Embedded Files
So, I wanted to configure an IPSEC VPN between a Cisco ASA and an HP MSR935.
I've simplified the config, and put the necessary bits in - this guide doesn't cover any ADSL or NAT configuration information.
ASA Version: Cisco Adaptive Security Appliance Software Version 9.1(2)
MSR Version: Comware Software, Version 5.20.106, Release 2513P09
P1 - ASA
crypto ikev1 policy 5 authentication pre-share encryption aes-192 hash sha group 2 lifetime 3600group-policy GroupPolicy_99.99.99.99 internalgroup-policy GroupPolicy_99.99.99.99 attributesvpn-tunnel-protocol ikev1tunnel-group 99.99.99.99 type ipsec-l2ltunnel-group 99.99.99.99 general-attributes default-group-policy GroupPolicy_99.99.99.99tunnel-group 99.99.99.99 ipsec-attributes ikev1 pre-shared-key cipher **C1231iPher$string
P1 - MSR
ike proposal 2encryption-algorithm aes-cbc 192dh group2sa duration 3600ike peer VPN-SITE1-TO-SITE2proposal 2pre-shared-key cipher **C1231iPher$stringremote-address 89.89.89.89local-address 99.99.99.99nat traversalP2 - ASA
crypto map outside_map 1 match address outside_cryptomapcrypto map outside_map 1 set peer 99.99.99.99crypto map outside_map 1 set ikev1 transform-set ESP-AES-192-SHAcrypto map outside_map 1 set security-association lifetime seconds 28800crypto map outside_map 1 set security-association lifetime kilobytes 1843200crypto map outside_map interface outsideP2 - MSR
ipsec transform-set vpn.1encapsulation-mode tunneltransform espesp authentication-algorithm sha1esp encryption-algorithm aes-cbc-192 ipsec policy vpn 1 isakmpconnection-name vpn.1security acl 3001pfs dh-group2ike-peer VPN-SITE1-TO-SITE2transform-set vpn.1sa duration traffic-based 1843200sa duration time-based 28800INTERESTING TRAFFIC - ASA
object network SITE-1 subnet 10.0.0.0 255.255.255.0object network SITE-2 subnet 192.168.10.0 255.255.255.0access-list outside_cryptomap extended permit ip object SITE-1 object SITE-2INTERESTING TRAFFIC - MSR
acl number 3001 rule 5 permit ip source 10.0.10.0 0.0.0.255 destination 192.168.10.0 0.0.0.255 rule 10permit ip source 192.168.10.0 0.0.0.255 destination 10.0.10.0 0.0.0.255Start sending traffic, and you'll notice that the VPN builds successfully - but..!!! You only get one way traffic, on the Cisco, its encaps but no decaps (the ASA is encapsulating traffic, but is not receiving anything back down)... I know the ASA pretty well, so knew it wasn't an issue there, it had to be NAT'ing or Routing on the MSR.. A quick call with HP support, and I added the following route:
ROUT CONFIGURATION - MSR
All of a sudden, traffic was traversing up and down the VPN.. job done
ip route-static 10.0.0.0 255.255.255.0 89.89.89.89Google Sites
Report abuse