RealVNC through ASA5505

[someguy758]

Hello, WE currently have a site to site VPN running and working with an ASA5505 and checkpoint firewall but we need to get realvnc working with it also. When we ping from the remote site's subnet or try to send a request using realvnc it is almost as if it is trying to establish a new tunnel on the one that is already there and fails with this error "QM FSM error (P2 struct &0xd535f638, mess id 0xeee2b6e9)!". I cannot explain the reason for the realvnc but i do know it needs to be working.

Can anyone help with getting this working or shed some light on what is and is not supposed to happen?

Information about checkpoint config is unfortunately unavailable.
Config of ASA:
: Saved
:
ASA Version 8.0(4)
!
hostname cinemas8
domain-name domain.com
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
name 10.11.9.0 BL--NET
name 69.XXX.XXX.74 BL-FW
name 69.XXX.XXX.231 BC-ASA
!
interface Vlan1
nameif inside
security-level 100
ip address 172.168.12.1 255.255.255.0
!
interface Vlan2
nameif DSL_Network
security-level 0
pppoe client vpdn group ecfh
ip address pppoe setroute
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
boot system disk0:/asa804-k8.bin
ftp mode passive
clock timezone GMT 0
dns server-group DefaultDNS
domain-name ecfh.com
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object-group icmp-type DM_INLINE_ICMP_1
icmp-object echo
icmp-object echo-reply
icmp-object source-quench
icmp-object time-exceeded
icmp-object traceroute
icmp-object unreachable
object-group service VNC tcp
port-object eq 5900
object-group service DM_INLINE_SERVICE_1
service-object tcp eq 5900
service-object udp eq 5900
object-group service DM_INLINE_SERVICE_2
service-object tcp eq 5900
service-object udp eq 5900
access-list DSL_Network_1_cryptomap extended permit ip 172.168.12.0 255.255.255.0 BL--NET 255.255.255.0
access-list inside_nat0_outbound extended permit ip 172.168.12.0 255.255.255.0 BL--NET 255.255.255.0
access-list inside_access_out extended permit ip any any
access-list DSL_Network_access_out extended permit ip any any
access-list DSL_Network_access_out extended permit icmp any any object-group DM_INLINE_ICMP_1
access-list CIN8_Network_access_out extended permit ip any any
access-list CIN8_Network_access_in extended permit ip any any
access-list ABM_Network_access_out extended permit ip any any
access-list ABM_Network_access_in extended permit ip any any
access-list DSL_Network_access_in extended permit object-group DM_INLINE_SERVICE_2 any interface DSL_Network
access-list DSL_Network_access_in extended permit object-group DM_INLINE_SERVICE_1 host 10.11.9.100 host 172.168.12.2
pager lines 24
logging enable
logging monitor debugging
logging asdm debugging
mtu DSL_Network 1500
mtu inside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-613.bin
no asdm history enable
arp timeout 14400
global (DSL_Network) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
access-group DSL_Network_access_in in interface DSL_Network
access-group DSL_Network_access_out out interface DSL_Network
access-group inside_access_out out interface inside
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
aaa authentication enable console LOCAL
aaa authentication http console LOCAL
aaa authentication serial console LOCAL
http server enable
http 0.0.0.0 0.0.0.0 DSL_Network
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set Trans_1 esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map DSL_Network_map 1 match address DSL_Network_1_cryptomap
crypto map DSL_Network_map 1 set pfs
crypto map DSL_Network_map 1 set peer 69.XX.XX.74
crypto map DSL_Network_map 1 set transform-set ESP-3DES-SHA
crypto map DSL_Network_map 1 set security-association lifetime seconds 28800
crypto map DSL_Network_map 1 set security-association lifetime kilobytes 4608000
crypto map DSL_Network_map interface DSL_Network
crypto isakmp enable DSL_Network
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
vpdn group ecfh request dialout pppoe
vpdn group ecfh localname name
vpdn group ecfh ppp authentication chap
vpdn username username password ********* store-local
dhcpd auto_config DSL_Network
!

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
username CIN8Admin password 6ld4baLaRCcyimOa encrypted privilege 15
tunnel-group 69.XX.XX.74 type ipsec-l2l
tunnel-group 69.XX.XX.74 ipsec-attributes
pre-shared-key *
tunnel-group 69.XX.XX.231 type ipsec-l2l
tunnel-group 69.XX.XX.231 ipsec-attributes
pre-shared-key *
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect esmtp
inspect ftp
inspect h323 h225
inspect h323 ras
inspect icmp
inspect icmp error
inspect netbios
inspect rsh
inspect rtsp
inspect sip
inspect skinny
inspect sqlnet
inspect sunrpc
inspect tftp
inspect xdmcp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:03daecdb74f8e0d6d2e604d6edc0ef7b
: end
asdm image disk0:/asdm-613.bin
no asdm history enable

Thanks

 

[Supergrrover]

Do you get a static ip from your isp? What is the topology? Does any other traffic flow across the tunnel? What does the other config look like?


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[someguy758]

IP from ISP is a static one connected to interface via PPPOE.
There is communication through the tunnel. The thing is that i can ping from the ASA side to the checkpoint side but from the checkpoint point side to the ASA it does not use the same tunnel to get there it tries to create another tunnel.

The hard part is that i do not have access to the checkpoint config but I am working with another tech to try to get it working.

This scenario should work with an asa5505 and checkpoint firewall?

 

[Supergrrover]

You can have opposite ends of the tunnel be different vendors. You have to be double sure that the specs match. It sounds like the checkpoint isn't setup the same as the asa.

This isn't for the ASA but the settings are similar - you can use it to check the checkpoint -

http://supportwiki.cisco.com/ViewWi..._3000_Concentrator_to_Checkpoint_4.1_Firewall

Check the logs on the ASA and the checkpoint, see what they say about the tunnels.



Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[someguy758]

Update: When I disable pfs on the asa the communication shifts from the asa to checkpoint to checkpoint to asa only and this message shows up alot:


Duplicate TCP SYN from inside:172.16.12.21/4019 to DSL_Network:10.11.9.24/5550 with different initial sequence number

The address here are the to machines which need to communicate.

 

[Supergrrover]

Disable pfs on both.

Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[someguy758]

the problem for this asa has been solved. pfs was off on the check point side turned it off on the ASA side but was still getting errors. there was a name in the ASA for the checkpoint network, this was removed and all worked fine.

 

[Supergrrover]

Just a name statement? Very strange. It is just a drop in replacement of the address/network. Were the ACL's setup with the name or the actual IP? - just curious, glad you got it working.

Brent
Systems Engineer / Consultant
CCNP, CCSP