Cisco VPN :: IPSEC VPN Setup On ASA 5510

May 12, 2011

We're in the process of setting up an ASA 5510 as our main VPN appliance.
 
The Outside interface of the 5510 faces our DMZ, the Inside interface sits on our main network.  The 5510 uses radius for authentication going to a server on the same subnet for the authentication.  That works fine.  VPN client can connect to the 5510 and successfully authenticate.  Routes are pass through to the VPN client, no problem.  PC with VPN client can access internet (which is by design, it should use it's own internet connection), but cannot ping/access/trace over the tunnel at all.
 
My hunch is that this is a nat issue - but I am confused as to how the NAT should be configured - I've tried several configurations with no luck.
 
The VPN client is set to pull an ip address from the pool - 192.168.56.10 - 100.  The 5510 is sitting on a separate subnet (50.x/22).  This seems to work on the Cisco 1700 that it will be replacing just fine.  I mirrored routes and ACLs as well onto the new 5510.  No luck.  Client connects, authenticates, pulls an IP address and routes, but can't see anything on the inside of the 5510. 

View 24 Replies


ADVERTISEMENT

Cisco VPN :: 5510 IPSec VPN Map

May 5, 2012

i have started managing a asa 5510 firewall which is already having 10 ipsec tunnels , the problem i am facing is they are configured as "ipsec vpn map"
 
i have attached sample config, i am finding it difficult to understand the parameters used in each tunnel as the configration seems bit complex to me, how it works .

View 9 Replies View Related

Cisco VPN :: 5510 - Context With IPSec VPN

Mar 10, 2011

I need to create a IPSec Site-Site VPN in the Single mode firewall. Is it possible to create the tunnel. I have ASA 5510 Security Plus with Ver 8.3

View 5 Replies View Related

Cisco VPN :: 5510 L2L IPSec VPN Blocks SQL

May 17, 2012

I have an ASA 5510 running 8.4(2) which has a site to site IPSec VPN to a 3rd party who run some form of Checkpoint.  The VPN establishes and allows access to a server in our DMZ on all ports that we have tested (so far HTTP, SSL, RDP, FTP) except for SQL which doesn't even seem to reach the server.  I've got Wireshark running on the DMZ server and if the 3rd party initiates a TCP conversation from their server on any of the working ports to the server I see all of the expected packets arrive with the correct IPs etc (no NAT takes place across the VPN) but when an ODBC client attempts to query the SQL server on our DMZ box the packets do not arrive at the server.  What I can see is the RX byte count on the VPN increasing each time the query is run but definitely no SQL arriving at the server.
 
Also if I revert the ASA back to the old PIX it has replaced with the same VPN config but on version 7.x then it works just fine.

View 16 Replies View Related

Cisco VPN :: How To Use ASA 5510 To Terminate A LAN To LAN IPsec VPN

Aug 6, 2012

We have an ASA 5510 running 8.3 that we need to use to terminate a LAN to LAN IPSEC VPN.
 
Problem is we only have one public address available so have had to configure the link between the ASA and the Internet Router on private addresses.
 
Is it possible to NAT the public address to the inside or outside interface of the ASA and terminate the VPN on that interface?

View 7 Replies View Related

Cisco VPN :: Connect To IPsec On ASA 5510?

Aug 31, 2011

I have been given the following details by a company for us to connec to their IPsec VPN.
  
IP Address                              200.9.21.214
VPN Device Description          Cisco ASA
VPN Device Version           5510
Encryption Domain       10.152.24.10 
Authentication Method                Pre Shared Key
Encryption Scheme                     IKE

[code]....
 
I was going to use VPNC with linux but the company said they do not use remote access. So I tried a draytek vigor 3300v, that as well did not work. Had very bad logging so i couldn't troubleshoot.In the end I have decided to buy the cheapest cisco device that will allow me to connect to this.

View 3 Replies View Related

Cisco VPN :: IPSec Tunnels Between ASA 5510 And 5555

Nov 13, 2012

I have an ASA 5510 running ver 8.0(2) that has (4) Ipsec tunnels going from it to various other locations.  I am having an issue with data transfer speed on only one of the Tunnels.  This tunnel is between the 5510 and the 5555, on that link I am getting a dat transfer rate of a little over 120k a second, whereas if I pull the same set of files from another location I am seeing a transfer rate of 5m per second. 
 
I have verified that it is not a capacity issue on the Internet bandwidth on both locations, and I can pull the same data from the same location to various other locations via Ipsec tunnels, I am only having an issue with a specific tunnel going from the 5510 to the 5555. 
 
Since it is not affecting other tunnels on the 5510 nor is it affecting tunnels on the 5555 going to other locations, I am leaning toward a routing issue within the ISP?  I will say the ISP is taking me a long way around to stay in the same Metropolitan area.

View 1 Replies View Related

Cisco VPN :: ASA 5510 Ipsec Stops Working

Jun 8, 2011

i've an Cisco ASA 5510 with Security Appliance Software Version 8.0(2), in this ASA i've many L2L tunnels to this ASA, anda sometims new tunnels can't connect, the older tunnels still ok and working, yesterday this situation occured again and i've tried to clear all ipsec tunnels and try to reconnect again no one cames up again. At the time of this situation memory usage was about 78% and CPU is was around 5%. I've made a reload without changes and the situation returns to the normality.
 
At the time of the fail i've collect the outpu from debug crypto isakmp 255, the outpu was in the annexed file.

View 1 Replies View Related

Cisco VPN :: IPSec Client Connection Through ASA 5510?

Mar 28, 2013

I've got random connection issue when I try to connect to a VPN gateway through an ASA 5510 (IPSEC client ->ASA 5510->VPN Gateway).
 
When the tunnel is coming up, those two lines appears in the captured traffic on the internal interface :
 
<private internal IP>.500          > <destination IP>.500:  udp 541
<public external IP>.500 > <destination IP>.500:  udp 541
 
When it's not coming up, the port nuimber for the public IP is not 500
 
(private internal IP).500  >  (destination IP).500:  udp 541
(public external IP).442 >  (destination IP).500:  udp 541
 
I don't understand why sometimes the port for the public external IP is 500 and sometimes not.

View 1 Replies View Related

Cisco VPN :: Citrix App Disconnect Over IPSEC In ASA 5510?

Jul 16, 2012

We have built IPSEC VPN over MPLS P2P circuit between Head & Branch office using Cisco ASA 5510. Client systems at Branch office connects to Citrix app at Head office, but it gets disconnect intermittently for all user. if any recommendations/changes required for Citrix App whn passing over IPSEC VPN/ ASA.

View 2 Replies View Related

Cisco VPN :: 5510 - L2TP Over IPSEC Static NAT

May 22, 2013

I have a 5510 that i have configured for L2TP over IPSEC, not using AnyConnect. The first, and most prevelant being, VPN clients are unable to ping/access any of the hosts that are assigned a static NAT from the inside interface to the outside interface.  I was able to circumvent this by adding another static NAT to the public interface for the incoming clients, but this caused intermittent connectivity issues with inside hosts.  The second issue involves DNS.  I have configured two DNS servers, both of which reside on the internal network and are in the split_tunnel ACL for VPN clients, but no clients are using this DNS.  What is the workaround for using split tunneling AND internal DNS servers, if any?
 
i've had two different CCNA's look at this numerous times to no avail.  A ping from a VPN client to any internal host works fine, unless it is one that is NAT'd.  You can see in the config where i added the extra STATIC NAT to try and fix the issue.  And this works perfectly across the tunnel but only intermittenly from the internal 10.1.4.x network. [code]

View 1 Replies View Related

Cisco WAN :: Connection With IPSEC 2811 To ASA 5510

Oct 27, 2011

I have a 2811 that is my HQ router with a 10MB pipe.  I was trying to configure a IPSEC tunnel to connect to my ASA that has access to our companies internal servers on the 10.33. and 172.16.31 network.  I am having a problem getting phase 1 to even come up.  I've looked over the configurations and unless i'm overlooking something I dont see what could be keeping it from at least completing phase 1
 
Below are the configs.
 2811-CFG
 crypto isakmp policy 10
encr 3des
hash md5
[Code] ....

View 6 Replies View Related

Cisco VPN :: IPSec VPN Connection From DMZ Interface ASA 5510?

Oct 11, 2011

I currently have an ASA 5510 setup with Dual homed ISP's and a remote access IPsec VPN setup to terminate at either interface. The first interface is named Outside and the second is simply called Outside-2. When outside the company(such as at home), the VPN client will connect on the Outside-2 interface and work normally. The problem is while testing on our DMZ, the VPN Client will not connect on the Outside-2 interface. It will try that interface fail to connect and then connect to the backup Outside interface. This isn't a huge concern because it still connects, but if we were ever to get rid of one of those connections, it would be nice to reliably test from our DMZ.

View 1 Replies View Related

Cisco VPN :: 5510 IPSEC No Traffic Flow

Jan 18, 2012

I am trying to pass Traffic thru the IPSEC tunnel but it does not work  ([Cisco Router 892] <---> [Cisco ASA 5510] <---> [Cisco Router 892]) The Cisco ASA 5510 doesn't pass traffic  UDP=500 & UDP=4500 ports...

View 1 Replies View Related

Cisco VPN :: 5510 - Establishing IPSEC Behind Another ASA Device

Aug 17, 2011

Attached are the configuration files for the devices in question.  I have a 5510 that belongs to my company and a 5505 that belongs to another company.  The 5505 sits behind the 5510 and is able to connect to the Internet.  My thought was that VPN access should be a trivial pursuit.  I was planning on just giving the admin at the remote office the public IP address that's natted to the 5505 and all would be good. 

View 7 Replies View Related

Cisco Routers :: IPSEC VPN - WRVS4400N To ASA 5510?

Oct 11, 2009

WRVS4400N Version V2.0.0.7.I have been attempting for weeks to connect an IPSEC tunnel between a Cisco ASA 5510 Version 8.0(2) and a WRVS4400N . Phase one seems connect okay, where as phase two always give me the errors below. This as far as I have got, I tried disabling keep alive monitor, the device never attempted phase 2.  I have read endless documentation on both devices and tried almost every combination of setting that I am aware of. The best case scenario answer would be detailed steps on how to setup the IPSEC VPN (linksys) & the site to site VPN (CISCO) as I cannot find any reference material for this combination .

View 6 Replies View Related

Cisco VPN :: Setting Up L2TP / IPsec VPN To ASA 5510

Jun 23, 2011

Co-worker just got a Blackberry Playbook tablet and, try as I might, we cannot get the darn thing to successfully set up a working IPSEC/L2TP vpn tunnel to our ASA 5510, which acts as a multi-purpose VPN concentrator.  Any luck setting up L2TP/IPSEC VPN to ASA from Blackberry Playbook?

View 0 Replies View Related

Cisco VPN :: ASA 5510 / LAN-to-LAN IPsec VPN With Overlapping Networks?

Feb 14, 2012

I'm trying to connect two operlapping networks via IPsec.

Details:Site_A use ASA 5510 with software version 8.0(4)32. Site_A use 10.100.0.0/24, 10.100.1.0/24 and 10.100.2.0/24 inside networks. 10.100.0.0/24 is directly connected to ASA (as vlan10), 10.100.1.0/24 and 10.100.2.0/24 are routed.Site_B use Linux box and networks 10.100.1.0/24, 10.100.2.0/24, 10.100.3.0/24 and so on (basically 10.100.x.0/24). I didn't set up this ASA, we took over this infrastructure without any documentation whatsoever.
 
According to link posted above I should use dual NAT. Site_B will see networks in Site_A as 10.26.0.0/22, and Site_A will see networks in Site_B as 10.25.0.0/24. Site_A is allowed to access only 10.100.1.0/24 in Site_B, and Site_B is allowed to access all 10.100.x.0/24 networks in Site_A - hence /22 mask in 10.26.0.0/22. I'd like to, for example, ssh from host in Site_B to host in Site_A using 10.26.1.222 as destination ip address (and it should be translated to 10.100.1.222 on the Site_A side). I'm looking for something like ip nat type match-host in Cisco routers - I want to translate only network part of the address an leave the host part intact. Anyway, following the steps from the link posted above everything is ok till the command:
 
static (companyname,outside) 10.26.0.0 access-list fake_nat_outbound
 
which results in:
 
WARNING: real-address conflict with existing static
  TCP companyname:10.100.0.6/443 to outside:x.x.x.178/443 netmask 255.255.255.255
WARNING: real-address conflict with existing static
  TCP companyname:10.100.0.20/25 to outside:x.x.x.178/25 netmask 255.255.255.255
WARNING: real-address conflict with existing static

[code]...

View 2 Replies View Related

Cisco LAN :: Debug An Ipsec Tunnel On An ASA 5510 (8.4(3))?

Mar 5, 2012

I'm attempting to debug an ipsec tunnel on an ASA 5510 (8.4(3)) and when I turn on `debug crypto ipsec` and then execute `logging monitor` I get an constant stream of TCP debugging events, is it possible to only view ipsec messages?

View 2 Replies View Related

Cisco VPN :: ASA 5510 - TP IOS IPSec Persistent Connection

Apr 10, 2011

I have created an IPSec VPN between our ASA (5510) and a Cisco Router running IOS.Only problem i have is that the VPN goes down if there's no interesting traffic from the router and i can't find anything to initiate the VPN Tunnel from the ASA (so we need to wait 'till someone connects on the other side).
 
Is there any way to make this connection persistent, just like an ASA-to-ASA tunnel?

View 3 Replies View Related

Cisco VPN :: ASA 5510 - VPN L2TP / IPsec Error 691

Sep 1, 2011

I'm opening a new topic related to my problem with the VPN connection, to avoid confusion, since there are many, in the old information, no longer required.
 
I would like to configure my ASA5510 L2PT/IpSec to accept connections from Windows clients. I happen to authenticate via AD credentials. When I try to connect is because the error 691. I enabled debugging on the machine the following:
 
debug crypto isakmp 3
debug crypto ipsec 3
debug ldap 255

View 4 Replies View Related

Cisco VPN :: Setup Two Separate IPSec VPNs On ASA 5505

May 12, 2013

I'm having trouble setting up a second IPSec VPN tunnel on my Cisco ASA 5505 to another office. I was able to setup the first one with no problem through the ASDM, but have not been able to get the second one up.The IPSec tunnel is connecting to a WRVS4400N router at the other office. I tried debugging crypto isakmp, and crypto ipsec, but I'm getting nothing. Below is the config. Does something look wrong on my end? I also attached a screenshot of the parameters setup on the remote router.

View 7 Replies View Related

Cisco VPN :: How To Setup IPSec Tunnel - 2320 And RVS4000

Aug 6, 2011

I have succesfully config an IPSec VPN Tunnel by using a Router Scientific Atlanta Cisco 2320 and a RVS4000 4-Port Gigabit Security Router with  VPN.On the site of Router Scientific Atlanta Cisco 2320 this is some info: [code] On the site of RVS4000 4-Port Gigabit Security Router with  VPN this is some info: [code] Remember that you can not be on the same range of IP, I mean, you can not have 192.168.0.X if the remote network is on 192.168.0.X, you have to change some of the Routers.I show the configuration on Router Scientific Atlanta Cisco 2320: I show the configuration on RVS4000 4-Port Gigabit Security Router with  VPN:If all is correctly configured, you should see on Router Scientific Atlanta Cisco 2320 the Status Connected:
 
If all is correctly configured, you should see on RVS4000 4-Port Gigabit Security Router with  VPN the Status Up.As you can see, I'm connected to the remote Router (RVS4000 4-Port Gigabit Security Router with  VPN) by my own web browser accesing by the local IP 192.168.0.10.I have used Authentication MD5, maybe is not the best one but I had no time to test SHA1, I will when I will have time.

View 1 Replies View Related

Cisco VPN :: Setup L2L IPSec VPN Between VPN3020 Concentrator And 2811?

Feb 22, 2011

I am trying to setup a L2L IPSec VPN between cisco VPN3020 concentrator and Cisco 2811 something is not working and I don't understand why.I describe my situation in detail my router has 2 interfaces

External interface Fa 0/1 ip 193.P.Q.R
Internal interface Fa 0/0 141.G.H.254 
Lan on internal interface is 141.G.H.0/24

 remote VPN concentrator has 2 interfaces
 
Public interface 131.A.B.C
Private interface 131.A.I.E
 
I have to set up L2L so that host 141.G.H.10 can talk to host 131.A.H.D whici is behind the VPN concentrator my router config:
 
crypto isakmp policy 3 encr 3des hash md5 authentication pre-share group 2crypto isakmp key * address 131.A.B.C!crypto ipsec transform-set presid-set esp-3des esp-md5-hmac !crypto map presid-map 5 ipsec-isakmp set peer 131.A.B.C set transform-set presid-set match address presid!interface FastEthernet0/1 ip address 193.P.Q.R 255.255.255.252 duplex full speed 100 crypto map presid-map!interface FastEthernet0/0 ip address 141.G.H.254 255.255.255.0 duplex auto speed auto!       
 ip access-list extended presid permit ip host 141.G.H.10 host 131.A.H.D
 ip route 0.0.0.0 0.0.0.0 193.P.Q.S 
 
Then I configured VPN3020 accordingly creating a lan to lan profile with the proper IKE proposals ecc ecc when interesting traffic is matched by VPN acl (presid) I see this messages in the VPN concentrator logs:

57101 02/23/2011 15:49:05.310 SEV=4 IKE/119 RPT=4033 193.P.Q.R Group [193.P.Q.R]PHASE 1 COMPLETED 57102 02/23/2011 15:49:05.310 SEV=4 AUTH/22 RPT=3935 193.P.Q.R User [193.P.Q.R] Group [193.P.Q.R] connected, Session Type: IPSec/LAN-to-LAN 57104 02/23/2011 15:49:05.310 SEV=4 AUTH/84 RPT=11 LAN-to-LAN tunnel to headend device 193.P.Q.R connected 57110 02/23/2011 15:49:54.820 SEV=4 IKE/123 RPT=1093 193.P.Q.R Group [193.P.Q.R]IKE lost contact with remote peer, deleting connection (keepalive type: DPD) 57112 02/23/2011 15:49:54.820 SEV=5 IKE/194 RPT=3778 193.P.Q.R Group [193.P.Q.R]Sending IKE Delete With Reason message: Connectivity to Client Lost. 57114 02/23/2011 15:49:54.820 SEV=4 AUTH/23 RPT=14 193.P.Q.R User [193.P.Q.R] Group [193.P.Q.R] disconnected: duration: 0:00:49 57115 02/23/2011 15:49:54.820 SEV=4 AUTH/85 RPT=11 LAN-to-LAN tunnel to headend device 193.P.Q.R disconnected: duration: 0:00:49
  
and from router side I See this with show crypto isakmp sa
 
131.A.B.C   193.P.Q.R  CONF_XAUTH           5    0 ACTIVE
 
but the status got stuck in CONF_XAUTH state and then disconnects?

View 1 Replies View Related

Cisco Firewall :: Setup Of IPSec Passthrough On ASA 5520

Mar 28, 2012

I am working on IPSec Passthrough on an ASA 5520, with version 8.3, and ASDM 6.3. Currently I have a requirement for users in my internal network (10.10.249.128 / 25) to be able to connect to external IPSec VPN servers.
 
So I created a network object with 10.10.249.128 / 25, and used dynamic PAT to translate the source ip address to the external internet facing outside interface:

I then added the following rules on the inside-in ACL: However troubleshooting shows that isakmp is passing through the firewall, but esp and ah is not.
 
For isakmp:
 
For ESP:Seems like the nat rule is drawing my ESP traffic,

View 1 Replies View Related

Cisco VPN :: 5510 - Multiple L2L Ipsec To Same Destination (ip Address)

Jan 23, 2012

im lookin to establish a a multiple L2L ips  tunnels ( one tunnel for each subnet) from my cisco asa 5510 to the same destination. should the cisco asa capable of this ?

View 6 Replies View Related

Cisco VPN :: 5510 - IPSEC Tunnel Won't Attempt Connection

Jul 31, 2012

I have a 5510 and a 5505 that I'm attempting to configure a simple VPN tunnel over. I have tried step by step configurations form CISCO ASA configs, as well as every source I can find. I have walked throught the config with IOS commands as well as Wizards. All my packets are dropped at the the inside or outside interface.
 
When I show SH ISAKMP command all I get are 0's straight down.

View 7 Replies View Related

Cisco Firewall :: 5510 Exporting Netflow Over A IPSEC VPN

Sep 2, 2012

we have a local Netflow collector working fine. We also have a centralised collector that we’d like to use to send the same Netflow data, but it is not being received. We need to send the data via an IPSEC VPN.
 
When I do a 'show flow-export counters' I can see the packets sent increasing. The local collector is receive netflow data. I am using the below config, 

access-list global_mpc extended permit ip any any
!
!IP far end of VPN

[Code].....

View 3 Replies View Related

Cisco Firewall :: 5510 ASA Exporting Netflow Over IPsec Vpn

Nov 29, 2012

we have a Cisco ASA 5510 8.4, this device is reachable through a lan to lan IPsec vpn. We are able to activate the netflow export (we see flow export counters incrementing), but the flow is not passing through the vpn. Our netflow collector is on the other side of the IPsec tunnel so we define it linked to the internet interface.Is the export possible through the vpn? I read in a Solarwinds forum that it should not be possible.What ip address is choosen as source interface by ASA? Is there a way to force a source interface?

View 5 Replies View Related

Cisco Security :: Change Ipsec Vpn To L2tp Over ASA 5510

Nov 14, 2011

i configurated ipsec vpn at cisco asa 5510. all them are working very well. now i want to change ipsec remote vpn to L2tp over ipsec.i have router, asa and 3750 switch. all nat translation are done at router , ipsec vpn configurate at asa.
 
this is my ipsec configuration. this is working config. as you see i do static nat asa outside ip for vpn at router. now i want l2tp over ipsec. before i do it i have some question
 
1. must i do static nat port  udp 1701 for l2tp over ipsec vpn?  can i write access list at asa to open port 1701?

2. can i remove this  static nat or i can not be change anything.is this nat is true for l2tp over ipsec vpn?
 
3.as you see user authentication from radius server at ipsec vpn. i also want this is same as l2tp over ipsec vpn..
 
4. i think that i must be add this addtional config. is this true? tunnel-group DefaultRAGroup ppp-attributesno authentication chapauthentication ms-chap-v2
 
is this config enougth for l2tp over ipsec vpn?? what is addtional config i need?

View 2 Replies View Related

Cisco Firewall :: IPSec Tunnel On Sub-interface On ASA 5510?

Jun 11, 2012

I working on a security solution using ASA firewall. Is it possible to setup a IPSec tunnels  on each subinterface of a physical interface on ASA 5510?

View 3 Replies View Related

Cisco VPN :: ASA 5510 OS 8.03 Change IPSec Tunnel IP Endpoint In CLI

Mar 29, 2012

I have an ipsec tunnel  IP is changing from mythical 200.200.200.182 to 200.200.200.254.  Is it possible to change the .182 ip in  below config via the CLI to .254 and have the site-to-site vpn continue to work? [code]

View 1 Replies View Related

Cisco VPN :: ASA 5510 - Group Policy In IPSEC Remote?

Nov 20, 2012

I have configured ASA 5510 With IPsec Remote VPN.With local database users(Users are created in ASA).
 
Internal network has 4 VLANS. Need solution for below.
 
There are 25 Users created in ASA. where only 5 tp 6 users wants to grant access to Particualr IP and Subnets and rest of the users can access entire lan.
 
Is it possible to configure Group policy in ASA for IPsec Remote VPN.

View 1 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved