4

I’m hopeful that someone can give us a pointer as we are sure it is a very simple error.

We were recently running an IPSec site-to-site VPN using 2 x Cisco ASA 5505s between a UK and US office. Both had ASA 8.4.1. We initially tried an upgrade directly to 9.1.5 but this caused connectivity issues and we rolled back the version and config and did a staged upgrade as per the release notes.

Before the upgrade…

  • US staff in the US who remotely accessed using Anyconnect to the US ASA. They could access things on the UK network. UK staff connect to the UK ASA from home and could access the US network.
  • Devices directly connected to the UK network could access devices on the US network (an appropriate static route via the respective ASA was on each device).

Both devices are now on 9.1.5 but we are seeing problems.

  • UK Anyconnect clients and UK devices can communicate over the VPN (ping, smtp, ssh etc).
  • US Anyconnect clients and US devices can communicate with each other but not with UK devices. The connection simply times out.

I’ve linked the running configs below. Thank you for any pointers than can be provided!

US Range: 192.168.0.0/16
UK Range: 172.16.0.0/16

UK VPN running-config:

!
ASA Version 9.1(5)
!
hostname ukvpn
domain-name inside.testco.com
names
ip local pool vpnips 172.16.200.151-172.16.200.200 mask 255.255.0.0
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
 switchport access vlan 12
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 172.16.254.7 255.255.0.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 29.135.92.8 255.255.254.0
!
interface Vlan12
 management-only
 no forward interface Vlan2
 nameif mgmt
 security-level 100
 ip address 10.0.0.35 255.0.0.0
!
boot system disk0:/asa915-k8.bin
boot system disk0:/asa913-k8.bin
ftp mode passive
clock timezone GMT/BST 0
clock summer-time GMT/BDT recurring last Sun Mar 1:00 last Sun Oct 2:00
dns domain-lookup inside
dns server-group DefaultDNS
 name-server 172.16.254.8
 name-server 192.168.254.111
 domain-name inside.testco.com
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network obj-172.16.0.0
 subnet 172.16.0.0 255.255.0.0
object network obj-192.168.0.0
 subnet 192.168.0.0 255.255.0.0
object network NETWORK_OBJ_172.16.200.128_25
 subnet 172.16.200.128 255.255.255.128
object network obj-45.99.208.8
 host 45.99.208.8
object network obj-172.16.254.8
 host 172.16.254.8
object-group network DM_INLINE_NETWORK_1
 network-object object obj-172.16.0.0
 network-object object obj-192.168.0.0
access-list outside_1_cryptomap extended permit ip 172.16.0.0 255.255.0.0 192.168.0.0 255.255.0.0
access-list outside_1_cryptomap extended permit icmp host 172.16.254.8 host 45.99.208.8
access-list outside_1_cryptomap extended permit ip host 172.16.254.8 host 65.99.209.9
access-list outside_1_cryptomap extended permit icmp host 29.135.92.8 host 192.168.254.111
access-list outside_1_cryptomap extended permit ip host 29.135.92.8 host 192.168.254.111
access-list outside_1_cryptomap extended permit ip 172.16.0.0 255.255.0.0 10.1.2.0 255.255.255.0
access-list outside_1_cryptomap extended permit ip 172.16.0.0 255.255.0.0 10.0.8.0 255.255.252.0
access-list inside_nat0_outbound extended permit ip 172.16.0.0 255.255.0.0 192.168.0.0 255.255.0.0
access-list inside_nat0_outbound extended permit ip 172.16.0.0 255.255.0.0 10.50.0.0 255.255.192.0
access-list inside_nat0_outbound extended permit ip 172.16.0.0 255.255.0.0 10.1.2.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 172.16.0.0 255.255.0.0 10.0.8.0 255.255.252.0
access-list testcostaffvpn_splitTunnelAcl standard permit 172.16.0.0 255.255.0.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.100.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.101.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.102.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.105.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.200.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.254.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 10.50.0.0 255.255.192.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.53.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.54.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.250.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.49.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.50.0 255.255.254.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.52.0 255.255.252.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.56.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.20.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.106.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.60.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 10.1.2.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.140.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.141.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 10.0.8.0 255.255.252.0
access-list inside_access_in extended permit ip any4 any4
access-list inside_access_in extended permit icmp any4 any4
access-list outside_access_in extended permit ip any4 any4
access-list outside_access_in extended permit icmp any4 any4
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu mgmt 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
asdm image disk0:/asdm-733.bin
asdm location 10.0.0.0 255.0.0.0 inside
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,outside) source static any any destination static NETWORK_OBJ_172.16.200.128_25 NETWORK_OBJ_172.16.200.128_25 no-proxy-arp route-lookup description mystery rule
nat (inside,any) source static obj-172.16.0.0 obj-172.16.0.0 destination static DM_INLINE_NETWORK_1 DM_INLINE_NETWORK_1 no-proxy-arp
!
object network obj-172.16.0.0
 nat (inside,outside) dynamic interface
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 29.135.92.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
 webvpn
  url-list value testco
  file-browsing enable
  file-entry enable
  http-proxy enable
  url-entry enable
aaa-server nt protocol nt
aaa-server nt (inside) host 172.16.254.8
 nt-auth-domain-controller dc-uk
aaa-server nt (outside) host 192.168.254.111
 nt-auth-domain-controller dc-us
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec ikev1 transform-set isr-vpn-set esp-des esp-md5-hmac
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set pfs group1
crypto map outside_map 1 set peer 45.99.208.8
crypto map outside_map 1 set ikev1 transform-set ESP-AES-256-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto ca trustpoint ASDM_TrustPoint0
 enrollment self
 subject-name CN=ukvpn
 proxy-ldc-issuer
 crl configure
crypto ca trustpool policy
crypto ca certificate chain ASDM_TrustPoint0
 certificate aafb674d
    <removed>
  quit
crypto isakmp nat-traversal 10
crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
crypto ikev1 enable outside
crypto ikev1 ipsec-over-tcp port 10000
crypto ikev1 policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
vpn-sessiondb max-other-vpn-limit 10
vpn-sessiondb max-anyconnect-premium-or-essentials-limit 25

dhcpd address 172.16.254.100-172.16.254.150 inside
dhcpd dns 172.16.254.8 192.168.254.111 interface inside
dhcpd lease 14400 interface inside
dhcpd domain inside.testco.com interface inside
dhcpd option 3 ip 172.16.254.7 interface inside
dhcpd option 60 ip 172.16.254.11 interface inside
dhcpd enable inside
!
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
ssl trust-point ASDM_TrustPoint0 inside
ssl trust-point ASDM_TrustPoint0 outside
webvpn
 enable inside
 enable outside
 anyconnect-essentials
 anyconnect image disk0:/anyconnect-win-3.1.06079-k9.pkg 1 regex "Windows NT"
 anyconnect image disk0:/anyconnect-macosx-i386-3.1.06079-k9.pkg 2 regex "Intel Mac OS X"
 anyconnect enable
 cache
  disable
group-policy DfltGrpPolicy attributes
 vpn-idle-timeout none
 vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-client ssl-clientless
 password-storage enable
 split-tunnel-network-list value testcostaffvpn_splitTunnelAcl
 webvpn
  hidden-shares visible
  activex-relay disable
  auto-signon allow uri * auth-type all
group-policy testcostaffvpn internal
group-policy testcostaffvpn attributes
 dns-server value 172.16.254.8 192.168.254.111
 vpn-access-hours none
 vpn-simultaneous-logins 4
 vpn-idle-timeout none
 vpn-session-timeout none
 vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-client ssl-clientless
 password-storage enable
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value testcostaffvpn_splitTunnelAcl
 default-domain value inside.testco.com
 split-dns value dfw1.rlocal lon1.rlocal testcopub.com testcopub.co.uk testco.com
 vlan none
 webvpn
  url-list value testco
  filter none
  http-proxy enable
  customization value DfltCustomization
  hidden-shares visible
  file-entry enable
  file-browsing enable
  url-entry enable
  auto-signon allow uri * auth-type all
tunnel-group DefaultWEBVPNGroup general-attributes
 address-pool vpnips
 authentication-server-group nt
 default-group-policy testcostaffvpn
tunnel-group testcostaffvpn type remote-access
tunnel-group testcostaffvpn general-attributes
 address-pool vpnips
 authentication-server-group nt
 default-group-policy testcostaffvpn
tunnel-group testcostaffvpn ipsec-attributes
 ikev1 pre-shared-key <removed>
 isakmp keepalive threshold 30 retry 2
tunnel-group testcostaffvpn ppp-attributes
 no authentication chap
 no authentication ms-chap-v1
 authentication ms-chap-v2
tunnel-group anyconnect type remote-access
tunnel-group anyconnect general-attributes
 address-pool vpnips
 authentication-server-group nt
 default-group-policy testcostaffvpn
tunnel-group 45.99.208.17 type ipsec-l2l
tunnel-group 45.99.208.17 ipsec-attributes
 ikev1 pre-shared-key <removed>
tunnel-group 45.99.208.8 type ipsec-l2l
tunnel-group 45.99.208.8 ipsec-attributes
 ikev1 pre-shared-key <removed>
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect rsh
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc 
  inspect xdmcp
  inspect netbios
  inspect tftp
  inspect ip-options
  inspect icmp
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email [email protected]
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:838a16ab71a9de739edc27076262d7b6
: end

US VPN running-config: 

!
ASA Version 9.1(5)
!
hostname usvpn
domain-name inside.testco.com
names
ip local pool vpnips 192.168.200.151-192.168.200.200 mask 255.255.0.0
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
 switchport access vlan 3
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
 switchport access vlan 12
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.254.107 255.255.0.0
 ospf cost 10
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 45.99.208.8 255.255.255.224
 ospf cost 10
!
boot system disk0:/asa915-k8.bin
boot system disk0:/asa913-k8.bin
ftp mode passive
clock timezone CST -6
clock summer-time CDT recurring
dns domain-lookup inside
dns server-group DefaultDNS
 name-server 192.168.254.111
 name-server 172.16.254.8
 domain-name inside.testco.com
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network obj-192.168.0.0
 subnet 192.168.0.0 255.255.0.0
object network obj-172.16.0.0
 subnet 172.16.0.0 255.255.0.0
object network obj-192.168.200.192
 subnet 192.168.200.192 255.255.255.224
object network NETWORK_OBJ_192.168.254.128_25
 subnet 192.168.254.128 255.255.255.128
object network obj-29.135.92.8
 host 29.135.92.8
object network obj-192.168.254.111
 host 192.168.254.111
object network obj-192.168.254.200
 host 192.168.254.200
object network obj-10.1.2.0
 subnet 10.1.2.0 255.255.255.0
object network obj-10.0.250.0
 subnet 10.0.250.0 255.255.255.0
object network obj-10.0.0.0
 subnet 10.0.0.0 255.0.0.0
 description http://www.cisco.com/en/US/docs/security/asa/asa83/upgrading/migrating.html#wp97481
object network intra
object-group network DM_INLINE_NETWORK_1
 network-object object obj-172.16.0.0
 network-object object obj-192.168.0.0
 network-object object obj-10.1.2.0
 network-object object obj-10.0.250.0
 network-object object obj-10.0.0.0
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.0.0 172.16.0.0 255.255.0.0
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.0.0 10.50.0.0 255.255.192.0
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.0.0 10.0.250.0 255.255.255.0
access-list outside_1_cryptomap extended permit ip 192.168.0.0 255.255.0.0 172.16.0.0 255.255.0.0
access-list outside_1_cryptomap extended permit icmp host 45.99.208.8 host 172.16.254.8
access-list outside_1_cryptomap extended permit ip host 45.99.208.8 host 172.16.254.8
access-list outside_1_cryptomap extended permit icmp host 192.168.254.111 host 29.135.92.8
access-list outside_1_cryptomap extended permit ip host 192.168.254.111 host 29.135.92.8
access-list outside_1_cryptomap extended permit ip 192.168.0.0 255.255.0.0 10.1.2.0 255.255.255.0
access-list outside_1_cryptomap extended permit ip 192.168.0.0 255.255.0.0 10.0.250.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 172.16.0.0 255.255.0.0
access-list testcostaffvpn_splitTunnelAcl standard permit 10.50.0.0 255.255.192.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.100.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.101.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.102.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.105.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.200.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.254.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.53.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.54.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.250.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.20.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.49.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.50.0 255.255.254.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.52.0 255.255.252.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.56.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.106.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.60.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 10.1.2.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.140.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 10.0.8.0 255.255.252.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.55.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 10.0.16.0 255.255.252.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.253.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.141.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.23.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 10.0.0.0 255.255.252.0
access-list testcostaffvpn_splitTunnelAcl standard permit 10.0.24.0 255.255.252.0
access-list testcostaffvpn_splitTunnelAcl standard permit 10.0.32.0 255.255.252.0
access-list testcostaffvpn_splitTunnelAcl standard permit 10.0.250.0 255.255.255.0
access-list inside_access_in extended permit ip any4 any4
access-list inside_access_in extended permit icmp any4 any4
access-list outside_access_in extended permit ip any4 any4
access-list outside_access_in extended permit icmp any4 any4
pager lines 24
logging enable
logging console warnings
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-733.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,any) source static DM_INLINE_NETWORK_1 DM_INLINE_NETWORK_1 destination static DM_INLINE_NETWORK_1 DM_INLINE_NETWORK_1 no-proxy-arp
!
object network obj-192.168.0.0
 nat (inside,outside) dynamic interface
object network obj-10.0.0.0
 nat (inside,outside) dynamic interface
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 45.99.208.1 1
route inside 10.0.0.0 255.0.0.0 192.168.49.3 1
route inside 10.0.0.0 255.255.252.0 192.168.49.3 1
route inside 10.0.8.0 255.255.252.0 192.168.49.3 1
route inside 10.0.16.0 255.255.252.0 192.168.49.3 1
route inside 10.0.24.0 255.255.252.0 192.168.49.3 1
route inside 10.0.32.0 255.255.252.0 192.168.49.3 1
route inside 10.1.2.0 255.255.255.0 192.168.49.3 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
 webvpn
  file-browsing enable
  file-entry enable
  http-proxy enable
  url-entry enable
aaa-server domain protocol nt
aaa-server domain (inside) host 192.168.254.111
 timeout 5
 nt-auth-domain-controller dc-us
aaa-server domain (outside) host 172.16.254.8
 nt-auth-domain-controller dc-uk
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set TRANS_ESP_3DES_SHA mode transport
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set isr-vpn-set esp-des esp-md5-hmac
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-192-SHA ESP-AES-256-SHA ESP-3DES-SHA
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set pfs group1
crypto map outside_map 1 set peer 29.135.92.8
crypto map outside_map 1 set ikev1 transform-set ESP-AES-256-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto ca trustpoint ASDM_TrustPoint0
 enrollment self
 subject-name CN=usvpn
 proxy-ldc-issuer
 crl configure
crypto ca trustpool policy
crypto ca certificate chain ASDM_TrustPoint0
 certificate f8674d
    <removed>
  quit
crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
crypto ikev1 enable outside
crypto ikev1 ipsec-over-tcp port 10000
crypto ikev1 policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
vpn-sessiondb max-anyconnect-premium-or-essentials-limit 25

dhcpd address 192.168.200.100-192.168.200.150 inside
dhcpd dns 192.168.254.111 172.16.254.8 interface inside
dhcpd lease 14400 interface inside
dhcpd domain inside.testco.com interface inside
dhcpd option 3 ip 192.168.254.107 interface inside
dhcpd option 60 ip 192.168.254.130 interface inside
dhcpd enable inside
!
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
ssl trust-point ASDM_TrustPoint0 inside
ssl trust-point ASDM_TrustPoint0 outside
webvpn
 enable inside
 enable outside
 anyconnect-essentials
 anyconnect image disk0:/anyconnect-dart-win-2.5.6005-k9.pkg 1 regex "Windows NT"
 anyconnect image disk0:/anyconnect-macosx-i386-2.5.6005-k9.pkg 2 regex "Intel Mac OS X"
 anyconnect enable
 tunnel-group-list enable
 cache
  disable
group-policy DfltGrpPolicy attributes
 vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-client ssl-clientless
group-policy GroupPolicy_anyconnect internal
group-policy GroupPolicy_anyconnect attributes
 wins-server none
 dns-server value 192.168.254.111 172.16.254.8
 vpn-tunnel-protocol ssl-client
 default-domain value inside.testco.com
group-policy testcostaffvpn internal
group-policy testcostaffvpn attributes
 wins-server none
 dns-server value 192.168.254.111 172.16.254.8
 vpn-access-hours none
 vpn-simultaneous-logins 2
 vpn-idle-timeout none
 vpn-session-timeout none
 vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-client ssl-clientless
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value testcostaffvpn_splitTunnelAcl
 default-domain value inside.testco.com
 split-dns value dfw1.rlocal lon1.rlocal testcopub.com testcopub.co.uk testco.com
 vlan none
 webvpn
  url-list none
  filter none
  http-proxy enable
  customization value DfltCustomization
  hidden-shares none
  file-entry enable
  file-browsing enable
  url-entry enable
tunnel-group DefaultRAGroup ppp-attributes
 no authentication chap
 no authentication ms-chap-v1
 authentication ms-chap-v2
tunnel-group 29.135.92.8 type ipsec-l2l
tunnel-group 29.135.92.8 ipsec-attributes
 ikev1 pre-shared-key <removed>
tunnel-group testcostaffvpn type remote-access
tunnel-group testcostaffvpn general-attributes
 address-pool vpnips
 authentication-server-group domain
 default-group-policy testcostaffvpn
tunnel-group testcostaffvpn ipsec-attributes
 ikev1 pre-shared-key <removed>
 isakmp keepalive threshold 30 retry 2
tunnel-group testcostaffvpn ppp-attributes
 no authentication chap
 no authentication ms-chap-v1
 authentication ms-chap-v2
tunnel-group anyconnect type remote-access
tunnel-group anyconnect general-attributes
 address-pool vpnips
 authentication-server-group domain
 default-group-policy testcostaffvpn
tunnel-group anyconnect webvpn-attributes
 group-alias anyconnect enable
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect netbios
  inspect tftp
  inspect ip-options
  inspect icmp
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email [email protected]
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
hpm topN enable
Cryptochecksum:d20c924a5c39211877c10cb6e61359fe
: end
Improve this question
2
  • You might want to sanitize those configurations...
    – Panther Modern
    Feb 25, 2015 at 18:17
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 11, 2017 at 4:33

1 Answer 1

Reset to default
1

192.168.0.0/16 is directly connected at US & 172.16.0.0/16 is directly connected at UK. As per the running-config, the site to site tunnels are allowed to pass traffic between 192.168.0.0/16 & 172.16.0.0/16. Also traffic between same security level is permitted. Also you are having manual identity NAT configuration at both firewall. Web-vpn is configured with tunnel-specified split-tunneling and the alternative addresses are permitted. Routing configurations are also correct.

So it should work perfectly.

Can you check below,

  1. route print at the vpn client machine to see whether alternate location destinations are routed through tunnel only.

  2. Connection logs at the firewalls while user trying to connect.

  3. Debug logs to see encryption, decryption happening while trying to connect from vpn client machine.

  4. Since it is 9.X, can you try ping tcp by spoofing the VPN Client IP address as source from one firewall to other firewall destination?

Example

From UK Firewall try this,

ping tcp 192.168.49.3 22 source 172.16.200.152 23423

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.