I don't know if this is in the right section, but I cannot set up a vpn tunnel between an asa 5510 and a cisco rv042 router. I believe the problem is because i need to set up a nat exempt rule on the rv042 route but don't know how.
View 1 RepliesFirewall ASA5510. I'm planning to get one of ASA5510 for our office in order to secure our network properly, however we have quite specific routing configuration to allow us failover to the remote location (data center) in case of any disaster with our server. I'd like to find out if I can just install firewall between our ISP Ruter and internet and allow traffic to/from Data Centre. In this situation will I have to change routing configuration on Company Router or do I have to do anything with our Company Router
View 1 Replies View RelatedI have our main site using a Cisco 5510 running 8.4.2 code and a remote site using a Cisco 5505 running 8.4.2 code. The main site has a T1 and the remote site is using a DSL connection. About every other day I have to reset the connection at the remote site. The process that I have found that works is to remove the nat statement, clear the cry ips sa and then add back the nat statement. The connection usually comes back up and a few minutes. I am trying to see what is causing this to drop.
View 5 Replies View RelatedI have an ASA 5510 and I am building a site-to-site vpn tunnel, peer on the other end is a sonicwall. I can initiate the tunnel from my end, but when he tries from his end it fails on phase 2 with this error in the logs:
"Rejecting IPSec tunnel: no matching crypto map entry for remote proxy"
Obviously our crypto map's don't match, i have it restricted to specific ports on my end and he had it wide open on his end, but said he is not sure how to restrict it down to specific ports. My question is why would I be able to bring the tunnel up on my end if the crypto map's don't match and he can't bring it up?
I have an ASA 5510 and I am building a site-to-site vpn tunnel, peer on the other end is a sonicwall. I can initiate the tunnel from my end, but when he tries from his end it fails on phase 2 with this error in the logs:
"Rejecting IPSec tunnel: no matching crypto map entry for remote proxy"
Obviously our crypto map's don't match, i have it restricted to specific ports on my end and he had it wide open on his end, but said he is not sure how to restrict it down to specific ports. My question is why would I be able to bring the tunnel up on my end if the crypto map's don't match and he can't bring it up?
I working on a security solution using ASA firewall. Is it possible to setup a IPSec tunnels on each subinterface of a physical interface on ASA 5510?
View 3 Replies View RelatedI have a dynamic VPN site to site between a Firewall ASA 5510 with ASA version 8.2(1) (firewall ASA have a Static IP 201.111.14.114) and a C870 ISR (the ISR have a dynamic IP). The tunnel and the conectivity in both sides is successfull, however each time that occurs a interface restart because the Internet link is unstable in ISR side the VPN tunnel does not going to UP STATE again
These are the ISR logs listed when VPN going to DOWN
*Mar 10 13:58:45.157: %LINK-3-UPDOWN: Interface ATM0, changed state to down
*Mar 10 13:58:46.157: %LINEPROTO-5-UPDOWN: Line protocol on Interface ATM0, changed state to down
[Code]......
I am not a ASA expert but I have configured them few times. I have a vision of a task I have to complete but not sure if it is practical or how to go about doing it.
We two locations, Location A and Location B. Both locations have a 100MB internet conection. Location A has a ASA 5510. Location B has a 5505. Users at both locations access the internet via their respective ASA. Location A is the headquarters and Location B is a disaster recovery site. We want to setup a tunnel between both ASAs. This tunnel will be used to replicate data between the two locations for DR purposes. We need the users to still use the same pipe to get to the internet but want to allocate 10MB for internet use and the remaining 90MB for the DR tunnel.
So I've run into a problem on my ASA5510, post-upgrade I can no longer connect to the inside interface from across our L2L VPN. I've tried both ASDM and SSH and the connections fail. I see in the logs that the attempt is being made, but it will eventually time out. There have been no problems with this type of connection with any previous upgrades, just this particular upgrade, I went from 8.4(1) to 8.4(2). I don't see much in the release notes or anything in a pre/post config diff that jumps out as a cause to this behavior. The only thing I did see in the release notes "CSCtg50770 Mngt-access (ASDM,SSH) to inside intf of 5580 fails over RA VPN session" which sounds like it could be my problem, but that was in the "Fixed in 8.4(2)" section and says it's for a 5580, maybe the fix for the 5580 broke it on a 5510??? I hope not and that I'm simply missing some new setting that I need to enable for this type of connection as this device is in a remote office.
View 2 Replies View RelatedHow would I go about configuring RADIUS based AAA for remote access VPN users? I have an OSX RADIUS server and an ASA 5510
(I want to keep console and SSH using LOCAL, so I keep this: "aaa authentication ssh console LOCAL", right?)What does the rest of the config look like to get RADIUS based AAA for remote access VPN users?
I have a ASA 5510 that has multiple site to site VPNs. I need to create an additiona site to site VPN but only allow 1 host to access and traverse the tunnel. The network is on a 192.168.5.x but the host that will need to access this tunnel needs to be on a 172.16.33.x network. I dont want any other traffic allowed to access or traverse the VPN tunnel for this host. How can I set this up?
View 33 Replies View Relatedwe are trying to establish VPN tunnel between ASA5550 and RV042. The tunnel is connected but I cannot access any resources that are behind ASA5550. I can ping the servers but that is about it.
View 1 Replies View RelatedI have VPN Gateway to Gateway VPN tunnels set from my central office to four remote sites. The tunnels have always been problematic. Started out with five Linksys RV042 v2 devices these had problems with handshake, sometimes would disconnect during this process and had to click disconnect button on either device and this wouold force the tunnel to rebuild. Recently upgrade central device to a Cisco RV042 v3 device. Good news is that this seems to have corrected the handshake issue but now each of the remote sites are having problems during periods of inactivity losing tunnel. The staff at the remote site indicate that they have to close out application and restart router to rebuild the tunnel.
All tunnels are Gateway to Gateway static IP addresses. They all will connect and behave as expected until they reach a certian period of inactivity. I have searched all over Cisco, Linksys, and Google have seen problems similar but no consistant or logical solutions so I thought since I am slowly upgrading my network from my initial equipment which was truely purchased based on cost alone to adding more Cisco equipment. However since this is among the first of my upgrade moves and the improved equipment is creating more problems than my older less expensive equipment I needed a solution to the problem before submitting additional PO's to upgrade switches and firewall products.
I have a two RV042 VPN Router, I successfully connected the IPSEC tunnel. I cannot route Traffic in the tunnel. See the diagram.
MAIN Network
10.252.x.x
-------------->
FIREWALL
a.a.a.1
INTERNET
RV042a WANa <<------------------------------->> WANb RV042b
a.a.a.2 b.b.b.b
In this manner the network of b.b.b.b wil connect to the Main Network 10.252.x.x, unfortunately I can't pass traffic to RV042b going to RV042a. Everytime I trace the route, the traffic goes outside the Internet not to RV042a.
configure ip-sec vpn tunnel between ASA5525x and RV042
View 5 Replies View Relatedhow to establish tunnel between rvs 4000 and rv042 ?
View 2 Replies View Relatedhere's my setup :
office 1 :
rv042 hw3
ISP:Obtain an IP automatically
office 2 :
rv042 hw3
ISP:PPPoE
VPN tunnel between both rv042, everything's fine but when i try to ssh from office 2 to an office 1's server, my connection drops.
When it drops, i can still ping pc in office 1, this is really strange!if i change the office 2 ISP to another provider (obtain an IP automatically) everything's ok !
i try to use another PPPoE ISP for office 2 and it's doing the same thing!I've also tried other rv042 in both locations with the same setup and it's doing the same thing, so it's not a router issue.
i've tried older firmware and it's doing the same thing, so it's not a firmware issue!
I have configured a VPN tunnel between two remote locations using static IP addresses on two RV042 routers. The tunnel seems to work but the problem is that when the two hosts attempt to ping each other only one can successfully ping. One PC with IP address 192.168.1.100 can ping across the network but the second PC with IP address 192.168.2.100 cannot. These are laptops seperate from the intranet used to test the tunnel. Someone had suggested NAT may be the issue so I enabled NAT Transverse on the routers but still no luck. The following is the results from a ping test.
PC 1
ping 192.168.2.1
Pinging 192.168.2.1 with 32 bytes of data:
Reply from 192.168.2.1: bytes=32 time=116ms TTL=63
[Code] ......
We have 4 RV 042 routers and cisco router at HQ, we have Site to Site VPN tunnels in between, All branch offices are connected to HQ via S2S VPN tunnels
10.10.1.0/ 24 HQ
10.10.2.0/24 Branch 1
10.10.3.0/24 Branch 2
10.10.4.0/24 Branch 3
10.10.5.0/24 Branch 4
now lets say i am branch 1, i can access 10.10.1.0/24 network but cant access 10.10.5.0/24 network, means i dont have branch to branch connection, it should be through HQ, means my RV042 at brnach should fwd all traffic to HQ for another branches also. Under VPN tunnel if i try to configure remote destination 10.10.0.0/21 its not allowing me it says network overlaping with local network, how i can sole it, I know how to do in cisco, we can permit those networks in access lists.
I was hoping that the latest firmware would fix my (2) 'bugs', but it did not. We are using the RV042s at our remote medical clinics as an end-point VPN router to our Nortel 1700 VPN router, replacing our old Nortel Contivity 100s.When I try and do a reset when connected remotely via the WAN interface, the RV042 hangs and will only reset by re-powering.
View 1 Replies View RelatedI have a client that needs to establish a IPsec tunnel to a large organization. They will not forward any traffic to an IP using private reserved IPs. However I am not finding another way to accomplish this. I tried ipsec to the router and using a second IP to a 1:1 Nat but it will not pass the traffic and would seem really insecure from the public internet. 1:1 Nat does work from the public internet but not over the tunnel.I have an RV042 a /29 block of IPs. I am at a loss of how I can accomplish what they want without allowing a private IP.
View 1 Replies View RelatedI have an RV042 VPN tunnel with an RV082.The RV042 has a public IP Address obtained by PPPoE, the RV082 has a public IP Address obtained via Static IP.The problem I see is a really slow performance. Both internet conections are idle and the performance is about 2 or 3 kbyte/s My question are if I should I enable any of this:
- Agresive mode
- NAT Traversal
- IP Compresion
- Dead Pear Detection
How can I troubleshot this slow performance?
I have a remote location that has a Linksys/Cisco RV042 router [URL] that allows PPTP connections based on username and password combinations. There are no intermediary routers between this device and the internet - only a DSL modem. A secondary WAN connection is not present.
I am able to dial into this VPN using the Windows XP and Windows 7 dialers from any of my local free-wifi locations(e.g. Starbucks). I WAS able to connect to this VPN connection from my house when my home router was a Buffalo brand router.
I have replaced the Buffalo router with a 2620(non-XM) that is connected in ROaS fashion to a 2950 switch. I need some guidance on what in my config is not allowing me to connect to this remote site.
Home network info: Local subnets : 192.168.x.x
Remote network info: Local subnet : 10.214.x.x
The Windows XP dialer client indicates that the username and password challenge is where the connection fails. It ultimately gives me the error code 619. I have performed a Wireshark packet capture of an attempt to connect from ip 192.168.10.11. This packet capture shows multiple "Configuration Request" packets being exchanged between the two endpoints, but does not ever show an exchange of authentication.
My nat translation table shows an entry for both a GRE tunnel as well as port 1723 between 192.168.10.11 and the WAN port of the RV042 when attempting to establish this VPN.
I have attached my 2620 configuration for your review.
i have 2 rv042 with a vpn tunnel between them.the problem is that i can't access https over the VPN !if i telnet 192.168.10.1 443 through the VPN, it's not working either. if i telnet 192.168.10.1 443 in my 192.168.10.0 network it's working so it's reall the VPN tunnel the problem.
View 1 Replies View RelatedSetup is two dynamic IP locations
1. first location RV042 is the gateway attached to ADSL modem
2. second location RV042 is behind BT home hub gateway - for now the BTHH DMZ is enabled to the RV042
Followed the user manual config for two dynamic IP but it seems that the RV042 behind the BTHH obviously has a different IP than the resolved IP and is causing problems with connection.
This from the log file:
Jan 14 15:04:16 2011 VPN Log Received Vendor ID payload Type = [Dead Peer Detection]
Jan 14 15:04:16 2011 VPN Log [Tunnel Negotiation Info] <<< Responder Received Aggressive Mode 1st packet
Jan 14 15:04:16 2011 VPN Log Aggressive mode peer ID is ID_IPV4_ADDR: '192.168.95.139'
Jan 14 15:04:16 2011 VPN Log No suitable connection for peer '192.168.95.139', Please check Phase 1 ID value
Jan 14 15:04:16 2011 VPN Log initial Aggressive Mode packet claiming to be from 81.156.xxx.xx on 81.156.xxx.xx
But no connection has been authorized,check peer ID Is there some way of making the RV042 behind the BTHH properly identifiable to the other end?
I configured ASA5520 and RV042 for site-to-site IPSec VPN tunnel.Tunnel get connected, but no ping, no traffic between both end network.
Network:
=======
192.168.113.0/24----------192.168.113.6 -ASA--------public, static IP address------Cisco 2821--------Internet
192.168.10.0/24-----------192.168.10.1 -RV042-----public, static IP address------Cisco 2821--------Internet
ASA5520 config:
----------------------
name 192.168.10.0 VPN
!
interface GigabitEthernet0/1
nameif NET
security-level 100
ip address 192.168.113.6 255.255.255.0
[code]....
Im able to create a gateway tunnel with two rv042 routers in different locations ( i can see the tunnel connected in the router) but the quick vpn utility is not working , i also tried to use the pptp as server as an alternative( im able to connect using windows connection to the pptp server but whenever I browse any of the four ip's allowed for the pptp server \10.0.0.200-204 it takes me to the documents of the local computer....I attached the configuration for one of the routers it is the same as the other end , just the information is flipped.
Message was edited by: Adrian Torres
We currently run dual ASA 5510's in A/S config on our main campus. We would like to create a VPN tunnel to a branch campus. Trying to decide between a 5505/5510/5512x, We would like to extend many of the capabilities of our network to the branch campus which will be 20-50 users on a 50mb/10mb internet connection.
Domain login
System Center workstation management
Cisco WCS
Shoretel voip
(Cisco NAC?)
Several different VLANs for wireless guest, student traffic, staff traffic, voip traffic, etc. Which device would be best and should we get the security plus license with it?
I have two 5510's that I am trying to get a tunnel established. One has an exsistinig tunnel to a 5505 that works but I cant get the next one to get past the first phase. I have sanitized the attached configs
View 5 Replies View RelatedI had a pix that had two working tunnels going to one 5510 and one 5520. Today the VPN tunnel to our 5520 stopped working but if I do sh cry isa sa both tunnels have QM_IDLE as the state. (both ends) I tried to debug crypto isakmp 255 but all I get is PEER_REAPER_TIMER and no other output on the pix side.
View 20 Replies View RelatedI am using a Cisco ASA 5510. Our tunnels always drop due to inactivity, which is a security issue I understand, and it only takes some "interesting traffic" to bring it back up. My problem is that it looks like the interesting traffic has to originate from my side of the tunnel, when our clients send traffic and the tunnel is down due to inactivity it does not come back up. Is there a setting that I am overlooking that will make it come back up no matter who sends traffic? Or, is there a way to make it stay up through inactivity?
View 4 Replies View RelatedI have been struggling to come up with the proper config to do a NAT of an incoming VPN tunnel to a VLAN on my network. I have an ASA 5510 with an IPSEC site-to-site tunnel to a partner network of 166.110.0.0/17.I have several VLANs on the ASA interface behind a cat4500 router (192.168.100.024, 172.16.4.0/24, 166.110.128.0/22 etc). The only network that the partner network sees is the 166.110.128.0/22.My problem is that I need to give them access to a node on my 192.168.100.0/24 net, but can't get the admin on the other side to add a route and adjust his tunnel.
View 4 Replies View RelatedI've a asa 5510 on the main site and different ASA 5505 on secundary sites for VPN tunneling between the sites. The problem is that the tunnels are acomplished but no traffic is going over them. What am i doing wrong? For the moment there is a ASA 5505 on the main site managing the tunnels but I want the 5510 to take over the job.
View 5 Replies View Related