-transform-set3 up-transform-set4

crypto map linuxserver 10 set security-association lifetime seconds 28800

crypto map linuxserver 10 set security-association lifetime kilobytes 4608000

crypto map linuxserver interface outside

crypto isakmp enable outside

crypto isakmp policy 1

authentication pre-share

encryption aes

hash sha

group 2

lifetime 28800

crypto isakmp policy 2

authentication pre-share

encryption aes-256

hash sha

group 2

lifetime 86400

crypto isakmp policy 3

authentication pre-share

encryption aes-256

hash md5

group 2

lifetime 86400

crypto isakmp policy 4

authentication pre-share

encryption aes-192

hash sha

group 2

lifetime 86400

crypto isakmp policy 5

authentication pre-share

encryption aes-192

hash md5

group 2

group-policy linuxserverip internal

group-policy linuxserverip attributes

vpn-filter value filtro-linuxserverip

tunnel-group linuxserverip type ipsec-l2l

tunnel-group linuxserverip general-attributes

default-group-policy linuxserverip

tunnel-group linuxserverip ipsec-attributes

pre-shared-key *

Does anyone know where the problem is and how to fix it?

2
  • Can you turn up the logging level on the firewall and check what it's logging when it drops? Aug 25, 2012 at 21:34
  • Can you show the access-list 'filtro-encrypt-linuxserver'? In addition to showing the NAT rules, can you please run a packet-tracer and see what it says?
    – 3molo
    Aug 31, 2012 at 19:33

1 Answer 1

1

Can you show your NAT and related access-lists on your ASA?

For example:

access-list nat0 extended permit ip 192.168.105.0 255.255.255.0 192.168.1.0 255.255.255.0 nat (inside) 0 access-list nat0

This is exception from my ASA config to show you 2 VPNs and difference between No-Nat access-list and actual VPN access-list. Basically, your no-nat access list is summary of your VPN access lists:

!
interface Ethernet0/1
 nameif inside
 security-level 100
 ip address 192.168.4.1 255.255.255.0
!
access-list nat0 extended permit ip 192.168.4.0 255.255.255.0 192.168.1.0 255.255.255.0 
access-list nat0 extended permit ip 192.168.4.0 255.255.255.0 192.168.100.0 255.255.255.0 
access-list nat0 extended permit ip 192.168.4.0 255.255.255.0 10.10.0.0 255.255.0.0 
access-list nat0 extended permit ip 192.168.4.0 255.255.255.0 192.168.7.0 255.255.255.0 
access-list TONJ extended permit ip 192.168.4.0 255.255.255.0 192.168.1.0 255.255.255.0 
access-list TONJ extended permit ip 192.168.4.0 255.255.255.0 192.168.100.0 255.255.255.0 
access-list TONJ extended permit ip 192.168.4.0 255.255.255.0 10.10.0.0 255.255.0.0 
access-list TOCHICAGO extended permit ip 192.168.4.0 255.255.255.0 192.168.7.0 255.255.255.0 
!
global (outside) 1 interface
nat (inside) 0 access-list nat0
nat (inside) 1 192.168.4.0 255.255.255.0
!
crypto map 2GRMLA 28 match address TONJ
crypto map 2GRMLA 28 set peer xxx.xxx.xxx.xxx 
crypto map 2GRMLA 28 set transform-set moishes
crypto map 2GRMLA 71 match address TOCHICAGO
crypto map 2GRMLA 71 set peer ***.***.***.*** 
crypto map 2GRMLA 71 set transform-set 3DES
4
  • Am I missing something? (I separate each rule with //) access-list pinky-no-nat extended permit ip 10.XXX.0.0 255.255.0.0 asa-ip 255.255.255.128// access-list brain-no-nat extended deny ip 10.0.0.0 255.128.0.0 host someserver// access-list brain-no-nat extended permit ip 10.0.0.0 255.128.0.0 asa-ip 255.255.255.128// access-list brain-no-nat extended permit ip 10.0.0.0 255.128.0.0 W.X.0.0 255.255.0.0 // access-list juancho-no-nat extended permit ip 10.ZZZ.0.0 255.255.0.0 asa-ip 255.255.255.128 // asa-ip is some ip of one asa interface
    – sebelk
    Sep 10, 2012 at 19:06
  • Your filtro-encrypt-linuxserver access-list should be similar (basically equal) to brain-no-nat. Also, you should have line (inside) 0 access-list brain-no-nat. What is the purpose of the juancho-no-nat and pinky-no-nat access-lists?
    – Serhiy
    Sep 11, 2012 at 20:34
  • I edited my answer to show you why I asked about nat command and no-nat access-list. Just creating no-nat list is not enough, it has to be included in "nat (inside) 0 access-list some-no-nat-list" command.
    – Serhiy
    Sep 11, 2012 at 20:48
  • Also, no traffic over VPN could be due to your ISP fault. We changed out T1 line to Ethernet line (IP addresses were preserved) recently and both firewalls (no changes on firewalls from T1 setup) were showing that VPN is up and running, but not traffic between them (regular web browsing was working). Hard to convince your ISP that he is wrong.
    – Serhiy
    Sep 11, 2012 at 21:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .