Cisco VPN :: Crypto ACL Asa 5520 Direct All Traffic To Go Over Vpn Tunnel

Feb 14, 2013

we have a L2L-VPN-Tunnel beetween our Headquarter (ASA5520 with Network 10.100.1.0) and a branch office (Cisco1841 with network 10.100.10.0 ). This works fine for years, but now we wish to change the configuration so that ALL traffic from the branch office goes over the vpn-tunnel. My question: How I have to change the crypto acl to reach this. Below the relevant parts of the branch route.

View 6 Replies


ADVERTISEMENT

Cisco Firewall :: ASA 5520 VPN Tunnel Up But Not Traffic

Nov 1, 2012

We just migrated from a single 5510 to a dual (failover)  5520, It seems that everything is working except the remote VPN. We can establish a tunnel and authenticate as local users, (going to LDAP when all is working) but no traffic is passing. I know I am overlooking something but cant see it. [code]

View 12 Replies View Related

Cisco VPN :: 5520 - Tunnel Up But Not Passing Traffic

Jan 15, 2012

I have a site to site tunnel between two 5520 ASAs.  Tunnel is up but when I try to talk to the other side, the implicit deny on the inside interface of the local ASA blocks the traffic.  When I ping, the tunnel comes up but in the logs it says it is blocking icmp from inside to outside.  I have tried the sys opt connection permit-vpn but it is not working.  The traffic is from 5 specific machines within the local sub net that I put in a network object group called Celerra_Replication.

I want to them to be able to talk to 5 machines on the far end of the tunnel in a seperate sub net.  They are in a net wrok object group called GP_Celerra_Replication The ACLs I created for this appear to be created correctly allowing IP from Celerra_replication to GP_Celerra_Replication and the opposite on the other side. 

View 1 Replies View Related

Cisco VPN :: ASA 5520 - Monitor / Trace VPN To VPN Tunnel Traffic?

Sep 7, 2011

I have a two ASA 5520's  and I want to be able to see or monitor the traffic between each tunnel. I am using external addresses but for the sake of this question I will use the following: 1.1.1.1  to 2.2.2.2 .   How can I montior the traffic? 

View 3 Replies View Related

Cisco Firewall :: ASA 5520 8.3 VPN Tunnel Drops Traffic

Aug 23, 2011

We have a 100 Mbps WAN circuit, we have configured an IPsec tunnel between ASA 5520 and Cisco 3845 Router for our DR site replication via Veeam Backup and Replication, it was working fine before, when we established the 3DES tunnel the traffic for certain subnets is dropped after an hour and it stops the replication, although tunnel remains up and we can access the other subnets, as soon as we clear the crypto SA and ISAKMP sessions on the firewall the traffic starts flowing again and then after an hour the traffic is dropped again.So far the testing and differnet configurations we tried are as under.
 
Tried with a different MTU size both on firewall and ESXi servers but nothing happened.Their is no QOS configuration.Checked the utilization on both ends its Noram although their are subsequent 100% spikes on Cisco 3845 but on average it remians at 30-40%.

View 6 Replies View Related

Cisco Firewall :: ASA 5520 With Windows UAG Direct Access In DMZ?

Dec 16, 2010

I'm trying to set up Windows Server UAG for Direct Access in a Testlab. The UAG Server has two network nics. One in my Testdomain (internal) and the other one in a DMZ of our Cisco ASA (external).Our ASA dmz has subnet 192.168.3.x but UAG Direct Access needs public ip adresses.Is there documentation how to configure an ASA 5520 Firewall so i can use my Windows UAG Server with Direct Access?

View 7 Replies View Related

Cisco Routers :: RV042 - How To Direct Traffic Through Specific Wan Port

Aug 1, 2012

I have an RV042. I understand and have created the services I need. The documentation is just not clear on how to direct traffic for these services to a specific wan port.
 
Can this even be done with this router? If so, the how? Use rate control or priority? Does checking a wan port mean that it will only go through that port?

View 4 Replies View Related

Cisco Routers :: RV042 - Direct Browsing Traffic To Only One WAN Port?

Jan 2, 2013

I have a RV042 (firmware 1.3.13.02-tm). Is it possible to configure so traffic from a specific domain (incl. its sub-domains) is directed exclusively to one WAN port?

View 10 Replies View Related

Cisco Firewall :: ASA 5520 / Crypto Errors CTM ERROR / Failed To Allocate X Bytes Of Memory

Oct 9, 2012

I am currently getting a strange error when trying to use and crypto services on our ASA 5520 (8.0.3)Initially I observed that a connected VPN had dropped.Then when I attempted to use ASDM or SSH I was blocked.
 
In the end I opened telnet as a test and this was successful. Syslog also shows that traffic is passing as normal.The only obvious error I can see when observing various debug traces is this;
 
FW02# CTM: rsa session with no priority allocated @ 0xCF1FBBA0
CTM: Session 0xCF1FBBA0 uses a nlite (Nitrox Lite) as its hardware engine
CTM: rsa context allocated for session 0xCF1FBBA0
CTM: rsa session with no priority allocated @ 0xCE7A5EA8

[code]....

View 5 Replies View Related

Cisco WAN :: 7201 Option To Send All Traffic Through GRE Tunnel / L2TPV3 Tunnel

Jan 9, 2011

i have a 7201 router with NPE-G2. i have a design which i have the option to send all the traffic through a GRE tunnel or a L2TPV3 tunnel.which method is more CPU consumption ?

View 1 Replies View Related

Networking :: To Tunnel All Routers Traffic Through SSH Tunnel With WRT300n

Jul 24, 2012

Environment :linksys wrt300n v1.1 which can have ddwrt-mega. Willing to tunnel all lan's outbound traffic through an ssh tunnel.

View 2 Replies View Related

Cisco Firewall :: ASA 5520 - Allow Traffic From DMZ To Internet And Block Traffic?

Apr 29, 2012

I have an ASA 5520 with the below config
 
Gi0/0: outside (Internet)
Gi0/1: inside (Internal users)
Gi0/2: DMZ (web servers, ftp, Mail etc..)
 
I have a SMTP relay deployed on the DMZ for mailing. I have also a mail servers installed in the internal lan,
 
I want to allow trafic from dmz to reach internal lan, and i want normally also allow stmp relay from dmz to reach Internet.
 
How can i block trafic from DMZ to reach Internal Lan (instead of smtp) if the to allow trafic from dmz to internet i must put ANY in the policy?
 
For allowing trafic from DMZ to reach Internet, the policy must be DMZ -----> ANY ----->Services., this policy means DMZ can implicity reach Internal Lan?

View 2 Replies View Related

Cisco VPN :: VTI Tunnel Using ASA 5520

Mar 4, 2013

Can i use at one site  ASA 5520 and another site Router to configure VTI tunnel with OSPF routing?

View 1 Replies View Related

Cisco VPN :: PIX 515 NAT Only Some Traffic In VPN Tunnel?

Nov 15, 2011

Currently I have  users that connect with the Cisco VPN client to our PIX 515e. Our  corporate network is also directly connected to our partners network, sharing common address space. I want to be able allow our VPN users to connect to certain  resources on their network. Since they already have routing for our  address space, can I allow the VPN to only NAT traffic to certain  destination addresses with a local IP address on our network? That way  the partner's network does not have to change any routing since they  would see the source address as a local IP on our network.

View 1 Replies View Related

Cisco VPN :: ASA 5520 How To Assure About Having IKEv2 Tunnel Instead Of SSL

Mar 18, 2012

I've ASA 5520 with 8.4(3) running.I want to set up VPN remote access using following document url...I managed to get a connection running, but when I check the connection on the ASA, it shows as a SSL-tunnel, not an IKEv2 tunnel.How can I assure I have an IKEv2 tunnel instead of a SSL tunnel ?Can I do with annyconnect same kind of connections I used to do with the Cisco VPN client for IPSEC?

View 4 Replies View Related

Cisco VPN :: Establish Tunnel From Client To ASA 5520

Oct 2, 2012

I have remote branches that connect to the corporate office as a site-to-site VPN. Now the clients at the branch are getting an application that is using an unsecured port (tcp/23). I would like to use a set of ASA 5520's that I have at the corporate office, with the AnyConnect license on them. I want the client machines to establish a tunnel from the client to one of these ASA's. The ASA' then would have a connection to the VLAN that the receiving server is housed on. The trick is to just establish the tunnel from the client to the ASA that will allow the IP of the client to not be translated. So I would use the ASA as a security 'pass-through' for the clients that use this new application.

View 1 Replies View Related

Cisco VPN :: ASA 5520 - Tunnel Up But Can't Access LAN For Each Side

Nov 1, 2012

i have configured site to site VPN between asa 5520.

Site A (192.168.56.0/24)------ASA5520------Internet--------- ASA5520-------Site B ( 192.168.255.0/24)
 
VPN tunnel is up but i cant access LAN for each side. config Site A 

host name CCASA 
name 192.168.255.0 CCNetwork
dns-guard interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 41.41.38.156 255.255.255.248
[code]...

View 5 Replies View Related

Cisco WAN :: 871 / 5520 - L2L IPSec Tunnel Between Two Routers

Apr 4, 2011

Here is the situation: A CISCO871 router is configured to establish an IP SEC tunnel with a CISCO ASA5520. The configuration is OK about that. I wish to configure the same CISCO871 in order to establish a LAN-to-LAN IP sec Tunnel with another CISCO871 at the same time in order to reach private network. So, I have followed the Cisco procedure Document ID: 71462 "LAN-to-LAN IP sec Tunnel Between Two Routers Configuration Example"; it works, I can reach the peer private network BUT ONLY when the IP SEC tunnel with ASA is not established.
 
It seems to be a routing problem...I don't find how to configure to make both tunnels up and functional at the same time.

View 1 Replies View Related

Cisco :: No Traffic Gre Tunnel 2901

Nov 6, 2012

I try to make a gre tunnel with 2 cisco routers 2901, ping responds between tunnel ip's ends, but I don't have pings from the pc's inside the networks. [code]

View 7 Replies View Related

Cisco VPN :: 2821 - Nat Web Traffic From Tunnel

Jan 23, 2012

i have 2 routers, 2821 and 2811. they are connected via GRE over IPsec, and all of the traffic from 2821 is being routed to 2811 with a default route to its tunnel interface. 2821 needs to access internet through 2811 valid ip address, my question is that how should i nat the traffic on 2811 so that 2821 can access the internet?

View 1 Replies View Related

Cisco VPN :: No Traffic GRE Tunnel 2901

Nov 5, 2012

I try to make a gre tunnel with 2 cisco routers 2901, ping responds between tunnel ip's ends, but I don't have pings from the pc's inside the networks.
 
[code]....

View 5 Replies View Related

Cisco VPN :: ASA Or 871 IPSec L2L To SSG-140 - Tunnel Is Up But No Traffic

Aug 8, 2012

i am curently troubleshooting a ipsec l2l VPN between
 
1. ASA 7.2(4) to SSG-140
2. Cisco 871W to SSG-140
 
In both scenario's the tunnel is nicely established, and traffic goes into the tunnel, but nothing comes out. All encap's, but no decap's                    
 
It seems like a routing issue, but we can not find anything on both sites.
 
So maybe i m running into a (known) issue between cisco VPN equipment and the SSG-140?
 
Could it be a proxy-id issue? Cause they configure stuff like 10.1.1.0/24 and i configure 10.1.1.0 0.0.0.255

View 7 Replies View Related

Tunnel All TCP Traffic To UDP Under Port 137?

Mar 13, 2012

is it possible to tunnel all TCP traffic to UDP under port 137?

View 1 Replies View Related

Cisco VPN :: ASA 5520 8.4(3) Tunnel Default Gateway And Various Subnets

Apr 9, 2012

I am struggling on a problem for over 2 weeks despite of various researches.
 
We have a Cisco router, then an ASA 5520 8.4(3).
The private interface of the ASA is connected to a switch, and so on connected to one interface of the router.
The private interface is as following : 129.88.63.253 255.255.248.0 (/21) =>
It is in the 129.88.56.0/21 subnet
 
Here is the part of the router config we are interested in  :
!
interface Vlan32
ip address 129.88.63.254 255.255.248.0 (this is the tunnel default gateway configured on the ASA - 129.88.56.0/21 subnet)
ip address 129.88.71.254 255.255.255.0 secondary
ip address 129.88.75.254 255.255.252.0 secondary
ip access-group CVPN-depuis-129.88.56 in
ip access-group CVPN-vers-129.88.56 out
ip verify unicast source reachable-via rx allow-default
no ip redirects
mls rp ip
!
 
On the ASA, there is currently one default route for the tunneled traffic :
route Private 0.0.0.0 0.0.0.0 129.88.63.254 tunneled
As you can see, it's on the same subnet as the primary IP address of interface Vlan32 on the router.
 
The scenario is as following :
- we can connect to the VPN with the appropriate alias (LDAP connection), then we get an IP address in the defined range (it's a local ASA pool)
- the pool is : 129.88.71.0/24
- but, once we are connected, we can't do anything, because it seems like we don't have any network access

View 9 Replies View Related

Cisco VPN :: VPN Tunnel Between ASA 5520 And Juniper Tears Down Intermittently

Feb 13, 2013

VPN tunnel between ASA 5520 ver 8.0(4) and a remote Juniper firewall keep tearing down during Phase 1 rekeying.  After the rekeying process fails, manually pinging one of the remote hosts that are proteced behind the Juniper firewall,initates the tunnel renegoation and rebuilds the tunnel successfully.
 
When the tunnel is down,  sh crypto isakmp sa shows no active SA for the remote peer.  That indicates the PHASE 1 negotation had indeed failed.When the tunnel is working, sh crypto isakmp sa indicates an IKE role of Responder - always.Clearly that also means Phase 1 negotation works only one way, i.e. negotation initated by the remote Juniper unit only.
  
Interestingly, the Syslog server logged the following SNMP trap messages at the time rekeying Phase1.Note, Line#2 and #7 and wrapped to the next line for easy of reading.
  
Line#1:   IP = Remote-Peer-IP-#, Starting phase 1 rekey
Line#2:   IP = Remote-Peer-IP-#, IKE Initiator: Rekeying Phase 1, Intf outside,
IKE Peer Remote-Peer-IP-# local Proxy Address N/A, remote Proxy Address N/A,  Crypto map (N/A)
Line#3:   IP = Remote-Peer-IP-#, constructing ISAKMP SA payload

[code]...
 
As I understand from the above syslog trap, the Responder ( the ASA unit this time) started Phase 1 rekey (Line #1).  It prepare a message to be sent to IKE Initiator, that it is about to start rekeying Phase 1 (Line #2). Down on the next line, it indicated that the local Proxy, remote Proxy and Crypto map as N/A ( not avaiable).Why would the ASA unit send N/A message as shown in Line#2, is that normal?

View 3 Replies View Related

Cisco VPN :: 5520 Feature That Allow To Have Backup VPN Tunnel On At Secondary ISP

Oct 8, 2011

My question is very simple is there any way or feature that could allow us to have a backup VPN tunnel on at the secondary ISP at the asa 5520? Lets assume if the primary isp goes down is there any way for  the VPN tunnel come online at the backup isp ? [code]

View 2 Replies View Related

Cisco Firewall :: 5520 - VPN Tunnel Not Working Properly?

Jan 11, 2012

I am getting the below  messages in my cisco asa 5520, during this time tunnel is down. just what to check whether the problem is at remote FW or with asa

[code]...

View 4 Replies View Related

Cisco Firewall :: 5520 - Remote Access VPN Through A Tunnel?

Oct 17, 2011

I have a site to site VPN between SiteA to SiteB which is working fine. SiteA has an ASA5520 and SiteB Pix501. The ASA5520 is running version 804 with split tunneling. Users connect to SiteA using remote access VPN. Is it possible to setup SiteA ASA5520 so that when users connect to SiteA they can access servers located on SiteB through the tunnel? I know i can setup the Pix501 for remote access VPN but it is located in another country and i don't want to take a chance just incase i lose connectivity.

View 7 Replies View Related

Cisco Firewall :: 5520 - SSH Socks Tunnel Set Up On Server

Jul 18, 2012

I have the following setup 
|| Socks Server || >> Switch1 >> ||Cisco 5520 ASA || -->> | Switch 2| -->> Clients
 
I have a SSH SOCKS tunnel set up on the socks server which is a Linux box. When I connect my machine to the switch 2, I am NOT able to receive and mail by setting up a mail client and it seems SOCKS traffic does not reach the socks server. I can however run a telnet command on port 1080 (socks port) which connects  which shows that the port was going through and open. However there was no SOCKS traffic. When I connected the machine to Switch 1, SOCKS traffic worked as expected and I was able to receive mail.

This suggests to me that the ASA has some inherent rule that does not allow SOCKS traffic. IS this true and if so how can I bypass this?

View 4 Replies View Related

Cisco VPN :: Tunnel Between Asa5505 And Fortigate 80c Up But No Traffic

Nov 27, 2011

I have set up an ipsec tunnel between a Cisco ASA 5505 and a Fortigate 80c. The tunnel is set up as I execute pings from inside behind ASA to inside behind FG, however I cannot get connectivity to hosts behind the Fortigate (traffic is allowed through policies configured on the FG). What I noticed in packet tracer is that traffic is dropped at the step 'Vpn lookup' To troubleshoot I have configured a test ('fake') vpn connection through the vpn wizard and get the same result in packet tracer. I run 8.4 software on the ASA and this is part of the relevant config.

View 1 Replies View Related

Cisco VPN :: 7200 - Traffic Is Not Passing Through Tunnel?

Nov 17, 2011

I have set a tunnel between Cisco pix 6.3 and Cisco Router 7200. Show Isakmp sa showing below detail on Pix
 
Total     : 1
Embryonic : 0
dst               src        state     pending     created
xx6.x71.x29.x68   x2.1x7.52.1x1    QM_IDLE         0           0
  
Is tunnel is UP ? Traffice is not going throgh the tunnel . why ?

View 1 Replies View Related

Cisco VPN :: RV042 - Cannot Route Traffic In The Tunnel

Jun 6, 2011

I have a two RV042 VPN Router, I successfully connected the IPSEC tunnel. I cannot route Traffic in the tunnel. See the diagram.
  
MAIN Network 
10.252.x.x 
--------------> 
FIREWALL                       
a.a.a.1                                                   
INTERNET
RV042a     WANa       <<------------------------------->>    WANb    RV042b
 a.a.a.2                                                                            b.b.b.b 
   
In this manner the network of b.b.b.b wil connect to the Main Network 10.252.x.x, unfortunately I can't pass traffic to RV042b going to RV042a. Everytime I trace the route, the traffic goes outside the Internet not to RV042a.

View 1 Replies View Related

Cisco VPN :: No Traffic Over Tunnel Between ASA 5505 And 5510

Dec 5, 2010

I've a asa 5510 on the main site and different ASA 5505 on secundary sites for VPN tunneling between the sites. The problem is that the tunnels are acomplished but no traffic is going over them. What am i doing wrong? For the moment there is a ASA 5505 on the main site managing the tunnels but I want the 5510 to take over the job.

View 5 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved