Hi All!
Please I have some trouble getting cisco and Sophos UTM v9 to send and receive traffic over A vpn I setup. The tunnel is up which is great (green in astaro and good isakmp ipsec status in Cisco), but I can't seem to send traffic to either side.
The devices are close on the same subnet externally, so I hope this isn't a problem?
Astaro internal: 192.168.2.0/24
Astaro external: 62.1.1.50
Cisco 1941 internal: 192.168.20.0/24
Cisco 1941 external: 62.1.1.122
Please see below my configurations and outputs, and please help!
From Astaro ipsec status I have:
ipsec status | grep -i THEIRS
000 "S_REF_IpsSitTHEIRSmmo_0": 192.168.2.0/24===62.1.1.50[62.1.1.50]...62.1.1.122[62.1.1.122]===192.168.20.0/24; erouted; eroute owner: #81931
000 "S_REF_IpsSitTHEIRSmmo_0": newest ISAKMP SA: #81930; newest IPsec SA: #81931;
000 #81931: "S_REF_IpsSitTHEIRSmmo_0" STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 84046s; newest IPSEC; eroute owner
000 #81931: "S_REF_IpsSitTHEIRSmmo_0" esp.f060294b@62.1.1.122 (672 bytes, 1064s ago) esp.8fe37822@62.1.1.50 (0 bytes); tunnel
000 #81930: "S_REF_IpsSitTHEIRSmmo_0" STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 83620s; newest ISAKMP
From tcpdump on Astaro:
10:17:55.932774 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 112) 62.1.1.50.500 > 62.1.1.122.500: isakmp 1.0 msgid : phase 2/others I inf[E]: [encrypted hash]
10:17:55.934349 IP (tos 0x0, ttl 254, id 3357, offset 0, flags [none], proto UDP (17), length 112) 62.1.1.122.500 > 62.1.1.50.500: isakmp 1.0 msgid : phase 2/others R inf[E]: [encrypted hash]
10:18:25.380016 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 112) 62.1.1.50.500 > 62.1.1.122.500: isakmp 1.0 msgid : phase 2/others I inf[E]: [encrypted hash]
10:18:25.381717 IP (tos 0x0, ttl 254, id 3358, offset 0, flags [none], proto UDP (17), length 112) 62.1.1.122.500 > 62.1.1.50.500: isakmp 1.0 msgid : phase 2/others R inf[E]: [encrypted hash]
10:18:55.938298 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 112) 62.1.1.50.500 > 62.1.1.122.500: isakmp 1.0 msgid : phase 2/others I inf[E]: [encrypted hash]
10:18:55.939912 IP (tos 0x0, ttl 254, id 3359, offset 0, flags [none], proto UDP (17), length 112) 62.1.1.122.500 > 62.1.1.50.500: isakmp 1.0 msgid : phase 2/others R inf[E]: [encrypted hash]
This is my Cisco 1941 configuration:
!
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key ****** address 62.1.1.50
!
!
crypto ipsec transform-set TS-MY esp-3des esp-md5-hmac
!
crypto map MYMAP 10 ipsec-isakmp
set peer 62.1.1.50
set transform-set TS-MY
match address MY-VPN-TRAFFIC
!
!
!
!
interface GigabitEthernet0/0
description WAN CONNECTION
ip address 62.1.1.124 255.255.255.248 secondary
ip address 62.1.1.123 255.255.255.248 secondary
ip address 62.1.1.122 255.255.255.248
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
crypto map MYMAP
!
ip nat inside source list 100 interface GigabitEthernet0/0 overload
!
!
ip route 192.168.2.0 255.255.255.0 GigabitEthernet0/0
!
ip access-list extended MY-VPN-TRAFFIC
permit ip 192.168.20.0 0.0.0.255 192.168.2.0 0.0.0.255
!
access-list 1 permit 192.168.20.0 0.0.0.255
access-list 100 permit ip 192.168.20.0 0.0.0.255 192.168.2.0 0.0.0.255
This thread was automatically locked due to age.
