Cisco Firewall :: PIX515 / 2821 / 2921 / Getting GRE IPsec Tunnel Setup?

Apr 18, 2013

We are setting up an old office building as an offsite data center. The network cosists on a PIX 501 firewall and a 2811 router.  I am attempting to setup a GRE tunnel over IPsec back to the main office.  The main office consists of a PIX515, a 2821 router, and a 2921 router.  
There is also an ASA5510 in our main office that is used as our primary connection for all of our external services and as a GRE endpoint for our other offices.  The PIX515 is used to connect our main office clients to the internet and we would like traffic between it and our offsite data center to go across it as well.   The default route is to use the ASA.   We used policy based routing on the 2821 and 2921 routers to direct the appropriate traffic to the PIX515.  Right now I am not able to get the tunnel setup.  It appears that the offsite datacenter is sending packets but is not receiving any when I issue the “show crypto ipsec sa” commands on both firewalls.  I will show the output of that command below. 
Main Office The external address The loopback address The tunnel address
 Offsite Datacenter The external address The loopback address The tunnel address
The main office PIX515 Config :

PIX Version 7.2(2)
interface Ethernet0
mac-address 5475.d0ba.5012
nameif outside
security-level 0
ip address


View 2 Replies


Cisco VPN :: 2821 - IPsec / GRE Tunnel Up / Down Every 4 Or 6 Minutes?

Jun 9, 2011

we have a DMVPN Phase 2 setup in a hub and spoke design using a single head end device (Cisco 2821) and 30 spokes the majority of which are 1801's, all spokes have the same configuration and underlying transport (DSL). DSL circuits are terminated directly on the ISR.
We have a strange issue where by one of the spokes drops the tunnel every 4 or 6 minutes almost down to the second as per the output from "crypto logging session" This seems to vary between both time frames.
EEYSRO01# sh logg | include CRYPTO-5-SESSION_STATUS
Jun 10 12:48:36.624: %CRYPTO-5-SESSION_STATUS: Crypto tunnel is DOWN.  Peer 213.**.**.**:500       Id: 213.**.**.**
Jun 10 12:49:06.697: %CRYPTO-5-SESSION_STATUS: Crypto tunnel is UP  .  Peer 213.**.**.**:500       Id: 213.**.**.**
Jun 10 12:52:36.718: %CRYPTO-5-SESSION_STATUS: Crypto tunnel is DOWN.  Peer 213.**.**.**:500       Id: 213.**.**.**
Jun 10 12:52:37.030: %CRYPTO-5-SESSION_STATUS: Crypto tunnel is UP  .  Peer 213.**.**.**:500       Id: 213.**.**.**

We also have other errors that proceed to the tunnel Up/Down events
Jun 10 14:35:15.716: IPSEC(crypto_map_check_encrypt_core): mtree says we have SA but couldn't find current outbound SA. dropping pak. pak->cryptoflags=0x2000820
 Jun 10 14:35:15.716: IPSEC(crypto_map_check_encrypt_core): mtree says we have SA but couldn't find current outbound SA. dropping pak. pak->cryptoflags=0x1000820

View 0 Replies View Related

Cisco VPN :: Configuring IPSec VPN Tunnel ISR 2921 Router With Watchguard?

Aug 28, 2012

I am configuring a vpn ipsec tunnel with cisco isr 2921 router and Watchguard edge 1250e. I have the watchguard configured so I just need to make sure I have everything setup on the cisco side. At this point, there is no communication as I am not sure if I configured it correctly. Should I do the crypto map on g 0/0 or dialer 1?
aaa new-model
aaa session-id common
no ipv6 cef


View 4 Replies View Related

Cisco VPN :: 2921 - IPSec Tunnel Random Packet Drops

Mar 15, 2013

I'm trying to troubleshoot a random packet drop issue for an IPSec tunnel between two VTIs. For over a month, we didn't see any issue, and starting today, we have up to 30% packet loss across an IPSec tunnel.
After some analysis, I concluded that the packet loss happens somewhere on the path from the uc520 to the 2921. Packet counts show up correctly on the uc520 physical egress interface, but the packet count is low on the ingress interface on the 2921.

Pings outside the tunnel along the same path are fine.
I also cleared the tunnels on both ends and after they reestablished, the issue was still present.
Any pointers on finding where the packets get lost?
rr-hq-2921#ping source g0/1 rep 100         
Type escape sequence to abort.
Sending 100, 100-byte ICMP Echos to, timeout is 2 seconds:


View 3 Replies View Related

Cisco VPN :: 2921 Site-2-Site IPSEC VPN Tunnel Will Not Come Up

Dec 5, 2012

I am setting up a IPSEC VPN tunnel between a Cisco 2921 and ASA 550x. [code]

View 6 Replies View Related

Cisco VPN :: How To Setup IPSec Tunnel - 2320 And RVS4000

Aug 6, 2011

I have succesfully config an IPSec VPN Tunnel by using a Router Scientific Atlanta Cisco 2320 and a RVS4000 4-Port Gigabit Security Router with  VPN.On the site of Router Scientific Atlanta Cisco 2320 this is some info: [code] On the site of RVS4000 4-Port Gigabit Security Router with  VPN this is some info: [code] Remember that you can not be on the same range of IP, I mean, you can not have 192.168.0.X if the remote network is on 192.168.0.X, you have to change some of the Routers.I show the configuration on Router Scientific Atlanta Cisco 2320: I show the configuration on RVS4000 4-Port Gigabit Security Router with  VPN:If all is correctly configured, you should see on Router Scientific Atlanta Cisco 2320 the Status Connected:
If all is correctly configured, you should see on RVS4000 4-Port Gigabit Security Router with  VPN the Status Up.As you can see, I'm connected to the remote Router (RVS4000 4-Port Gigabit Security Router with  VPN) by my own web browser accesing by the local IP have used Authentication MD5, maybe is not the best one but I had no time to test SHA1, I will when I will have time.

View 1 Replies View Related

Cisco Routers :: SRP541W / Setup IPSEC Tunnel To Be Able To Go From Subnet?

Jun 12, 2012

Is there any way to setup an IPSEC tunnel to be able to go from my subnet, 192.168.75.x and be able to reach anything on the other side of the tunnel, 192.168.X.X?

View 5 Replies View Related

Cisco VPN :: 800 - How To Setup Both Ends Of IPsec Tunnel Using Software Client

Sep 29, 2011

how to setup a both ends of an IPSEC VPN tunnel using a software client such as shrewsoft vpn and an 800 series router?
I've tried following the instructions on cisco's site, but I don't really understand which interface I should use? Dialer, VLAN1 or UnNumbered to a Loopback?
I'm OK with most basic features of the router, but never had any luck with VPNs?

View 3 Replies View Related

Cisco Routers :: Rv220W / Assign Vpn Traffic To A Vlan When Setup An Ipsec Tunnel?

Apr 7, 2012

i'm using an rv220W and i whant to know if is it possible to assign vpn traffic to a vlan when i setup an ipsec tunnel?
Im using different vlans on my rv220W.
Vlan 10: engineers (ex: no intervlan routing
Vlan20: sales (ex: no intervlan routing
 This is what i need:  - An engineer is on the road and when he makes a ipsec vpn connection => assignd to the vlan "engineers" so he can access the server/pc's in that vlan.and when someone from the sales group starts a vpn connection he needs to be in the vlan "sales" so he can access his pc/data,...

View 15 Replies View Related

Cisco WAN :: Firewall Setup On 2921 Router?

Jun 27, 2011

I just purchased thie Cisco 2921 router and have all the configuration completed except the Firewall and NAT. We have 4 supnets at our location on the router each with a DHCP handed from the router to our network. Any examples for the Firewall and Nat configurations?

View 6 Replies View Related

Cisco WAN :: 2921 / 2821 - Using BGP Routing

Mar 12, 2013

I have two routers 2921 and 2821. Also 2 WAN Links from two Different  ISP's. Presently I am using Static Routing with PBR for traffic shaping.
Now I want to use BGP Routing in my network. What is the requirement  for using BGP. Does  ASN need to  buy  or   the ISP will provide ?

View 1 Replies View Related

Cisco Firewall :: 5540 - Multicast Over Lan To Lan Ipsec Tunnel

May 3, 2011

I need to configure multicast between 2 Csico 5540's lan to lan ipsec tunnel for a Voip application.

View 2 Replies View Related

Cisco Firewall :: IPSec Tunnel On Sub-interface On ASA 5510?

Jun 11, 2012

I working on a security solution using ASA firewall. Is it possible to setup a IPSec tunnels  on each subinterface of a physical interface on ASA 5510?

View 3 Replies View Related

Cisco Firewall :: ASA 5520 - IPSec Tunnel Without Private Network

Apr 11, 2013

I'm trying to achieve a site-to-site ipsec tunnel to a Cisco ASA 5520.  Most examples feature the ASA with a public interface that terminates the tuennel and a private network on another interface that the tunnel interacts with.  Where my scenario differs is that the interface that accepts the tunnel is part of a public /29 network where I want the remaining hosts on that subnet to be able to route thrugh to the other end of the tunnel.  My tunnel gets established, but any attempts to route via the IP assigned to that one interface result in the ASA rejecting traffic. If so, what configuration options should I consider?

View 5 Replies View Related

Cisco Firewall :: Can Configure Two IPsec Tunnel In ASA5525X / When Destination Is Same

Sep 7, 2012

Can I configure two IPsec tunnel in a ASA5525X, when the destination is same.

View 1 Replies View Related

Cisco Firewall :: Command To Check IPSEC Tunnel On ASA 5520?

Jan 7, 2013

Need to check how many tunnels IPSEC are running over ASA 5520.Tried commands which we use on Routers no luck?

View 6 Replies View Related

Cisco Firewall :: ASA 5540 - IPSec Tunnel / ASA Refuses To Encrypt Traffic But Decrypts It

May 31, 2012

This has to be the most weirdest issue I have seen since the past year on my ASA. I have an ASA 5540 running the 8.4(2) code without any issues until I stumbled upon this problem last week and I have spent sleepless nights with no resolution! So, take a deep breath and here is a brief description of my setup and the problem:
A Simple IPSEC tunnel between my ASA 5540 8.4(2) and a Juniper SSG 140 screen OS 6.3.0r9.0(route based VPN)
The tunnel comes up without any issues but the ASA refuses to encrypt the traffic but decrypts it with GLORY! below are some debug outputs, show outputs and a packet tracer output which also has an explanation of my WEIRD NAT issue:  

My setup - ( I wont get into the tunnel encryption details as my tunnel negotiations are **** perfect and comes up right off the bat when the ASA is configured as answer only)
CISCO ASA - IPSec networking details
JUNIPER SSG 140 - IPSec networking details
HOST NAME# sh cry ipsec sa peer <JUNIPER SSG PEER>
peer address: <JUNIPER SSG PEER>

As you can see, there is no echo reply packet at all as the packet is not being encapsulated while it is being sent back. I have been going mad with this. Also, this is a live production multi tenant firewall with no issues at all apart from this ****** ip sec tunnel to a juniper!!

Also, the is another IP Sec tunnel remote network to this network and this IP SEC tunnel has a similar Juniper SSG 140 screen os 6.3.0r9.0 at the remote end and this woks like a charm without any issues, but the 171 is not being encrypted by the ASA at all.

View 2 Replies View Related

Cisco WAN :: 1941 Router - Enable IPSec Virtual Tunnel Interface With Tunnel Mode IPv4

Sep 23, 2012

I'm in process of purchasing a new Cisco routers for our branches that will be used primary to enable IPSec virtual tunnel interfce with "tunnel mode ipsec ipv4". does the default IOS IP Base supports this feature? or i need to purchase DATA license or SECURITY license?

View 4 Replies View Related

Cisco Routers :: Set A VPN IpSec Tunnel GW To GW Tunnel Between RV110W

Oct 17, 2012

I am using a Cisco RV110W (Firmware 1.2.09) in a branch and I would like to create a VPN Tunnel to another site that has a Cisco RV042 (firmware v4.2.1.02)
What would be the correct Configuration? the current configuration I am using is
in the RV042 i am using
Check Enable 
Local Group Setup
Local Security Gateway Type : IP Only
IP Address : RV042 Pulbic IP address


View 3 Replies View Related

Cisco WAN :: 2921 / VTI Tunnel On Two Different ISP?

Mar 28, 2012

i have one interesting problem with local PBR on 2921 router. Here is the case,On HQ site there is 2921 router with two directly connected ISP, and there is Branch which is connected to only one ISP. The configuration should be to connect HQ router to Branch router with two VTI tunnels, so that each tunnel on HQ site should be terminated on different ISP, and EIGRP will be monitoring each VTI status.The problem is on HQ site, there is only one way to specify router with LOCAL PBR configuration, so router should send on ISP1 terminated tunnel traffic to ISP1, and on ISP2 interface terminated tunnel traffic to ISP2.
As I know this configuratino should work, but I could't make it work on c2900-universalk9-mz.SPA.151-4.M4.bin IOS, and on c2900-universalk9-mz.SPA.152-2.T1.bin.
 Here is simple config:
ISP1 ip is
ISP2 ip is is Branch ip address.
ip vrf BRANCH

when I configure one default static route, it starts workig, but both tunnels go with specified ISP, and also there is no vrf problem,when there is no any vrf config it also don't work. gre tunnels also dont work.

View 4 Replies View Related

Cisco Firewall :: Route To Internet Through Old PIX515 Firewall

Jun 10, 2012

We have a wifi network for guests, that we route to internet through an old PIX515 Firewall. We recently tuned the timers to lower values in order to "save" on resources and publix address usage.
The timers we use are:
-timeout xlate 0:30:00
-timeout conn 0:30:00 half-closed 0:05:00 udp 0:02:00 icmp 0:00:02
Through verifying the new timers, we noticed at some xlate connections (TCP PAT) that are idle for ever!!In the connection table, I cannot find an idle connection for longer than 1h....

View 1 Replies View Related

Cisco Firewall :: Setup Of IPSec Passthrough On ASA 5520

Mar 28, 2012

I am working on IPSec Passthrough on an ASA 5520, with version 8.3, and ASDM 6.3. Currently I have a requirement for users in my internal network ( / 25) to be able to connect to external IPSec VPN servers.
So I created a network object with / 25, and used dynamic PAT to translate the source ip address to the external internet facing outside interface:

I then added the following rules on the inside-in ACL: However troubleshooting shows that isakmp is passing through the firewall, but esp and ah is not.
For isakmp:
For ESP:Seems like the nat rule is drawing my ESP traffic,

View 1 Replies View Related

Cisco WAN :: 7200 / 2921 With VTI IPsec

May 20, 2013

We have a Cisco 7204 G1 running c7200-advipservicesk9-mz.122-33.SRE7.bin and we're having a lot of difficulties getting a VTI working to a Cisco 2921 with adv. security. I've ruled out that the 2921 is at fault by successfully establishing a VTI to another 2921 and a 7200 running a different IOS release.
We see the tunnel come up, but when I sent a ping from the 2921 to the 7204 there isn't a reply. When I look at the results on the 7204 from a 'sh crypto engine connection active', I see the decrypt counters increase, but I don't see the Encrypt counters increase as it's trying to reply to the ping.  I'm not sure if this is because there is an issue with the encryption or whether there might be a more fundamental issue with the router not replying to the pings.
I've tried the following IOS releases (c7200-advipservicesk9-mz.122-33.SRE7 & c7200-advipservicesk9-mz.122-33.SRE6) and they all behave the same way - this makes me think it might be a config issue rather than and IOS bug which is what I first thought. c7200-advipservicesk9-mz.122-33.SRE7.bin.  
sh crypto engine connections active
Crypto Engine Connections 

   ID Interface       Type  Algorithm           Encrypt  Decrypt IP Address
    1 Tu10             IPsec 3DES+SHA                 0       31
    2 Tu10             IPsec 3DES+SHA                19         0
1001 Tu10           IKE   SHA+3DES                  0        0
Here is a copy of my config on the 7204 - the other end (Cisco 2921) is configured in the same way.
crypto isakmp policy 1
encr 3des
authentication pre-share

View 16 Replies View Related

Cisco Firewall :: VPN Concentrator On PIX515 DMZ

Feb 7, 2011

I'm  planning connect VPN concentrator in our company to PIX515 DMZ interface.At the moment , VPN concentrator(used for remote access VPN for laptop users) is connected directly to core switch so as PIx515. Having VPN Concentrator connected directly to LAN is security risk .SO i want to connect VPN concentrator to DMZ of the Firewall(pix515).
We don't have any test environment and we are not allowed to have downtime of more than 10 minutes in production network ,I want to make sure my design and commands would work without problem .I've attached  doigram of our curernt setup and new setup I'm planning to work on as well as commands . Does this design will work .Nat , routing everything .

View 15 Replies View Related

Cisco Firewall :: Can't Ping PC From PIX515

Jun 14, 2012

I am unable to ping my computer (attached via crossover). I can ping from the PC, but not from the PIX515. I'm using ethernet 1, and I have its IP set at, but for what ever reason I am unable to contact the computer. I tried messing with the access list a little bit but nothing so far.

PIX515(config)# show run
: Saved
PIX Version 6.3(5)
interface ethernet0 auto shutdown
interface ethernet1 auto
nameif ethernet0 outside security0


View 7 Replies View Related

Cisco VPN :: 2821 - Nat Web Traffic From Tunnel

Jan 23, 2012

i have 2 routers, 2821 and 2811. they are connected via GRE over IPsec, and all of the traffic from 2821 is being routed to 2811 with a default route to its tunnel interface. 2821 needs to access internet through 2811 valid ip address, my question is that how should i nat the traffic on 2811 so that 2821 can access the internet?

View 1 Replies View Related

Cisco VPN :: VPN Tunnel Monitoring With 2821

Nov 7, 2010

We have around 20 VPN tunnel via Cisco Router 2821 (Intranet) and around 30 VPN tunnel via Cisco ASA  (Internet) with 3rd Parties/Vendors.I wanna know if there is any monitoring tools from Cisco or any others providers who can give me information/trend report about VPN tunnel Up/Down time, Volumns of Traffic, Protocols etc.

View 2 Replies View Related

Cisco VPN :: 2921 And 1941 EAP TLS Fragmentation Across VPN Tunnel

May 7, 2012

I am having an issue authenticating users via 802.1x/EAP-TLS across an IPSec tunnel. I am using route-based VPN with SVTI configuration on a 2921 and 1941. I have the following settings defined:

- Under the tunnel interfaces:
- MTU 1390
- MSS 1350
- Under the ingress LAN interface
- route-map to set the DNF bit to 0
- On the RADIUS Server (2008 NPS)
- Framed-MTU: 1300
This had been working for months until I got a call last week about users not being able to authenticate to our secured SSID. I fired up wireshark and also used my client monitor tool in my wireless NMS to watch what is going on. I see all of the access-request and access-challenge exchanges, but the final exchange never happens. In both captures you can see messages with id's 77-81, but message id 82 isn't shown in the wireshark capture, only fragments are. In the client monitor capture you can see that message id 82 is 1726 bytes in length. Now, if I capture packets on my local LAN, the 1726 byte packet is properly fragmented and users can authenticate just fine.

I have scoured the Internet trying to find a setting that I must have missed, but I can't. I've tried adjusting the Framed-MTU, all the way down to 1100.

View 1 Replies View Related

Cisco Firewall :: Do PIX515 Support For Version 8.3

Jun 12, 2012

I have PIX515 with version 7.0 installed, so can i install version 8.3 on it?and what will be the memory requirements?

View 2 Replies View Related

Cisco Firewall :: PIX515 To ASA5510 8.4(5) Migration?

Dec 18, 2012

We're migrating as mentioned in the subject and this new format is quite a departure from previous iOS versions so I thought I'd post the configs of the PIX and the ASA and ask if someone is willing to compare them and verify that it is correct and should be basically plug and play. The are outside IP addresses and the yyy.yyy.yyy are inside addresses. .
Existing PIX config
PIX Version 6.3(4)
interface ethernet0 100full


View 2 Replies View Related

Cisco VPN :: Site To Site VPN IPSEC Tunnel From ASA 5505 To Clavister Firewall

Nov 20, 2012

I have weird problem with a Site to site VPN tunnel from a Cisco ASA 5505 to an Clavister Firewall.When I restart the Cisco ASA 5505 the tunnel is up and down,up, down, down, and I get all strange messages when I see if the tunnel is up or down with the syntax: [code]
After a while like 5-10 min the vpn site to site tunnel is up and here is the strange thing happening I have all accesslists and tunnel accesslists right I can only access one remote network (Main site Clavister Firewall) trought the vpn tunnel behind the Cisco ASA 5505, and I have 5 more remote networks that I want to access but only one remote network is working trought the vpn tunnel behind the Cisco ASA. I see that when I do this syntax in ASA: show crypto ipsec sa.They had a Clavister Firewall before on that site before and now they have a Cisco ASA 5505 and all the rules on the main site thats have the big Clavister Firewall is intact so the problems are in the Cisco ASA 5505. [code]
All these remote networks are at the Main Site Clavister Firewall.

View 1 Replies View Related

Cisco VPN :: 2821 Tunnel To Snapgear SG560

Oct 24, 2011

So i am trying to test out a vpn config to establish an IPSEC tunnel between our 2821 and a snapgear product. I have the tunnel built, it comes up but I am not able to pass traffic between the two networks. The 2821 end is 10.30.254.x and the snapgear end is 10.30.200.x I thought it was an issue with the acl, but that looks like it is allowing communication between the two subnets. I know I am missing something simple, but I can not for the life of me find it.
urrent configuration : 7866 bytes
! Last configuration change at 17:49:21 Chicago Mon Oct 24 2011 by admin
version 15.1
service timestamps debug datetime msec


View 1 Replies View Related

Cisco VPN :: 2921 / Split Tunnel VPN Connected But No Gateway

Jul 10, 2012

I followed:[URL]And my VPN connection is established on 2921.However when I successfully connected to the router via VPN,  ipfoncfig shows default gateway being,My CISCO2921 GI0/0 has default IP assigned, I want to access this interface with CISCO CP.

View 2 Replies View Related

Copyrights 2005-15, All rights reserved