1.4 IPSec: Site to Site

ASA ISAKMP STATES

MM_WAIT_MSG2
Initial DH public key sent to responder. Awaiting initial contact reply from other side.
If stuck here it usually means the other end is not responding. This could be due to no route to the far end or the far end does not have ISAKMP enabled on the outside or the far end is down.

MM_WAIT_MSG3
Both peers have agreed on the ISAKMP policies. Awaiting exchange of keyring information.
Hang up’s here may be due to mismatch device vendors, a router with a firewall in the way, or even ASA version mismatches.

MM_WAIT_MSG4
In this step the pre-share key hashes are exchanged. They are not compared or checked, only sent. If one side sends a key and does not receive a key back, this is where the tunnel will fail.
I have seen the tunnel fail at this step due to the remote side having the wrong Peer IP address. Hang up’s here may also be due to mismatch device vendors, a router with a firewall in the way, or even ASA version mismatches.

MM_WAIT_MSG5
This step is where the devices exchange pre-shared keys.
If the pre-shared keys do not match it will stay at this MSG. I have also seen the tunnel stop here when NAT Traversal was on when it needed to be turned off.

MM_WAIT_MSG6
This step is where the devices exchange pre-shared keys.
If the pre-shared keys do not match it will stay at this MSG. I have also seen the tunnel stop here when NAT Traversal was on when it needed to be turned off.
However, if the state goes to MSG6 then the ISAKMP gets reset that means phase 1 finished but phase 2 failed. Check that IPSEC settings match in phase 2 to get the tunnel to MM_ACTIVE.

AM_ACTIVE / MM_ACTIVE
The ISAKMP negotiations are complete. Phase 1 has successfully completed.

- Step 1: Configure Mirrored ACL/Crypto ACL for Interesting Traffic
- - (config)# access-list permit host host
- Step 2: Configure ISAKMP Policy
- - (config)# crypto isakmp policy
- - - (config-policy)#encryption
    - (config-policy)# hash
    - (config-policy)# group
    - (config-policy)# authentication
    - (config-policy)# lifetime [Default: 86400]
- Step 3: Define Tunnel Group [DIFFERENT FROM ROUTER]
- - (config)# tunnel-group type ipsec l2l
  - (config)# tunnel-group ipsec-attributes // This command is enabled only after the previous command
  - - // If the authentication mechanism is Pre-Share Key use this 1 line:
  - - (config-tunnel-ipsec)# pre-shared-key
    - // If the authentication mechanism is RSA-Sig use these 2 lines:
    - (config-tunnel-ipsec)# peer-id-valid-check nocheck
    - (config-tunnel-ipsec)# trust-point
- Step 4: Configure Transform Set
- - (config)# crypto ipsec transform-set

- Step 5: Configure Crypto Map [DIFFERENT FROM ROUTER]
- - (config)# crypto map <#> set peer
- - (config)# crypto map <#> transform-set
  - (config)# crypto map <#> match address
  - // If the authentication mechanism is RSA-Sig ADD the following
  - (config)# crypto map <#> trustpoint

- Step 6: Apply Crypto Map to an Interface
- - (config)# crypto map interface
- Step 7: Enable ISAKMP on the interface [EXTRA Command]
- - (config)# crypto isakmp enable

Configuration on new ASA: [5 Changes]

(config)# access-list 101 permit ip host 10.1.1.1 host 20.1.1.1 // Please note its between R1 and R2
(config)# crypto isakmp policy 10
- (config-policy)# authentication pre-share
- (config-policy)# encryption 3des
- (config-policy)# hash sha
- (config-policy)# group 2
(config)# tunnel-group 2.2.2.1 type ipsec-l2l
(config)# tunnel-group 2.2.2.1 ipsec-attributes
- (config-tunnel-ipsec)# pre-shared-key cisco123
(config)# crypto ipsec transform-set TSET esp-3des esp-sha-hmac
(config)# crypto map CMAP 10 set peer 2.2.2.1
(config)# crypto map CMAP 10 set transform-set TSET
(config)# crypto map CMAP 10 match address 101
(config)# crypto map CMAP interface OUTSIDE
(config)# crypto isakmp enable OUTSIDE

ON R2

(config)# access-list 101 permit ip host 20.1.1.1 host 10.1.1.1 // Please note its between R1 and R2
(config)# crypto isakmp policy 10
- (config-policy)# authentication pre-share
- (config-policy)# encryption 3des
- (config-policy)# hash sha
- (config-policy)# group 2
(config)# crypto isakmp key 0 cisco123 address 2.2.2.10
(config)# crypto ipsec transform-set TSET esp-3des esp-sha-hmac
(config)# crypto map CMAP 10 ipsec-isakmp
- (config-map)# set peer 2.2.2.10
- (config-map)# set transform-set TSET
- (config-map)# match address 101
(config)# int f0/0
- (config-if)# crypto map CMAP