Cisco VPN :: 1841 / 1811 - Site To Site VPN Is Up But No Traffic Gets Through?
Jul 28, 2012
Using the Cisco Configuration Professional software I have created a site to site VPN connection (between a cisco 1841 and 1811).The tunnel appears to be up as far as the routers are concerned, but I am unable to ping anything on the remote networks. I thought route maps may have had something to do with this but I cant see what is worng with them.Just so you know, the 1841 device already has a functioning VPN tunnel to another site. The peers I am concerned about are 141.0.59.x and 109.238.78.x.
I want to implement site to site vpn among our Head Office and Barnch routers (300 Sites).Head Office Site I have a cisco 7200 Router Im going to terminate the VPN conection on that.Branches we are having cisco 1841 series routers. They all are capable of working with VPN.In the present it is act like a EazyVPN Server for selected sites(30 sites).Is there any license limitations in Cisco 7200 Router ?Can I run both Site to site VPN and Eazy VPN Server together ?
The problem I am having is very strange and I have tried to upgrade the IOS on the 1841 to solve the problem but no luck. The issue is when I enable Zone Based firewall security on of the 1841 routers two VPN site-to-site tunnels stops working. If I turn off CEF (no ip cef) then the traffic for both tunnels works. Someone told me that the Zone Based firewall must have a match for the VPN traffic and I created that with ACL 160 and 161 but it did not solve the problem.
Current IOS is below.
Cisco IOS Software, 1841 Software (C1841-ADVSECURITYK9-M), Version 15.0(1)M9, RELEASE SOFTWARE (fc1) Technical Support: [URL] Copyright (c) 1986-2012 by Cisco Systems, Inc. Compiled Tue 11-Sep-12 23:58 by prod_rel_team
I am in the process of setting up a site to site VPN connection with a Cisco 1841 with the AIM-VPN-SSL-1 module and an NEC IX2015. We are using a GRE tunnel with IPSec.The problem we are having is the NEC router will not repsond to ICMP packets (and there isn't a way to make it respond). Will this cause any problems with the tunnel?
Is there a guide to set up a site to site VPN using 1841.
I have 3 points, 1 1841, 1 pix 506e and 1 ASA 5500. I need a good guide/manual to set up this. I would like to connect to any of the points, and be able to see all the infrastructure.
i have 2 routers both 1841's and am trying to get a simple static vpn up and running. Now One router is at our main location (ill call it router a) and the remote location (ill call it router b). Both have internet connectivity that works, can ping router a from b and b to a. Now on router b side when i run show crypto isakmp sa on router b i get the following:
SBOneonta#show crypto isakmp sa IPv4 Crypto ISAKMP SA dst src state conn-id status 72.43.229.138 66.194.51.66 MM_NO_STATE 0 ACTIVE (deleted) 72.43.229.138 66.194.51.66 MM_NO_STATE 0 ACTIVE (deleted) 72.43.229.138 66.194.51.66 MM_NO_STATE 0 ACTIVE (deleted)
[code]....
i72.43.229.138 is the router and the other ip is i have no idea! its no where in the config, but that shows me this router is trying to do something. Now on router a when i run the same command i get this:
show crypto isakmp sa dst src state conn-id slot status
a whole lot of nothing! now i have been working on this for a few days now and i cant understand why i cant get this simple vpn tunnel to work! I have debuging on both routers, router a shows nothing period for vpn traffic, router b shows a connection from the 66.194.51.66 which again i have no idea who or where this ip is and its not in the config any where.
I have an 1841 that I set up to do site to site VPN between my company's network and an external network. This has a backup connection point. All works well including automatically failing over to the backup site.
We also want to be able to VPN remotely to our company's network using the same 1841.I have tried many different ways to configure this, but the best I had resulted in an external VPN request taking down the site-to-site link.
Is this possible? Our internet connection is through an ADSL router set up with pasthrough, then into the Cisco 1841 which does the dialer PPPOE authentication.
Got an ASA5505 connected to another endpoint running IPsec and being NAT'd at each end to a 10.0.0.0/24 network. I can pass other types of traffic through the ASA 5505 but not RTP traffic. The moment it is NAT'd and hits the firewall rules it gets denied by the default deny at the bottom of the list.
Currently the rules are as follows
Incoming External allow ip any any allow tcp any any allow udp any any default deny
[code].....
It wont allow us to setup a voip call...however when the same call manager sets up a voip call NOT using this ipsec tunnel it works just fine.
Got an ASA5505 connected to another endpoint running IPsec and being NAT'd at each end to a 10.0.0.0/24 network. I can pass other types of traffic through the ASA 5505 but not RTP traffic. The moment it is NAT'd and hits the firewall rules it gets denied by the default deny at the bottom of the list.
Currently the rules are as follows
Incoming External allow ip any any allow tcp any any allow udp any any default deny
[code]....
It wont allow us to setup a voip call...however when the same call manager sets up a voip call NOT using this ipsec tunnel it works just fine.
I have some challenges with a VPN config I recently setup for a client.I have at the HO the following:
- 1800 router - Avaya phones and Gateway - 1MB radio internet access
At the BO(branch office), i have:
- 871 Router - Avaya phones - 256k internet bandwidth
The only reason we setup the VPN in the first place was for the phones at the BO to be able to connect to the gateway at the HO and also able to make calls and receive calls as if the phones were at the HO.The phones at the BO successfully register to the HO, but are unable to recieve calls and dial out. Everytime I try to make a call, the phone displays a "connecting..." message. [code]
All have a Security Association Lifetime (Time) of 8 hours. All have a Security Association Lifetime (Traffic Volum) of 4608000 KiloBytes.
We have an issue when we do Oracle logshipping between the sites.
This triggers the Traffic Volume rekey as can be seen by this entry in the logs: -
%ASA-7-702307: IPSEC: An inbound L2L SA (SPI= 0x169FA1C1) between and (user= ) is rekeying due to data rollover.
However it does not appear as if the renegotiation is occurring properly. Within 10 to 15 minutes data stops being transmitted along the link, even though the IPSec tunnel still appears up in the ASDM GUI.
The 'fix' for this is that we are using is to login to the ASDM GUI and bounce the link by going to Monitoring => VPN => VPN Statistics => Sessions => IPSec Site-to-Site. Then select the appropriate VPN tunnel and click on 'Logout'. This forces a link renegotiation which works fine.
I have attached a logfile from the local ASA (there's nothing in the logfile of the remote ASA until we bounce the VPN tunnel).
I have 2 ASA 5505 Firewall, I Configured Site 2 Site VPN no both the fitrewall, as i have a dual ISP, i am able to create the tunnel with primary but once my primary is down i am not able to create the tunnel with back up ISP. During the troobleshoothing by typing Show isakmp sa and Show ipsec sa, i can see my tunnel is up, but not able to decap the packets.
At the main site, I have 3 5508 WLCs each part of a mobility group (wlcMain-MG). In NCS, under "System/Mobility Groups" for each controller, I see each controller listed as "local" with the other Controllers listed with the group name "wlcMain-MG". None of the SSIDs are "anchored".
I have a new site with a 2500 series WLC that I would like to push out 2 SSIDs. This site contains two customers. One customer is the Main customer with the second customer leasing space.
I have the Cust2 WLAN at the remote site set to have traffic egress out of a local interface on the 2500 WLC (this traffic is then tunnelled back to their Main location via an ASA which houses the DHCP scope for that vlan). I can connect to this SSID, obtain an IP Address off the ASA and am tunnelling without issue.
For the Cust1 WLAN at the remote site, I would like to broadcast an SSID from the Main location on those same APs which are registered to the 2500. It is my understanding, that I anchor the SSID at the Main site and identically configure the SSID at the remote site. This will allow the end user to authenticate to the RADIUS server at the Main site and be placed upon the correct vlan (we are using DOT1x and dynamic vlans).
For my test, I am starting simple. I have created a test WLAN with no authentication. At the main site, on 5508 WLC3, I have created the test WLAN, and placed the interface into a low security vlan (call it VLAN-low). I have anchored this test WLAN to that controller. At the remote site, I have created the same WLAN (but placed it into the management interface for now - the VLAN-low does not exist at the remote site) and configured that WLAN to anchor back to the WLC3 at the main site. I am unable to obtain an IP address from the remote site. I have placed the remote site WLC in the wlcMain-MG as well. How close does the code need to be on the controllers - the 5508s are at 7.0.116.0 and the 2500 is at 7.0.220.0? What could I be missing?
A user with Easy VPN client connects to a 876 ISR (router A). This router also has a site-to-site VPN to another 876 ISR (router B). What I want to achieve is that the user dials in to router A and can access the network on the remote end of the site-to-site tunnel (router B) In diagram:
user (192.168.18.x) - Easy VPN - Router A (192.168.16.x) - sitetosite - Router B (192.168.17.x)
I have added routes in router B to the 192.168.18.x network with router A as next hop, but I can't reach the other segment.
I am trying to establish routing between two Site to Site vpn tunnels, both of which are terminating on the same outside interface of my Cisco ASA.
find attached Network Diagram for the same. All Firewalls used are Cisco ASA 5520.
Both VPN tunnels between Point A and Point B, Point B and Point C too are up. I have enabled Same security level intra interface permit command also.
How do i enable traffic originating from LAN Subnets behind Point A to reach LAN Subnets behind Point C without having to create a Seperate tunnel between Point A and Point C
I have set up a site to site VPN from a Cisco ASA 5580 to a Netgear FVS318v3 using 3DES, MD5, GH 2 and preshared key, My VPN Tunnel is always up, I can see on the netgear and firewall ASA that the connection VPN is established at both phase 1 and phase 2 level, but no traffic is flowing through the tunnel sometimes. The only way I can see the traffic passing, it is reload the tunnel on the firewall netgear.the configurations on the firewalls are same.
I can see the requests of the ASA Red_Lan to server located at the remote site, behind the Netgear Firewall and observe traffic on the ASA but on the outside/inside interfaces of the firewall Netgear there are not traffic. Is necessary to configure and others parameters for VPN?
I'd like to create a site-to-site vpn between an SRP527 and an other vpn gateway. The problem is i don't see how to route all traffic from the local network (network defined by the lan ip interface of the SRP527) to the other vpn gateway? It seems to be only possible to define the destination network (accessible via the vpn) with ip/mask (but only for "small" network: for exemple i tried with 10.2.0.0 mask 255.255.0.0 and it's ok but i tried with 10.0.0.0 mask 255.0.0.0 -> it's not working. I obtain the message "invalid ip")
I do have a 5505 up and running, and passing data... url...Now I am trying to get a IPSEC VPN tunnel working.I actually have it up (IKE phase 1 & 2 both passed), but it is not sending/receiving data through the tunnel.
The networks concerned: name 10.0.0.0 Eventual (HQ Site behind Firewall)name 1.1.1.0 CFS (Public Network Gateway for Palo Alto Firewall - Firewall IP: 1.1.1.1)name 2.2.2.0 T1 (Remote site - Outside interface of 5505: 2.2.2.2)name 10.209.0.0 Local (Remote Network - internal interface of 5505: 10.20 9. 0.3) On a ping to the HQ network from behind the ASA, I get port map translation creation failed for icmp src inside:10.209.0.9 dst inside:10.0.0.33 (type 8, code 0)
I am suspecting that there is a NAT error and/or a lack of a static route for the rest of the 10.0.0.0 traffic, and that I may have to exempt/route the traffic for the HQ network (10.0.0.0), but I haven't been able to get the correct entries to make it work. [code]
I want to configure QoS for voice traffic over a site-to-site VPN tunnel. I have a Cisco 851 router on the branch end and a Cisco 1800 router at the HQ. The setup is an Avaya Gateway located at the HQ and the idea is that the phones at the branch office are connected over the VPN tunnel to the gateway at the HQ.
I have a 1MB internet link at the HQ from a service provider and 256kbps internet link (from a different service provider) at the branch office. The branch office has just 3 users.
I have a functioning site-to-site VPN between two ASA 5505 appiances. Sub-net on one side is 192.168.20.0/24 (inside I/F) and on the other side is 192.168.30.0/24 (inside I/F). VPN is built over public Internet (outside I/Fs of those two ASAs).
Now I connected another subnet on 192.168.30.0/24 - e.g. 192.168.35.0/24. Traffic from 192.168.30.0 subnet is routed to 192.168.35.0 via Gateway at 192.168.30.250 IP.
My task is to make packets from 192.168.20.0 subnet to go to 192.168.35.0 subnet and vice versa.
I setup a static route on 20.0 ASA's Inside interface as 192.168.35.0 255.255.255.0 to 192.168.30.250. I also created NAT examptions for outbound packets from 20.0 to 35.0 and inbound as well. I also added destination network of 35.0 to VPN cryptomap traffic selection (on both ASAs).
I'm working with a client who has a site to site VPN between the main office and a branch office. The main office is 192.168.200.0/24 and the branch office is 192.168.1.0/24. The issue is when the branch office users use the VPN in they receive a 192.168.200.x address, however, they cannot access a server or any other resources at the branch office.
They have a SSL-VPN 2000 connected to a TZ100 at the main office and a Juniper device at the branch office. I did try setting the Tunnel All mode on the NetExtender but that does not allow me to access the resources at the branch office. Additionally, those users at the main office can access the resources at the branch office without getting on the VPN.
I've setup a site-to-site vpn between 2 5505s, with 1 subnet per site directly behind the ASAs.The VPN establishes connection successfully, but i can only access resources from site2 to site 1. E.g. I can ping or rdp from a server in site2 at IP 192.168.3.250 to a site1 server at IP 192.168.10.250. I cannot make the opposite connection, i.e. 192.168.10.250 to 192.168.3.250.
I have an ASA5520 and need to set up multiple VPN's to some vendor sites. All these vendors are using 192.168.1.0 networks. All have public IP's and very little knowledge so are unable to NAT from their end.The idea is to create some /28 blocks of IP's (172.29.0.0/28) and manage this on our end.
How do I get this to work?
example: (all IP's are fictional) tunnel1 VPN My side "outside" 10.10.10.10 Their side "outside" 20.20.20.20 Networks My side "inside" 172.30.30.0 Their side "inside" 192.168.1.0 NAT'ed to 172.29.0.0/28
How many site-to-site VPN can we establish in Cisco router 1841. When we start 1841 we get the message that VPN Module 1. What is the meaning of it, does it mean that we can establish only one VPN. How about the limitation of GRE VPN Tunnel.
I have 3x site-to-site vpn connections setup on my Cisco 2911 router which is based at Head Office. They all connect OK but there appears to be some ports blocked.Access any applications using HTTPS Our Proxy Agent uses port 8280 - When the internal address is used, it doesn't work. When the public address is used, it works. Printers are unable to use scan to email - Port 25.I'm confident that nothing is being restricted at the remote sites as all of these functions worked on our old Head Office router.All i want to do is allow ANY traffic to and from Head Office and all the VPN sites. I'm fairly new to this type of router having made the jump from small business equipment.
I had to edit an ACL on an active S2S VPN today because traffic was being denied from a host onsite to a host on the remote site (port 449). After I made the change, we tried to make the connection again, but it was still denied. Do we need to tear down the S2S vpn for the change to the ACL to take effect? Also, what if we just wait for the connection to rekey itself? Will it work after that?
I have an 881 ISR router in which I need to configure a site to site ipsec vpn with a vendor. The vendor will not accept traffic from RFC 1918 addresses (private addresses), so the outgoing vpn traffic needs to be natted to a public IP. I'm not sure how to get the vpn to work with NAT.
Is this something that I could do using the Cisco Configuration Professional app, or should I forget that and do it strictly from the cli?
I have a requirement to create a site to site vpn tunnel on ASA 5510 from a remote site to my HO, ihave already other site-to-site tunnels are up and running on the ASA.The issue is my remote site has got the network address which falls in one of the subnet used in HO(192.168.10.0/24).My requirement is only My remote site need to accees couple of my servers in HO which is in 192.168.200.0/24 subnet.
We have ordered a pair of Cisco ASA5520 (ASA5520-BUN-K9).Now there is a requirement to terminate site-to-site VPN from remote site. Do we need VPN plus licence for this and how much it cost?
