Cisco VPN :: Up But Not Routing Over Tunnel (1811 To ASA5520)
Oct 9, 2012
I was recently tasked with adding a redundant internet connection for one of our remote sites. this new connection was to be used as the primary connection for the VPN from the site with the existing one being configured as a failover controlled by an IP SLA tracker on the new interface.
The existing connection uses a PPPoE connection configured under Dialer1 associated with FE0 to connect to our ASA. Duplicating this wasn't an option given the hardware that the second ISP provided. They provided a /29 for use; I configured FE2 using a Vlan interface with a host on that subnet.
I duplicated the connection profiles and tunnel groups on our ASA, changing only the Peer IP. Both interfaces on the 1811 are using the same crypto map.
The new connection seems fine and I can reach other hosts on its subnet from both the router and hosts on the inside of the NAT.
The issue happens when I change the default route to use the new connection.
I'm able to reach internet hosts using the new connection and I can see the VPN being established on the ASA while the VPN from the old connection drops, but I can't get traffic to route over the tunnel.
If I remove the default route that uses the new connection the VPN comes back up on the old connection just fine. There's no problem routing over the VPN when it uses that connection, just the new one.
Relevant config from show run:
!
crypto isakmp policy 10
encr aes 256
[Code].....
View 1 Replies
ADVERTISEMENT
May 31, 2011
Our firewall expert has gone off on long term illness leave and I am trying to pick up the pieces :-(
We have an ASA 5520 (local office) talking to another ASA (remote office) via a VPN Tunnel.
My 1st problem is that I cannot ping from my inside network (local) to the outside interface of my remote ASA.
My 2nd is that I have debug enabled on my rules but am not logging anything.
View 1 Replies
View Related
Jun 26, 2007
I've configured SSL VPN on an 1811 router running 12.4(9) IOS. I'm using the full SSL VPN client and do not want to split tunnel the traffic. I can reach my inside resources just fine, but I can not reach sites on the Internet. I want to tunnel my Internet traffic to the router and then have it hairpin out the same interface.
I've successfully configured this type of hairpinning on an ASA for SSL VPN, but have yet to find a way to do it in IOS.
View 4 Replies
View Related
May 12, 2011
Scenario:
Central Router (WAN: 1.1.1.1) <--> Internet <--> (WAN: Dynamic IP) Branch RouterTunnel 172.31.254.1/26 Tunnel 172.31.254.9/26
Central router is a Cisco 1811 running IOS c181x-advipservicesk9-mz.151-4.M.bin.Branch router is a Cisco 1941 running IOS c1900-universalk9-mz.SPA.151-4.M.bin.
When I do a Ping test directly from the branch to central router over the Internet I have no packet loss:
branch#ping 1.1.1.1 source GigabitEthernet 0/0 repeat 1000Type escape sequence to abort.Sending 1000, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:Packet sent with a source address of 192.168.0.100!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!(...)!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Success rate is 100 percent (1000/1000), round-trip min/avg/max = 40/41/60 msbranch#
When doing a Ping test over the DMVPN tunnel (which is using the WAN IP as source) I see packetloss.
branch#ping 172.31.254.1 source Tunnel 3 repeat 1000Type escape sequence to abort.Sending 1000, 100-byte ICMP Echos to 172.31.254.1, timeout is 2 seconds:Packet sent with a source address of 172.31.254.9!!!!!!!!!!.!!!!!!!!!!.!.!!!!!!.!!!!!..!!!!!!..!!!!!!!!.!!.!!!!!.!!!!!!!!!!!!.!!!!!.!!!.!!!!!!!!!!!..!!!!.!.!.!!!!!.!!!!!!!!!.!..!!!.!.!!!!!.(...)!!!!!!.!!!.!!!!.!!!!.!.!!.!!!!!!!!!!!!!!!.!!.!!!!!!!!!.!!!.!!.!.!!!!!...!!!!!!!!!!..!!!!!!Success rate is 79 percent (795/1000), round-trip min/avg/max = 40/43/568 msbranch#
Central:
interface Tunnel0 description Testing (DMVPN) bandwidth 10000 ip address 172.31.254.1 255.255.255.192 no ip redirects ip mtu 1400 ip nhrp authentication testing ip nhrp map multicast dynamic ip nhrp network-id 1 ip nhrp holdtime 600 ip nhrp redirect ip tcp adjust-mss 1360 no ip split-horizon eigrp 1 tunnel source FastEthernet1 tunnel mode gre multipoint tunnel key 100003 tunnel bandwidth transmit 10000 tunnel bandwidth receive 10000 tunnel protection ipsec profile secure_profile shared
Branch:
interface Tunnel3 description Testing (DMVPN) bandwidth 2000 ip address 172.31.254.9 255.255.255.192 no ip redirects ip mtu 1400 ip nhrp authentication testing ip nhrp map multicast 1.1.1.1 ip nhrp map 172.31.254.1 1.1.1.1 ip nhrp network-id 1 ip nhrp holdtime 300 ip nhrp nhs 172.31.254.1 ip nhrp shortcut ip nhrp redirect ip tcp adjust-mss 1360 no ip split-horizon eigrp 1 delay 1000 tunnel source GigabitEthernet0/0 tunnel mode gre multipoint tunnel key 100003 tunnel bandwidth transmit 2000 tunnel bandwidth receive 2000 tunnel protection ipsec profile secure_profile shared
Crypto parameters on both central and branch routers:
crypto isakmp policy 1 authentication pre-share
crypto ipsec transform-set secure_transform-set esp-3des esp-sha-hmac mode transport
crypto ipsec profile secure_profile set transform-set secure_transform-set
I disabled CEF on both the central and branch routers and no success. The EIGRP neighborship appears to be stable.
View 4 Replies
View Related
Sep 12, 2012
I have implemented a Clientless SSL VPN solution with Smart-Tunnel feature on Cisco ASA 5520, software 8.4(4)1.I have been successful in making Bookmarks which employ Smart-Tunnel feature to avoid content rewritting (if any). And in reality it works fine with some links. However there are some links to an Oracle portal, it doesn't work.I was able to log into the Oracle portal with its username/password. However when i click into a button of the drop-down menu, nothing happens while normally there should be a box appearing. The Oracle portal runs with some Java stuffs which i don't really know as i am not a programming engineer anyway.
View 1 Replies
View Related
Apr 10, 2012
We have an ASA5520 version 8.3(1) We have an existing VPN tunnel between us and our partner site. We need to add a new vlan to our existing VPN tunnel.
Where do we need to add the new vlan to in ASDM interface? Looking through using ASDM, I found 3 places.
Site-to-Site VPN:
1) Connection profiles
2) Advanced > crypto maps
3) ACL Manager
View 5 Replies
View Related
Sep 21, 2011
I am getting the following errow message while trying to create a VPN tunnel between an ASA5520 and a 2921 router. [code]
View 9 Replies
View Related
Jan 25, 2011
We have ASA 5520 running 8.2(3) software and we're trying to make Remote Access VPN (l2tp/ipsec) working from Android. We succeeded in making IPSEC tunnel (ending "Phase 2 completed"), but we cannot make L2TP tunnel working.We're using RADIUS for L2TP authentication, but ASA doesn't even try to check credentials entered by use. The same set of credentials entered on Windows {XP, VISTA, 7, Mobile} works ok. Which debugging options should we turned on?
View 3 Replies
View Related
Feb 10, 2011
My remote VPN device (static IP address) is setup to connect on the ASA5520 DMZ interface.
Peers performing L2L IPsec VPN with pre-shared keys sync-up regardless of which identity mode selected. If I set the router to “crypto isakmp identity address” or “crypto isakmp identity hostname” the ASA still accepts the connection. Also tunnel mode on initiator (router) is set to “TRANSPORT” but negotiates to TUNNEL mode with ASA.
I am able to successfully ping and telnet from a remote device through the router -- ASA5520 VPN tunnel into the HQ hosts so I can see communication is working.Initial ISAKMP negotiation debugs on router (below) shows the differences but the ASA accepts anyway.
-ASA5520 8.0(4) running in router mode
-ASA should only answer, never initiate VPN sessions
-Cisco 2800 router IOS 12.4 Adv Security should always initiate the VPN session.
-Cisco 2800 router does not have option of key-id, only address, hostname and dn.
View 1 Replies
View Related
Sep 13, 2011
I configured ASA5520 and RV042 for site-to-site IPSec VPN tunnel.Tunnel get connected, but no ping, no traffic between both end network.
Network:
=======
192.168.113.0/24----------192.168.113.6 -ASA--------public, static IP address------Cisco 2821--------Internet
192.168.10.0/24-----------192.168.10.1 -RV042-----public, static IP address------Cisco 2821--------Internet
ASA5520 config:
----------------------
name 192.168.10.0 VPN
!
interface GigabitEthernet0/1
nameif NET
security-level 100
ip address 192.168.113.6 255.255.255.0
[code]....
View 5 Replies
View Related
Dec 1, 2011
How can I NAT the same set of four hosts and give them access to two different networks across an IPSEC site-to-site VPN tunnel? I'm using an ASA5520 running 8.04.
I have four hosts say: 10.240.1.1-10.240.1.4
They need access to two different networks:
205.100.150.0
140.175.200.0
I woud like to NAT them as something like:
7.5.210.1
7.5.210.2
7.5.210.3
7.5.210.4
View 1 Replies
View Related
Aug 10, 2011
I cannot get it to work : if interesting traffic comes ffrom the IPSO side, the box would not even try to set up the tunnel. and If it comes fomr the ASA side, the box attempts to do so but it with this strange message : AM_WAIT_MSG2
View 3 Replies
View Related
Jun 14, 2012
I have a site-site VPN tunnel between my location and my remote office. My remote office is changing their ISP, so the VPN GW is getting changed. do i need to create new site-site tunnel again or changing the remote peer VPN GW in my FW is enough? FYI, i have cisco ASA5520 and my remote office has check point UTM-1 edge box.
View 1 Replies
View Related
Aug 21, 2012
Last night I had a crack at setting up PBR on my companies Cisco 1811.Joy, I thought, it's actually working. Alas I was wrong, the addresses were getting translated to our ADSLs external ip address but routed over our EFM.What I want to acheive is to send all HTTP(s) traffic from our workstations over the ADSL (FastEthernet1) whilst all other traffic and VPN goes out over our Bonded ADSL (FastEthernet0). There is also a minor failover in place for traffic routed to the ADSL in the route-map PBR_VLAN1. The servers are on IPs 200, 202, 204 and 240.
Anyway, I have re-written the configuration and xxx'd and x.a/b/c'd all the IP addresses I want to keep secret. Need to make sure that the PBR is correct, and will do what I want it to? I have a very small time-frame to get this correct and I dont want to fudge the bucket so to speak.
View 8 Replies
View Related
Jan 8, 2013
I am trying to get a 1811 to update routes on a 3750x. My static routes are being redistributed to the switch fine, however my connected networks are not My router has Vlan with several subnets attached.
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-FE 2$$ES_LAN$$FW_INSIDE$
ip address xxx.xx.xx7.185 255.255.255.0 secondary
ip address 172.90.0.185 255.255.255.0 secondary
ip address 172.99.0.1 255.255.255.0 secondary
ip address 10.170.10.254 255.255.255.0 secondary
[code]....
A host on the xxx.xx.xx6.0 network cannot ping a host on the 10.10.44.0 network. All ports on the switch and the router are in vlan1
View 3 Replies
View Related
Aug 30, 2012
I have a Cisco 1811 with a 4/port Serial Async/Sync (HWIC 4 A/S) and another 2 port A/S serial wic. My router seems to have a problem reading the 4/port card. I did some research and it looks like there shouldn't be a compatibility issue.
View 7 Replies
View Related
Oct 30, 2012
My question is wrt policy-based routing on my network. Our switch is a 3560G 24PS running Adv Ip Services image. It is connected to an 1841 and an 1811 each with a dual-wan connection . The 3560 defines 6 vlans and we are using PBR to route some vlans via the 1841 and some vlans via the 1811.
From a client on one vlan a traceroute to a client on another vlan goes through the 1811 before being routed back to the 3560. Is it possible to use PBR to detect traffic that is destined for another vlan on the same switch and then route it directly?
View 2 Replies
View Related
Feb 25, 2013
I have manual Cisco 1812 (1811) Integrated Srvice Router Cabling and Installation in front of meI have Cisco 1811 connected to my laptop according to this manualI have Cisco SDM latest version installed on my laptopI have DHCP enabled on my laptopThe problem that my laptop can't get valid IP adreess from the router (see att. laptop_, laptop_2)
Which IP address I have to use in order to get access to router inrerface (see. SDM_1)?
View 3 Replies
View Related
Oct 25, 2012
Recently i atsrt having problems with my cisco router 1811/k9, apparently was booting continiosly when restarted.
After i connected my console i found the problem while booting:
DDR memory test failed. Resetting the router ...
I tried to contact cisco TAC, but i need a reseller contract number to place a ticket, i do not have a resller contract number as my router was bought more than two years ago. I called cisco support and they told me to contact my reseller, my reseller told me to contact cisco so i am in a eternal loop of forwarding phone calls...
View 1 Replies
View Related
Oct 2, 2012
I have Cisco 1811 and Cisco 2960 interconnect with each other by TRUNK link. As time pass i recieving below log on cisco 1811 router.
DTP-5-NONTRUNKPORTON: Port Fa8 has become non-trunk
LINEPROTO-5-UPDOWN: Line protocol on Interface FastEtherne t8, changed state to down
LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan100, changed state to down
LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan200, changed state to down
LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan300, changed state to down
LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan400, changed state to down
View 4 Replies
View Related
Apr 2, 2012
We're in the process of swapping in a new pair of ASA5520s and Catalyst 3750s to support two separate business units. We want Firewall A and Switch A to handle traffic for Org A (VLAN 100). Similarly, firewall B and Switch B should handle traffic for Org B (VLAN200). But we want to be able to fail traffic over in case of firewall or switch failure. Traffic between the two Orgs is being routed at the switch level. [code]
The uplink interface on each switch is currently a routed port with a static address on the uplink subnet. This works fine in a normal state. However, when we fail over one of the firewall contexts to the other chassis, this results in the inability to route internal traffic because the internal interface is now physically connected to a different switch with a different IP port address (obvious in hindsight). The question is, rather than a routed port, what would be the proper way to handle traffic between the switches and firewalls in a failover scenario? If I make the uplink ports into trunks, won't this cause all packets destined for either firewall to hit both both? Seems like that's not the way to go either? [code]
View 0 Replies
View Related
Feb 15, 2012
configuration of NAT on an ASA 5520. On the ASA I have 1 x WAN connection and 1 x Internet Connection as well as the Inside and DMZ. I want to translate traffic from certain subnets on the inside (say 10.1.2.0 255.255.255.0) to an outside address (say 1.2.3.0 255.255.255.0). I'm assuming the ASA using the number after the brackets to distinguish what to translate? So if I had another entry with a '2' after the brackets, any of the '1' entries wouldn't translate to this? I have access-lits inbound on the INSIDE interface, I'm assuming these are applied before any NAT and only items allowed through the access-list are allowed to NAT?
I also have an address I would like to statically NAT with a certain port number, how do I do this? After I've configured this, what are the commands to apply NAT on the interface?
View 9 Replies
View Related
Jun 26, 2011
I can't seem to find where in ASDM (6.4.1), can we configure IGMP forwarding? ASA5520(config-if)# igmp forward interface outside The ASDM doc reference does not seem to be correct pointing to:configuring Stub Multicast Routing
Step 1 In the main ASDM window, choose Configuration > Device Setup > Routing > Multicast > IGMP.
#Step 2 In the Multicast pane, check the Enable Multicast routing check box.
#Step 3 Choose MForwarding.
which generates:
ASA5520(config-if)# mfib forwarding
View 4 Replies
View Related
Apr 17, 2012
We have an ASA5520 running ver 7.0(8), nat-control is disabled. On the "outside" interface we have a closed network which is publicly addressed i.e. no access to Internet. We also have two Vlan interfaces on a trunk connection i.e. "inside" interface (Vlan7) and "dmz" interface (Vlan802). Traffic from the "outside" to "inside" is statically NAT'd such that the public IP is translated to a private IP when accessing the "inside" interface. However, our OSS servers on the "dmz" interface need to be able to receive packets from the public IP addresses on the "outside" . All is okay with the outside to inside traffic and traffic initiated from the OSS servers on the "dmz" to the outside works okay (snmp gets etc) i.e. the servers receive reply packets from the public addresses of the outside devices.
However, traffic that originates on the "outside" interface (snmp traps etc) which is destined for the "dmz" is actually being routed to the "inside" interface and therefore the public source address is being NAT'd by the static NAT command. The access-list "in_on_outside" has relevant entries to allow connectivity from outside to dmz, we have tried a static nat command (outside, dmz) to maintain the public addressing but this made no difference and also a nat exempt. With ########nat-control disabled - do I still need a translation or NAT exempt for the "outside" <> "dmz" traffic flow, if so how should this look ?
View 11 Replies
View Related
Apr 13, 2011
ISP assigned us the following:xxx.yyy.zzz.32/30 as the outside interface network.This means .33 is the next hop, gateway, or default route.This means .34 is the outside interface on the ASA.xxx.yyy.zzz.64/26 as the ip address pool.This means xxx.yyy.zzz.65 to xxx.yyy.zzz.127 is the address pool.xxx.yyy.zzz is identical in all cases.Addresses .35 through .63 are owned by other parties and are not usable to us.The 33-34 setup works using static routing - IPSEC VPN is setup and functioning properly using these addresses.
[ie. Route outside 0.0.0.0 0.0.0.0 xxx.yyy.zzz.33]
After NAT and ACL entries are created to provide altnernate external IP address on the outside interface [ie. static (inside,outside) [external ip] [name] netmask 255.255.255.255 and access-list [name2] extended permit tcp any host [alternate outside ip] eq https], attempting to browse to an internally hosted website from an external IP address results in the following messages in the ASDM log.
6 Apr 14 2011 17:58:51 110003 [redacted external IP Address] 37763 [Internal Website Name] 80 Routing failed to locate next hop for TCP from Outside:[redacted external IP Address]/37763 to Inside:[Internal Website Name]/80
How do I setup routing for this non contiguous address range?
View 4 Replies
View Related
Jan 9, 2011
i have a 7201 router with NPE-G2. i have a design which i have the option to send all the traffic through a GRE tunnel or a L2TPV3 tunnel.which method is more CPU consumption ?
View 1 Replies
View Related
Sep 23, 2012
I'm in process of purchasing a new Cisco routers for our branches that will be used primary to enable IPSec virtual tunnel interfce with "tunnel mode ipsec ipv4". does the default IOS IP Base supports this feature? or i need to purchase DATA license or SECURITY license?
View 4 Replies
View Related
Sep 5, 2012
I have a problem with ip-sec lan to lan tunnel
Location A ASA5505 192.168.100.0/24
Location B ASA5510 192.168.58.0/24
I created a ipsec site to site vpn Also create the nat exempt rule Now i have also a second interface on Location B with subnet 192.168.100.0/24 Now can i access from location a the devices on location b But when i wil connect from location b to location a i get no connection i think that the asa the traffic not send over the ipsec tunnel but it keeps in the asa?
View 2 Replies
View Related
Oct 17, 2012
I am using a Cisco RV110W (Firmware 1.2.09) in a branch and I would like to create a VPN Tunnel to another site that has a Cisco RV042 (firmware v4.2.1.02)
What would be the correct Configuration? the current configuration I am using is
in the RV042 i am using
Check Enable
Local Group Setup
Local Security Gateway Type : IP Only
IP Address : RV042 Pulbic IP address
[Code].....
View 3 Replies
View Related
Feb 20, 2013
Basically, he has an office he's supporting on a contract basis, they have a cable modem uplink. They move very large (100MB or so) EXCEL files to/from a server "somewhere out there"...The place has 19 users on cable modem (presumably commercial level). They're having "severe latency due to all the users". They're also using VOIP (not sure what product, shouldn't really matter)this doesn't pass the sniff test to me- I have 70+ users on 4 T1s and don't have the problems they claim to be having. Suspect they should be doing some packet sniffing to see who's camping on Youtube, but this is not an option....They're adding in a second cable modem line and want to bind both together. I immediately figured they should do QOS, dedicate the mission-critical traffic to 1 line and let it bleed over onto the other and take precedence if necessary. They have a Cisco 1811 router. I haven't messed with those before, but what I am seeing is they are a "fixed-configuration router". Obviously there has to be SOME config changeable- if for nothing other than IP assignment to interface and such. So what does Cisco mean by "fixed-config"? Is this basically a dumbed-down Linksys router?
View 19 Replies
View Related
Jan 8, 2013
I need some help in configuration of Cisco IOS VPN. Basically, we have 2 Cisco 1811 routers in our company. Router 1 - Production router (IP 192.168.x.254)Router 2 - VPN router (IP 192.168.x.251). All machines/servers inside our network has been configured with a default gateway of 192.168.x.254. Hence, all internet traffic will go through the production router.
Now, we want to deploy a new router (i.e. Router 2) which will be solely used for VPN purpose (such as DMVPN, IPsec site to site, VPN client configuration etc). I have configured Router 2 with Cisco VPN client and can connect to this using VPN client application from my home PC. However, once I connect to it, I am not able to ping anything inside this network other than Router 2 IP (192.168.x.251).
Is there anything else that I would need to put into the configuration so that I can ping everything inside the network?
View 4 Replies
View Related
Jul 24, 2012
Environment :linksys wrt300n v1.1 which can have ddwrt-mega. Willing to tunnel all lan's outbound traffic through an ssh tunnel.
View 2 Replies
View Related
Jan 23, 2012
There are a few situations were I'd like to be able to use the locally configured account on a device but still have ACS in place.I want to complete this WITHOUT adding the locally configured account into ACS.I have tried setting the advanced option under Identity for if an account is not found to "Continue" however this causes the account to be allowed as long as a password is typed (any password, as long as its not blank).
View 2 Replies
View Related
