L2L VPN - ohne Datenübertragung

[kees_23 10]

Hallo Gemeinde,

 

Ich habe ein kleines Problem mit einer ASA5510 und einer ASA5505.

In meiner WAN-Umgebung habe ich mehrere ASAs (5505) stehen, die sich über L2L mit meiner 5510 verbinden. Bei der letzten, habe ich das Phänomen, dass der Tunnel zwar steht, ich aber nur die ASA pingen kann, und im Netzwerk dahinter keine Hosts erreichen kann. Was ich im ASDM-Log zu hauf habe sind "Teardown dynamic TCP...". Ich hoffe Ihr könnt mir weiterhelfen.

Anbei noch die Konfigs:

Es soll von der ASA5505 (10.3.0.0/24) nach ASA5510 (10.0.0.0/16) geroutet werden.

 

ASA5505:
: Saved
: Written by enable_15 at 15:08:50.263 UTC Tue May 10 2011
!
ASA Version 8.0(2) 
!
hostname MyHostName
enable password MYPasswort encrypted
names
!
interface Vlan1
nameif inside
security-level 100
ip address 10.3.0.1 255.255.255.0 
!
interface Vlan2
nameif outside
security-level 0
ip address MyExternalIP 255.255.255.248 
!
interface Ethernet0/0
switchport access vlan 2
!
boot system disk0:/asa802-k8.bin
ftp mode passive
access-list outside_access_in extended permit icmp any any 
access-list outside_1_cryptomap extended permit ip 10.3.0.0 255.255.255.0 10.0.0.0 255.255.0.0 
access-list inside_nat0_outbound extended permit ip 10.3.0.0 255.255.255.0 10.0.0.0 255.255.0.0 
icmp permit any inside
icmp permit any outside
asdm image disk0:/asdm-602.bin
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 90.83.30.182 1
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 10.3.0.0 255.255.255.0 inside
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac 
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set peer MyASA5510
crypto map outside_map 1 set transform-set ESP-3DES-SHA
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp nat-traversal 3600
tunnel-group MyASA5510 type ipsec-l2l
tunnel-group MyASA5510 ipsec-attributes
pre-shared-key MyPSK
prompt hostname context 
Cryptochecksum:de3e9bb5874504e5c822e28d4a53bf7c
: end

[Wordo 11]

Hast schon mal mit dem Packet Capture Wizard ueber ASDM geschaut ob da was ankommt / durchgeht? Bin mir jetzt nicht sicher ob das schon ab 8.0.2 verfuegbar ist ...

[kees_23 10]

Hi,

ich habe mit dem Wizard einen https und einen icmp Zugriff aufgenommen. Ich kann mit der Ausgabe leider nicht wirklich viel anfangen :confused:

8 packets captured
  1: 07:00:21.417077 802.1Q vlan#1 P0 10.3.0.102.49646 > 10.0.1.177.443: S 2377788135:2377788135(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK>
  2: 07:00:24.416818 802.1Q vlan#1 P0 10.3.0.102.49646 > 10.0.1.177.443: S 2377788135:2377788135(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK>
  3: 07:00:30.426308 802.1Q vlan#1 P0 10.3.0.102.49646 > 10.0.1.177.443: S 2377788135:2377788135(0) win 8192 <mss 1460,nop,nop,sackOK>
  4: 07:01:15.502430 802.1Q vlan#1 P0 10.3.0.102 > 10.0.1.11: icmp: echo request
  5: 07:01:20.502003 802.1Q vlan#1 P0 10.3.0.102 > 10.0.1.11: icmp: echo request
  6: 07:01:25.501576 802.1Q vlan#1 P0 10.3.0.102 > 10.0.1.11: icmp: echo request
  7: 07:01:30.501149 802.1Q vlan#1 P0 10.3.0.102 > 10.0.1.11: icmp: echo request
  8: 07:01:45.635465 802.1Q vlan#1 P0 10.3.0.11.62200 > 10.0.1.14.135: S 295618178:295618178(0) win 8192 <mss 1460,nop,wscale 8,nop,nop,sackOK>
8 packets shown

[kees_23 10]

Anbei habe ich noch die Ausgaben von: sh crypt ipsec sa:

ASA5505 (8.0(2))
interface: outside
   Crypto map tag: outside_map, seq num: 100, local addr: MyIP

     access-list 100 permit ip 10.3.0.0 255.255.255.0 10.0.1.0 255.255.255.0
     local ident (addr/mask/prot/port): (10.3.0.0/255.255.255.0/0/0)
     remote ident (addr/mask/prot/port): (10.0.1.0/255.255.255.0/0/0)
     current_peer: PartnerIP

     #pkts encaps: 50, #pkts encrypt: 50, #pkts digest: 50
     #pkts decaps: 2, #pkts decrypt: 2, #pkts verify: 2
     #pkts compressed: 0, #pkts decompressed: 0
     #pkts not compressed: 50, #pkts comp failed: 0, #pkts decomp failed: 0
     #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
     #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
     #send errors: 0, #recv errors: 0

     local crypto endpt.: MyIP, remote crypto endpt.: PartnerIP

     path mtu 1500, ipsec overhead 58, media mtu 1500
     current outbound spi: B27F632B

   inbound esp sas:
     spi: 0xAC0B1E91 (2886409873)
        transform: esp-3des esp-sha-hmac none
        in use settings ={L2L, Tunnel, }
        slot: 0, conn_id: 4096, crypto-map: outside_map
        sa timing: remaining key lifetime (kB/sec): (3824999/28041)
        IV size: 8 bytes
        replay detection support: Y
   outbound esp sas:
     spi: 0xB27F632B (2994692907)
        transform: esp-3des esp-sha-hmac none
        in use settings ={L2L, Tunnel, }
        slot: 0, conn_id: 4096, crypto-map: outside_map
        sa timing: remaining key lifetime (kB/sec): (3824996/28041)
        IV size: 8 bytes
        replay detection support: Y

 

ASA5510 (7.2(4))
Crypto map tag: outside_map, seq num: 100, local addr: MyIP

     access-list outside_100_cryptomap permit ip 10.0.0.0 255.255.0.0 10.3.0.0 255.255.255.0
     local ident (addr/mask/prot/port): (10.0.1.0/255.255.255.0/0/0)
     remote ident (addr/mask/prot/port): (10.3.0.0/255.255.255.0/0/0)
     current_peer: PartnerIP

     #pkts encaps: 2, #pkts encrypt: 2, #pkts digest: 2
     #pkts decaps: 85, #pkts decrypt: 85, #pkts verify: 85
     #pkts compressed: 0, #pkts decompressed: 0
     #pkts not compressed: 2, #pkts comp failed: 0, #pkts decomp failed: 0
     #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
     #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
     #send errors: 0, #recv errors: 0

     local crypto endpt.: MyIP, remote crypto endpt.: PartnerIP

     path mtu 1500, ipsec overhead 58, media mtu 1500
     current outbound spi: AC0B1E91

   inbound esp sas:
     spi: 0xB27F632B (2994692907)
        transform: esp-3des esp-sha-hmac
        in use settings ={L2L, Tunnel, }
        slot: 0, conn_id: 2143, crypto-map: outside_map
        sa timing: remaining key lifetime (kB/sec): (4274994/27785)
        IV size: 8 bytes
        replay detection support: Y
   outbound esp sas:
     spi: 0xAC0B1E91 (2886409873)
        transform: esp-3des esp-sha-hmac
        in use settings ={L2L, Tunnel, }
        slot: 0, conn_id: 2143, crypto-map: outside_map
        sa timing: remaining key lifetime (kB/sec): (4274999/27781)
        IV size: 8 bytes
        replay detection support: Y