Problema VPN IPSEC CON 2 FIREWALL ASA 5505

Wizard · mer 16 lug , 2008 9:16 am

Cisco$, la tua situazione non è affatto normale...
Io ho configurato decine di VPN l2l e non ho mai dovuto diventare pazzo come te...

Ti ho preparato un template sicuramente funzionante, prova a confrontarlo con la tua config:

Codice: Seleziona tutto

crypto isakmp enable OUTSIDE

access-list INSIDE_NAT0 line 1 extended permit ip 172.26.65.0 255.255.255.0 192.168.0.0 255.255.255.0 
access-list OUTSIDE_20_cryptomap line 1 extended permit ip 172.26.65.0 255.255.255.0 192.168.0.0 255.255.255.0

tunnel-group 1.1.1.1 type ipsec-l2l
tunnel-group 1.1.1.1 ipsec-attributes
pre-shared-key l2l10xhtw%

isakmp keepalive threshold 10 retry 2
crypto isakmp policy 10 authen pre-share
crypto isakmp policy 10 encrypt 3des
crypto isakmp policy 10 hash md5
crypto isakmp policy 10 group 2
crypto isakmp policy 10 lifetime 86400

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto map OUTSIDE_map 20 match address OUTSIDE_20_cryptomap
crypto map OUTSIDE_map 20 set  pfs group2
crypto map OUTSIDE_map 20 set  peer  1.1.1.1
crypto map OUTSIDE_map 20 set  transform-set  ESP-3DES-MD5
crypto map OUTSIDE_map interface  OUTSIDE

nat (INSIDE) 0 access-list INSIDE_NAT0  tcp 0 0 udp 0

Cisco$ · mer 16 lug , 2008 9:56 am

ho controllato ed è + o - uguale tranne questo comando che non ho

isakmp keepalive threshold 10 retry 2

potrei provare a mettere anke questo?

però mi sembra di averlo già messo.

quelli che mi avevi dato tu

Wizard · mer 16 lug , 2008 10:01 am

Eh si, te lo avevo dato prima io!
E' per la gestione del DPD!

Cisco$ · mer 16 lug , 2008 10:39 am

si i comandi li avevo inseriti però senza risolvere nulla.

poi ho visto questo comando che ti ho detto prima che non c'è.

dove posso metterlo oppure e superflo

ti faccio vedere le due conf. dopo i comandi da te dati:

ASA Version 7.2(3)
!
hostname Autoshop-Battipaglia
domain-name default.domain
enable password lewDbIQp6v222N.4 encrypted
names
dns-guard
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.225.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 81.117.204.66 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd RLPMUQ26KL4blgFN encrypted
ftp mode passive
clock timezone WAT 1
dns domain-lookup outside
dns server-group DefaultDNS
name-server 151.99.125.2
name-server 151.99.125.3
domain-name default.domain
access-list outside_1_cryptomap extended permit ip 192.168.225.0 255.255.255.0 1
92.168.227.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 192.168.225.0 255.255.255.0
192.168.227.0 255.255.255.0
pager lines 24
logging enable
logging asdm informational
logging flash-bufferwrap
logging flash-maximum-allocation 512
mtu inside 1500
mtu outside 1500
ip verify reverse-path interface outside
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
asdm image disk0:/asdm-523.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
route outside 0.0.0.0 0.0.0.0 192.168.225.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
http server enable
http 192.168.225.0 255.255.255.0 inside
http 0.0.0.0 0.0.0.0 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set pfs
crypto map outside_map 1 set peer 88.41.126.86
crypto map outside_map 1 set transform-set ESP-3DES-SHA
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 172800
crypto isakmp policy 30
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 172800
telnet 192.168.225.0 255.255.255.0 inside
telnet 192.168.227.0 255.255.255.0 outside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!
dhcpd address 192.168.225.101-192.168.225.140 inside
dhcpd dns 151.99.125.3 interface inside
dhcpd enable inside
!

!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
tunnel-group DefaultL2LGroup ipsec-attributes
isakmp keepalive threshold 20 retry 4
tunnel-group 88.41.126.86 type ipsec-l2l
tunnel-group 88.41.126.86 ipsec-attributes
pre-shared-key *
isakmp keepalive threshold 20 retry 4
prompt hostname context
Cryptochecksum:33171b4c517cbc066048fb241ddf0cbf
Autoshop-Battipaglia#

la seconda conf.

!
hostname Autoshop-Salerno
domain-name default.domain
enable password 0NjRwmAHetszWiXd encrypted
names
dns-guard
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.227.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 88.41.126.86 255.255.255.248
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd RLPMUQ26KL4blgFN encrypted
ftp mode passive
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
dns domain-lookup outside
dns server-group DefaultDNS
name-server 151.99.125.2
name-server 151.99.125.3
domain-name default.domain
access-list inside_nat0_outbound extended permit ip 192.168.227.0 255.255.255.0
192.168.225.0 255.255.255.0
access-list outside_1_cryptomap extended permit ip 192.168.227.0 255.255.255.0 1
92.168.225.0 255.255.255.0
pager lines 24
logging enable
logging list VPN level debugging class vpn
logging list VPN message 101002
logging console VPN
logging buffered VPN
logging asdm informational
logging flash-bufferwrap
logging class vpn buffered debugging asdm debugging
mtu inside 1500
mtu outside 1500
ip verify reverse-path interface outside
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
asdm image disk0:/asdm-523.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
route outside 0.0.0.0 0.0.0.0 192.168.227.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
http server enable
http 192.168.227.0 255.255.255.0 inside
http 0.0.0.0 0.0.0.0 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set pfs
crypto map outside_map 1 set peer 81.117.204.66
crypto map outside_map 1 set transform-set ESP-3DES-SHA
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 172800
crypto isakmp policy 30
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 172800
telnet 192.168.227.0 255.255.255.0 inside
telnet 192.168.225.0 255.255.255.0 outside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd dns 151.99.125.2
dhcpd lease 806000
dhcpd auto_config outside
!
dhcpd address 192.168.227.101-192.168.227.140 inside
dhcpd enable inside
!

!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
tunnel-group DefaultL2LGroup ipsec-attributes
isakmp keepalive threshold 20 retry 4
tunnel-group 81.117.204.66 type ipsec-l2l
tunnel-group 81.117.204.66 ipsec-attributes
pre-shared-key *
isakmp keepalive threshold 20 retry 4
prompt hostname context
Cryptochecksum:db5bf87560a42c3c17b58d0f74e8a1c2
Autoshop-Salerno#

il comando che dicevo io era questo:
isakmp keepalive threshold 10 retry 2

grazie

Wizard · mer 16 lug , 2008 11:27 am

Fai controllare le linee internet eaggiorna la ios agli ASA!

Cisco$ · mer 16 lug , 2008 12:07 pm

scusa se aggiorno i firewall non si perde la configurazione?

alcune volte ho notato che il firewall della sede b cioè della filiale l'utilizzo della cpu arrivava anche al 70 %.

Sulla linea internet farò controllare.

Wizard · mer 16 lug , 2008 1:33 pm

scusa se aggiorno i firewall non si perde la configurazione?

Chiaro se non si perde!

Cisco$ · mer 16 lug , 2008 2:08 pm

Oggi ho riprovato ed ha fatto la stessa cosa.

il log del firewall mi ha dato altri errori se vedi nel log in fondo:

User Access Verification

Password:
Type help or '?' for a list of available commands.
Autoshop-Salerno> en
Password: *************
Autoshop-Salerno# sh log
Syslog logging: enabled
Facility: 20
Timestamp logging: disabled
Standby logging: disabled
Deny Conn when Queue Full: disabled
Console logging: list VPN, 316111 messages logged
Monitor logging: disabled
Buffer logging: list VPN, class vpn, 316111 messages logged
Trap logging: disabled
History logging: disabled
Device ID: disabled
Mail logging: disabled
ASDM logging: level informational, class vpn, 449902 messages logged
of type DPD R-U-THERE (seq number 0xc9de479)
%ASA-7-715036: Group = 81.117.204.66, IP = 81.117.204.66, Sending keep-alive of
type DPD R-U-THERE-ACK (seq number 0xc9de479)
%ASA-7-715046: Group = 81.117.204.66, IP = 81.117.204.66, constructing blank has
h payload
%ASA-7-715046: Group = 81.117.204.66, IP = 81.117.204.66, constructing qm hash p
ayload
%ASA-7-713236: IP = 81.117.204.66, IKE_DECODE SENDING Message (msgid=94907858) w
ith payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
%ASA-7-713236: IP = 81.117.204.66, IKE_DECODE RECEIVED Message (msgid=a221a2a7)
with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
%ASA-7-715047: Group = 81.117.204.66, IP = 81.117.204.66, processing hash payloa
d
%ASA-7-715047: Group = 81.117.204.66, IP = 81.117.204.66, processing notify payl
oad
%ASA-7-715075: Group = 81.117.204.66, IP = 81.117.204.66, Received keep-alive of
type DPD R-U-THERE (seq number 0xc9de47a)
%ASA-7-715036: Group = 81.117.204.66, IP = 81.117.204.66, Sending keep-alive of
type DPD R-U-THERE-ACK (seq number 0xc9de47a)
%ASA-7-715046: Group = 81.117.204.66, IP = 81.117.204.66, constructing blank has
h payload
%ASA-7-715046: Group = 81.117.204.66, IP = 81.117.204.66, constructing qm hash p
ayload
%ASA-7-713236: IP = 81.117.204.66, IKE_DECODE SENDING Message (msgid=d33730d1) w
ith payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
%ASA-7-713236: IP = 81.117.204.66, IKE_DECODE RECEIVED Message (msgid=1a6f5a9c)
with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
%ASA-7-715047: Group = 81.117.204.66, IP = 81.117.204.66, processing hash payloa
d
%ASA-7-715047: Group = 81.117.204.66, IP = 81.117.204.66, processing notify payl
oad
%ASA-7-715075: Group = 81.117.204.66, IP = 81.117.204.66, Received keep-alive of
type DPD R-U-THERE (seq number 0xc9de47b)
%ASA-7-715036: Group = 81.117.204.66, IP = 81.117.204.66, Sending keep-alive of
type DPD R-U-THERE-ACK (seq number 0xc9de47b)
%ASA-7-715046: Group = 81.117.204.66, IP = 81.117.204.66, constructing blank has
h payload
%ASA-7-715046: Group = 81.117.204.66, IP = 81.117.204.66, constructing qm hash p
ayload
%ASA-7-713236: IP = 81.117.204.66, IKE_DECODE SENDING Message (msgid=6e571515) w
ith payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
%ASA-7-713236: IP = 81.117.204.66, IKE_DECODE RECEIVED Message (msgid=5a4ac73e)
with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
%ASA-7-715047: Group = 81.117.204.66, IP = 81.117.204.66, processing hash payloa
d
%ASA-7-715047: Group = 81.117.204.66, IP = 81.117.204.66, processing notify payl
oad
%ASA-7-715075: Group = 81.117.204.66, IP = 81.117.204.66, Received keep-alive of
type DPD R-U-THERE (seq number 0xc9de47c)
%ASA-7-715036: Group = 81.117.204.66, IP = 81.117.204.66, Sending keep-alive of
type DPD R-U-THERE-ACK (seq number 0xc9de47c)
%ASA-7-715046: Group = 81.117.204.66, IP = 81.117.204.66, constructing blank has
h payload
%ASA-7-715046: Group = 81.117.204.66, IP = 81.117.204.66, constructing qm hash p
ayload
%ASA-7-713236: IP = 81.117.204.66, IKE_DECODE SENDING Message (msgid=f1a3a98) wi
th payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
%ASA-7-713236: IP = 81.117.204.66, IKE_DECODE RECEIVED Message (msgid=9ee3db55)
with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
%ASA-7-715047: Group = 81.117.204.66, IP = 81.117.204.66, processing hash payloa
d
%ASA-7-715047: Group = 81.117.204.66, IP = 81.117.204.66, processing notify payl
oad
%ASA-7-715075: Group = 81.117.204.66, IP = 81.117.204.66, Received keep-alive of
type DPD R-U-THERE (seq number 0xc9de47d)
%ASA-7-715036: Group = 81.117.204.66, IP = 81.117.204.66, Sending keep-alive of
type DPD R-U-THERE-ACK (seq number 0xc9de47d)
%ASA-7-715046: Group = 81.117.204.66, IP = 81.117.204.66, constructing blank has
h payload
%ASA-7-715046: Group = 81.117.204.66, IP = 81.117.204.66, constructing qm hash p
ayload
%ASA-7-713236: IP = 81.117.204.66, IKE_DECODE SENDING Message (msgid=673c53e2) w
ith payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80

sempre quello della filiale della sede B

dopo che ho messo i comandi da te dati.

comunque la VPN è caduta dopo 30 minuti mi sa che forse hai ragione tu sarà un problema di linea.

Grazie

Cisco$ · mer 16 lug , 2008 9:02 pm

scusa wizard

per fare un ultimo tentativo non posso mettere un comando tipo fare ping dal firewall sede centrale ogni 20-30 minuti all'altro firewall della filiale per vedere se la VPN rimane sù?

sai indicarmi il comando da mettere per fare ciò?

Grazie

Wizard · gio 17 lug , 2008 10:09 am

Non lo fare dal firewall ma da una macchina dietro uno dei 2

Cisco$ · gio 17 lug , 2008 10:12 am

scusa

xchè dal firewall no?

Cisco$ · gio 17 lug , 2008 11:25 am

Io penso che si può fare anche da router.

Fare un ping ogni 5 minuti all'indirizzo del firewall.

tu conosci un comando per fare questo?

Grazie

Cisco$ · gio 17 lug , 2008 12:24 pm

scusa l'ho fatto sul server però per abilitare il ping sul router della sede centrale non mi ricordo il comando.

xchè è disabilitato.

Wizard · gio 17 lug , 2008 3:00 pm

Devi stare dietro al nat del firewall quindi dal server!
Lancia un ping -t

Cisco$ · gio 17 lug , 2008 3:15 pm

ho fatto diversamente da un client

e ho aggiunto su operazioni pianificate di eseguire il ping da un tot orario tutti i giorni della settimana ogni 5 minuti.

ora provo stasera a vedere se si spegne la VPN.

o e meglio forse sul server?

non è la stessa cosa?

il client fa parte della stessa rete.

Problema VPN IPSEC CON 2 FIREWALL ASA 5505

Login • Iscriviti