I've two sites, the branch with an ASA 5505 and on the corporate office i've an ASA 5510.I need to make a easy vpn tunnel between this to sites and I've made some configuration, but for now, the ikev1 isn't working.
View 1 RepliesI'm looking for automating a couple failover scenarios. Both VPN redundancy and black hole internet traffic redundancy.I currently use the more reliable T1 connection for the VPN connection and the DSL for internet traffic.My current configuration is working but requires a manual update to get the VPN or black hole back up and operational when either link fails.
[code]....
We have to make disaster recovery site EasyVPN tunnels on Cisco 5505 ASA firewalls. Now there is only one main site and 3 remote sites.For DR we have to use the same subnet as it is on the main site because the Vmware virtual machines will be replicated to DR.For DR we are using Double Take software.What is the best solution for this? I think that we could use Destination NAT on ASAs. The other sites (HQ and remote) will se only the NAT address of theDR and not the real one which is the same as on the main site.We are using IPSec VPN? In packet-tracer on ASA I see that the packet is first NATed and then encrypted, so it should work, yes?
View 2 Replies View RelatedI just learned that the licensing structure for the ASAs is changing, but I don't have any details. We have roughly 30 ASAs (from 5505s to 5585s). If there's a licensing change, I need to do an impact assessment and plan accordingly.
View 5 Replies View RelatedI'm trying to configure policing and/or shaping on a setup of 2 x ASA 5505 Sec Plus. The units are placed in office A and office B and each have a ISP connection to the internet and a leased line with a capacity of 4/4 Mbit/s for interoffice communication.
On each ASA there's four subnets. VLAN 200 is used to connect the offices through the leased line.
Subnets:
Outside = 2
Data = 10
Voice = 100
Linknet = 200
I've read a lot of articles and posts about shaping and policing on the ASA but still can't get it to work like I wan't to. I'm trying to limit all traffic besides IP-telephony traffic to 3 Mbit/s and thus reserving 900 Kbit/s for voice traffic. I tried setting a service-policy on the linknet interface on each ASA and set Traffic match to Any traffic and QoS settings for both input and output.
I can see traffic passing the policy when I run the "show service-policy police" command but it never seems to be high enough to be policed which is strange since the ASDM monitoring shows that I'm pushing 3900 kbit/s. I file transfers verifies that policing does'nt work.
We have many new and very small remote sites that will be connecting via an ASA5505 using easy VPN. Works without an issue and we've got the configuration and process nailed down.
The challenge I was presented with today involve non-standard remote sites where I need to configure a third interface on an ASA 5505 and allow it to pass directly to the Internet and not go through the VPN. Configuration of the third interface, assignment and configuration of the ACLs / NAT(PAT) are straight forward.
The challenge I face and haven't been able to find a direct answer to is if it's possible to have the traffic bypass the easy vpn network extension process. At this time the traffic is going down the tunnel which isn't what I want.
I fear I'll have to build classic site-to-site VPN configurations which isn't a huge issue though it breaks all maintenance/operations methods, processes and I'll have to spend time training the support team how to detect the differences.
I have a Cisco ASA 5505 which is setup as an EasyVPN client to e remote VPN concentrator.
The Cisco ASA has the 50 internal user license with 10 VPN peers.
We just upgraded the license from the base 10 internal user to 50 user license but it has not resolved the problem and only 10 internal users still work, the 11th fails.
Does each EasyVPN client on the inside network take up 1 of the 10 VPN peer licences?
This seems to be the issue from what I can see, just need confirmation.
I have a Cisco ASA 5505 which is setup as an EasyVPN client to e remote VPN concentrator.The Cisco ASA has the 50 internal user license with 10 VPN peers.We just upgraded the license from the base 10 internal user to 50 user license but it has not resolved the problem and only 10 internal users still work, the 11th fails. Does each EasyVPN client on the inside network take up 1 of the 10 VPN peer licences? This seems to be the issue from what I can see, just need confirmation.
View 3 Replies View RelatedI have a branch office set up with a cable modem and an ASA 5505 as an easyvpn hardware client with network extension mode enabled, and connects to a PIX515E at the headend.I'm working on a separate issue for why the Internet connection drops periodically at the site, but my main problem is as follows.In this location, I have an 1142 LAP. It can boot up, and join the WLC just fine. Performance seems a little slow when it's working, but it works. The real issue is, if the VPN connection drops and reestablishes for any reason, the wireless clients all cease being able to communicate. All wired clients seem to bounce back without a problem.
The access point still shows to be joined to the controller, the access point never goes down, just wireless clients can't access anything any more. If I reload the access point, clients reassociate and continue on their merry way. For now, I am experimenting to keep the connection from dropping, but I'd really like to get it where I don't have to babysit this thing all day and night, and it can rejoin and function normally by itself after an outage.We are changing to this configuration from wireless bridging due to interference and reliability issues - however, I never experienced any similar issues with this particular access point before, so it's not the access point itself.
I am installing 2 ASA 5505s at home offices with dynamic IPs. The EasyVPN server is a ASA585x. I am using the 5505s in NEM mode. I configured a unique DHCP scope on each 5505. I have a dynamic crpto map on the server. I configured unique tunnel groups, group policies and usernames for each site on the server. This seems to work fine. Is it normal to configure unique tunnel groups, group policies and usernames for each remote site?
View 2 Replies View RelatedWhen ASA 5505 was installed we selected Easy VPN Remote. Now we want to disable it. In ASDM we navigate to Configuration > Remote Access VPN > Easy VPN Remote and try to clear the Enable Easy VPN Remote checkbox but it will not uncheck.
View 2 Replies View RelatedSo I have three ASA 5505 firewall. my firewalls we are in the test environment. I read on the net that when you have a situation like in my company where are headquarter and two offices, i should put in each branch office and headquarter one asa firewall and a firewalls should be configured as easyvpn.
VPN server is in headquarter and easyvpn's are in branch offices. i tried everything, but we could not configure them. maybe it's not a problem that in my test environment at my the external interfaces which have static addresses on these three firewalls, respectively serever 192.168.2.1, 192.168.2.2 and 192.168.2.3 client client. I seted firewalls by following the instructions, but does not work
[URL]...
I solved the problem with the server as a remote access VPN. client workstations that are on the 192.168.2.0/24 network can access a local LAN via VPN. But when you put the ASA 5505 firewall. clients on the LAN side of the firewall can not access the VPN. I use software products Cisco VPN Client 5.0.06, but when I create a connection and try to connect to get an error secure vpn connection terminated locally by the client. reason 412: the remote peer is no longer responding.
We have a number of 5505 ASAs at remote sites all of which are configured to connect to one of two head-end servers.We need to change the primary head-end IP addresses. At the moment devices are successfully connected to the secondary.If we issue vpnclient server i.j.k.l e.f.g.h then the device drops off the network and won't reconnect until it is power cycled.If we make the changes in ASDM using the GUI to remove the old primary and add in the new primary the ASDM says "No changes made".Devices are running 8.2 and 8.4 code and behaviour is the same.
how to change head-end server IP addresses without the device disconnecting and not coming back up? According to the configuration guide the ASA should cycle through the addresses every 8 seconds until it can connect - but it doesn't seem to do this as it won't connect to the good secondary head-end either!
I have site-to-site VPN using two ASAs 5505. I can ping between two computers C1 and C2. Now I want to add subnet 192.168.1.0. How do I configure routes on ASA so that I can ping between computers C3 and C2?
View 5 Replies View Relatedi have a question about tunneling a software EasyVPN client to a client ASA Network. It looks like this:
EasyVPN Server 192.168.202.0/24 Network extension mode to Client EasyVPN ASA 192.168.1.0/24 This works fine in both directions. But now i want to connect the client ASA network via EasyVPN software client from outside. The user are already able to connect to the ASA Server on its static outside IP obtaining an IP from a 192.168.21.0/24 pool. This works fine. But how am i able to connect to the 192.168.1.0/24 network from this client?
We have an ASA 5505 in our environment and currently two IPSec L2L VPN tunnels are established. But we are planning to connect using Easy VPN(Network Extension Mode) to another site as Client. Is it possible to configure Easy VPN configurations by keeping the currently active IPSec L2L VPN(Site-to-Site) tunnels?
Following is the warning that we get when tried to configure Easy VPN Client.NOCMEFW1(config)# vpnclient enable
* Remove "nat (inside) 0 S2S-VPN"
* Detach crypto map attached to interface outside
* Remove user-defined tunnel-groups
* Remove manually configured ISA policies
CONFIG CONFLICT: Configuration that would prevent successful Cisco EasyVPN Remote operation has been detected, and is listed above. P
I've deployed L2L VPN between ASA's dynamic to static in a hub and spoke format.Everything works great if you are on a spoke ASA and you need to go to the hub but you can not go from the hub to spoke.
I'm using ASA code version 8.4(1) ... Below is what I have so far...
HUB
crypto ipsec ikev1 transform-set ts-dyna esp-aes-256 esp-sha-hmac crypto dynamic-map dm-dyna 65000 set ikev1 transform-set ts-dynacrypto dynamic-map dm-dyna 65000 set reverse-routecrypto map cr-vpn 65000 ipsec-isakmp dynamic dm-dynacrypto map cr-vpn interface outside
crypto ikev1 policy 10 authentication pre-share encryption aes hash sha group 2 lifetime 86400
tunnel-group DefaultL2LGroup ipsec-attributes ikev1 pre-shared-key *****
[code].....
Is there any way to apply a crypto map on the Hub side to encrypt the traffic to the spokes?
I am currently having some problems on our 5520 ASAs. The problem is the IPSec VPN clients not being able to connect. We have had an issue twice this week where this happened. Earlier in the week we had folks not able to sign in, but some folks who were connected already stayed connected. The ASAs had been up for 200+ days and no changes have been made to it recently. At that point I had to reload the ASAs so users could start signing back in to it. Today we had a similar issue, but I didn’t have to reload the ASAs. The issue‘resolved’ itself. The VPN clients are getting Error code: 433 and the ASAs are getting Reason: Peer Address Changed when this occurs.
ASA5520, 2048 MB RAM, CPU Pentium 4 Celeron 2000 MHz version 8.3.2.
I am having a hard time getting tunnel fail over working. My setup is illustrated below:
I derive my default route on the border routers. The 6513 peers with the 7206's using BGP to get the default route from each ISP into the core. On the core I use BGP weighting to get my primary default to point to ISP1. So far so good. When I look at my core I see to defaults with ISP1 preferred.
Each ASA has an IP Sec tunnel to the head end site configured (Not shown). The head end site has a crypto map entry with ISP1 and ISP2 defined (in that order) using the "set peer" command.
Fail over works great if an ISP drops the connection or my 7206 or ASA fails, but... While testing fail over I had an issue where both tunnels would be active and there were issues with traffic between sites. I could not determine the root cause. I can only guess that some traffic was going out one tunnel and when trying to come back across the other tunnel was dropped from the firewall because there was no connection built for it. After reading I found that in order to use multiple peers in the "set peer" statement, I needed to configure my head end as "originate-only". I have not done this yet as I have concerns. If the head end site is "originate-only" and the tunnel, for whatever reason drops, I cannot wait for interesting traffic at the head end site bound for this site to bring up the tunnel as most of the traffic originates at this site.
I have been reading about IKE keep alives and DPD but that doesn't sound like it will re-initiate the tunnel. Is this correct? If so I'm looking for a way to make this work.
I have a pair of ASA5520s in active/active failover - this works fine. Both primary and secondary ASAs are running 8.2(2) code.I have a 30-day temp 50 seat SSL license that I applied to the primary. I then started having problems with L2L tunnels.
I noted that if the 'show crypto isakmp sa' state for an L2L was MM_STANDBY, then the remote protected net could not reach my side. However, I could ping across to the other side at which time the state changed to MM_ACTIVE as I would expect and the remote could then reach my side.
I believe this results from the differences between the two licenses. When I applied the 50 seat SSL lic. it disabled failover, but I was willing to risk that for a few days to do show my customer the benifits of SSL connectivity. Note license differences. Is this causing the MM_STANDBY IKE issue and if so can I overcome it and use the 50 SSL VPN Peers lic.
[code]...
We have a site with two inbound circuits, one for internet and one for our MPLS. Each circuit is being terminated by a 2921 Router and matching ASA 5510 Firewall. For the internal network, the Internet ASA's inside interface (172.16.0.1) is the default gateway for all hosts. OSPF is the routing protocol between all the routers and ASA's and routing is working. In fact, ICMP is working as well. From an inside host (172.16.0.81), we can ping anything on the MPLS network. But when I try to use telnet (for example), the connection fails. If I add a route to 10.10.10.0 to the host, or re-configure the host to point to the MPLS ASA (172.16.0.254) as it's default gateway, connections will establish.
Both ASAs are running 8.4(3), and have the following commands:
same-security-traffic permit intra-interface
interface Ethernet0/0
nameif outside
[Code]....
And from the MPLS nodes, I can see a tcp request is made.
is it possible to configure a Cisco 881 router to split the incoming internet connection between two ASA's? If one ASA fails then the router would switch traffic over to the second ASA. The 2nd ASA would takeover from the primary ASA through the active/standby failover configuration and crossover cable. I'm trying to avoid configuring the switch to control the traffic using VLANS if possible.
View 3 Replies View RelatedI need to upgrade the active/standby failover pair of 5510 ASA's to have1 Gig DRAM each, and I am trying to plan out the upgrade process. I'm looking for a zero downtime upgrade process.
I know that the failover pair has to have the same amount of memory, so how do I perform a zero-downtime upgrade process?Can I power off the standby unit and upgrade it's memory first? Or will it cause a memory mismatch between the active and standby units when it is powered on?
I want to implement Active/Standby cluster with a pair of 5550 ASAs and I have a licensing question. Here is the "sh activation-key detail" output from both devices...
ASA1:
sh activation-key detail:
Serial Number: XXXXX
No active temporary key.
Running Activation Key: XXXXX XXXXX XXXXX XXXXX XXXXX
[code]....
This platform has an ASA 5550 VPN Premium license.The flash activation key is the SAME as the running key.So it looks obvious that I'll have to upgrade the first ASA to support 25 SSL VPN Peers in order to build HA cluster, right?Now I want to know do I need the "ASA5505-SSL25-K9" license or something else.
URL What changes are needed to the 2821 config that is behind another Cisco router? And what static ports should be opened on the MAIN Cisco router that is in front of the 2821?
View 1 Replies View RelatedCan the Cisco ASA 5510 appliance be used as an EasyVPN Remote device, or only as an EasyVPN Server?
View 1 Replies View RelatedI don't seem to be able to connect to my cisco 831 router with easy vpn server configured using my Blackberry Playbook. Looking at the console of the router i can see the debugging but am not sure what it all means.
Current configuration : 2574 bytes!version 12.3no service padservice timestamps debug datetime msecservice timestamps log datetime msecno service password-encryption!hostname Router!enable secret 5 $1$FM71$y4ejS2icnqX79b9gD92E81enable password xxxx!username CRWS_Ritesh privilege 15 password 0 $1$W1fA$o1oSEpa163775446username shamilton privilege 15 secret 5 $1$wFLF$8eRxnrrgVHMXXC0bXdEGi1aaa new-model!!aaa authentication login default localaaa authentication login ciscocp_vpn_xauth_ml_1 localaaa authorization exec default localaaa authorization network ciscocp_vpn_group_ml_1 localaaa session-id commonip subnet-zerono ip
[code]....
I have one ASA 5510 on main office that access the internet trought of a private link and one ASA5505 on the branch office that access the internet trought of a ADSL link with dynamic IP.
Behind ASA 5510 the network is 10.8.40.0/24 and behind the ASA 5505 the network is 10.30.103.0/24. I want access both network trought of the frame-relay link and the internet link with EzVPN.I make that access only ip on the main office, this comunication go to frame-relay link and the everyone go to the VPN.When the traffic go to the frame-relay link, I use a NAT Static Policy that change the source 10.30.103.0/24 to source 10.40.103.0/24. Its work OK when a VPN do not UP.When the VPN is UP, the NAT dont work and the packet go to the true IP (10.30.103.0/24).
How to setup option 150 in IP pool on VPN Client.
View 2 Replies View RelatedI have been trying to configure Cisco1941/K9 as Easy VPN Server through CiscoCP.The tunnel comes up but I cannot pass any traffic to the secure LAN (GigEth 0/1). When the tunnel comes up, I can ping the Loopback interface and the GigEth 0/1 interface IPs.
View 21 Replies View RelatedI have a Cisco ASA 5510 and a Cisco ASA 5505. I want to configure the ASA 5510 as Easy VPN Server and 5505 as Easy VPN hardware client.Using either CLI or ASDM.
View 1 Replies View RelatedI'm in the process of setting up a working VPN/Firewall setup on an 881W ISR. I have the firewall, NAT, and VPN working, and I'm able to connect remotely to my router. The problem I am having is that I none of my VPN cllients can connect to the internet. I suspect that my firewall rules may have something to do with this. Let me break-down what I have, and what I want to achieve:
1. My router is setup with VLAN1 (172.16.1.0/24) as the inside zone (in-zone), while my outside zone (out-zone) is FastEthernet4 (DHCP WAN Interface). I also have a guest zone (guest-zone) VLAN12 (192.168.12.0/24) used for my guest SSID wireless, which is NATed to the outside zone.
2. I have my EasyVPN setup using a Virtual Template Interface that terminates at the WAN interface FastEthernet4 (something tells me this should be changed). Should I terminate at VLAN1, or an interface or loopback on VLAN1?
3. I ultimately want the VPN users to be able to conenct to the local resources on VLAN1 only, while being able to get out to the internet. [code]
I have big trouble with easyvpn clients access filtering on asaos 8.4.1. I have couple of remote offices with hardware clients (cisco 87x, 88x) configured as easyvpn clients to Asa. Default route in it's routing table pointing to the Virtaul-Access interface (easyvpn connection to ASA), so there is no split tunneling or any kind of nat on the clients. I have ip-telephony deployed across remote offices. This remote offices should be able to call to each other.
On the ASA i have configuration for this purpose:
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
But as soon as I configured it, remote users obtain an ability to access Internet without any restrictions although there is couple of access-lists configured on the outside interface pointing to easyvpn clients. Then there is no same-security-traffic commands i can filter out access to internal and external resources correctly, but remote offices can't communicate with each other