6

I have got an issue where SPOKE 1 and SPOKE 2 cannot communicate with each other. However, SPOKE 1 and SPOKE 2 can communicate with HUB. Please see configuration below for spoke and hub.

SPOKE 1 (Cisco SRST881, v. 12.4)

SPOKE 2 (Cisco 887VA, v.12.4(22r)

HUB (ASA5525, v.8.6(1)2)

** Spoke 1 (Cisco SRST881, v. 12.4) **

crypto ikev2 proposal AES256-192-128-PROPOSAL
 encryption aes-cbc-256 aes-cbc-192 aes-cbc-128
 integrity sha1
 group 2

crypto ikev2 policy IKEv2-Policy
 proposal AES256-192-128-PROPOSAL

crypto ikev2 keyring VPN-KEYS
 peer ASA-DC
  address 200.200.200.1
  pre-shared-key local 12345678
  pre-shared-key remote 12345678

crypto ikev2 profile ASA-DC
 match identity remote address 200.200.200.1 255.255.255.255
 identity local address 50.50.50.1
 authentication local pre-share
 authentication remote pre-share
 keyring VPN-KEYS

crypto ipsec transform-set ESP-AES256-SHA esp-aes 256 esp-sha-hmac

crypto map SPOKE1-ASA 10 ipsec-isakmp
 set peer 200.200.200.1
 set transform-set ESP-AES256-SHA
 set ikev2-profile ASA-DC
 match address SPOKE1-VPN-ACL

interface FastEthernet4
 ip address dhcp
 ip nat outside
 ip virtual-reassembly in
 duplex auto
 speed auto
 crypto map SPOKE1-ASA

interface Vlan1
 ip address 192.168.210.225 255.255.255.224
 ip nat inside
 ip virtual-reassembly in

ip nat inside source list NONAT interface FastEthernet4 overload
ip route 0.0.0.0 0.0.0.0 50.50.50.1

ip access-list extended NONAT
 deny   ip 192.168.210.64 0.0.0.31 172.16.0.0 0.0.255.255
 permit ip 192.168.210.64 0.0.0.31 any

ip access-list extended SPOKE1-VPN-ACL
 permit ip 192.168.210.224 0.0.0.31 172.16.0.0 0.0.255.255
 permit ip 192.168.210.224 0.0.0.31 192.168.210.64 0.0.0.31

** SPOKE 2 (Cisco 887VA, v.12.4(22r) **

crypto ikev2 proposal AES256-192-128-PROPOSAL
 encryption aes-cbc-256 aes-cbc-192 aes-cbc-128
 integrity sha1
 group 2

crypto ikev2 policy IKEv2-Policy
 proposal AES256-192-128-PROPOSAL

crypto ikev2 keyring VPN-KEYS
 peer ASA-DC
  address 200.200.200.1
  pre-shared-key local 12345678
  pre-shared-key remote 12345678

crypto ikev2 profile ASA-DC
 match identity remote address 200.200.200.1 255.255.255.255
 identity local address 100.100.100.1
 authentication local pre-share
 authentication remote pre-share
 keyring VPN-KEYS

crypto ipsec transform-set ESP-AES256-SHA esp-aes 256 esp-sha-hmac

crypto map SPOKE2-ASA 10 ipsec-isakmp
 set peer 200.200.200.1
 set transform-set ESP-AES256-SHA
 set ikev2-profile ASA-DC
 match address SPOKE2-VPN-ACL

interface Vlan1
 ip address 192.168.210.65 255.255.255.224
 ip helper-address 172.16.5.32
 ip nat inside
 ip virtual-reassembly in

interface Dialer1
 ip address negotiated
 ip nat outside
 ip virtual-reassembly in
 encapsulation ppp
 dialer pool 1
 ppp chap hostname [email protected]
 ppp chap password 7 zzzzzzzzz
 crypto map SPOKE2-ASA

ip nat inside source list NONAT interface Dialer1 overload
ip route 0.0.0.0 0.0.0.0 Dialer1

ip access-list extended SPOKE2-VPN-ACL
 permit ip 192.168.210.64 0.0.0.31 172.16.0.0 0.0.255.255
 permit ip 192.168.210.64 0.0.0.31 192.168.210.224 0.0.0.31

ip access-list extended NONAT
 deny   ip 192.168.210.64 0.0.0.31 172.16.0.0 0.0.255.255
 permit ip 192.168.210.64 0.0.0.31 any

** HUB (ASA5525, v.8.6(1)2) **

object network SPOKE1
 subnet 192.168.210.224 255.255.255.224

object network SPOKE2
 subnet 192.168.210.64 255.255.255.224

object-group network INSIDE-SUBNET
 network-object 172.16.0.0 255.255.0.0


access-list VPN-SPOKE1 extended permit ip object-group INSIDE-SUBNET object SPOKE1
access-list VPN-SPOKE1 extended permit ip object SPOKE2 object SPOKE1
access-list VPN-SPOKE2 extended permit ip object-group INSIDE-SUBNET object SPOKE2
access-list VPN-SPOKE2 extended permit ip object SPOKE1 object SPOKE2

nat (inside,outside) source static inside-subnet-source INSIDE-SUBNET destination static SPOKE1 SPOKE1 no-proxy-arp route-lookup
nat (inside,outside) source static inside-subnet-source INSIDE-SUBNET destination static SPOKE2 SPOKE2 no-proxy-arp route-lookup
nat (any,outside) source static inside-subnet-source INSIDE-SUBNET destination static SPOKE1 SPOKE1 no-proxy-arp
nat (any,outside) source static inside-subnet-source INSIDE-SUBNET destination static SPOKE2 SPOKE2 no-proxy-arp

route outside 192.168.210.64 255.255.255.224 200.200.200.1 1
route outside 192.168.210.224 255.255.255.224 200.200.200.1 1

crypto ipsec ikev2 ipsec-proposal AES256-192-128-PROPOSAL
 protocol esp encryption aes-256 aes-192 aes
 protocol esp integrity sha-1

crypto map ASA-VPN-SITE 10 match address VPN-SPOKE1
crypto map ASA-VPN-SITE 10 set peer 50.50.50.1
crypto map ASA-VPN-SITE 20 set ikev2 ipsec-proposal AES256-192-128-PROPOSAL

crypto map ASA-VPN-SITE 20 match address VPN-SPOKE2
crypto map ASA-VPN-SITE 20 set peer 100.100.100.1
crypto map ASA-VPN-SITE 20 set ikev2 ipsec-proposal AES256-192-128-PROPOSAL

tunnel-group 50.50.50.1 type ipsec-l2l
tunnel-group 50.50.50.1 ipsec-attributes
 ikev2 remote-authentication pre-shared-key *****
 ikev2 local-authentication pre-shared-key *****

tunnel-group 100.100.100.1 type ipsec-l2l
tunnel-group 100.100.100.1 ipsec-attributes
 ikev2 remote-authentication pre-shared-key *****
 ikev2 local-authentication pre-shared-key *****

same-security-traffic permit intra-interface

Thanks for the quick reply Brett. Please see the result below.

ciscoasa# packet-tracer input outside icmp 192.168.210.65 8 0 192.168.210.225

Phase: 1 Type: CAPTURE Subtype: Result: ALLOW Config: Additional Information: MAC Access list

Phase: 2 Type: ACCESS-LIST Subtype: Result: ALLOW Config: Implicit Rule Additional Information: MAC Access list

Phase: 3 Type: UN-NAT Subtype: static Result: ALLOW Config: nat (inside,any) source static obj-192.168.0.0-nonat obj-192.168.0.0-nonat destination static obj-192.168.0.0-nonat obj-192.168.0.0-nonat no-proxy-arp Additional Information: NAT divert to egress interface inside Untranslate 192.168.210.225/0 to 192.168.210.225/0

Phase: 4 Type: ACCESS-LIST Subtype: log Result: ALLOW Config: access-group outside in interface outside access-list outside extended permit icmp any any Additional Information:

Phase: 5 Type: IP-OPTIONS Subtype: Result: ALLOW Config: Additional Information:

Phase: 6 Type: INSPECT Subtype: np-inspect Result: ALLOW Config: class-map inspection_default match default-inspection-traffic policy-map global_policy class inspection_default inspect icmp service-policy global_policy global Additional Information:

Phase: 7 Type: INSPECT Subtype: np-inspect Result: ALLOW Config: Additional Information:

Phase: 8 Type: VPN Subtype: ipsec-tunnel-flow Result: ALLOW Config: Additional Information:

Phase: 9 Type: NAT Subtype: rpf-check Result: ALLOW Config: nat (inside,any) source static obj-192.168.0.0-nonat obj-192.168.0.0-nonat destination static obj-192.168.0.0-nonat obj-192.168.0.0-nonat no-proxy-arp Additional Information:

Phase: 10 Type: IP-OPTIONS Subtype: Result: ALLOW Config: Additional Information:

Phase: 11 Type: VPN Subtype: encrypt Result: DROP Config: Additional Information:

Result: input-interface: outside input-status: up input-line-status: up output-interface: inside output-status: up output-line-status: up Action: drop Drop-reason: (acl-drop) Flow is denied by configured rule

Improve this question
4
  • Have you configured a VPN between Spoke1 and Spoke2 directly? IIRC, you can't send a packet across two Cisco VPN tunnels, terminated on the same device, in succession without doing some weird stuff.
    – Todd Wilcox
    Jun 26, 2015 at 12:18
  • I agree w Todd, why not just nail up a tunnel between the spokes?
    – Ronnie Royston
    Jun 27, 2015 at 18:36
  • Thanks for the reply. If possible, could you please explain a bit more about this issue.
    – Rohit Mangotra
    Jul 3, 2015 at 2:40
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Jan 5, 2021 at 2:09

2 Answers 2

Reset to default
2

Your NAT Exemptions on the Spokes are messed up.

First, you have the Spoke 2 address as the source on Spoke 1, and you're missing Spoke 2 altogether:

ip access-list extended NONAT
deny   ip 192.168.210.64 0.0.0.31 172.16.0.0 0.0.255.255
permit ip 192.168.210.64 0.0.0.31 any

You need to have:

ip access-list extended NONAT
deny   ip 192.168.210.224 0.0.0.31 172.16.0.0 0.0.255.255
deny   ip 192.168.210.224 0.0.0.31 192.168.210.64 0.0.0.31
permit ip 192.168.210.224 0.0.0.31 any

And then on Spoke 2 you have the right source, but are just missing an entry for Spoke 1:

ip access-list extended NONAT
deny   ip 192.168.210.64 0.0.0.31 172.16.0.0 0.0.255.255
permit ip 192.168.210.64 0.0.0.31 any

This needs to have the Spoke 1 segment added as shown below:

ip access-list extended NONAT
deny   ip 192.168.210.64 0.0.0.31 172.16.0.0 0.0.255.255
deny   ip 192.168.210.64 0.0.0.31 192.168.210.224 0.0.0.31
permit ip 192.168.210.64 0.0.0.31 any
Improve this answer
4
  • Thanks Brett for your reply. We have tried the configuration you told but it's still not working. I am still not able to ping between Spoke 1 and Spoke 2.Any other suggestions please. Thank you in advance.
    – Rohit Mangotra
    Jul 3, 2015 at 2:42
  • Can you please post the output of 'packet-tracer input outside icmp 192.168.210.65 8 0 192.168.210.225' from the ASA?
    – Brett Lykins
    Jul 3, 2015 at 3:05
  • Hi Brett, Please see the result above. Thank You very much.
    – Rohit Mangotra
    Jul 3, 2015 at 4:05
  • Thanks for all the help. The issue is resolved now. The problem was default NAT in ASA [nat (dmz,any) source static obj-192.168.1.0-nonatdmz obj-192.168.1.0-nonatdmz destination static obj-192.168.201.0-nonatdmz obj-192.168.201.0-nonatdmz no-proxy-arp]. so, we changed the ip address range [10.1.11.x/24, 10.1.12.x/24]of both spoke1 & Spoke 2. After the change its all working now. Thank You Kind Regards Rohit
    – Rohit Mangotra
    Jul 9, 2015 at 4:32
-1

You want a Full Mesh VPN Topology. The documentation is all online. Your best bet is DMVPN but ASA's don't support tunnel interfaces, thus don't support DMVPN.

If you need assistance, contact me :-) . http:rack.pub

http://www.cisco.com/c/en/us/td/docs/security/security_management/cisco_security_manager/security_manager/3-2-2/user/guide/UserGuide/vpchap.html#wp586214

enter image description here

Improve this answer
1
  • what type of person downvotes accurate and valuable information? ...A troll.
    – Ronnie Royston
    May 29, 2016 at 19:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.