2

We have two ASA 5585 and ASA 5506 and we're trying to setup an IPsec VPN tunnel between both ASA but getting this error

[SITE-1]--------Internet------------[SITE-2]

I'm getting this error in debug and it's not bringing tunnel up (I am seeing the ACL hit count raising) 

site-2# Dec 13 08:13:47 [IKEv1]Group = 66.XX.XX.33, IP = 66.XX.XX.33, Removing peer from correlator table failed, no match!
Dec 13 08:13:47 [IKEv1]Group = 66.XX.XX.33, IP = 66.XX.XX.33, Session is being torn down. Reason: User Requested

This is SITE-2 config and same config I have on SITE-1 (except different crypto map name and sequence number) 

!
access-list ACL-VPN-SITE-1 extended permit ip any4 object-group NET-SITE-2
!
sysopt connection tcpmss 1379
service sw-reset-button
crypto ipsec ikev1 transform-set VPN-ESP-AES-SHA esp-aes esp-sha-hmac
crypto ipsec security-association replay window-size 128
crypto ipsec security-association pmtu-aging infinite
crypto ipsec df-bit clear-df outside
!
crypto map VPN 5 match address ACL-VPN-SITE-1
crypto map VPN 5 set pfs
crypto map VPN 5 set peer 66.XX.XX.33
crypto map VPN 5 set ikev1 transform-set VPN-ESP-AES-SHA
crypto map VPN 5 set security-association lifetime seconds 3600
crypto map VPN interface outside
!
crypto isakmp identity address
crypto ikev1 enable outside
crypto ikev1 policy 10
 authentication pre-share
 encryption aes
 hash sha
 group 2
 lifetime 28800
!

tunnel-group 66.XX.XX.33 type ipsec-l2l
tunnel-group 66.XX.XX.33 ipsec-attributes
 ikev1 pre-shared-key *****
 isakmp keepalive threshold 10 retry 10
Improve this question
1
  • After increase debug level i found it was ACL does not match proxy IDs src:0.0.0.0 dst:10.10.0.0 so i have remove source any4 from VPN and specified both specific source address and it works! but i have multiple LAN IPs so how do i fix that issue?
    – Satish
    Commented Dec 13, 2017 at 21:15

1 Answer 1

Reset to default
4

With access-list ACL-VPN-SITE-1, you can have mullple lines for different subnets at Site-1.

If you would like to have a single-line access-list, you need to put all subnets (for VPN traffic) at Site-1 under one object-group (for example: object-group NET-SITE-1), then your access-list ACL-VPN-SITE-1 would be:

access-list ACL-VPN-SITE-1 extended permit ip object-group NET-SITE-1 object-group NET-SITE-2

You will need to mirror these rules at the other Site.

Improve this answer
5
  • I believe if you add Multiple ACL then either one will work both won't work because because every ACL associated with single sa security association, I think there is some config which i didn't recall to allow multiple sa over any any ACL
    – Satish
    Commented Dec 14, 2017 at 16:33
  • @Satish That is the problem you have with AWS VPN tunnel you asked before :), but it is because S2S with AWS is different. As I said, you can try either way I suggested. However, single-line ACL as access-list ACL-VPN-SITE-1 extended permit ip object-group NET-SITE-1 object-group NET-SITE-2 is preffered. Try and see the results.
    – Hung Tran
    Commented Dec 14, 2017 at 17:13
  • @Satish Ensure that you mirror this crypto ACL and update the interface ACL and the NAT Exemption statements at both ends. If you test and it still does not, please update your question with the configurations of related object-group, Interface/Crypto ACL and NAT Exemptions...
    – Hung Tran
    Commented Dec 14, 2017 at 17:17
  • I added second ACL for new subnet and it works! and i am seeing two sa in show crypto ipsec sa it seem works! but i am going to do more testing tomorrow to see, i am not missing something.
    – Satish
    Commented Dec 15, 2017 at 0:11
  • @Satish It should work like that. Each SA wll be established for each pair of subnets (local and remote ones) if there is traffic passing between them. Please test further and update us the result.
    – Hung Tran
    Commented Dec 15, 2017 at 19:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.