Why isn't the VPN between two Cisco ASA 5505s working?
November 23, 2008 4:24 PM Subscribe
Why isn't the VPN between two Cisco ASA 5505s working when I switch ISPs? One of the ASA 5505s is sort-of dual homed in the new configuration. The VPN appears to establish, but I can't pass traffic from one LAN to the other.
posted by chengjih to computers & internet (4 answers total)
We currently have a IPSec VPN between the office and our colo across a business-class cable line. We recently got a symmetric DSL line in the office in order to improve upload speeds to the colo from the office. Ideally, we'd like to have the cable line for ordinary Internet traffic, and the DSL just for the VPN traffic to the colo.
The ASA in the office has the DSL connected to ethernet port 7, which we've set up as a separate VLAN named "colo", in addition to the standard "inside" and "outside" VLANs. This ASA has a "restricted" license so only VLANs, and traffic between "outside" and "colo" is blocked.
I set up a static route using the "colo" interface to the colo ASA. Traceroute looks correct, and I can ping through it (in fact, I can ping from behind the ASA, from one of the internal machines on the office LAN). I then did an "isakmp enable colo", and switched the interface associated with the crypto map from "outside" to "colo".
On the ASA in the colo, I changed the peer for the crypto to the IP of the DSL line. I also added a tunnel group for this IP.
The VPN establishes -- I can see it in the ADSM and through "show crypto ipsec sa" -- but I can't send traffic from one LAN to the other. Ping doesn't work. ssh from an office server to a colo server seems to start but doesn't get anywhere. Strangely, when I telnet to the ssh port of the colo server, I see the usual SSH banner, so something seems to get through.
Any ideas? I haven't really touched the access lists on either ASA, as they appear to be correct. All I'm doing is changing the IP address of the "office", albeit to a different interface/VLAN. Is this a licensing problem for the ASA?