Likes: 
Hallo,
De afgelopen 24 uur breek ik mijn hoofd al over iets héél simpels (denk ik).
De situatie is als volgt: In Amsterdam hebben wij een Cisco ASA 5510 hangen met daar achter onze VOIP centrale.
Onze kantoren hebben allemaal een Cisco ASA 5505 en daarmee maken we IPSec verbindingen om onze VOIP veilig over te transporteren.
Op een nieuw kantoor hebben we een SDSL verbinding en daarbij kregen we een Cisco 888 router. Aangezien deze ook IPSec kan leg ik liever met die router al de IPSec verbinding.
De SDSL provider gaf ons de login gegevens van die 888, ideaal!
De situatie is nu dat de IPSec tunnel up is (VPN lampje op de 888 brand ook), echter komt verkeer vanuit Amsterdam wel aan op een host hier, echter terug gaat het niet richting Amsterdam. Dat gaat ergens een zwart gat in.
Een echo-request vanuit Amsterdam komt dan ook wel aan op kantoor, maar de echo-reply die de host verstuurd raakt verloren.
De configuratie van de 888 router:
De relevante config op de ASA:Code:Current configuration : 3804 bytes ! ! Last configuration change at 13:02:08 UTC Wed Apr 11 2012 by admin ! NVRAM config last updated at 13:02:38 UTC Wed Apr 11 2012 by admin ! version 15.0 no service pad service timestamps debug uptime service timestamps log uptime service password-encryption ! hostname PC-extreme-xsdsl ! boot-start-marker boot-end-marker ! logging buffered 4096 ! no aaa new-model memory-size iomem 10 ! crypto pki trustpoint TP-self-signed-271429907 enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-271429907 revocation-check none rsakeypair TP-self-signed-271429907 ! ! crypto pki certificate chain TP-self-signed-271429907 certificate self-signed 01 ip source-route ! ! ! ip dhcp pool local import all network 192.168.7.0 255.255.255.0 next-server 10.0.199.11 dns-server 10.0.199.15 domain-name pcextreme.nl default-router 192.168.7.1 lease 1 12 ! ! ip cef no ip domain lookup ip domain name yourdomain.com no ipv6 cef ! ! license udi pid CISCO888-K9 sn XXXXXXXXXX ! ! username helpdesk privilege 15 secret 5 $1$FFFFFFFFF username admin privilege 15 secret 5 $1$FFFFFFFF ! ! controller DSL 0 mode atm dsl-mode shdsl symmetric annex A-B-ANFP ! ! ! crypto isakmp policy 10 encr aes 256 authentication pre-share group 5 crypto isakmp key MYCRYPPTKEY address 109.72.87.200 no-xauth ! crypto ipsec security-association lifetime seconds 28800 ! crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec transform-set vpnset esp-aes 256 esp-sha-hmac ! crypto map vpn 10 ipsec-isakmp set peer 109.72.87.200 set transform-set vpnset match address encrypt-acl-ams ! ! ! ! ! interface BRI0 no ip address encapsulation hdlc shutdown isdn termination multidrop ! interface ATM0 no ip address no ip redirects no ip unreachables no ip proxy-arp no atm ilmi-keepalive hold-queue 224 in ! interface ATM0.1 point-to-point ip unnumbered Vlan1 no ip redirects no ip unreachables no ip proxy-arp ip virtual-reassembly pvc 0 0/35 encapsulation aal5mux ppp dialer dialer pool-member 1 ! ! interface FastEthernet0 switchport access vlan 200 no cdp enable ! interface FastEthernet1 switchport access vlan 200 no cdp enable ! interface FastEthernet2 switchport access vlan 200 no cdp enable ! interface FastEthernet3 switchport access vlan 200 ! interface Vlan1 description local ip address 62.212.XX.XX 255.255.255.252 ip virtual-reassembly ip tcp adjust-mss 1452 no autostate crypto map vpn ! interface Vlan200 ip address 192.168.7.1 255.255.255.0 ip virtual-reassembly ! interface Dialer0 ip unnumbered Vlan1 ip virtual-reassembly encapsulation ppp dialer pool 1 dialer-group 1 no peer default ip address ppp authentication pap callin ppp pap sent-username pcextreme@XXXXXXXX.net password 7 XXXXXXXXXXXXXXXXX no cdp enable ! ip forward-protocol nd no ip http server ip http access-class 23 ip http authentication local no ip http secure-server ip http timeout-policy idle 60 life 86400 requests 10000 ! ip route 0.0.0.0 0.0.0.0 Dialer0 permanent ! ip access-list extended encrypt-acl-ams permit ip 192.168.7.0 0.0.0.255 10.0.0.0 0.0.255.255 ! access-list 10 permit 0.0.0.0 255.255.255.0 access-list 23 permit 10.10.10.0 0.0.0.7 access-list 23 permit any dialer-list 1 protocol ip permit no cdp run ! ! ! ! snmp-server community XXXXXXXXXXXXXXXX RO ! control-plane ! line con 0 exec-timeout 120 0 login local no modem enable stopbits 1 line aux 0 line vty 0 4 access-class 23 in exec-timeout 120 0 privilege level 15 login local transport input telnet ssh ! scheduler max-task-time 5000 end
De tunnels zijn ook écht up:Code:access-list encrypt-acl-sdsl-veldzigt extended permit ip object-group Internal_Network 192.168.7.0 255.255.255.0 ! crypto ipsec transform-set vpnset esp-aes-256 esp-sha-hmac crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec security-association lifetime seconds 28800 crypto ipsec security-association lifetime kilobytes 4608000 crypto map IPsec_map 16 match address encrypt-acl-sdsl-veldzigt crypto map IPsec_map 16 set peer 62.212.XX.XX crypto map IPsec_map 16 set transform-set vpnset crypto map IPsec_map interface outside crypto isakmp identity address crypto isakmp enable outside crypto isakmp policy 10 authentication pre-share encryption aes-256 hash md5 group 5 lifetime 28800 crypto isakmp policy 20 authentication crack encryption 3des hash md5 group 2 lifetime 86400 crypto isakmp policy 30 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 crypto isakmp policy 40 authentication pre-share encryption aes-256 hash sha group 5 lifetime 86400
888 Router
ASA 5510Code:PC-extreme-xsdsl# show crypto isakmp sa IPv4 Crypto ISAKMP SA dst src state conn-id status 62.212.XX.XX 109.72.XX.XX QM_IDLE 2004 ACTIVE IPv6 Crypto ISAKMP SA PC-extreme-xsdsl# show crypto ipsec sa interface: Vlan1 Crypto map tag: vpn, local addr 62.212.XX.XX protected vrf: (none) local ident (addr/mask/prot/port): (192.168.7.0/255.255.255.0/0/0) remote ident (addr/mask/prot/port): (10.0.0.0/255.255.0.0/0/0) current_peer 109.72.XX.XX port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 #pkts decaps: 1417, #pkts decrypt: 1417, #pkts verify: 1417 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0 #pkts not decompressed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0 local crypto endpt.: 62.212.XX.XX, remote crypto endpt.: 109.72.XX.XX path mtu 1500, ip mtu 1500, ip mtu idb Vlan1 current outbound spi: 0x673D9BBA(1732090810) PFS (Y/N): N, DH group: none inbound esp sas: spi: 0x85728BB6(2238876598) transform: esp-256-aes esp-sha-hmac , in use settings ={Tunnel, } conn id: 5, flow_id: Onboard VPN:5, sibling_flags 80000046, crypto map: vpn sa timing: remaining key lifetime (k/sec): (4519845/27343) IV size: 16 bytes replay detection support: Y Status: ACTIVE inbound ah sas: inbound pcp sas: outbound esp sas: spi: 0x673D9BBA(1732090810) transform: esp-256-aes esp-sha-hmac , in use settings ={Tunnel, } conn id: 6, flow_id: Onboard VPN:6, sibling_flags 80000046, crypto map: vpn sa timing: remaining key lifetime (k/sec): (4520056/27343) IV size: 16 bytes replay detection support: Y Status: ACTIVE outbound ah sas: outbound pcp sas: PC-extreme-xsdsl#
Mijn gevoel zegt dat het fout gaat op de 888. Die lijkt het verkeer wat hij op zijn "inside" (vlan 200) binnen ziet komen niet via de IPSec tunnel terug te sturen.Code:cisco-asa-5510-01# sh isakmp sa Active SA: 5 Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey) Total IKE SA: 5 5 IKE Peer: 62.212.XX.XX Type : L2L Role : initiator Rekey : no State : MM_ACTIVE cisco-asa-5510-01#
De access-list op de 888 lijkt me ook te kloppen, die matched gewoon dat 192.168.7.0/24 lokaal is en 10.0.0.0/16 de remote in Amsterdam.
Ik weet het inmiddels niet meer, dus vandaar mijn vraag hier
Quote
Oorspronkelijk geplaatst door jobsnijders
