we built a VPN between partner's Cisco ASA (unknown version) and my Juniper SRX 340.
The tunnel seems to go up properly:
root@fw01> show security ike security-associations
node0:
--------------------------------------------------------------------------
Index State Initiator cookie Responder cookie Mode Remote Address
871021 UP 122b1bc303e78c95 59463a0410c30855 Main 10.20.30.40
{primary:node0}
root@fw01> show security ipsec security-associations
node0:
--------------------------------------------------------------------------
Total active tunnels: 2
ID Algorithm SPI Life:sec/kb Mon lsys Port Gateway
<67108877 ESP:3des/md5 31c1eaf2 3402/ 4608000 - root 500 10.20.30.40
>67108877 ESP:3des/md5 9acb5daf 3402/ 4608000 - root 500 10.20.30.40
<67108878 ESP:3des/md5 5e4c4071 3462/ 4608000 - root 500 10.20.30.40
>67108878 ESP:3des/md5 2efdc6d8 3462/ 4608000 - root 500 10.20.30.40
{primary:node0}
but there is no way to send traffic over the tunnel (there are 2 subnets /24 from its side and 1 /24 from mine). I did a lot of attemps, but without serious results.
My conf is the following:
ike {
proposal LO-MI_prop {
authentication-method pre-shared-keys;
dh-group group5;
authentication-algorithm sha1;
encryption-algorithm aes-256-cbc;
lifetime-seconds 28800;
}
policy LO-MI_Ike {
mode main;
proposals LO-MI_prop;
pre-shared-key ascii-text "$9$sN4GDQznu0IHqnCu0cSaZGU.P369BRhM8Nb"; ## SECRET-DATA
}
gateway LO-MI_gw {
ike-policy LO-MI_Ike;
address 10.20.30.40;
external-interface reth0.0;
}
}
ipsec {
proposal LO-MI-IPsec_prop {
protocol esp;
authentication-algorithm hmac-md5-96;
encryption-algorithm 3des-cbc;
lifetime-seconds 3600;
}
policy LO-MI-IPsec_policy {
proposals LO-MI-IPsec_prop;
}
vpn LO-MI_VPN {
bind-interface st0.4;
ike {
gateway LO-MI_gw;
ipsec-policy LO-MI-IPsec_policy;
}
traffic-selector term1 {
local-ip 192.168.0.0/24;
remote-ip 192.168.10.0/24;
}
traffic-selector term2 {
local-ip 192.168.0.0/24;
remote-ip 192.168.11.0/24;
}
establish-tunnels immediately;
}
}
routing-options {
static {
route 0.0.0.0/0 next-hop 40.30.20.1;
route 192.168.10.0/24 next-hop st0.4;
route 192.168.11.0/24 next-hop st0.4;
}
auto-export {
disable;
}
}
policies {
from-zone Untrust to-zone Trust {
policy VPN-PARTNER_IN {
match {
source-address VPN-PARTNER;
destination-address addr_192_168_0_0_24;
application any;
}
then {
permit;
}
}
}
from-zone Trust to-zone Untrust {
policy VPN-PARTNER_OUT {
match {
source-address addr_192_168_0_0_24;
destination-address VPN-PARTNER;
application any;
}
then {
permit;
}
}
}
}
security-zone Untrust {
interfaces {
reth0.0;
st0.4;
}
}
Can anyone give me a suggestion?
Thanks in advance to all
UPDATE:
This is the configuration from ASA
crypto map out_map1 1 match address VPN_PARTNER_VB
crypto map out_map1 1 set peer 40.30.20.11
crypto map out_map1 1 set ikev1 transform-set ESP-3DES-MD5
crypto map out_map1 interface out
tunnel-group 40.30.20.11 type ipsec-l2l
tunnel-group 40.30.20.11 ipsec-attributes
ikev1 pre-shared-key *****
...
...
...
access-list VPN_VERTICALBOOKING extended permit ip 192.168.10.0 255.255.255.0 192.168.0.0 255.255.255.0
access-list VPN_VERTICALBOOKING extended permit ip 192.168.11.0 255.255.255.0 192.168.0.0 255.255.255.0
...
...
...
access-list mgmt_access_in extended permit ip 192.168.10.0 255.255.255.0 192.168.0.0 255.255.255.0
access-list dmz_access_in extended permit ip 192.168.11.0 255.255.255.0 192.168.0.0 255.255.255.0
access-list out_access_in extended permit ip 192.168.0.0 255.255.255.0 object-group DM_INLINE_NETWORK_4 <--- this is my network
...
...
...
object-group network DM_INLINE_NETWORK_4
network-object 192.168.10.0 255.255.255.0
network-object 192.168.11.0 255.255.255.0