Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

Register Log in
  • Congratulations Mike Lewis on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

ASA-5510 - site-to-site and RA VPNs

Status
Not open for further replies.
bsols

bsols

Technical User
Jul 29, 2005
47
US
I hope this is simple. I have an established site-to-site VPN between an ASA5501 and an ASA5505 (5505 connects to 5510 using a dynamic IP configuration). I now need to add a remote access (Cisco client, using Xauth on the 5510) VPN configuration. I've done this successfully, however when the remote client configuration is added and the 5505 VPN recycles, it fails to reconnect. The log on the 5510 shows the connection failing due to no Xauth information. I believe I need to disable Xauth on the site-to-site tunnel group configuration, however I can't find a way to do this. I know you could do this on a PIX under the ISAKMP pre-shared key configuration, but that's no longer an option with ASAs. I've both configurations (current site-to-site and working RA/broken S2S)

Thank you.
__________________________________________________________________________
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
__________________________________________________________________________
Current configuration with working site-to-site VPN
__________________________________________________________________________
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
__________________________________________________________________________

: Saved
:
ASA Version 8.2(1)
!
hostname PIMainASA
enable password xxxx encrypted
passwd xxxx encrypted
names
name 192.168.1.0 PubSafety
name 192.168.254.0 RemoteClientPool
name 192.168.2.0 ParksRec
!
interface Ethernet0/0
nameif outside
security-level 0
ip address x.x.x.x 255.255.255.248
!
interface Ethernet0/1
nameif Inside
security-level 100
ip address 192.0.0.11 255.255.255.0
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.101.1 255.255.255.0
management-only
!
ftp mode passive
access-list outside_cryptomap extended permit ip 192.0.0.0 255.255.255.0 PubSafety 255.255.255.0
access-list outside_cryptomap extended permit ip any 192.0.0.176 255.255.255.240
access-list outside_cryptomap extended permit ip 192.0.0.0 255.255.255.0 ParksRec 255.255.255.0
access-list 101 extended permit ip 192.0.0.0 255.255.255.0 PubSafety 255.255.255.0
access-list 101 extended permit ip PubSafety 255.255.255.0 192.0.0.0 255.255.255.0
access-list 101 extended permit ip ParksRec 255.255.255.0 192.0.0.0 255.255.255.0
access-list 101 extended permit ip 192.0.0.0 255.255.255.0 ParksRec 255.255.255.0
access-list 102 extended permit ip PubSafety 255.255.255.0 192.0.0.0 255.255.255.0
access-list 102 extended permit ip 192.0.0.0 255.255.255.0 PubSafety 255.255.255.0
access-list 102 extended permit ip ParksRec 255.255.255.0 192.0.0.0 255.255.255.0
access-list 102 extended permit ip 192.0.0.0 255.255.255.0 ParksRec 255.255.255.0
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu Inside 1500
mtu management 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (Inside) 0 access-list outside_cryptomap
nat (Inside) 1 0.0.0.0 0.0.0.0
access-group 102 in interface Inside
route outside 0.0.0.0 0.0.0.0 24.103.196.249 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http PubSafety 255.255.255.0 management
http 192.0.0.0 255.255.255.0 management
http 192.0.0.0 255.255.255.0 Inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set CryptoSet esp-aes-256 esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map dynmap 10 set transform-set CryptoSet
crypto dynamic-map dynmap 10 set security-association lifetime seconds 28800
crypto dynamic-map dynmap 10 set security-association lifetime kilobytes 4608000
crypto map partner-map 100 ipsec-isakmp dynamic dynmap
crypto map partner-map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 3600
telnet 192.0.0.0 255.255.255.0 Inside
telnet 192.0.0.0 255.255.255.0 management
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.101.20-192.168.101.25 management
dhcpd dns x.x.x.x x.x.x.x interface management
dhcpd enable management
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
group-policy DfltGrpPolicy attributes
vpn-filter value 101
vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
tunnel-group DefaultL2LGroup ipsec-attributes
pre-shared-key *
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:0178c6ddb694179638c543e9ed6112a8
: end
__________________________________________________________________________
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
__________________________________________________________________________
Configuration where remote access VPN works & Site-to-Site starts to fail
__________________________________________________________________________
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
__________________________________________________________________________

ASA Version 8.2(1)
!
hostname PIMainASA
enable password xxxx encrypted
passwd xxxx encrypted
names
name 192.168.1.0 PubSafety
name 192.168.254.0 RemoteClientPool
name 192.168.2.0 ParksRec
!
interface Ethernet0/0
nameif outside
security-level 0
ip address x.x.x.x 255.255.255.248
!
interface Ethernet0/1
nameif Inside
security-level 100
ip address 192.0.0.11 255.255.255.0
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.101.1 255.255.255.0
management-only
!
ftp mode passive
access-list outside_cryptomap extended permit ip 192.0.0.0 255.255.255.0 PubSafety 255.255.255.0
access-list outside_cryptomap extended permit ip any 192.0.0.176 255.255.255.240
access-list outside_cryptomap extended permit ip 192.0.0.0 255.255.255.0 ParksRec 255.255.255.0
access-list outside_cryptomap extended permit ip any RemoteClientPool 255.255.255.0
access-list 101 extended permit ip 192.0.0.0 255.255.255.0 PubSafety 255.255.255.0
access-list 101 extended permit ip PubSafety 255.255.255.0 192.0.0.0 255.255.255.0
access-list 101 extended permit ip ParksRec 255.255.255.0 192.0.0.0 255.255.255.0
access-list 101 extended permit ip 192.0.0.0 255.255.255.0 ParksRec 255.255.255.0
access-list 101 extended permit ip 192.0.0.0 255.255.255.0 RemoteClientPool 255.255.255.0
access-list 101 extended permit ip RemoteClientPool 255.255.255.0 192.0.0.0 255.255.255.0
access-list 101 extended permit ip RemoteClientPool 255.255.255.0 any
access-list 102 extended permit ip PubSafety 255.255.255.0 192.0.0.0 255.255.255.0
access-list 102 extended permit ip 192.0.0.0 255.255.255.0 PubSafety 255.255.255.0
access-list 102 extended permit ip ParksRec 255.255.255.0 192.0.0.0 255.255.255.0
access-list 102 extended permit ip 192.0.0.0 255.255.255.0 ParksRec 255.255.255.0
access-list 102 extended permit ip 192.0.0.0 255.255.255.0 RemoteClientPool 255.255.255.0
access-list 102 extended permit ip RemoteClientPool 255.255.255.0 192.0.0.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip any RemoteClientPool 255.255.255.0
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu Inside 1500
mtu management 1500
ip local pool VPN_Pool-1 192.168.254.100-192.168.254.110 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (Inside) 0 access-list outside_cryptomap
nat (Inside) 1 0.0.0.0 0.0.0.0
access-group 102 in interface Inside
route outside 0.0.0.0 0.0.0.0 24.103.196.249 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http PubSafety 255.255.255.0 management
http 192.0.0.0 255.255.255.0 management
http 192.0.0.0 255.255.255.0 Inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set CryptoSet esp-aes-256 esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map dynmap 10 set transform-set CryptoSet
crypto dynamic-map dynmap 10 set security-association lifetime seconds 28800
crypto dynamic-map dynmap 10 set security-association lifetime kilobytes 4608000
crypto map partner-map 100 ipsec-isakmp dynamic dynmap
crypto map partner-map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 3600
telnet 192.0.0.0 255.255.255.0 Inside
telnet 192.0.0.0 255.255.255.0 management
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.101.20-192.168.101.25 management
dhcpd dns 24.92.226.11 24.92.226.12 interface management
dhcpd enable management
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
group-policy DefaultRAGroup internal
group-policy DefaultRAGroup attributes
dns-server value 192.0.0.3
dhcp-network-scope 192.168.254.0
vpn-tunnel-protocol IPSec
group-policy DfltGrpPolicy attributes
vpn-filter value 101
vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
username USER password xxxx encrypted
username USER attributes
vpn-group-policy DefaultRAGroup
tunnel-group DefaultL2LGroup ipsec-attributes
pre-shared-key *
tunnel-group DefaultRAGroup general-attributes
address-pool VPN_Pool-1
default-group-policy DefaultRAGroup
tunnel-group DefaultRAGroup ipsec-attributes
pre-shared-key *
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:0178c6ddb694179638c543e9ed6112a8
: end
 
Sort by date Sort by votes
Based on the configuration you don't have a L2L to the 5505 as there is no peer information configured
 
Upvote 0 Downvote
Status
Not open for further replies.

Similar threads

Sameer258
  • Locked
  • Question
Need Help to Find ip and mac address with email who one open my email
Replies
0
Views
323
Sameer258
Sameer258
intel233
  • Locked
  • Question
Cisco ASA 5510 -Static NAT Help
Replies
8
Views
378
intel233
intel233
intel233
  • Locked
  • Question
Cisco ASA - VPN Question
Replies
6
Views
340
intel233
intel233
gkreg
  • Locked
  • Question
asa 5500-x url filtering
Replies
0
Views
226
gkreg
gkreg
phjames
  • Locked
  • Question
Replacement for ASA-5510
Replies
1
Views
107
ADB100
ADB100

Part and Inventory Search

Sponsor

Back
Top