Cisco ASA & sonicwall vpn tunnel problem
Jeong
Newbie ✭
I connected VPN tunnel with Cisco ASA with "IKEv2, Site to Site". But a problem arose.
I connected local is two networks subnet, remote is three hosts unit.
Although a total of 6 tunnels should be created, only one tunnel is created.
If I delete the connected tunnel, only one connection will be made to the next one.
Is there anything that needs to be reviewed on the SonicWall side or on the Cisco side?
If not, is it possible to only have one tunnel with ASA?
The guide only composed one tunnel.
Best Answer
-
CORRECT ANSWER
Ajishlal
Community Legend ✭✭✭✭✭
Since sonicwall doesn't have PRF feature in 1st or 2nd phase, you must have to configure the Integrity algorithm and the PRF algorithm should be same in cisco ASA, since in IKEv2 (cisco), the hash algorithm is separated into two options, one for the integrity algorithm, and one for the pseudo-random function (PRF).
1
Answers
@Jeong
Share with us the CISCO configuration and the sonicwall configuration.
I share the settings of cisco and sonicwall.
The object of sonicwall is the same as that of cisco.
Currently, only one tunnel is active.
Thanks
== Cisco ASA config ===
object-group network IPSEC-CHEMON-LOCAL
network-object host xx.xx.xx.xx1
network-object host xx.xx.xx.xx2
network-object host xx.xx.xx.xx3
exit
object-group network IPSEC-CHEMON-REMOTE
network-object xxx.xxx.x.xx1 255.255.255.128
network-object xxx.xxx.x.xx2 255.255.252.0
exit
nat (any,outside) source static IPSEC-CHEMON-LOCAL IPSEC-CHEMON-LOCAL destination static IPSEC-CHEMON-REMOTE IPSEC-CHEMON-REMOTE no-proxy-arp route-lookup
access-list IPSEC-CHEMON extended permit ip object-group IPSEC-CHEMON-LOCAL object-group IPSEC-CHEMON-REMOTE
crypto map mycryptomap 270 match address IPSEC-CHEMON
crypto map mycryptomap 270 set peer xxx.xx.xx.xxx
crypto map mycryptomap 270 set ikev2 ipsec-proposal AES256-SHA256
crypto map mycryptomap 270 set security-association lifetime seconds 3600
tunnel-group xxx.xx.xx.xxx type ipsec-l2l
tunnel-group xxx.xx.xx.xxx ipsec-attributes
ikev2 remote-authentication pre-shared-key *****
ikev2 local-authentication pre-shared-key *****
crypto ipsec ikev2 ipsec-proposal AES256-SHA256
protocol esp encryption aes-256
protocol esp integrity sha-256
crypto ikev2 policy 10
encryption aes-256
integrity sha256
group 5
prf sha
lifetime seconds 86400
crypto ikev2 policy 20
encryption aes-256
integrity sha256
group 5
prf sha256
lifetime seconds 86400
crypto ikev2 policy 30
encryption aes-gcm-256
integrity null
group 5
prf sha
lifetime seconds 86400
crypto ikev2 policy 40
encryption aes-256
integrity sha256
group 5
prf sha512 sha384 sha256 sha
lifetime seconds 86400
crypto ikev2 policy 50
encryption aes-256 aes-192 aes
integrity sha512 sha384 sha256 sha
group 20 19 24 14 5 2
prf sha512 sha384 sha256 sha
lifetime seconds 3600
=== SonicWall ===
Is anything actually not working? I saw this too, and when someone pinged between one of the "down" tunnels, it came up and all was OK.
I would think "keep alive" would avoid this micro-issue, however.