Cisco VPN :: 5510 - IPsec Tunnel Going Down At Specific Times

Dec 5, 2011

i have a Ipsec tunnel between a ASA 5510 (Uk) & a router (France) that seems to be going down a specific times during the day. I have attached the sys log as well.
 
I cannot seem to copy & paste the config onto here for some reason so i have attched the configs, Ipsec details & syslog details from the asa.

View 3 Replies


ADVERTISEMENT

Cisco VPN :: Specific Tunnel-group With User On ASA 5510?

May 13, 2011

I would like to ask some question about VPN clinet and SSL VPN, on my ASA 5510 i have many tunnel-group it have around 5 tunnel-group and i have one SSL VPN,i also have user 20 user. let me show you that:
 
1- tunnel-group Staff-VPN remote-access
2- tunnel-group Manager-VPN remote-access
3- tunnel-group normalstaff-VPN remote-access
4- tunnel-group guest-VPN remote-access
5- tunnel-group other-VPN remote-access
and tunnel-group sslgroup type remote-access
 
and i have user around 20 user and i want to specific user to tunnel-groups like this
 
1- tunnel-group Staff-VPN remote-access
username AAA password AAA
username AAA01 password AA01
 
2- tunnel-group Manager-VPN remote-access
username BBB password BBB
username BBB01 password BBB01
 
3- tunnel-group normalstaff-VPN remote-access
username CCC password CCC
username CCC01 password CCC01
 
5- tunnel-group other-VPN remote-access
username DDD password DDD
username DDD01  password DDD01
 
So, How can i manag tunel-groups with user?

View 3 Replies View Related

Cisco LAN :: Debug An Ipsec Tunnel On An ASA 5510 (8.4(3))?

Mar 5, 2012

I'm attempting to debug an ipsec tunnel on an ASA 5510 (8.4(3)) and when I turn on `debug crypto ipsec` and then execute `logging monitor` I get an constant stream of TCP debugging events, is it possible to only view ipsec messages?

View 2 Replies View Related

Cisco VPN :: 5510 - IPSEC Tunnel Won't Attempt Connection

Jul 31, 2012

I have a 5510 and a 5505 that I'm attempting to configure a simple VPN tunnel over. I have tried step by step configurations form CISCO ASA configs, as well as every source I can find. I have walked throught the config with IOS commands as well as Wizards. All my packets are dropped at the the inside or outside interface.
 
When I show SH ISAKMP command all I get are 0's straight down.

View 7 Replies View Related

Cisco Firewall :: IPSec Tunnel On Sub-interface On ASA 5510?

Jun 11, 2012

I working on a security solution using ASA firewall. Is it possible to setup a IPSec tunnels  on each subinterface of a physical interface on ASA 5510?

View 3 Replies View Related

Cisco VPN :: ASA 5510 OS 8.03 Change IPSec Tunnel IP Endpoint In CLI

Mar 29, 2012

I have an ipsec tunnel  IP is changing from mythical 200.200.200.182 to 200.200.200.254.  Is it possible to change the .182 ip in  below config via the CLI to .254 and have the site-to-site vpn continue to work? [code]

View 1 Replies View Related

Cisco VPN :: 5510 - Slow Throughput On L2L IPsec Tunnel

Jan 8, 2013

I am experiencing slow throughput on a L2L IPsec tunnel that we have between one of our offices on the west coast (WC) US and another on the east coast (EC) US. The tunnel endpoint on the WC resides on a 5510 and a 5545x on the EC. The DIA circuit speed on the WC is 45 Mbps and 200 Mbps on the EC. The throughput of this IPsec tunnel is maxing out at approx. 4 – 5 Mbps. The utilization of the DIA circuits at both offices is under 5% when running various FTP test transfers. Both devices have low memory and CPU utilization.
 
We have a 2nd office on the EC (45 Mbps DIA) which I built a tunnel on a 5510 with the WC office and it is experiencing the same slow throughput. In covering all my bases we have a colocation facility on the WC and in building a tunnel between the 2 WC offices I WAS seeing close to full line rate speeds over the tunnel. Additionally, I built a tunnel between the 2 EC offices and I saw full line rate speeds. With the physical distance between the WC & EC offices I would expect some loss in throughput speeds but I would not expect it to drop as low as 4 – 5 Mbps. In thinking something may be up with the 5510 in our WC office we shipped a 5505 to the WC office and we built the same IPsec tunnels on it and it is experiencing the same.
 
In working with our support vendor to try and solve the WC <-> EC throughput issue they had me change the MTU, TCP mss, DF-bit, types of encryption/hash on the IPsec tunnel but nothing has resolved it.  We are not showing fragmentation or PMTU issues on the tunnel. In contacting the ISP of our WC office they mentioned that they do not have any type or rate limiting in place. Our WC ISP had a CCIE review our configurations but nothing was found.

View 1 Replies View Related

Cisco VPN :: 5510 IPSec Tunnel With Juniper Netscreens

Apr 25, 2011

I'm having an issue bringing a L2L tunnels up between my ASA 5510 and an ISPs Netscreens. I can establish the tunnels from my side by initiating traffic to the far end. The tunnels come up and stay up as long as there is traffic. Once the tunnels drop, they will not re-establish with inbound traffic. The only way to re-establish the tunnel is to send traffic outbound from our network. My ASAs are on ASA Version 7.0(8) in active/standby. [code]

View 2 Replies View Related

Cisco VPN :: ASA 5520 / Define Specific IKE Proposal For Specific L2L Tunnel?

May 24, 2011

ASA 5520 running 8.0.4
ASDM v.6.1
 
Need assistance understanding how in ASDM/Configuration/Site-to-Site VPN/Connection Profiles/ "Any Entry" I can specify that I only want to offer an IKE Proposal of pre-share-aes-256-sha?
 
The IKE Proposal field has a number of possible options including: pre-share-aes-256-md5, pre-share-3des-md5, pre-share-aes-256-sha, pre-share-aes-192-sha, pre-share-3des-md5, pre-share-aes-sha and pre-share-3des-sha.
 
I am able to pick a specific IPSec Proposal w/o issue but when I attempt to do the same for the IKE Proposal, and click OK the choice does not "stick" but rather returns to the entire list as defined above.

View 2 Replies View Related

Cisco WAN :: 1941 Router - Enable IPSec Virtual Tunnel Interface With Tunnel Mode IPv4

Sep 23, 2012

I'm in process of purchasing a new Cisco routers for our branches that will be used primary to enable IPSec virtual tunnel interfce with "tunnel mode ipsec ipv4". does the default IOS IP Base supports this feature? or i need to purchase DATA license or SECURITY license?

View 4 Replies View Related

Cisco Routers :: Set A VPN IpSec Tunnel GW To GW Tunnel Between RV110W

Oct 17, 2012

I am using a Cisco RV110W (Firmware 1.2.09) in a branch and I would like to create a VPN Tunnel to another site that has a Cisco RV042 (firmware v4.2.1.02)
 
What would be the correct Configuration? the current configuration I am using is
 
in the RV042 i am using
 
Check Enable 
Local Group Setup
Local Security Gateway Type : IP Only
IP Address : RV042 Pulbic IP address

[Code].....

View 3 Replies View Related

Cisco VPN :: 1921 - Specific Way To Bring Up Tunnel?

Aug 2, 2011

I am trying to configure an IPSEC tunnel on a 1921 router.  What I hope to accomplish is that using a IP SLA that the IPSEC tunnel will only be brought up  IF the normal WAN connection is not responding.  My thoughts were to route the traffic that needed to come back to corporate through a loopback interface but I havent found a way to do that.

View 1 Replies View Related

ASA5505 - Tunnel A Specific Traffic Via VPN

May 20, 2012

I have a number of sites in China, they have decent inter-country connectivity but poor connectivity when going overseas.

We have a single site in China witha dedicated 1:1 leased line that has good conectivity both inside and outside of China.

All the sites in China have ASA5505 firewalls

One of our Citrix farms is hosted in the UK and although the main site with the leased line is fine accessing the farm the other sites are not. I would like to try and tunnel just the citrix connectivity via a VPN to the China head office then use their connection to get out to the farm.

how to tunnel all traffic but not just specific traffic over the VPN.

View 3 Replies View Related

Cisco Firewall :: ASA 5510 Reboots Itself Several Times A Day

Apr 30, 2011

we just bought brand new Cisco ASA 5510.We are using it in transparent mode, only for firewalling.But we have problems... This device reboots itself several times in day. Actually throughput is around 5 Mb/s and connection number is around 200.

View 3 Replies View Related

Cisco Firewall :: ASA5540 - Disabling Anti-Replay For Specific Tunnel

Sep 23, 2012

We need Solution for disabling Anti-Replay on the Firewall for a specific tunnel. ASA 8.4(2) ) does not support disabling Anti-Replay on specific Ipsec tunnel , is it true , then if we want to disable Anti-replay , what we have  to do in ASA5540 .

View 4 Replies View Related

Linux - Split Tunnel Routing Specific Port Over OpenVPN On Ubuntu Server 12.04

Jun 10, 2013

(Setup routing and iptables for new VPN connection to redirect **only** ports 80 and 443) Only my goal is a bit different. I am running a headless gui-less install of Ubuntu Server 12.04 that is being used for a variety of different purposes... I would like all traffic to travel un-prohibited through my ISP except for my transmission traffic. I have a VPN i subscribe to that allows me access for which I only want to direct a single port's traffic to. I am currently using a modified version of the code from the above link. My current code is below:

#!/bin/sh
sleep 200
DEV1=eth0

[Code].....

View 1 Replies View Related

Cisco VPN :: Ipsec Tunnel Between Two 881

Oct 19, 2011

- Ipsec tunnell between two 881's
- An Aruba access point trying to set up a tunnell back to controller through the ipsec tunnell, on udp 4500
- Even though traffic shouldn't be NAT'ed (and other traffic is not), udp 4500 is NAT'ed
 
I guess this might be default behaviour, thing is that it used to work when it was set up as a route based easy vpn.

View 1 Replies View Related

Cisco :: How To Create Ipsec Tunnel

May 4, 2011

how to create ip sec tunnel using these parameters. customer ip where tunnel has to be connected 1.1.1.1

ISAKMP Parameters: (Phase I)
Encryption: AES-256 or 3DES
Authentication Mode: Pre-shared key

[Code]......

View 4 Replies View Related

Cisco :: IPsec VPN Tunnel Between 2820 And 871?

Mar 9, 2011

We have a Cisco 2820 that serves as a hub and our spokes are Cisco 871s. Its been working for a while and for some reason last week. Http and https traffic over the tunnel is having connection issues. I can Remote desktop or PCanywhere into the remote PCs. From that PC I can ping internal IP address or IP of the webmail server or internal webserver with no issue. But if I access it over the browser it times out or it will work and stop working again. Basically ica, icmp, pcanythere, rdp traffic works over the tunnel but not http or https.

View 2 Replies View Related

Cisco VPN :: Force Use Of NAT-T On IPSEC L2L Tunnel

May 4, 2011

can I force an IPSEC L2L tunnel to use NAT-T encapsulation no matter what? Automatic detection says none of the endpoints are behind NAT. I know I can disable it by the "crypto map XXX set nat-t-disable" command, but I want the exact opposite.
 
I have a very strange issue where asynchronos routing is making my life as a technician very hard.
 
A side question; Can I do something about an ISP that is policy-base-routing its ESP traffic (and/or translating it)?
 
ASA5505 ===>===>===> ISAKMP traffic ===>===>===> ASA5510
212.178.155.73                                                                 80.62.yyy.xxx (traffic source IP: 212.178.155.73)

[Code].....

View 3 Replies View Related

Cisco VPN :: ASA Or 871 IPSec L2L To SSG-140 - Tunnel Is Up But No Traffic

Aug 8, 2012

i am curently troubleshooting a ipsec l2l VPN between
 
1. ASA 7.2(4) to SSG-140
2. Cisco 871W to SSG-140
 
In both scenario's the tunnel is nicely established, and traffic goes into the tunnel, but nothing comes out. All encap's, but no decap's                    
 
It seems like a routing issue, but we can not find anything on both sites.
 
So maybe i m running into a (known) issue between cisco VPN equipment and the SSG-140?
 
Could it be a proxy-id issue? Cause they configure stuff like 10.1.1.0/24 and i configure 10.1.1.0 0.0.0.255

View 7 Replies View Related

Cisco VPN :: PIX-501 IPSec To Configure Tunnel

Mar 24, 2011

I'm attempting to configure a tunnel on a PIX-501 version 6.3. It's an old device that's due to be replaced soon, but unfortunately we need a tunnel now... I have been using this document as a reference (6211): URL ,The remote end is a sonicwall.
 
The problem seems to be that the pix never sees the interesting traffic for the tunnel, and never tries to initiate a connection. I have enabled crypto ipsec and crypto isakmp debugs, but no data is ever displayed, even when attempting to access a device on the remote side of the tunnel! Someone had tried to set up this device with some tunnels in the past, but was never successful, so I'm thinking there might be remaining commands in the running-config causing problems.

View 7 Replies View Related

Cisco VPN :: 887 - Static NAT With IPSec Tunnel

Oct 29, 2012

configuring some static NAT entries on a remote site 887 router which also has a IPSec tunnel configured back to our main office. 
 
I have been asked to configure some mobile phone "boost" boxes, which will take a mobile phone and send the traffic over the Internet - this is required because of the poor signal at the branch.  These boxes connect via Ethernet to the local network and need a direct connection to the Internet and also certain UDP and TCP ports opening up.
 
There is only one local subnet on site and the ACL for the crypto map dictates that all traffic from this network to our head office go over the tunnel.  What I wanted to do was create another vlan, give this a different subnet.  Assign these mobile boost boxes DHCP reservations (there is no interface to them so they cannot be configured) and then allow them to break out to the Internet locally rather than send the traffic back to our head office and have to open up ports on our main ASA firewall. 
 
[URL]
 
So I went ahead and created a separate vlan and DHCP reservation and then also followed the guidelines outlined above about using a route-map to stop the traffic being sent down the tunnel and then configured static NAT statements for each of the four ports these boost boxes need to work.  I configure the ip nat inside/outside on the relevant ports (vlan 3 for inside, dialer 1 for outside) The configuration can be seen below for the NAT part;
 
! Denies vpn interesting traffic but permits all otherip access-list extended NAT-Trafficdeny ip 172.19.191.0 0.0.0.255 172.16.0.0 0.3.255.255deny ip 172.19.191.0 0.0.0.255 10.0.0.0 0.255.255.255deny ip 172.19.191.0 0.0.0.255 192.168.128.0

[Code].....

View 1 Replies View Related

Cisco VPN :: ASA 5510 - Set Up Domain Specific DNS?

Feb 17, 2013

Is it possible to set up a domain specific DNS on an ASA 5510?The problem I am having is that while the site to site VPN is up the DNS servers on the main site are serving ip addresses for the remote site. Main site is on CBeyond and remote is on Time Warner so when doing an nslookup at the remote site it returns one IP address and when the remote site uses google DNS servers it returns another. The main difference being download speed (weird that it relates) as using main site DNS it was 3 hours and google DNS it took 10 minutes. I am looking for a way to serve DNS for the main site domains and for all public domains use google DNS or Time Warner DNS.

View 3 Replies View Related

Cisco :: L2L IPSec Tunnel - ASA To 3800 Router

Mar 3, 2011

I have been struggling for a few days with getting site-to-site traffic working across a L2L IPSec tunnel. At this point, I have the tunnel up, and I see packets being decrypted on the correct IPSec SA's when I ping from a local network computer on the ASA side to a local network computer on the router side. I cannot ping from one side to the other, but those packets are getting through. We have another L2L tunnel that is from that ASA to another remote site's ASA, and that is functional. I have mirrored the configuration for ACLs, etc. from that site, so I believe that the issue is with the packets getting incorrectly translated by the NAT/NONAT statements/ACLs on the router side.

View 8 Replies View Related

Cisco :: Reach Second LAN Over Existing IPSec Tunnel?

Nov 28, 2012

since a few days I'm trying to solve a problem. I've successfully established an IPSec tunnel between two local LANs. In the main office I'm working with a ASA5510 CLI 8.4 and a static public IP address. The branches are using different Cisco 8xx routers and dynamic public IP address. The following picture shows the current configuration:As I mentioned an IPSec Tunnel between the main office "Intern"-LAN 192.168.1.0/24 and an outside LAN 10.10.0.0/24 is successfully established. Now there is a new intern "Admin"-LAN 192.168.2.0/24 at the main office. The users from the outside LAN 10.10.0.0/24 need the possibility to reach this new intern "Admin"-LAN.Can I simply route the traffic from 10.10.0.0/24 to 192.168.2.0/24 via the existing IPSec-Tunnel? Or need I a new IPSec tunnel between the outside 10.10.0.0/24 LAN and the new "Admin"-LAN 192.168.2.0/24?

View 5 Replies View Related

Cisco :: DNAT / SNAT After IPSec Tunnel

Aug 24, 2012

I'm going to implement a S-2-S VPN IPSec connection between 2 locations and I've to NAT incomming and outgoing traffic.

View 4 Replies View Related

Cisco WAN :: ASA5510 Routing Through IPSEC Tunnel

May 20, 2013

I have an ASA5510 configuration that I'd like to add to.In this configuration there is a site to site IPSEC VPN tunnel to a remote location.It is tunneling a particular subnet for me and everything is working.In the remote subnet, there is an ASA 5525-x connected on the outside interface. Let's say for argument's sake, the outside IP is 210.0.0.1.On the Inside interface, i've configured 10.240.32.0/24 network.The only static route I have configured on the 5510 is the default gateway that goes to the ISP.I assumed that I have to add: route Outside 10.240.32.0 255.255.255.0 210.0.0.1 1.I did this, but i'm not able to reach the destination 10.240.32.0/24 network. I can't see anything hitting the 5525-x and the only thing I see on the 5510 is the building outbound ICMP and the teardown for the ICMP.

View 6 Replies View Related

Cisco VPN :: How To Establish IPsec Tunnel Using DNS With ASA 5505

Aug 22, 2011

I´m getting a dynamic public IP from my provider and what I´m trying to do is to establish a remote vpn tunnnel using IPSec which I achieve but every time the sessions resets or the ASA 5505 resets I get a new public IP and I need to put the new IP on the remote client so I can establish the vpn... How can I establish an ipsec vpn  using DNS?  For this scenario the remote vpn client is a vpn phone but it could be for any vpn client. 
 
Private IP                       Public IP                                       Private IP
PBX ---- (LAN) ---- ASA 5505 ---( Internet ) --- Remote Site ( Router ) --- (LAN) -- VPN Phone

View 3 Replies View Related

Cisco VPN :: ASA 5505 IPSec Tunnel Not Establishing

May 7, 2012

I have a site to site IPSec tunnel setup and operational but periodically the remote site goes down, because of a somewhat reliable internet connection. The only way to get the tunnel to re-establish is to go to the remote site and simply issue a ping from a workstation on the remote network. We were having this same issue with a Cisco PIX 506E but decided to upgrade the hardware and see if that resolve the issue. It ran for well over a year and our assumtions was that the issue was resolved. I was looking in the direction of the security-association lifetime but if we power cycle the unit, I would expect that it would kill the SA but even after power cycling, the VPN does not come up automatically.

View 1 Replies View Related

Cisco VPN :: 5505 - Permanent IPSec Tunnel Between Two ASA

Nov 18, 2011

I configured an IPSec VPN tunnel between two ASA 5505 firewalls. I would like to make sure that the IPSec tunnel (hence the security association) is permanent and do not drop due to idle condition.

View 2 Replies View Related

Cisco VPN :: 881 / Route Traffic Thru IPSec Tunnel To DMZ

Jun 29, 2011

I need to route traffic to DMZ (and internal) from the branch office thru the IPSec tunnel. How do I manage that with my Cisco 881?

View 1 Replies View Related

Cisco VPN :: ASA5540 / Disable IPSec VPN Tunnel

Mar 29, 2011

I have running more the 30 VPN tunnels on my ASA5540 release 8.3(x).I want to disable one VPN tunnel(temporarily) without removing the configuration either Phase 1 or Phase 2.let me to know the command to disable IPSec VPN tunnel on CLI or ASDM.

View 1 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved