dslreports logo
 
    All Forums Hot Topics Gallery
spc
Search similar:


uniqs
770
alla19l
join:2014-08-18

alla19l

Member

[Config] two tunnels on one outside interface

Hello, i have asa 5505 8.2
I want to use two vpn tunnels at the same time.
One is for cisco vpn client and one for android client (l2tp)

In this configuration, alternately running one or another vpn

crypto ipsec transform-set FirstSet esp-3des esp-md5-hmac
crypto ipsec transform-set trans esp-3des esp-sha-hmac
crypto ipsec transform-set trans mode transport
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000

crypto dynamic-map dyno 10 set transform-set trans
crypto dynamic-map dyn1 1 set transform-set FirstSet
crypto dynamic-map dyn1 1 set reverse-route

crypto map vpn 65535 ipsec-isakmp dynamic dyno
crypto map mymap 1 ipsec-isakmp dynamic dyn1
crypto map vpn interface outside

I tried to fix by making like this:

crypto dynamic-map dyno 10 set transform-set trans
crypto dynamic-map dyn1 1 set transform-set FirstSet
crypto dynamic-map dyn1 1 set reverse-route

crypto map outside_map 65534 ipsec-isakmp dynamic dyn1
crypto map outside_map 65535 ipsec-isakmp dynamic dyno
crypto map outside_map interface outside

I attached two different crypto dynamic-map: dyno and dyn1 at one crypto
map outside_map with different sequence numbers, the result - still at the
same time I can not connect through the Cisco VPN Client, and with android
phone (l2tp). Only connect via Cisco VPN Client.
HELLFIRE
MVM
join:2009-11-25

HELLFIRE

MVM

Two different tunnels, or two different phase1/2 proposals?

Here's the seperation I make
said by alla19l:

crypto ipsec transform-set FirstSet esp-3des esp-md5-hmac

...is one transform set
said by alla19l:

crypto ipsec transform-set trans esp-3des esp-sha-hmac

...is the other transform set

If so, then you should only have to build one crypto map and let the ASA offer each one accordingly
in sequence. Otherwise, not sure why you have them under two different crypto maps.

My 00000010bits

Regards