1

I am trying to setup a site to site VPN tunnel, between two networks, one with a Sophos UTM, the other a Cisco 5515X. The ASA side of the tunnel is configured with a public peer, private address subnet (192.168.71.0) while the Sophos side is compelled to use the same IP address as tunnel peer and host (3.3.3.50 - this is a fake address.) Tunnel is up, I can see traffic passing through it from the Sophos UTM's network, but there is nothing coming back out from the Cisco side. This is my first time having to configure an ASA for this, and I am completely stumped.

Please can someone tell me what I am missing? My Cisco ASA configuration is below. 

crypto ipsec ikev1 transform-set REMOTE_LOCAL esp-3des esp-md5-hmac 
crypto ipsec security-association pmtu-aging infinite
crypto map REMOTE2LOCAL 1 match address REMOTE_to_LOCAL
crypto map REMOTE2LOCAL 1 set pfs 
crypto map REMOTE2LOCAL 1 set peer 3.3.3.50 
crypto map REMOTE2LOCAL 1 set ikev1 transform-set REMOTE_LOCAL
crypto map REMOTE2LOCAL interface outside
crypto ca trustpool policy
crypto ikev1 enable outside
crypto ikev1 policy 10
 authentication pre-share
 encryption 3des
 hash md5
 group 2
 lifetime 86400

crypto ipsec ikev1 transform-set REMOTE_LOCAL esp-3des esp-md5-hmac

object network mgmt71vpn
 subnet 192.168.71.0 255.255.255.0
object network REMOTE.50
 host 3.3.3.50

nat (inside,outside) source static mgmt71vpn mgmt71vpn destination static REMOTE.50 REMOTE.50 no-proxy-arp route-lookup
access-list REMOTE_to_LOCAL extended permit ip object mgmt71vpn object REMOTE.50 
access-list outside_in extended permit ip host 3.3.3.50 192.168.71.0 255.255.255.0
access-group outside_in in interface outside

Thank you!

Improve this question
5
  • If it's coming in as the same address it's peering to there shouldn't be a tunnel at all you'd simply NAT it in. Is there a reason why you're using the peering address as the protected subnet? Are you following this KB on the Sophos side? sophos.com/en-us/support/knowledgebase/115661.aspx
    – Fallacy11
    Commented Mar 14, 2016 at 19:37
  • I'm using the peering address as the protected subnet because I dont want the other side to have access to the internal subnet directly.
    – Unpossible
    Commented Mar 14, 2016 at 19:41
  • PAT that address out to a separate IP address (it can be in the private range) that's not in use instead of the 3.3.3.50. Then make sure on the ASA you have a route pointing to the outside for the private address.
    – Fallacy11
    Commented Mar 14, 2016 at 19:52
  • How do I do that please? First time ASA user here.
    – Unpossible
    Commented Mar 14, 2016 at 19:53
  • Posted below as answer since it won't fit here and it should get you working.
    – Fallacy11
    Commented Mar 14, 2016 at 20:00

1 Answer 1

Reset to default
1

Here's the configuration for the ASA:

route outside 192.168.26.50 255.255.255.255 <default gateway IP address>

crypto ipsec ikev1 transform-set REMOTE_LOCAL esp-3des esp-md5-hmac 
crypto ipsec security-association pmtu-aging infinite
crypto map REMOTE2LOCAL 1 match address REMOTE_to_LOCAL
crypto map REMOTE2LOCAL 1 set pfs 
crypto map REMOTE2LOCAL 1 set peer 3.3.3.50 
crypto map REMOTE2LOCAL 1 set ikev1 transform-set REMOTE_LOCAL
crypto map REMOTE2LOCAL interface outside
crypto ca trustpool policy
crypto ikev1 enable outside
crypto ikev1 policy 10
 authentication pre-share
 encryption 3des
 hash md5
 group 2
 lifetime 86400

crypto ipsec ikev1 transform-set REMOTE_LOCAL esp-3des esp-md5-hmac

object network mgmt71vpn
 subnet 192.168.71.0 255.255.255.0
object network REMOTE.50
 host 192.168.26.50

nat (inside,outside) source static mgmt71vpn mgmt71vpn destination static REMOTE.50 REMOTE.50
access-list REMOTE_to_LOCAL extended permit ip object mgmt71vpn object REMOTE.50 
access-list outside_in extended permit ip host 192.168.26.50 192.168.71.0 255.255.255.0
access-group outside_in in interface outside

Then on the Sophos box NAT your protected subnets to the 192.168.26.50 address when destined to the 192.168.71.0/24 network. Let me know if you have any issues with that or if you need more help.

Improve this answer
3
  • Thanks! I am not totally sure I get it, but would it be better to just use public IPs all round for both peer and host markings, and just NAT incoming traffic ? (I am not sure how I'd do this on the ASA, but I've noticed a lot of organizations we work with demand this kind of VPN setup.)
    – Unpossible
    Commented Mar 15, 2016 at 7:32
  • What this is doing is making it so only connections can be formed outbound without there being an exiting translation in the table (kind of like PAT to the normal internet) Your followup solution would work, It depends on what data your sending, essentially the VPN is used just to encrypt data and ensure you're sending traffic to the proper destination since the tunnel needs to be formed. If whatever application your transferring data between is already encrypted you should just be able to NAT it in and out. Think HTTP vs. HTTPS for that scenario.
    – Fallacy11
    Commented Mar 15, 2016 at 15:38
  • I fixed it. Thanks! The problem was I messed up my vlans. The VPN is running like you defined it, but with the public address instead of 192.168.26.50.
    – Unpossible
    Commented Mar 15, 2016 at 18:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.