Site to Site VPN error on Cisco ASA5500 and router 1800

Hi Young

Can you post your config files?

cu ivo

On Jan 6, 5:07=A0am, " snipped-for-privacy@ruetsche.com" wrote:

The following is the part of VPN configuration on both end, can you advise me what I have to correct. Thank you.

1. On ASA 5510:

ASA Version 7.2(3) ! hostname asa5510 domain-name test.com enable password Q2REeCxc0Wlu3zej encrypted names name 1.2.3.4 WAN description WAN ! interface Ethernet0/0 description WAN nameif WAN security-level 10 ip address WAN 255.255.255.248 ospf cost 10 ! interface Ethernet0/1 description LAN nameif LAN security-level 90 ip address 192.168.0.50 255.255.255.0 ospf cost 10 ! interface Ethernet0/2 shutdown no nameif no security-level no ip address ! interface Ethernet0/3 shutdown no nameif no security-level no ip address ! interface Management0/0 nameif management security-level 100 ip address 192.168.1.1 255.255.255.0 ospf cost 10 management-only !

same-security-traffic permit inter-interface same-security-traffic permit intra-interface

access-list LAN_nat0_outbound extended permit ip 192.168.0.0

global (WAN) 1 interface nat (LAN) 0 access-list LAN_nat0_outbound nat (LAN) 1 192.168.0.0 255.255.255.0 nat (management) 0 access-list management_nat0_outbound =2E =2E =2E

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec security-association lifetime seconds 86400 crypto dynamic-map LAN_dyn_map 20 set pfs crypto dynamic-map LAN_dyn_map 20 set transform-set ESP-3DES-SHA crypto dynamic-map LAN_dyn_map 20 set security-association lifetime seconds 28800 crypto dynamic-map WAN_dyn_map 20 set pfs crypto dynamic-map WAN_dyn_map 20 set transform-set ESP-3DES-SHA crypto dynamic-map WAN_dyn_map 20 set security-association lifetime seconds 28800 crypto dynamic-map WAN_dyn_map 40 set pfs crypto dynamic-map WAN_dyn_map 40 set transform-set ESP-3DES-SHA crypto dynamic-map WAN_dyn_map 40 set security-association lifetime seconds 28800 crypto dynamic-map WAN_dyn_map 60 set pfs crypto dynamic-map WAN_dyn_map 60 set transform-set ESP-3DES-SHA crypto dynamic-map WAN_dyn_map 60 set security-association lifetime seconds 28800 crypto dynamic-map WAN_dyn_map 80 set pfs crypto dynamic-map WAN_dyn_map 80 set transform-set ESP-3DES-SHA crypto dynamic-map WAN_dyn_map 80 set security-association lifetime seconds 28800 crypto map LAN_map 65535 ipsec-isakmp dynamic LAN_dyn_map crypto map LAN_map interface LAN crypto map WAN_map 1 match address WAN_1_cryptomap crypto map WAN_map 1 set pfs crypto map WAN_map 1 set peer 5.6.7.8 crypto map WAN_map 1 set transform-set ESP-3DES-SHA crypto map WAN_map 65535 ipsec-isakmp dynamic WAN_dyn_map crypto map WAN_map interface WAN

crypto isakmp enable WAN crypto isakmp enable LAN crypto isakmp policy 10 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 crypto isakmp nat-traversal 20 no vpn-addr-assign aaa

group-policy testing internal group-policy testing attributes vpn-tunnel-protocol IPSec split-tunnel-policy tunnelspecified split-tunnel-network-list value testing_splitTunnelAcl group-policy DfltGrpPolicy attributes banner none wins-server none dns-server none dhcp-network-scope none vpn-access-hours none vpn-simultaneous-logins 3 vpn-idle-timeout 30 vpn-session-timeout none vpn-filter none vpn-tunnel-protocol IPSec l2tp-ipsec webvpn password-storage disable ip-comp enable re-xauth enable group-lock none pfs disable ipsec-udp disable ipsec-udp-port 10000 split-tunnel-policy tunnelall split-tunnel-network-list none default-domain none split-dns none intercept-dhcp 255.255.255.255 disable secure-unit-authentication disable user-authentication disable user-authentication-idle-timeout 30 ip-phone-bypass disable leap-bypass disable nem disable backup-servers keep-client-config msie-proxy server none msie-proxy method no-modify msie-proxy except-list none msie-proxy local-bypass disable nac enable nac-sq-period 300 nac-reval-period 36000 nac-default-acl none address-pools value ClientVPN smartcard-removal-disconnect enable client-firewall none client-access-rule none webvpn functions url-entry html-content-filter none homepage none keep-alive-ignore 4 http-comp gzip filter none url-list none customization value DfltCustomization port-forward none port-forward-name value Application Access sso-server none deny-message value Login was successful, but because certain criteria have not been met or due to some specific group policy, you do not have permission to use any of the VPN features. Contact your IT administrator for more information svc none svc keep-installer installed svc keepalive none svc rekey time none svc rekey method none svc dpd-interval client none svc dpd-interval gateway none svc compression deflate

tunnel-group DefaultL2LGroup ipsec-attributes pre-shared-key Test

tunnel-group 5.6.7.8 type ipsec-l2l tunnel-group 5.6.7.8 ipsec-attributes pre-shared-key Test tunnel-group-map default-group TestVPN =2E =2E =2E End

1. On Cisco 1800 Router version 12.4

hostname 1800 ! crypto isakmp policy 1 encr 3des authentication pre-share group 2 crypto isakmp key test address 1.2.3.4 255.255.255.248 no-xauth ! ! crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac crypto ipsec transform-set ESP-3DES-SHA2 esp-3des esp-sha-hmac ! crypto map SDM_CMAP_1 1 ipsec-isakmp description Tunnel to1.2.3.4 set peer 1.2.3.4 set security-association lifetime seconds 86400 set transform-set ESP-3DES-SHA match address 102 ! ! interface FastEthernet0 description $FW_OUTSIDE$$ETH-WAN$ ip address 5.6.7.8 255.255.255.248 ip nat outside ip virtual-reassembly zone-member security out-zone duplex auto speed auto crypto map SDM_CMAP_1 ! interface BVI1 description $ES_LAN$$FW_INSIDE$ ip address 192.168.46.1 255.255.255.0 ip nat inside ip virtual-reassembly zone-member security in-zone

! ip access-list extended SDM_AH remark SDM_ACL Category=3D1 permit ahp any any ip access-list extended SDM_ESP remark SDM_ACL Category=3D1 permit esp any any ip access-list extended SDM_GRE remark SDM_ACL Category=3D0 permit gre any any ip access-list extended SDM_HTTPS remark SDM_ACL Category=3D1 permit tcp any any eq 443 ip access-list extended SDM_SHELL remark SDM_ACL Category=3D1 permit tcp any any eq cmd ip access-list extended SDM_SSH remark SDM_ACL Category=3D1 permit tcp any any eq 22 ip access-list extended To-test remark SDM_ACL Category=3D128

access-list 1 remark INSIDE_IF=3DVlan1 access-list 1 remark SDM_ACL Category=3D2 access-list 1 permit 10.10.10.0 0.0.0.7 access-list 100 remark SDM_ACL Category=3D128 access-list 100 permit ip host 255.255.255.255 any access-list 100 permit ip 127.0.0.0 0.255.255.255 any access-list 101 remark SDM_ACL Category=3D128 access-list 101 permit ip any any access-list 102 remark SDM_ACL Category=3D4 access-list 102 remark IPSec Rule access-list 102 permit ip 192.168.46.0 0.0.0.255 192.168.0.0 0.0.0.255 access-list 103 remark SDM_ACL Category=3D128 access-list 103 permit ip host 1.2.3.4 any access-list 104 remark SDM_ACL Category=3D0 access-list 104 remark IPSec Rule access-list 104 permit ip 192.168.0.0 0.0.0.255 192.168.46.0 0.0.0.255 access-list 106 remark SDM_ACL Category=3D0 access-list 106 remark IPSec Rule access-list 106 permit ip 192.168.0.0 0.0.0.255 192.168.46.0 0.0.0.255 access-list 107 remark SDM_ACL Category=3D2 access-list 107 remark IPSec Rule access-list 107 deny ip 192.168.46.0 0.0.0.255 192.168.0.0 0.0.0.255 access-list 107 permit ip 192.168.46.0 0.0.0.255 any ! ! route-map SDM_RMAP_2 permit 1 match ip address 107

Do the crypto maps match on both sides? I believe they should.