5

I have configured a virtual network in azure that is linked back to our on premise Cisco ASA 5505 device. After setting up in Azure, I used the VPN device script which is provided by Microsoft through the Azure portal for our selected device.

Using putty, I logged onto the box using SSH and tried running the script but in the section:

! ACL and NAT rules
! 
! Proper ACL and NAT rules are needed for permitting cross-premise network traffic.
! You should also allow inbound UDP/ESP traffic for the interface which will be used for the IPSec tunnel.
object-group network azure-networks
  network-object 10.100.1.0 255.255.255.0
exit
object-group network onprem-networks
  network-object 172.16.55.0 255.255.255.0
  network-object 172.16.129.0 255.255.255.0
exit
access-list azure-vpn-acl extended permit ip object-group onprem-networks object-group azure-networks
nat (inside,outside) source static onprem-networks onprem-networks destination static azure-networks azure-networks

I encountered an error while trying to enter the final line:

nat (inside,outside) source static onprem-networks onprem-networks destination static azure-networks azure-networks
                             ^
ERROR: % Invalid input detected at '^' marker.

With the marker between s^tatic

While my gateway is showing in the Azure portal as connected, I have 300 Kb of data coming out but no data going in. I have tried pinging from within my local network, but I am experiencing 100% packet loss.

Would the failure of the line above be accounting for this issue? How can I resolve it?

Improve this question
5
  • 3
    What software version are you running on the ASA? NAT syntax changed between version 8.2 and 8.3, which might account for the error.
    – RobinG
    Jun 4, 2015 at 17:44
  • We are on 8.2 so this is most likely the case
    – Jay
    Jun 4, 2015 at 23:42
  • 2
    Then you should add a NAT-Exempt rule for traffic through te VPN. My pre-8.2 CLI skills are a bit rusty, but you can check the Cisco docs for all the details: cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/…. If it is possible, an upgrade to a more recent version of the software would also be a good idea ofcourse.
    – RobinG
    Jun 5, 2015 at 6:40
  • 2
    What I did in this case was grab the config that Microsoft provided and put it in a text document, and then basically re-created it with the correct syntax for the ASA version I was running. It did take some time and knowledge of ASA at the command line. You could attempt to use the same information to set up a VPN in the ASDM or you should have at least some kind of support with your Azure subscription. Nat commands were definitely changed and are now more confusing, that is probably the problem.
    – Todd Wilcox
    Jun 5, 2015 at 17:46
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin ♦
    Jan 5, 2021 at 19:23

1 Answer 1

Reset to default
2

If the syntax is for 8.2, you need to use nat 0, something like:

nat (inside) 0 access-list azure-vpn-acl

This guy has done a fantastic article relating to a PIX 501, but it should work for a 5500 series pre-8.3. I am trying this on a 5510 with 8.2: Create Azure Site-to-Site VPN Solution using Cisco Pix 501

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.