Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations SkipVought on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

can not get site to site VPN working between to ASA 5510

Status
Not open for further replies.

jrecho

IS-IT--Management
Nov 25, 2009
7
0
0
MA
No ping from one side to the other nothing. I see the tunnel up but I get this error when I try to ping
I get in Site B this error
3 Dec 02 2009 16:17:38 305005 10.10.20.55 No translation group found for icmp src outside:10.10.10.157 dst Inside:10.10.20.55 (type 8, code 0)


Here is the config for :
Site A
Public: 196.XXX.XXX.XXX
inside: 10.10.10.0/24
--------------------------------------------
crypto isakmp enable Outside
crypto isakmp policy 10
authentication pre-share
encryption aes
hash sha
group 1
lifetime 28800
access-list REMOTE_SITE ex permit ip 10.10.10.0 255.255.255.0 10.10.20.0 255.255.255.0
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto map OUTSIDE_MAP 20 match address REMOTE_SITE
crypto map OUTSIDE_MAP 20 set pfs group1
crypto map OUTSIDE_MAP 20 set peer 82.XXX.XXX.XXX
crypto map OUTSIDE_MAP 20 set transform-set ESP-AES-128-SHA
crypto map OUTSIDE_MAP 20 set security-association lifetime seconds 28800
crypto map OUTSIDE_MAP interface Outside
nat (inside) 0 access-list REMOTE_SITE
access-list NO_NAT permit ip 10.10.10.0 255.255.255.0 10.10.20.0 255.255.255.0
nat (inside) 0 access-list NO_NAT
tunnel-group 82.XXX.XXX.XXX type ipsec-l2l
tunnel-group 82.XXX.XXX.XXX ipsec-attributes
pre-shared-key ***
---------------------------------

SiteB
Public: 82.XXX.XXX.XXX
Inside: 10.10.20.0/24
-----------------------------------

crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption aes
hash sha
group 1
lifetime 28800
access-list REMOTE_SITE ex permit ip 10.10.20.0 255.255.255.0 10.10.10.0 255.255.255.0
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto map OUTSIDE_MAP 20 match address REMOTE_SITE
crypto map OUTSIDE_MAP 20 set pfs group1
crypto map OUTSIDE_MAP 20 set peer 196.XXX.XXX.XXX
crypto map OUTSIDE_MAP 20 set transform-set ESP-AES-128-SHA
crypto map OUTSIDE_MAP 20 set security-association lifetime seconds 28800
crypto map OUTSIDE_MAP interface outside
access-list NO_NAT permit ip 10.10.20.0 255.255.255.0 10.10.10.0 255.255.255.0
nat (inside) 0 access-list NO_NAT
nat (inside) 0 access-list REMOTE_SITE
tunnel-group 196.XXX.XXX.XXX type ipsec-l2l
tunnel-group 196.XXX.XXX.XXX ipsec-attributes


Thanks for the help
 
can you post full configs?? also, is it the same if you ping from site b to site a??

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)
 
Can you please be specific my config is 7 pages long and would take me a long time to clean it. Can tell me which part and wich config you one Site A or Site B ?
 
: Saved
:
ASA Version 8.2(1)
!
hostname wana
domain-name santexia.com
enable password Y6EAV/jsWINei.BW encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
name 82.xx.xx.xx AS1-32 description AS1-32

!
interface Ethernet0/0
description Wana Fibre Optique
nameif Outside
security-level 0
ip address 196.xx.xx.xx. 255.255.255.224
ospf cost 10
!
interface Ethernet0/1
description Network 10.10.10.0
nameif inside
security-level 100
ip address 10.10.10.2 255.255.255.0
ospf cost 10
!
interface Ethernet0/2
description Ml Voice Network
nameif DMZ
security-level 50
ip address 10.150.37.116 255.255.255.248
ospf cost 10
!
interface Ethernet0/3
description Network 10.10.7.0
nameif Inside107
security-level 100
ip address 10.10.7.253 255.255.255.0
ospf cost 10
!
interface Management0/0
description Management Only Interface 192.168.2.1
nameif management
security-level 100
ip address 192.168.2.1 255.255.255.0
ospf cost 10
management-only
!
boot system disk0:/asa821-k8.bin
ftp mode passive
clock timezone WET -5
dns domain-lookup Outside
dns domain-lookup inside
dns domain-lookup DMZ
dns domain-lookup Inside107
dns domain-lookup management
dns server-group DefaultDNS
name-server 196.xx.xx.5
name-server 196.xx.xx.6
domain-name sxxxxx.com
dns server-group OpenDNS
name-server 208.67.220.220
domain-name opendns.org
dns server-group Ours
name-server 64.xx.xx.2
name-server 64.xx.xx.4
domain-name ns1.salesrep.com
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object-group service Voip
description Voip Providers
service-object icmp
service-object icmp echo
service-object icmp echo-reply
service-object tcp-udp eq 50000
service-object tcp-udp eq 5038
service-object udp range 10000 20000
service-object udp range sip 5099
object-group service VoipAdmin
description Asterisk Admin only ports
group-object Voip
service-object tcp range 1048 1048
service-object tcp range 50000 50000
service-object tcp range 6600 6600
service-object tcp range 8000 8500
service-object tcp eq ftp
service-object tcp eq ftp-data
service-object tcp eq h323
service-object tcp eq www
service-object tcp eq nntp
service-object udp range 1048 1068
service-object udp eq snmp
service-object udp eq talk
service-object udp eq tftp
service-object udp eq time
service-object udp eq 4569
service-object tcp-udp source eq 22 eq 22
service-object tcp eq ssh
service-object tcp-udp source eq 10000 eq 10000
service-object tcp eq https
service-object icmp
service-object tcp-udp eq domain
service-object tcp-udp range 4445 4446
service-object tcp-udp eq 843
service-object tcp-udp range 5036 5038
service-object tcp eq 135
service-object tcp range 2000 2006
object-group network Trusted
description Trusted Network Santexia Orbit Salesrep
network-object host Casa-3
network-object host Home
network-object USA-1xx 255.255.255.0
network-object host Hassam-IAM
object-group network DM_INLINE_NETWORK_1
network-object host 196.xx.xx.187
network-object host 196.xx.xx.188
object-group network DM_INLINE_NETWORK_3
network-object host 196.xx.xx.188
network-object host 196.xx.xx.187
object-group protocol DM_INLINE_PROTOCOL_1
protocol-object ip
protocol-object icmp
object-group service 194
service-object icmp
service-object tcp eq domain
service-object udp eq domain
object-group protocol DM_INLINE_PROTOCOL_4
protocol-object ip
protocol-object icmp
object-group service DM_INLINE_SERVICE_1
service-object icmp
service-object tcp eq domain
service-object udp eq domain
object-group service DM_INLINE_SERVICE_2
group-object VoipAdmin
service-object tcp eq 3389
object-group service Terminal-Server tcp-udp
port-object eq 3389
object-group service DM_INLINE_SERVICE_3
service-object tcp-udp eq 12000
service-object tcp-udp eq 16001
service-object tcp-udp eq 4000
service-object tcp-udp eq 4001
service-object icmp echo
service-object icmp echo-reply
service-object tcp-udp eq 5000
object-group network Maroc

object-group service attack
service-object tcp source eq 6000 range 1 65535
object-group service DM_INLINE_SERVICE_4
service-object tcp eq 135
service-object tcp eq 445
service-object udp eq 135
service-object udp eq 445
service-object tcp-udp eq 5555
service-object tcp eq netbios-ssn
group-object attack
object-group network DM_INLINE_NETWORK_2
network-object host kenitra-iam-166
network-object host kenitra-iam-167
network-object host Rabat-Wimax
network-object host Rabat-IAM-135
network-object host Rabat-IAM-136
network-object host 208.67.220.220
object-group service DM_INLINE_SERVICE_5
service-object icmp
group-object Voip
service-object tcp eq 2000
service-object tcp-udp eq domain
object-group protocol TCPUDP
protocol-object udp
protocol-object tcp
object-group service cam tcp-udp
description cam1
port-object eq 2000
object-group service cam11 tcp-udp
description cam11
port-object eq 2001
object-group service cam2 tcp-udp
description cam2
port-object eq 2002
object-group service cam3 tcp-udp
description cam3
port-object eq 2003
object-group service cam33 tcp-udp
description cam33
port-object eq 2003
object-group service DM_INLINE_SERVICE_8
service-object icmp
service-object tcp eq 3389
object-group service DM_INLINE_TCP_2 tcp
port-object eq ftp
port-object eq www
object-group network DM_INLINE_NETWORK_6
network-object host 196.xx.xx.178
network-object host 196.xx.xx.186
object-group network DM_INLINE_NETWORK_7
network-object host 196.xx.xx.178
network-object host 196.xx.xx.188
object-group network DM_INLINE_NETWORK_4
network-object host Rabat-IAM-135
network-object host Rabat-IAM-136
object-group service DM_INLINE_SERVICE_6
service-object tcp-udp eq 5038
service-object tcp eq www
object-group protocol DM_INLINE_PROTOCOL_3
protocol-object ip
protocol-object icmp
object-group protocol DM_INLINE_PROTOCOL_5
protocol-object ip
protocol-object icmp
object-group protocol DM_INLINE_PROTOCOL_6
protocol-object ip
protocol-object icmp
object-group protocol DM_INLINE_PROTOCOL_7
protocol-object ip
protocol-object icmp
object-group service DM_INLINE_SERVICE_7
group-object Voip
group-object VoipAdmin
object-group service DM_INLINE_SERVICE_9
service-object tcp eq www
service-object tcp eq telnet
service-object udp eq tftp
service-object icmp
object-group network DM_INLINE_NETWORK_9
network-object host Grandstream
group-object Trusted
object-group network Attacks
network-object A131 255.255.255.0
network-object Tetouan 255.255.255.0
network-object 82.97.15.0 255.255.255.0
network-object a3 255.255.255.0
network-object 87.119.49.0 255.255.255.0
network-object 93.92.47.0 255.255.255.0
network-object a6 255.255.255.0
network-object a25 255.255.255.0
network-object a64 255.255.255.0
network-object a5 255.255.255.0
network-object a8 255.255.255.0
network-object german 255.255.255.0
network-object wa 255.255.255.0
network-object cloumbus 255.255.255.0
network-object aggg 255.255.255.0
network-object af 255.255.255.0
network-object wana 255.255.255.0
network-object hack64 255.255.255.0
network-object a17 255.255.255.0
network-object at10000 255.255.255.0
network-object a220 255.255.255.0
object-group protocol DM_INLINE_PROTOCOL_2
protocol-object ip
protocol-object icmp
access-list inside_nat_outbound extended permit ip any 10.150.0.0 255.255.0.0
access-list Wan_access_in extended permit icmp any any echo-reply
access-list Wan_access_in remark GrandStream Support
access-list Wan_access_in extended permit object-group DM_INLINE_SERVICE_9 object-group DM_INLINE_NETWORK_9 host 196.xx.xx.183
access-list Wan_access_in extended permit object-group DM_INLINE_SERVICE_1 any object-group DM_INLINE_NETWORK_6
access-list Wan_access_in remark Asterisk Servers
access-list Wan_access_in extended permit object-group Voip object-group VoipIp object-group DM_INLINE_NETWORK_3
access-list Wan_access_in remark Asterisk Servers Admin Ports
access-list Wan_access_in extended permit object-group DM_INLINE_SERVICE_2 object-group Trusted object-group DM_INLINE_NETWORK_1
access-list Wan_access_in remark Kabal setup
access-list Wan_access_in extended permit object-group DM_INLINE_SERVICE_3 any host 196.xx.xx.184
access-list Wan_access_in remark Kabal setup
access-list Wan_access_in extended permit tcp object-group Trusted host 196.xx.xx.184 object-group DM_INLINE_TCP_2
access-list Wan_access_in remark Echouafni PC TS Server
access-list Wan_access_in extended permit object-group DM_INLINE_SERVICE_8 object-group Trusted host 196.xx.xx.250
access-list Wan_access_in remark Temp For denied simple ports
access-list Wan_access_in extended permit object-group DM_INLINE_SERVICE_5 object-group DM_INLINE_NETWORK_2 object-group DM_INLINE_NETWORK_7
access-list Wan_access_in extended permit object-group DM_INLINE_SERVICE_6 object-group DM_INLINE_NETWORK_4 host 196.xx.xx.188
access-list Wan_access_in remark Tries to connect to all our network nodes
access-list Wan_access_in extended deny ip object-group Attacks any log disable
access-list Wan_access_in extended deny object-group DM_INLINE_SERVICE_4 any any log disable
access-list Wan_access_in extended permit object-group DM_INLINE_PROTOCOL_2 10.10.20.0 255.255.255.0 any
access-list DMZ_access_in extended permit icmp any any
access-list DMZ_access_in extended permit ip any any
access-list Inside107_access_in remark Implicit rule: Permit all traffic to less secure networks
access-list Inside107_access_in extended permit object-group DM_INLINE_PROTOCOL_3 any any
access-list inside_access_out extended permit object-group DM_INLINE_PROTOCOL_4 any any
access-list inside_access_out extended permit object-group DM_INLINE_SERVICE_7 any any
access-list inside_access_out extended deny object-group DM_INLINE_PROTOCOL_7 host 10.10.10.151 any
access-list Inside107_access_out extended permit ip any any
access-list inside_access_in remark to Block someone inside add them to this list
access-list inside_access_in extended deny ip host 10.10.10.237 any inactive
access-list inside_access_in remark To be validated
access-list inside_access_in extended permit object-group DM_INLINE_PROTOCOL_1 10.10.10.0 255.255.255.0 any
access-list REMOTE_SITE extended permit ip 10.10.10.0 255.255.255.0 10.10.20.0 255.255.255.0
access-list NO_NAT extended permit ip 10.10.10.0 255.255.255.0 10.10.20.0 255.255.255.0
pager lines 24
logging enable
logging console alerts
logging monitor alerts
logging buffered emergencies
logging history debugging
logging asdm notifications
logging mail emergencies
logging from-address wana@santexia.com
logging recipient-address se@marocdata.com level critical
mtu Outside 1500
mtu inside 1500
mtu DMZ 1500
mtu Inside107 1500
mtu management 1500
ip local pool VPN-Casa 10.10.10.30-10.10.10.39 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-621.bin
no asdm history enable
arp timeout 60
nat-control
global (Outside) 1 interface
global (DMZ) 2 interface
nat (inside) 0 access-list NO_NAT
nat (inside) 2 access-list inside_nat_outbound dns
nat (inside) 1 0.0.0.0 0.0.0.0 dns
nat (Inside107) 1 0.0.0.0 0.0.0.0 dns
static (inside,Outside) 196.xx.xx.197 cam3 netmask 255.255.255.255 dns
static (inside,Outside) 196.xx.xx.188 10.10.10.188 netmask 255.255.255.255 dns
static (inside,Outside) 196.xx.xx.187 10.10.10.187 netmask 255.255.255.255 dns
static (inside,Outside) 196.xx.xx.190 10.10.10.190 netmask 255.255.255.255 dns
static (inside,Outside) 196.xx.xx.189 10.10.10.171 netmask 255.255.255.255 dns
static (inside,Outside) 196.xx.xx.180 10.10.10.243 netmask 255.255.255.255 dns
static (inside,Outside) 196.xx.xx.179 10.10.10.11 netmask 255.255.255.255 dns
static (inside,Outside) 196.xx.xx.186 10.10.10.194 netmask 255.255.255.255 dns
static (inside,Outside) 196.xx.xx.184 10.10.10.237 netmask 255.255.255.255 dns
static (inside,Outside) 196.xx.xx.250 10.10.10.250 netmask 255.255.255.255 dns
static (inside,Outside) 196.xx.xx.183 10.10.10.183 netmask 255.255.255.255 dns
access-group Wan_access_in in interface Outside
access-group inside_access_in in interface inside
access-group inside_access_out out interface inside
access-group DMZ_access_in in interface DMZ
access-group Inside107_access_in in interface Inside107
access-group Inside107_access_out out interface Inside107
route Outside 0.0.0.0 0.0.0.0 196.xx.xx.177 1
route DMZ 10.150.0.0 255.255.0.0 10.150.37.113 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 10.10.10.0 255.255.255.0 inside
http Home 255.255.255.255 Outside
http MlWimax 255.255.255.255 Outside
http 64.182.157.131 255.255.255.255 Outside
http 192.168.1.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set TRANS_ESP_DES_SHA esp-des esp-sha-hmac
crypto ipsec transform-set TRANS_ESP_DES_SHA mode transport
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-DES-SHA ESP-DES-MD5
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime seconds 28800
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime kilobytes 4608000
crypto map Outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map OUTSIDE_MAP 20 match address REMOTE_SITE
crypto map OUTSIDE_MAP 20 set pfs group1
crypto map OUTSIDE_MAP 20 set peer 89.xx.xx.126
crypto map OUTSIDE_MAP 20 set transform-set ESP-AES-128-SHA
crypto map OUTSIDE_MAP 20 set security-association lifetime seconds 28800
crypto map OUTSIDE_MAP interface Outside
crypto isakmp enable Outside
crypto isakmp policy 10
authentication pre-share
encryption aes
hash sha
group 1
lifetime 28800
crypto isakmp policy 30
authentication pre-share
encryption des
hash md5
group 2
lifetime 86400
crypto isakmp policy 50
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 70
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
crypto isakmp policy 90
authentication pre-share
encryption des
hash md5
group 1
lifetime 86400
no crypto isakmp nat-traversal
vpn-addr-assign local reuse-delay 5
console timeout 0
dhcpd dns 64.xxx.xxx.xxx 64.xxx.xxx.xxx
dhcpd auto_config Outside
!
dhcpd dns 196.xxx.xxx.xxx 196.xxx.xxx.xxx interface Outside
!
dhcpd address 10.10.10.55-10.10.10.59 inside
dhcpd dns 64.xxx.xxx.xxx 64.xxx.xxx.xxx interface inside
dhcpd update dns interface inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection scanning-threat shun
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 50 burst-rate 300 average-rate 200
ssl encryption des-sha1 aes128-sha1 rc4-md5 rc4-sha1 aes256-sha1 3des-sha1
webvpn
enable Outside
group-policy DefaultRAGroup internal
group-policy DefaultRAGroup attributes
dns-server value 196.xxx.xxx.xxx
vpn-tunnel-protocol l2tp-ipsec webvpn
group-policy casa internal
group-policy casa attributes
dns-server value 196.xx.xx.x 196.xx.xx.x
vpn-tunnel-protocol IPSec webvpn
default-domain value santexia.com
group-policy DfltGrpPolicy attributes
vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
group-policy saad internal
group-policy saad attributes
vpn-tunnel-protocol webvpn
webvpn
url-list none
group-policy se internal
group-policy se attributes
dns-server value 196.12.205.5 196.12.205.6
vpn-tunnel-protocol IPSec l2tp-ipsec svc
username saad password L2vrOrsINlABBmbM encrypted privilege 0
username saad attributes
vpn-group-policy saad
service-type nas-prompt
username echouafnist password m6gqgAR+Oi3nk4n16cU0Kg== nt-encrypted privilege 15
username hadia password 5u4.UevybQpGz7dn encrypted privilege 15
username Kabal password 28tC1ApEpsgsTSzF encrypted privilege 1
username Kabal attributes
service-type nas-prompt
tunnel-group DefaultRAGroup general-attributes
address-pool VPN-Casa
default-group-policy DefaultRAGroup
tunnel-group DefaultRAGroup ipsec-attributes
pre-shared-key *
tunnel-group ste type remote-access
tunnel-group ste general-attributes
authentication-server-group (Outside) LOCAL
tunnel-group ste webvpn-attributes
group-alias ste enable
tunnel-group 89.xx.xx.126 type ipsec-l2l
tunnel-group 89.xx.xx.126 ipsec-attributes
pre-shared-key *
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns migrated_dns_map_1
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns migrated_dns_map_1
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:c7757540e662f91a03c65d8d3d14665a
: end
asdm image disk0:/asdm-621.bin
asdm location kenitra-iam-166 255.255.255.255 inside
asdm location kenitra-iam-167 255.255.255.255 inside
asdm location cam1 255.255.255.255 inside
asdm location cam2 255.255.255.255 inside
asdm location cam3 255.255.255.255 inside
no asdm history enable

 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top