1

I have some issues regarding my site-to-site vpn konfiguration between two ASA firewalls.. I have two firewalls FW1 and FW2 where FW1 = 192.168.1.0 and FW2 = 192.168.2.0

I used the following template for FW1, and obviously switched the configuration around for FW2. - This worked perfectly! Phase 1 and Phase 2 came up, and i was able to ping each end.

      object network REMOTE_NETWORK
    subnet 192.168.2.0 255.255.255.0
  object network LOCAL_NETWORK
    subnet 192.168.1.0 255.255.255.0
  access-list CRYPTOMAP_ACL line 1 extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0 
  group-policy GroupPolicy_REMOTE_IP internal
  group-policy GroupPolicy_REMOTE_IP attributes
    vpn-tunnel-protocol ikev1
  exit
  tunnel-group REMOTE_IP type ipsec-l2l
  tunnel-group REMOTE_IP general-attributes
  tunnel-group REMOTE_IP ipsec-attributes
    ikev1 pre-shared-key **********

  crypto ikev1 policy 5
    group 5
    encryption aes-256

  crypto ikev1 enable  outside
  crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

  crypto map CRYPTOMAP_NAME 1 match address CRYPTOMAP_ACL
  crypto map CRYPTOMAP_NAME 1 set  peer  REMOTE_PEER_IP
  crypto map CRYPTOMAP_NAME 1 set  ikev1 transform-set  ESP-AES-256-SHA
  crypto map CRYPTOMAP_NAME interface  outside
  nat (inside,outside) 1 source static LOCAL_NETWORK LOCAL_NETWORK destination static REMOTE_NETWORK REMOTE_NETWORK no-proxy-arp route-lookup

I then thought.. What if i have multiple subnets on my LAN that i need to be put through the tunnel.. What if i had three subnets for example.. So i made two network objects called LOCAL_SUBNETS and REMOTE_SUBNETS and put the following in each of them

192.168.1.0/24 192.168.10.0/24 192.168.100.0/24

192.168.2.0/24 192.168.20.0/24 192.168.200.0/24

Changed my crypto ACL to permit ip traffic from the local object group and remote object group, and changed my nat exemption rule to match on the objects rather than the old ip-addresses.. For some reason i cannot get this to work anymore.. Phase 1 is up but i can't ping the other end no matter what i try..

This is the configuration on the same part as previously.. FW2 obviously has the same configuration but with ACL and NAT switched around

    object-group network LOCAL_SUBNETS
network-object 192.168.1.0 255.255.255.0
network-object 192.168.10.0 255.255.255.0
network-object 192.168.100.0 255.255.255.0

object-group network REMOTE_SUBNETS
network-object 192.168.2.0 255.255.255.0
network-object 192.168.20.0 255.255.255.0
network-object 192.168.200.0 255.255.255.0
access-list CRYPTOMAP_ACL extended permit ip object-group LOCAL_SUBNETS object-group REMOTE_SUBNETS 
  group-policy GroupPolicy_REMOTE_IP internal
  group-policy GroupPolicy_REMOTE_IP attributes
    vpn-tunnel-protocol ikev1
  exit
  tunnel-group REMOTE_IP type ipsec-l2l
  tunnel-group REMOTE_IP general-attributes
  tunnel-group REMOTE_IP ipsec-attributes
    ikev1 pre-shared-key **********

  crypto ikev1 policy 5
    group 5
    encryption aes-256

  crypto ikev1 enable  outside
  crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

  crypto map CRYPTOMAP_NAME 1 match address CRYPTOMAP_ACL
  crypto map CRYPTOMAP_NAME 1 set  peer  REMOTE_PEER_IP
  crypto map CRYPTOMAP_NAME 1 set  ikev1 transform-set  ESP-AES-256-SHA
  crypto map CRYPTOMAP_NAME interface  outside
  nat (inside,outside) source static LOCAL_SUBNETS LOCAL_SUBNETS destination static REMOTE_SUBNETS REMOTE_SUBNETS no-proxy-arp route-lookup

Can anyone see whats wrong with my configuration?

  • If possible, include the configurations for both FW1 & FW2. Include sh crypto isa. If you have VPN logging configured, most likely logs will be a good source of trouble-shooting. – dareuja Jan 18 '16 at 0:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.