Cisco VPN :: 5505 Connection To Mapped File Shared Dropping On A Site-to-Site VPN

Nov 27, 2011

We've just deployed a site-to-site VPN using a 5505 ASA on the client's site and a checkpoint Nokia FW on our site. Everything seems to be fine except that the user's connections to their file shares seem to be intermittently dropping. One minute the connection to the shares is there, next thing it's lost. There is no logic to it because no two users are experiencing issues at the same time, as a matter of fact even on the same PC where a user has access to 3 shares on 3 different servers, one could be showing as connected whereas the other two be dropping. [code]
 
As you can see the Duplex and Speed are set to auto, I've rectified this since then and I'm keeping a close eye on the output errors, and collisions. However, I'm afraid that this did not rectify the issue and the users are still experiencing intermittent connection dropping to their file shares over the VPN!

View 1 Replies


ADVERTISEMENT

Cisco VPN :: Slow File Transfer Over Site-To-Site With VPN 5505

Jul 26, 2011

I am noticing the following issue with one of our VPN connections:
 
Site A is connected to the Internet with an ISA Firewall
Site B is connected to the Internet with a CISCO 5505
 
Both sites are connected together via a VPN ,Both sites have around a 6MB up and 6MB down connection to the Internet
 
If I sent a 100MB file from Site A to B it takes around 30-45 minutes to copy, which to me seems excessive.
 
I've run Wireshark on the server sending the file (from Site A) and the desktop receiving the file (Site B). Initially, the server sending the file was generating a large number of TCP DUP ACK, TCP FAST RETRANSMISSION, TCP PREVIOUS SEGMENT LOST AND TCP OUT-OF-ORDER messages. I narrowed it down to IPv4 Checksum Offload and IPv4 Large Send offload which I disabled on the server. This sped up the file copy and massively reduced the errors in Wireshark, but not to what I think it should be. I then performed Wireshark logging on the desktop receiving the file which was also generating a large amount of TCP DUP ACK, TCP FAST RETRANSMISSION, TCP PREVIOUS SEGMENT LOST AND TCP OUT-OF-ORDER messages. I disabled IPv4 Checksum Offload and IPv4 Large Send offload options on the network card of the desktop and tried resending the file, which made no difference in speed and still generated the above messages in Wireshark.
 
I have run an mturoute between site A and B and get the following:
 
C: emp>mturoute.exe 10.0.66.2 (to PC on site B)
* ICMP Fragmentation is not permitted. *
* Speed optimization is enabled. *
* Maximum payload is 10000 bytes. *
.[Code]....

View 2 Replies View Related

Cisco Firewall :: ASA 5505 Site To Site VPN Keep Dropping?

Feb 1, 2012

I have an issue with my site to site VPN. I have 4 sites connected  to my main HQ site via Cisco ASAs 5505 firewalls. The problem is that once and then the sites disconnected from my main site. This disconnection is not happening at the same time for the the 4 sites. For example, it might be different site each time disconnected.

View 7 Replies View Related

Cisco VPN :: ASA 5505 Site To Site Connection / Remote Site?

Mar 6, 2011

i have 2 router asa 5505 with base license i wanna make site to site vpn connection and remote site using vpn client to connect first i have hdsl router with 5 public ip i wanna try it by giving 1 public ip to each router and try the vpn but nothing work?

View 1 Replies View Related

Cisco VPN :: Setup Site-to-Site Connection With 5505 ASA Using IPSec And Isakmp?

Aug 8, 2011

im drawing a blank trying to setup a site to site connection with a 5505 ASA using ipsec and isakmp.i have the pre shared key as well as the external address of the other end of the tunnel but do not remember what the commands are to setup the crypto map and isakmp.

View 7 Replies View Related

Cisco VPN :: 5505 Site-to-site Vpn With ADSL PPPoE Connection

Oct 10, 2012

I would like know is that possible to connect two 5505 ASA in site to site VPN with 1 site using ADSL pppoe connection?

View 5 Replies View Related

Cisco VPN :: Site-to-Site VPN With Internet Connection ASA 5505

Jul 11, 2012

i configured site to site VPN beetwen the asa 5505 (asa 8.4.2) and the asa 5510 (asa 8.4.4). how i can configure that the users from one side and second side use internet in same time?

View 13 Replies View Related

Cisco VPN :: VPN Site To Site Connection ASA 5520 And 5505

Nov 5, 2012

We have a site to site client that is having issue with intermittent disconnects.  The Main endpoint is a CIsco ASA 5520 8.4.3 and the remote site has a a Cisco ASA 5505 8.2.5.

If we have a disconnect, we can "logout" of the Main ASA and the connection seems to find itself and traffic will flow.  This take place about every 1 - 5 minutes but if you reset the crypto (which I am assuming you do) by logging out under the Logging Monitor Session - ikev1 sessions.  It all starts right back up.

I am stumped. At first I thought MTUs but I am not sure that is the answer.

View 1 Replies View Related

Cisco VPN :: 5505 - Site To Site Connected But Cannot Ping Remote Site

Oct 11, 2011

cisco products and am struggling getting a VPN going between an ASA 5505 and 5510.  I have a VPN created (using the VPN wizward on both) and it shows the VPN is up, but I can't ping the remote site (from either side).

View 11 Replies View Related

Cisco WAN :: 3825 Shared Internet Through Site To Site IPsec VPN Tunnel

Apr 24, 2013

I have configured Ipsec vpn tunnel beetween two routers (from site A to site B) over untrusted internet connection by cisco 3825 routers and i can  successfully access both of this routers. But now i need to access internet on site B router sitting on site A router. So that if i run traceroute from A site machine then the gateway by which internet passing through shows the ip of site B.

The Architecture of our both site routers :

Site A  10.1.11.0-----Router A 172.18.12.1-----VPN tunnel----Router B 172.18.12.2-----Site B 10.4.11.0 

/////Create IKE policy
crypto isakmp policy 1
encr aes
authentication pre-share
group 2
[Code] .....

View 10 Replies View Related

Cisco VPN :: ASA 5505 / Site To Site Vpn With One Site Always Initiate A Tunnel?

Feb 7, 2011

I have ASA 5505, i configured site to site vpn between central site and remote site and is working. Now the problem is we use remote site for troubleshooting purpose, so we need to create a tunnel from remote site to central site. I need to configure such a way that remote site can craete a tunnel to central site, but central site not able to create a tunnel, it just respond to remote site.

View 3 Replies View Related

Cisco WAN :: Site-to-Site VPN ASA5510 - 887VA Dropping Every 20 Seconds

Apr 21, 2013

I have an issue with a site-to-site VPN tunnel between a ASA5510 and 887VA.  I  have two tunnels connected to the ASA and one seems to be affected where by the tunnel is disconnected and brought up around every 20 seconds.  The tunnel is re-established instantly but this break in transmission is causing application issues.

View 2 Replies View Related

Cisco Routers :: RV110W Site To Site VPN Keeps Dropping Off

Jun 11, 2013

I've got two sites both using RV110w routers over a BT line.  They're successfully connecting over the site2site VPN using the Cisco control panels IP sec etc. However the connections drop after a day or so and do not re-establish themselves whenever a connection is attempted from a PC on either Lan over the WAN (ie. devices on one lan are xxx.xxx.2.x to xxx.xxx.3.x on the other site).  If I enter the advanced VPN page on the router control panel/config and prompt to attempt to re-establish the connection it fails, the error log states that the connection fails due to "no connection has been authorized with policy=PSK 8".  If I make no changes to any settings, but save the page and then try to re-establish the connection this works and continues to work for a day or so. This is happening consistently over a two week period.  All settings on both routers for IP sec etc are identical, that fact that it will connect confirms that the policies etc must be aligned at some point. 
 
Is it a router setting that I've missed), is it to do with BT, or the automatic adjustment of time on the LANS.

View 2 Replies View Related

Shared Files Across Site-to-site VPN?

Jan 11, 2012

I'm trying to get a network drive mapped across a site-to-site VPN. The details...

Network layout:XP (192.168.1.x) -- router -- site-to-site VPN tunnel -- router -- Win7 (192.168.2.x)

- Shared folders are on the XP PC
- Can ping across
- No VPN client software being used; uses site-to-site
- Router configuration had not been changed
- IPSec tunnel set to allow NetBIOS across
- PCs both set to allow NetBIOS over TCP/IP
- All PCs on the .1.0 LAN can access the shared folders on the XP machine
- All PCs on the .2.0 LAN can see each other
- ran "nbtstat -RR" on both PCs
- Have rebooted both routers; power-cycled the one at the .1.0 site

The Windows 7 PC (.2.x) can't access the shared folders on the XP (.1.x) PC The Windows 7 PC CAN access the shared folders when at the .1.0 site, but not at the .2.0 site.This apparently started when the XP PC was rebooted. I don't know why that would have affected it.

View 6 Replies View Related

Cisco VPN :: ASA5505 - Site To Site VPN Keeps Dropping

Sep 20, 2012

I have a site to site VPN. Every few days my site stops transmitting data to the remote site but I do receive data from the remote site. Only way to fix it is to rebuild the tunnel. I dont have any idle time set for the vpn. so not sure why the tunnel keeps going down. I have  a ASA 5505 running 7.2 (3) IOS.

View 5 Replies View Related

Cisco VPN :: 2901 / 2921 / 5505 ASA - Router Versus Firewall Site To Site VPN?

May 30, 2013

I would like to know both Cisco 2901 or 2921 router and Cisco 5505 ASA can build site to site VPN.
 
1) what is the different to build site to site VPN between router and firewall ?

2) which is the best choice if using in site to site VPN connection ? 

View 9 Replies View Related

Cisco Firewall :: ASA 5505 / Site To Site VPN Using Public Addresses On Local Network

Jul 28, 2011

I have a request to establish a site to site VPN with a customer. While collecting the information I give them our local network subnet which is a private subnet (192.168.5.0). They asked me if I could give them a public address instead. They can not work with the 192.168.5 subnet. Is this possible?
 
My side of the VPN is an ASA 5505 running 8.2(2). The other side i believe is a Checkpoint.

View 5 Replies View Related

Cisco Firewall :: ASA 5505 Site To Site RTP Traffic Is Hitting Deny All Rule?

Aug 13, 2012

Got an ASA5505 connected to another endpoint running IPsec and being NAT'd at each end to a 10.0.0.0/24 network. I can pass other types of traffic through the ASA 5505 but not RTP traffic. The moment it is NAT'd and hits the firewall rules it gets denied by the default deny at the bottom of the list.

Currently the rules are as follows
 
 Incoming External
allow ip any any
allow tcp any any
allow udp any any
default deny

 [code].....
 
It wont allow us to setup a voip call...however when the same call manager sets up a voip call NOT using this ipsec tunnel it works just fine.

View 2 Replies View Related

Cisco :: ASA 5505 Site To Site RTP Traffic Is Hitting Deny All Rule?

Aug 14, 2012

Got an ASA5505 connected to another endpoint running IPsec and being NAT'd at each end to a 10.0.0.0/24 network. I can pass other types of traffic through the ASA 5505 but not RTP traffic. The moment it is NAT'd and hits the firewall rules it gets denied by the default deny at the bottom of the list.

Currently the rules are as follows

Incoming External
allow ip any any
allow tcp any any
allow udp any any
default deny

[code]....

It wont allow us to setup a voip call...however when the same call manager sets up a voip call NOT using this ipsec tunnel it works just fine.

View 3 Replies View Related

Cisco Firewall :: ASA 5505 - Unable To Access Certain Ports Over Site To Site VPN

Jan 16, 2013

We have a client that has a Cisco 1801W Firewall that is setup as a site to site VPN terminating to a Cisco ASA 5505. The tunnel is up and established, I can ping from both sides of the tunnel.
 
The problem is the clients behind the Cisco ASA (192.168.2.x) cannot reach certain ports behind the Router (192.168.1.x). The main thing we're trying to do is browse via UNC path (ex: \192.168.1.120 from a 192.168.2.x machine).
 
I got 3389 working after I changed the - ip nat inside source static tcp 192.168.1.120 3389 y.y.x.x 3389 route-map DM_RMAP_1 extendable Modified the command to include the public IP instead of interface FastEthernet0
 
I believe it has something to do with the way NAT and route-maps are setup currently but I'm not familar enough with them to make the changes. I worked with Cisco to ensure the VPN tunnel was fine and it's something security related on the Router.
 
Here is the configuration (removed a few lines not necessary. y.y.x.x = WAN IP of Router x.x.y.y = WAN IP of ASA).
  
Building configuration...
  
Current configuration : 23648 bytes
!
version 12.4
no service pad

[Code].....

View 1 Replies View Related

Cisco AAA/Identity/Nac :: ASA 5505 - Procedure For Monitoring Site-to-site VPN Tunnel?

Apr 30, 2012

Need to know the step by step procedure for monitoring site-to-site VPN tunnel (up/down) using SNMP on Cisco ASA 5505. 

View 1 Replies View Related

Cisco WAN :: 5505 Correct Site-to-site / SSLVPN Security Device

Dec 12, 2012

I have tried Cisco presales but got bounced - go Cisco !So, i have a small customer who requires a single device which will provide .....
 
1/ Leased Line connection @ 10mb
2/ ADSL failover onbox (so configurable from CLI, unlike the 860’s which I see only have one ‘active’ wan port)
3/ IOS based
4/ integrated 4 ports (min) switch
5/ site to site VPN
6/ up to 10 x SSLVPN remote users
 
I did pitch in with ASA5505 with external ADSL router but he is “space-constrained”.It worries me when Cisco doc's say only one WAN port is 'active' - since it doesn't say the second port automatically comes up if the first goes down so I can't take a gamble on that being the case.

View 3 Replies View Related

Cisco Firewall :: ASA 5505 Site To Site VPN Route From Multiple LANs?

Dec 19, 2012

I've set up a standard site-to-site VPN between 2 ASA 5505s and the VPN is working fine for traffic between these ASAs and computers which are in the same LANs.but when I'm trying to connect to computers which are in another VLAN I have a problem.

View 1 Replies View Related

Cisco VPN :: Site To Site VPN IPSEC Tunnel From ASA 5505 To Clavister Firewall

Nov 20, 2012

I have weird problem with a Site to site VPN tunnel from a Cisco ASA 5505 to an Clavister Firewall.When I restart the Cisco ASA 5505 the tunnel is up and down,up, down, down, and I get all strange messages when I see if the tunnel is up or down with the syntax: [code]
 
After a while like 5-10 min the vpn site to site tunnel is up and here is the strange thing happening I have all accesslists and tunnel accesslists right I can only access one remote network (Main site Clavister Firewall) trought the vpn tunnel behind the Cisco ASA 5505, and I have 5 more remote networks that I want to access but only one remote network is working trought the vpn tunnel behind the Cisco ASA. I see that when I do this syntax in ASA: show crypto ipsec sa.They had a Clavister Firewall before on that site before and now they have a Cisco ASA 5505 and all the rules on the main site thats have the big Clavister Firewall is intact so the problems are in the Cisco ASA 5505. [code]
 
All these remote networks are at the Main Site Clavister Firewall.

View 1 Replies View Related

Cisco Routers :: Site-to-site VPN From SRP527W (dynamic IP) To ASA 5505 (Static)

Sep 6, 2011

I have an ASA5505 running which is on a static IP. I have just got an SRP527W for a remote worker and want to create a site-to-site VPN into the ASA. I have a number of other router of non-cisco brand which just all dial-in and connect no problem.
 
On other routers I have been abloe to specify the DDNS hostname in the VPN setup so that the ASA can identify it. I'm not sure how I setup the SRP527 to connect to the ASA.

View 3 Replies View Related

Cisco VPN :: ASA 5505 / Site 2 Site VPN With Backup Peer Not Able To Send Traffic

Mar 13, 2011

I have 2 ASA 5505 Firewall, I Configured Site 2 Site VPN no both the fitrewall, as i have a dual ISP, i am able to create the tunnel with primary but once my primary is down i am not able to create the tunnel with back up ISP. During the troobleshoothing by typing Show isakmp sa and Show ipsec sa, i can see my tunnel is up, but not able to decap the packets.
 
As it will look like
 
#pkts encaps: 15, #pkts encrypt: 15, #pkts digest: 15      #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0      #pkts compressed: 0, #pkts decompressed: 0      #pkts not compressed: 15, #pkts comp failed: 0, #pkts decomp failed: 0      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0      #send errors: 0, #recv errors: 0

View 4 Replies View Related

Cisco Firewall :: Max Number Of Clients And Site To Site VPN Tunnels On ASA 5505

Aug 15, 2012

I wanted to know the maximum VPN client sessions (using the Cisco VPN  client) and Site-to-Site VPN tunnels that I can connect to my ASA 5505  simultaneously.
 
In other words, if I have x VPN clients and y Site-to-Site  tunnels, at any time, does x + y have to be <= 10 (Total VPN Peers)?  If yes, can I upgrade to the security plus license to increase the Total VPN Peers to 25?

Licensed features for this platform:
Maximum Physical Interfaces    : 8
VLANs                          : 3, DMZ Restricted
Inside Hosts                   : Unlimited
Failover                       : Disabled
VPN-DES                        : Enabled
[Code]...

View 3 Replies View Related

Cisco VPN :: ASA 5505 - Users Aren't Able To Reach Remote Network Through Site-to-site Tunnel

May 21, 2011

Remote-access users aren't able to reach our remote network through a site-to-site VPN tunnel between two ASA 5505's.
 
I've seen several threads about that here, I've run through the walkthrough at [URL] I've taken a stab at setting split tunnelling and nat exemption, but it seems I'm still missing something. Remote-access users can reach the main site, but not the remote site.
 
Remote-access (vpn-houston) uses 192.168.69.0/24.
The main site (houston) uses 10.0.0.0/24
The remote site (lugoff) uses 10.0.1.0/24

View 5 Replies View Related

Cisco VPN :: Establish Site-to-site VPN Tunnel Between ASA 5505 And C881?

Dec 27, 2012

Last week, I was able to establish a site-to-site VPN tunnel between an ASA 5505 and Cisco C881 router just fine. The tunnel was up and and running for a number of days but today the tunnel is no longer up.  I was wondering how, if there are any commands  to re-establish or re-initiate the tunnel.

View 3 Replies View Related

Cisco Firewall :: ASA 5505 Setup A Site To Site Tunnel?

Nov 13, 2012

I have a 5505 asa code version 8.3(2). Trying to set up a site to site tunnel with someone and he is asking if I can use ike v2. How do I go about setting up the tunnel to use ikev2? Is ikev2 an option with site to site tunnels?

View 5 Replies View Related

Cisco VPN :: Configuring VPN Site To Site ASA 5505 With Contivity Nortel

Oct 17, 2012

ASA is configured with the VPN site to site using the wizard, created the Public IP of contivity, local and remote LAN . I attached the configuration. In contivity have the following settings: Not able to communicate both subnets.Do I need to configure IP subnets and published in the contivity as was done in the ASA?

View 3 Replies View Related

Cisco Firewall :: Site-to-Site VPN Between ASA 5510 And 5505 Configuration

Apr 18, 2013

I am not very experienced with Cisco networking.

Here is the situation.
 
Site A - headquarters 192.168.1.x
Site B - remote office 192.168.20.x
Site C - remote office 192.168.30.x
 
Site A - ASA 5510
Site B - ASA 5505
Site C - ASA 5505
 
Site-to-site VPN is established and works between A and B, A and C. Users would like to establish a tunnel between B and C to work on a common project and the data is on Site B.
 
I tried configuring the S2S VPN with pre-shared keys on both firewalls at sites B and C but in the end it is not established (I cannot ping either side). I used the Wizard interface multiple times and one time the CLI. I generally followed the settings chosen between the headquarter and the individual remote sites and tried to replicate them. Obviously I have made a mistake somewhere.
 
Could there be any limitation on the ASA 5505 in terms of licensing and the number of S2S tunnels?

View 7 Replies View Related

Cisco VPN :: ASA 5505 Site-to-site VPN Tunnel And Client VPN Sessions?

Nov 14, 2012

i have a client who needs to establish a VPN tunnel from his satellite office (Site A) to his corporate office (Site Z).  His satellite office will have a single PC sitting behind the ASA.  In addition, he needs to be able to VPN from his home (Site H) to Site A to access his PC.The first question I have is about the ASA 5505 and the various licensing options.  I want to ensure that an ASA5505-BUN-K9 will be able to establish the site-to-site tunnel as well as allow him to use either the IPsec or SSL VPN client to connect from Site H to Site A.  Secondly, I would like to verify that no special routing or configuration would need to take place in order to allow traffic not destined for Site Z (i.e., general web browsing or other traffic to any resource that is not part of the Site Z network) to go out his outside interface without specifically traversing the VPN tunnel (split tunneling?)Finally, if the client were to establish a VPN session from Site H to Site A, would that allow for him to connect directly into resources at Site Z without any special firewall security rules?  Since the VPN session would come in on the outside interface, and the tunnel back to Site Z goes out on the same interface, would this constitute a split horizon scenario that would call for a more complex config, or will the ASA handle that automatically without issue?

View 1 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved