ASA as VPN server, R5 as client...having issues.

Hi All,

  I am trying to establish the IPSec connection on R5 by running it in client mode. The show crypto isakmp sa shows the following:

Rack6R5#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id slot status
174.6.124.12    204.12.6.5      CONF_XAUTH        1010    0 ACTIVE
174.6.124.12    204.12.6.5      MM_NO_STATE       1009    0 ACTIVE (deleted).

I do a debug on the ASA( the server) and I see the following :



%ASA-7-715046: Group = IELAB, IP = 204.12.6.5, constructing blank hash payload
%ASA-7-715046: Group = IELAB, IP = 204.12.6.5, constructing qm hash payload
%ASA-7-713236: IP = 204.12.6.5, IKE_DECODE SENDING Message (msgid=e7f7f30f) with payloads : HDR + HASH (8) + ATTR (14) + NONE (0) total length : 72
%ASA-7-713906: Group = IELAB, IP = 204.12.6.5, IKE SA AM:6eaApr 03 22:25:08 [IKEv1]62cd7 terminating:  flags 0x0105c001, refcnt 0, tuncnt 0
%ASA-7-713906: Group = IELAB, IP = 204.12.6.5, sending delete/delete with reason message
%ASA-7-715046: Group = IELAB, IP = 204.12.6.5, constructing blank hash payload
%ASA-7-715046: Group = IELAB, IP = 204.12.6.5, constructing IKE delete payload
%ASA-7-715046: Group = IELAB, IP = 204.12.6.5, constructing qm hash payload
%ASA-7-713236: IP = 204.12.6.5, IKE_DECODE SENDING Message (msgid=eb73f95d) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 80
%ASA-3-713902: Group = IELAB, IP = 204.12.6.5, Removing peer from peer table failed, no match!
%ASA-4-713903: Group = IELAB, IP = 204.12.6.5, Error: Unable to remove PeerTblEntry
%ASA-4-113019: Group = , Username = , IP = 0.0.0.0, Session disconnected. Session Type: , Duration: 0h:00m:59s, Bytes xmt: 0, Bytes rcv: 0, Reason: Unknown
: Group = IELAB, IP = 204.12.6.5, Removing peer from peer table failed, no match!
Apr 03 22:25:08 [IKEv1]: Group = IELAB, IP = 204.12.6.5, Error: Unable to remove PeerTblEntry

My configuration is like this:

crypto isakmp policy 20
 encr 3des
 authentication pre-share
 group 2
!
!
crypto ipsec client ezvpn IELAB
 connect auto
 group IELAB key CISCO
 local-address FastEthernet0/1
 mode client
 peer 174.6.124.12
 username IPSECUSER password CISCO
 xauth userid mode local

interface FastEthernet0/1
 ip address 204.12.6.5 255.255.255.0
 speed auto
 half-duplex
 crypto ipsec client ezvpn IELAB inside

interface Serial0/0
 ip address 174.6.145.5 255.255.255.0
 encapsulation frame-relay
 frame-relay map ip 174.6.145.4 501 broadcast
 frame-relay map ip 174.6.145.1 501 broadcast
 no frame-relay inverse-arp
 crypto ipsec client ezvpn IELAB


Any help would be greatly appreciated!!!

 

Thanks,

Vikram Parmar

CCIE#22735

Comments

  • Hi,

    Can you please share the ASA config as well? Configs for tunnel-group, local pool, group-policy and crypto.

    Thanks!

  • I could not find the attachment link. Hence , the complete configuration of ASA (server)

     

    Rack6ASA1(config)# sh run
    : Saved
    :
    ASA Version 8.0(4)
    !
    hostname Rack6ASA1
    enable password 8Ry2YjIyt7RRXU24 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 174.6.124.100 ACS_POST_NAT_IP
    name 10.0.0.100 ACS_PRE_NAT_IP
    name 174.6.124.6 R6_POST_NAT_IP
    name 150.6.6.6 R6_PRE_NAT_IP
    name 150.6.5.5 R5
    name 174.6.135.13 ASA2
    !
    interface Ethernet0/0
     no nameif
     no security-level
     no ip address
    !
    interface Ethernet0/1
     no nameif
     no security-level
     no ip address
    !
    interface Ethernet0/2
     shutdown
     no nameif
     no security-level
     no ip address
    !
    interface Ethernet0/3
     shutdown
     no nameif
     no security-level
     no ip address
    !
    interface Management0/0
     shutdown
     no nameif
     no security-level
     no ip address
    !
    interface Redundant8
     member-interface Ethernet0/1
     member-interface Ethernet0/0
     nameif IN
     security-level 99
     ip address 174.6.127.12 255.255.255.0
     ospf authentication-key CISCO
     ospf authentication
    !
    interface Redundant8.124
     vlan 124
     nameif OUT
     security-level 1
     ip address 174.6.124.12 255.255.255.0
    !
    ftp mode passive
    object-group network HOSTS1
     network-object host 10.0.0.101
    object-group network HOSTS2
     network-object host 10.0.0.200
    object-group network HOSTS
     group-object HOSTS1
     group-object HOSTS2
    access-list OUTSIDE_IN extended permit tcp any host ACS_POST_NAT_IP eq tacacs
    access-list OUTSIDE_IN extended permit udp any host ACS_POST_NAT_IP eq radius
    access-list OUTSIDE_IN extended permit udp any host ACS_POST_NAT_IP eq radius-acct
    access-list OUTSIDE_IN extended permit udp any host ACS_POST_NAT_IP eq 1812
    access-list OUTSIDE_IN extended permit udp any host ACS_POST_NAT_IP eq 1813
    access-list OUTSIDE_IN extended permit tcp host R5 eq bgp host R6_POST_NAT_IP
    access-list OUTSIDE_IN extended permit tcp host R5 host R6_POST_NAT_IP eq bgp
    access-list OUTSIDE_IN extended permit icmp any any echo
    access-list OUTSIDE_IN extended permit tcp host ASA2 host ACS_POST_NAT_IP eq 1470
    access-list OUTSIDE_IN extended permit udp host R5 host ACS_POST_NAT_IP eq syslog
    access-list INSIDE_OUT extended deny icmp object-group HOSTS any echo
    access-list INSIDE_OUT extended permit ip any any
    access-list SPLIT_TUNNEL extended permit ip 174.6.127.0 255.255.255.0 any
    pager lines 24
    logging enable
    mtu IN 1500
    mtu OUT 1500
    ip local pool CCIEPOOL 10.105.105.1-10.105.105.50 mask 255.255.255.0
    ip verify reverse-path interface IN
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    static (IN,OUT) ACS_POST_NAT_IP ACS_PRE_NAT_IP netmask 255.255.255.255 tcp 250 200 udp 300
    static (IN,OUT) R6_POST_NAT_IP R6_PRE_NAT_IP netmask 255.255.255.255
    access-group INSIDE_OUT in interface IN
    !
    router ospf 1
     network 174.6.127.12 255.255.255.255 area 51
     log-adj-changes
     default-information originate
    !
    route OUT 0.0.0.0 0.0.0.0 174.6.124.4 1
    route IN 10.0.0.0 255.255.255.0 174.6.127.7 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server RADIUS protocol radius
    aaa-server RADIUS (IN) host ACS_PRE_NAT_IP
     key CISCO
     authentication-port 1812
     accounting-port 1813
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set 3DESSHA esp-3des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map DYNAMIC 10 set transform-set 3DESSHA
    crypto dynamic-map DYNAMIC 10 set security-association lifetime seconds 28800
    crypto dynamic-map DYNAMIC 10 set security-association lifetime kilobytes 4608000
    crypto map VPN 10 ipsec-isakmp dynamic DYNAMIC
    crypto map VPN interface OUT
    crypto isakmp enable OUT
    crypto isakmp policy 20
     authentication pre-share
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    crypto isakmp policy 65535
     authentication pre-share
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    group-policy IELAB internal
    group-policy IELAB attributes
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value SPLIT_TUNNEL
     address-pools value CCIEPOOL
    username IPSECUSER password GlECUFrs9HVxCBI8 encrypted
    username CISCO password TYX7NfYD.Yf733Bn encrypted
    tunnel-group IELAB type remote-access
    tunnel-group IELAB general-attributes
     authentication-server-group RADIUS
     default-group-policy IELAB
    tunnel-group IELAB ipsec-attributes
     pre-shared-key *
    tunnel-group IELAB2 type remote-access
    !
    class-map inspection_default
     match default-inspection-traffic
    !
    !
    policy-map type inspect dns preset_dns_map
     parameters
      message-length maximum 512
    policy-map global_policy
     class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip
      inspect xdmcp
      inspect icmp
    !
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:d41d8cd98f00b204e9800998ecf8427e
    : end

  • Still looking for some help!!!

  • Parvikram,

    I was going through the configs you provided and I am still looking at them. But I found something here:

    tunnel-group IELAB general-attributes
     authentication-server-group RADIUS
     default-group-policy IELAB

    I do see that you are setting your x-auth to use Radius, but I believe you may want to try it locally, as you have the IPSECUSER locally created. Can you change this to authentication-server-group LOCAL?

    I am still checking the rest of the configs.

    HTH

    Good luck!

  • Thanks qqabdal. I will try the same and let you know.

  • Hi,

    Did you have a chance to try this out?

    Regards,

Sign In or Register to comment.