Hurricane Electric's IPv6 Tunnel Broker Forums

Advanced search  

News:

Welcome to Hurricane Electric's Tunnelbroker.net forums!

Pages: 1 [2]

Author Topic: How to make a Cisco ASA work with only one public IP address  (Read 33378 times)

cholzhauer

  • Hero Member
  • *****
  • Posts: 2724
Re: How to make a Cisco ASA work with only one public IP address
« Reply #15 on: December 02, 2010, 05:08:56 AM »

Quote
And this is also confusing, since I have a ipv6 rule saying allow inside net to any protocol any.

Maybe it's too early in the morning still, but I don't see anything like that in the config you sent
Logged

gflygt

  • Newbie
  • *
  • Posts: 13
Re: How to make a Cisco ASA work with only one public IP address
« Reply #16 on: December 02, 2010, 10:34:41 AM »

When I run packet tracer on the external interface from my side of the tunnel to the other with protocol 41, everything looks fine (all green) But I get (rpf-violated) Reverse-path verify failed.

Maybe I should upload a new config. I've been saving so many different that I might have choosen the wrong one.

What does this mean?
« Last Edit: December 02, 2010, 10:36:35 AM by gflygt »
Logged

cholzhauer

  • Hero Member
  • *****
  • Posts: 2724
Re: How to make a Cisco ASA work with only one public IP address
« Reply #17 on: December 02, 2010, 10:37:56 AM »

I had that problem before and I'm trying to remember how I fixed it.  I'm pretty sure it means that the ASA can't determine where the packet originated.  So if you're doing a trace from your outside interface to the other end of your tunnel and you use an address that should be located on an inside interface, you'll receive that error.
Logged

gflygt

  • Newbie
  • *
  • Posts: 13
Re: How to make a Cisco ASA work with only one public IP address
« Reply #18 on: December 02, 2010, 10:45:37 AM »

Code: [Select]
: Saved
:
ASA Version 8.3(2)
!
hostname wall
domain-name gflyg.se
enable password 86jCl42PVQo encrypted
passwd 2KFQnbNIdI.KYOU encrypted
names
name 192.168.0.21 enigma.gflygt.se
name 192.168.0.22 mac.gflyg.se
name 192.168.0.101 ns1.gflyg.se description Mailhost och DNS
name 192.168.0.111 wall-2.gflyg.se description ASA 5505
name 83.227.135.66 wall.gflyg.se description External interface
name 134.25.0.33 portos description Proxy SR
name 192.168.0.31 afrodite.gflyg.se description Stora MAC-en
name 2001:470:28:277::1 Inside-v6.gflyg.se description Inside of ASA
name 2001:470:27:277::2 wall-v6.gflyg.se description My side of the tunnel
!
interface Vlan1
 nameif inside
 security-level 100
 ip address wall-2.gflyg.se 255.255.255.0
 ipv6 address 2001:470:28:277::/64 eui-64
 ipv6 address fe80::223:5eff:fe23:8b7f link-local
 ipv6 address autoconfig
 ipv6 enable
!
interface Vlan2
 nameif outside
 security-level 0
 ip address wall.gflygt.se 255.255.255.192
 ipv6 address wall-v6.gflyg.se/64
 ipv6 address fe80::223:5eff:fe23:8b7f link-local
 ipv6 enable
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
boot system disk0:/asa832-k8.bin
ftp mode passive
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
dns domain-lookup inside
dns server-group DefaultDNS
 name-server ns1.gflyg.se
 domain-name gflyg.se
object network ns1.gflyg.se
 host 192.168.0.101
object network obj_any
 subnet 0.0.0.0 0.0.0.0
object network obj_any-01
 subnet 0.0.0.0 0.0.0.0
object network obj-0.0.0.0
 host 0.0.0.0
object network wall.gflyg.se
 host 83.227.135.66
 description Created during name migration  
object network portos
 host 134.25.0.133
 description Created during name migration  
object network local_endpoint
 host 83.227.135.66
 description External interface  
object network remote_endpoint
 host 216.66.80.90
 description Endpoint at HE  
object network HE_Server
 host 2001:470:27:277::1
 description HE Andra sidan tunnel  
object service 6in4
 service 41
object network Inside-network
 subnet 2001:470:28:277::/64
 description Internal Network
object-group protocol TCPUDP
 protocol-object udp
 protocol-object tcp
object-group service DM_INLINE_SERVICE_1
 service-object icmp6 echo
 service-object icmp6 echo-reply
 service-object icmp6 neighbor-advertisement
 service-object icmp6 neighbor-redirect
 service-object icmp6 time-exceeded
 service-object icmp6 unreachable
access-list outside_access_in remark Incoming DNS requests
access-list outside_access_in extended permit object-group TCPUDP any object wall.gflygt.se eq domain
access-list outside_access_in remark Incoming mail to gflygt.se
access-list outside_access_in extended permit tcp any object wall.gflygt.se eq smtp
access-list outside_access_in remark Acess Portos -> ns1.gflygt.se
access-list outside_access_in extended permit 222 object portos object ns1.gflygt.se
access-list 101 extended permit icmp any any echo-reply
access-list 101 extended permit icmp any any source-quench
access-list 101 extended permit icmp any any unreachable
access-list 101 extended permit icmp any any time-exceeded
access-list tunnel extended permit object 6in4 object remote_endpoint object local_endpoint
access-list Access_Mac webtype permit url ssh://mac.gflygt.se log default
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
ip local pool Pool-1 192.168.0.141-192.168.0.149 mask 255.255.255.0
ip verify reverse-path interface outside
ipv6 enforce-eui64 inside
ipv6 route inside ::/0 2001:470:27:277::1
ipv6 access-list inside_access_ipv6_in remark Access till min sida
ipv6 access-list inside_access_ipv6_in permit object-group TCPUDP object Inside-network any
ipv6 access-list inside_access_ipv6_in permit object-group DM_INLINE_SERVICE_1 object Inside-network any
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-634-53.bin
no asdm history enable
arp timeout 14400
nat (inside,outside) source static local_endpoint interface destination static remote_endpoint remote_endpoint
!
object network ns1.gflyg.se
 nat (inside,outside) static interface service tcp smtp smtp
object network ns1.gflyg.se-01
 nat (inside,outside) static interface service tcp domain domain
object network ns1.gflyg.se-02
 nat (inside,outside) static interface service udp domain domain
object network ns1.gflyg.se-03
 nat (inside,outside) static interface service tcp ssh 222
object network obj_any
 nat (inside,outside) dynamic interface
object network obj_any-01
 nat (inside,outside) dynamic obj-0.0.0.0
access-group inside_access_ipv6_in in interface inside
access-group tunnel in interface outside
route outside 0.0.0.0 0.0.0.0 83.227.135.65 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication http console LOCAL
aaa authentication ssh console LOCAL
http server enable
http 192.168.0.0 255.255.255.0 inside
http redirect outside 80
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime seconds 28800
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime kilobytes 4608000
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto ca trustpoint ASDM_TrustPoint0
 enrollment self
 email gunnar.flyg@bredband.net
 subject-name CN=wall.gflyg.se
 crl configure
crypto ca certificate chain ASDM_TrustPoint0
 certificate 8ec54d49
    30820324 3082020c a0030201 0202048e c54d4930 0d06092a 864886f7 0d010104
    05003054 31173015 06035504 03130e77 616c6c2e 67666c79 67742e73 65313930
    1a06092a 864886f7 0d010908 130d3833 2e323237 2e313335 2e363630 1b06092a
    38b9a8ef c9cb7f0d 2f552633 9471bf71 d0cdebcd 6ed09c5a 4528fa39 fff218a5
    9e7481c0 e918a43f e3bc8b12 d0983302 03010001 300d0609 2a864886 f70d0101
    04050003 82010100 1edbd3f8 0772e955 6f583074 b8d257e2 ed078e1c 6f6bbc12
    0a6a1a0e 1078c30f feda23c3 f08d1159 4447b517 a24ddef8 191cc3a5 a73a60b5
    84be1100 8857f338 db55d67f 48238c6d 888c0a0d dc1de65d 0b385709 3cb86223
    d18fbbc4 0170370d 4b1e8627 eaa03e39 3cccd575 768e41e0 b4c8abf9 a6f33070
    d354b5f3 a778094d b3018619 76466c8b 26e0452b d147eaf5 3cbe8750 21194fd0
    98293c86 2f2044b9 e1849837 97fdc48b b45ac2f4 073d350d 2006ad76 38bd5ca4
    870efd89 73043e8f 0f5e46fb 5adeff9a e279e542 ac6d5a58 0af89972 6f6bea96
    f58d3126 bc4075ef 8d25c600 89f196af a237d088 94a30fe0 7ea96e3e b12369f9
    ac3a7cc2 e10cfe76
  quit
crypto isakmp enable outside
crypto isakmp policy 5
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 10
 authentication pre-share
 encryption des
 hash sha
 group 2
 lifetime 86400
telnet timeout 5
ssh scopy enable
ssh enigma.gflygt.se 255.255.255.255 inside
ssh mac.gflygt.se 255.255.255.255 inside
ssh afrodite.gflygt.se 255.255.255.255 inside
ssh 192.168.0.41 255.255.255.255 inside
ssh timeout 5
ssh version 2
console timeout 0
dhcpd dns 195.54.122.200
dhcpd option 15 ascii gflygt.se
!
dhcpd address 192.168.0.2-192.168.0.10 inside
dhcpd dns ns1.gflygt.se interface inside
dhcpd domain gflygt.se interface inside
dhcpd enable inside
!

threat-detection basic-threat
threat-detection statistics port
threat-detection statistics protocol
threat-detection statistics access-list
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
ntp server 195.54.122.168 source outside prefer
ntp server 195.54.122.100 source outside
ssl trust-point ASDM_TrustPoint0
ssl trust-point ASDM_TrustPoint0 outside
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny  
  inspect sunrpc
  inspect xdmcp
  inspect sip  
  inspect netbios
  inspect tftp
  inspect ip-options
!
service-policy global_policy global
prompt hostname context
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:7f1e6ed191875dc729367
: end
asdm image disk0:/asdm-634-53.bin
asdm location enigma.gflygt.se 255.255.255.255 inside
asdm location mac.gflygt.se 255.255.255.255 inside
asdm location ns1.gflygt.se 255.255.255.255 inside
asdm location wall-2.gflygt.se 255.255.255.255 inside
asdm location wall.gflygt.se 255.255.255.255 inside
asdm location portos 255.255.255.255 inside
asdm location afrodite.gflygt.se 255.255.255.255 inside
asdm location wall-v6.gflygt.se/128 inside
asdm location Inside-v6.gflygt.se/128 inside
no asdm history enable
« Last Edit: December 07, 2010, 02:14:21 AM by gflygt »
Logged

lukec

  • Jr. Member
  • **
  • Posts: 65
    • Home
Re: How to make a Cisco ASA work with only one public IP address
« Reply #19 on: December 04, 2010, 01:57:19 AM »

Both your inside and outside interfaces have the same link-local addresses (vlan1 & 2)
Code: [Select]
interface Vlan1
 nameif inside
 ipv6 address fe80::223:5eff:fe23:8b7f link-local
!
interface Vlan2
 nameif outside
 ipv6 address fe80::223:5eff:fe23:8b7f link-local
Is this valid?
Your rpf errors are "reverse path forwarding" errors being generated by this config
Code: [Select]
ip verify reverse-path interface outside as cholzhauer states...

rgds
lukec
Logged

gflygt

  • Newbie
  • *
  • Posts: 13
Re: How to make a Cisco ASA work with only one public IP address
« Reply #20 on: December 04, 2010, 02:15:06 AM »

Hmm, dont know why it became like that. But when I remove both link local addresses I get the same error.
Logged

gflygt

  • Newbie
  • *
  • Posts: 13
Re: How to make a Cisco ASA work with only one public IP address
« Reply #21 on: December 04, 2010, 07:04:37 AM »

I slight difference occurs when I reboot. Then it says like this in the log:

Deny IPv6 reverse path check from wall-v6.gflygt.se to 2001:470:27:277::1 on interface outside
Logged

cholzhauer

  • Hero Member
  • *****
  • Posts: 2724
Re: How to make a Cisco ASA work with only one public IP address
« Reply #22 on: December 04, 2010, 03:06:57 PM »

I don't know if this matters or not, but wall-v6.gflygt.se only seems to have a IPv4 address
Logged

gflygt

  • Newbie
  • *
  • Posts: 13
Re: How to make a Cisco ASA work with only one public IP address
« Reply #23 on: December 05, 2010, 03:34:43 AM »

In the config it says:

name 2001:470:27:277::2 wall-v6.gflygt.se description My side of the tunnel

So I disagree. :)
Logged

gflygt

  • Newbie
  • *
  • Posts: 13
Re: How to make a Cisco ASA work with only one public IP address
« Reply #24 on: December 30, 2010, 02:32:09 PM »

I gave this up, and now have a full working tunnel environment, using my old OpenBSD firewall.  ;D

Easy to set up and working like a charm.

/Gunnar
Logged
Pages: 1 [2]