Cisco :: IPSec GRE Tunnels And Traditional Site VPNs
Mar 21, 2011
I've been reading this site for a while, and finally decided to post I'm really interested to see what everyones opinion on this is.My company currently uses what i would call traditional site to site VPN's using crypto maps, main site has a pair of ASA's in HA and remote sites use ISR's like 1801's.I've recently been playing in my lab with GRE tunnels using IPSec protection (note this is config from my labs, so ip's and key's are just randomly selected)
Question on ASA VPN tunnels. I have one ASA 5510 in our corporate office, I have two subnets in our corporate office that are configured in the ASA in a Object group. I have a site to site IPSEC tunnel already up and that has been working. I am trying to set up another site to site IPSEC tunnel to a different location that will need to be setup to access the same two subnets. I'm not sure if this can be setup or not, I think I had a problem with setting up two tunnels that were trying to connect to the same subnet but that was between the same two ASA's. Anyways the new tunnel to a new site is not coming up and I want to make sure it is not the subnet issue. The current working tunnel is between two ASA 5510's, the new tunnel we are trying to build is between the ASA and a Sonicwall firewall.
I have a ASA 5510 at our corporate HQ that has one site to site VPN. I need to add 6 additional site to site VPN's to this ASA for our remote branches. How can I add them without affecting the existing site to site VPN? The 6 site to site VPN's will all have the same settings however these settings are different from the existing site to site that I already have set up. How can I set it up so the 6 additional VPN's use their own crypto map and all use the same settings?
[code] Site-to-site VPNs in place between Site A and Site B and between each site to the DC. Site A and Site B have Cisco 2911 routers, there are ASA’s at the DC. The existing Site-to-site VPNs carry data and voice traffic between the sites (though voice and data is on separate VLANs in separate subnets)
ISP1 currently used for the existing circuits at Sites A and B but we have experienced issues with them recently which has disrupted service. So new circuits are to be installed at each site with ISP2. (See basic diagram attached which shows current set-up with intention to get new circuits via ISP2 installed)
We have 3 ports on our Cisco 2911 routers with 2 ports already in use for the existing connections (1 for the LAN and 1 for the WAN connection to ISP1) Can we simply use the 3rd port for the connection to ISP2 or would it be far more advisable to use a 2nd router (for redundancy, etc)
Would it be feasible to have a set-up where we have e.g. voice traffic go over a site-to-site VPN via ISP1 and data traffic go via site-to-site VPN via ISP2 but each can take over from the other in the event of a failure?
I'm working with a client who has a site to site VPN between the main office and a branch office. The main office is 192.168.200.0/24 and the branch office is 192.168.1.0/24. The issue is when the branch office users use the VPN in they receive a 192.168.200.x address, however, they cannot access a server or any other resources at the branch office.
They have a SSL-VPN 2000 connected to a TZ100 at the main office and a Juniper device at the branch office. I did try setting the Tunnel All mode on the NetExtender but that does not allow me to access the resources at the branch office. Additionally, those users at the main office can access the resources at the branch office without getting on the VPN.
I have a network of 5 different ASA 5505 they are all connected via site to site VPNs. 4 of the routers are working fine but the 5th one is only connecting to 2 VPNs when it should be connecting to 4 VPNs. I have verified that all the settings are correct on the routers (peer ip address, PSK, etc...) but the router still only connects to 2 VPNs. Is this a licensing issue? The license of the router in question looks like this: [code]
I have a 50MB ME circuit at HQ site running a 3925 router and 20MB ME circuits at 2 branch sites running 2951 routers.
I need to reserve 90% of the bandwidth at each site for site-to-site IPSec VPN's and leave the remaining 10% for browsing. I also need to shape the traffic on the outside interface's to match the bandwidth of the particular site. I also want to drop any traffic that is determined to be file sharing.
The routers work fine, the VPN's work fine, traffic shaping seems to be working, but when I generate traffic across the VPN and do "sh policy-map interface Gi0/1 output" all traffic is falling into the default class, nothing is getting classified as IPSec.
My class maps, policy maps, and outside interface config is attached. Can some tell me why my ISec VPN traffic is not being recognized as such?
I wanted to know the maximum VPN client sessions (using the Cisco VPN client) and Site-to-Site VPN tunnels that I can connect to my ASA 5505 simultaneously.
In other words, if I have x VPN clients and y Site-to-Site tunnels, at any time, does x + y have to be <= 10 (Total VPN Peers)? If yes, can I upgrade to the security plus license to increase the Total VPN Peers to 25?
Licensed features for this platform: Maximum Physical Interfaces : 8 VLANs : 3, DMZ Restricted Inside Hosts : Unlimited Failover : Disabled VPN-DES : Enabled [Code]...
I am trying to establish routing between two Site to Site vpn tunnels, both of which are terminating on the same outside interface of my Cisco ASA.
find attached Network Diagram for the same. All Firewalls used are Cisco ASA 5520.
Both VPN tunnels between Point A and Point B, Point B and Point C too are up. I have enabled Same security level intra interface permit command also.
How do i enable traffic originating from LAN Subnets behind Point A to reach LAN Subnets behind Point C without having to create a Seperate tunnel between Point A and Point C
I have an issue with 2 site to site VPN tunnels from a RV042G router. The issue is for both VPN tunnels is that in the logs, it is showing that when the RV042G router is trying to establish the tunnel, it is getting a response from the remote gateway internal address and not the Public address of the remote gateways. On the remote gateways I have other site to site VPN's terminating fine and the tunnels are passing traffic. I only have an issue with the RV042. On the VPN Tunnel page it shows for both tunnels waiting for connection. This is an output from the log of the RV042G
Dec 17 15:19:48 2012VPN Log(g2gips0) #2174: sending encrypted notification INVALID_ID_INFORMATION to 203.43.XX.XXX:500 Dec 17 15:19:48 2012VPN Log(g2gips0) #2174: [Tunnel Negotiation Info] >>> Initiator Receive Main Mode 6th packet Dec 17 15:19:48 2012VPN Log(g2gips0) #2174: [Tunnel Negotiation Info] >>> Initiator Receive Main Mode 6th packet Dec 17 15:19:48 2012VPN Log(g2gips0) #2174: Peer ID is ID_IPV4_ADDR: '126.0.21.52' Dec 17 15:19:48 2012VPN Log(g2gips0) #2174: we require peer to have ID '203.43.XX.XXX', but peer declares '126.0.21.52' Dec 17 15:19:48 2012VPN Log(g2gips0) #2174: we require peer to have ID '203.43.XX.XXX', but peer declares '126.0.21.52' Dec 17 15:19:48 2012VPN Log(g2gips0) #2174: sending encrypted notification INVALID_ID_INFORMATION to 203.43.XX.XXX:500 Dec 17 15:39:50 2012VPN Log(g2gips1) #2192: [Tunnel Negotiation Info] >>> Initiator Receive Main Mode 6th packet Dec 17 15:39:50 2012VPN Log(g2gips1) #2192: Peer ID is ID_IPV4_ADDR: '10.1.202.65' Dec 17 15:39:50 2012VPN Log(g2gips1) #2192: we require peer to have ID '203.47.XXX.XX', but peer declares '10.1.202.65' Dec 17 15:39:50 2012VPN Log(g2gips1) #2192: we require peer to have ID '203.47.XXX.XX', but peer declares '10.1.202.65' Dec 17 15:39:50 2012VPN Log(g2gips1) #2192: sending encrypted notification INVALID_ID_INFORMATION to 203.47.XXX.XX:500
VPN tunnel terminating on 203.43.XX.XXX is a Checkpoint firewall running R70 software version?VPN tunnel terminating on 203.47.XXX.XX is a Cisco ASA 5510 running ASA 8.2.4 software?As stated above, I have other VPN tunnels working fine. This RV042 is a replacement router as the original router suffered a power surge.
I have a setup with a pair off ASA5510 on the central site, and approx 20 sites with ASA5505.A couple off network are configured as site to site tunnels to every remote site.Its very stable, but the last year or so ocassionally one of the tunnels go one-way.Just like one of the nat exeptions suddenly stops working.I can see the remote side transmitting packets, but no answer.Central site is running 8.22, want to upgrade but have to mount more RAM.The only cure i have found is to reboot the central pair off ASA5510, not very popular as all 20 tunnels goes down.
I have vpn-concentrator on vyatta, 8 cisco 881w and 2 cisco 1941 with vpn site-to-site connected to vyatta. They all are in one ISP's vlan native L2 level.
I user pre-shared key, aes128 and md5 hash.
Traffic goes both sides, everything is okay, i strated cacti monitor of traffic and CPU, started netflow analyzer.
Sometimes one ipsec connection between any of branches go down, it doesn't have any extra CPU load, not more then 20-30%, no huge traffic but somewhy i recieve phone call like "i can't reach server" i check on vyatta - tunnels are down with one router, i do "reset vpn ipsec-peer N" and everything is ok.
I mentioned that when I added "keepalive periodic 10" on ciscos, tunnels started go down more often, for exmaple usually I recieve 1-2 phone calls during a day, whan I added this command, i started to recieve 4-5 phonecalls from branches.
it's always random tunnel down branch, today it was one 1941 and one 881w, yesturday it was 3 881w during all day
I have a pair of 5505s with an IPsec VPN between them. On the first 5505, I also have a user connecting to it via client based vpn. The user cannot access systems on the other side of the ipsec tunnel. That 5505 protects subnet a.b.c.d, the user is on subnet a.b.e.d which is not inclusive to a.b.c.d. First, am I correct in the assumption that I need to add the vpn network of a.b.e.d to the list of protected networks, and second if I change the list, does it drop and reset the ipsec vpn?
I'm having trouble setting up a second IPSec VPN tunnel on my Cisco ASA 5505 to another office. I was able to setup the first one with no problem through the ASDM, but have not been able to get the second one up.The IPSec tunnel is connecting to a WRVS4400N router at the other office. I tried debugging crypto isakmp, and crypto ipsec, but I'm getting nothing. Below is the config. Does something look wrong on my end? I also attached a screenshot of the parameters setup on the remote router.
I am setting up a simple remote IPsec VPN with a ASA 8.4. All I want to do is the remote user can VPN into the ASA, from there, he can browse the outside Web pages in the internet. and we'd like not to use split-tunneling. The outside infterface is 192.168.1.155/24, which is inside our network and this subnet works fine to outside. The pool for vpn is 192.168.0.0./24 (please pay attention to the 3r octet)
I configured and the remote user can vpn in and get an IP from the pool. but it seems that he cannot do anything. he cannot ping anything.I suspected the NATTing that i use. What is configured wrong? What traffic need to be natted and what need not.
======:ASA Version 8.4(2) ! !interface GigabitEthernet0description VPN interfacenameif outsidesecurity-level 0ip address 192.168.1.156 255.255.255.0 !interface GigabitEthernet1description VPN interfacenameif insidesecurity-level 100ip address 192.168.0.1 255.255.255.0 !ftp mode passiveobject network obj-192.168.0.0subnet 192.168.0.0 255.255.255.0object network obj-192.168.1.155host 192.168.1.155access-list EXTERNAL extended permit ip any any access-list EXTERNAL extended permit icmp any any access-list vpn extended permit ip 192.168.1.0 255.255.255.0 192.168.0.0 255.255.255.0 pager lines 24mtu outside 1500mtu inside 1500ip local pool testpool 192.168.0.10-192.168.0.15ip verify reverse-path interface outsideicmp unreachable rate-limit 1 burst-size 1icmp permit any outsideicmp permit any insideno asdm history enablearp timeout
The scenario where a Site to Site VPN tunnel has been established between Site A and Site B. Lan on Site A can ping Lan on Site B. My problem is a Printer behind Site B needs to be accessed by using the WAN IP address of Site A. Also i could not ping the remote lan or printer from the router.
Below are my configure on the Cisco 877 in site A.
Building configuration... Current configuration : 5425 bytes ! ! Last configuration change at 15:09:21 PCTime Fri Jun 15 2012 by admin01 ! version 12.4 no service pad
I have an ASA 5510 running ver 8.0(2) that has (4) Ipsec tunnels going from it to various other locations. I am having an issue with data transfer speed on only one of the Tunnels. This tunnel is between the 5510 and the 5555, on that link I am getting a dat transfer rate of a little over 120k a second, whereas if I pull the same set of files from another location I am seeing a transfer rate of 5m per second.
I have verified that it is not a capacity issue on the Internet bandwidth on both locations, and I can pull the same data from the same location to various other locations via Ipsec tunnels, I am only having an issue with a specific tunnel going from the 5510 to the 5555.
Since it is not affecting other tunnels on the 5510 nor is it affecting tunnels on the 5555 going to other locations, I am leaning toward a routing issue within the ISP? I will say the ISP is taking me a long way around to stay in the same Metropolitan area.
I tried to monitor via SNMP my ASA 5550&5510 my Active IPSEC tunnels , I want to receive Bandwidth for each tunnel interface.I’m running Version 8.2(1)? which OID to use?
We have many VPN tunnels back to our corporate office. All of these tunnels are very slow (same with our client VPN's). Our main firewall device at the corporate office is an ASA5510. We have a 100 Mb/sec Metro Ethernet internet connection here. We do not allow split-tunneling.
Our remote sites vary. We have DSL connections, cable internet connections, and other types of broadband that vary in speeds from 5 to 100 Mb/sec (up and down). The remote sites mostly have PIX 501's, but we have an ASA 5505 in one of the locations.
To take an example. On one of our remote sites that has a 100 Mb/sec connection, if I ping device to device, I'm getting ping times of about 50ms. And I'm pinging back through another 100 Mb/sec connection. If I get on a computer down there and run a speed test, I'm showing down speeds of about 1.5 Mb/sec... nowhere near 100. Some of that could be due to the lack of split tunneling, but I also suspect this could be an MTU issue.
Right now, all my MTU's are just set to the default 1500. Perhaps this is too high. I used this site to check my max: [URL]
I did a few tests from behind several of my firewalls. I pinged from a machine on one side of the tunnel to the firewall on the other end. I'm assuming the max MTU I come up with is the max MTU for the firewall I'm behind while pinging, right? The max amounts I came up with for some of my devices were as follows: Corporate ASA 5510 > 1272 (if you add the 28 byte packet header that would make it 1300) Remote PIX 501 > 1416 (if you add the 28 byte packet header that would make it 1444) Remote ASA 5505 > 1418 (if you add the 28 byte packet header that would make it 1446)
So, do I just need to set my MTU values to the appropriate amounts? I have tried changing the value, but I don't see any change in speed/performance. But I also don't know if I need to reboot the firewalls after changing the MTU. I know with Catalyst switches, you have to reload. But I didn't see any messages about needing to reboot on the ASA's/PIX's.
I have an ASA 5510 at Site A with a L2L tunnel to another site, Site B. Single subnet at each site. In a few weeks we will be adding a second Internet connection to Site B, so both connections will be active. But we want traffic to go over the new connection unless it goes down, then use the other. How do I set that up on the ASA so it doesn't get confused as to which tunnel to take to get to the Site B subnet?
I am trying to set up a site to site ipsec connection. AT site A, I have Vlan's 652-10.55.216.0/24, Vlan653 -10.55.217.0/24, Vlan 654-10.55.217.0/24 and Vlan655-10.55.219.0/24 and at site B, Vlan650-10.55.214.0/24 and Vlan651-10.55.215.0/24.The problem is that I am unable to get any associations when i do a "sh crypto isakmp sa"/"sh crypto ipsec sa" on either router at each site.I am also unable to ping by pluging in a laptop into the site at each site. Laptop at site A is set to access vlan 655 and laptop at site B is set to acess vlan 651. I can ping all the devices from one end to the other.I have turned on debug crypto isakmp, debug crypto ipsec, debug crypto ipsec errors but dont get anything at all as output.I have attached the sh run for each router Cisco (1941/K9) and switch (Catalyst 3750) at each site.
I have an ASA 5525 and need to configure site to site ipsec vpn to 3 peers. I currently have an existing /28 public address from my ISP that is used by other services.Is there a way to use this existing ip range to configure IPSEC tunnels to 3 peers ?
I have two Cisco routers - 2911 in HQ and RV180 in branch office. Because in HQ LAN network I have some development servers, to which guys from branch office need to have acces, I decided to setup VPN site-to-site between HQ and branch office. Everything went quite smoothly, on both devices I see, that ipsec connection is established. Unfortunately I am not able to ping resources from one network to other one and vice versa. Below is the configuration of 2911 router (I skipped som unimportant (imho) configuration directives) :
With à customer we have à site to site VPN connection. In this tunnel there is one subnet routed with a 3des-sha encryption / hash. Now the want to add a new subnet in this tunnel, but with a AES-128 / MD5 encryption / hash. Is it correct if we make a new crypto map with a higher seq. number?
im drawing a blank trying to setup a site to site connection with a 5505 ASA using ipsec and isakmp.i have the pre shared key as well as the external address of the other end of the tunnel but do not remember what the commands are to setup the crypto map and isakmp.
