{"id":346,"date":"2009-04-08T01:56:11","date_gmt":"2009-04-08T07:56:11","guid":{"rendered":"http:\/\/gregsowell.com\/?p=346"},"modified":"2009-03-24T12:55:05","modified_gmt":"2009-03-24T18:55:05","slug":"asa-crypto-map-ordering","status":"publish","type":"post","link":"https:\/\/gregsowell.com\/?p=346","title":{"rendered":"ASA Crypto Map Ordering"},"content":{"rendered":"<p>A friend of mine was telling me about an ASA issue he was having.  His LAN-to-LAN tunnels would establish and cause intermittent connectivity issues.  He would be able to only get to some subnets on either side of the tunnel.  It wasn&#8217;t always the same subnets, nor would it always happen.  His ACLs were the same on either side, as well as his crypto map sequencing.  <\/p>\n<p>Below is similar to what his maps looked like:<\/p>\n<pre class=\"gs-code\"><code class=\"language-plaintext\">crypto map global_map 10 match address outside_1_cryptomap_1\r\ncrypto map global_map 10 set pfs\r\ncrypto map global_map 10 set peer 1.1.1.1\r\ncrypto map global_map 10 set transform-set ESP-AES-128-SHA\r\ncrypto map global_map 10 set security-association lifetime seconds 28800\r\ncrypto map global_map 10 set security-association lifetime kilobytes 4608000\r\ncrypto map global_map 15 ipsec-isakmp dynamic global_dyn_map !!!!here is our dynamic!!!!!!!\r\ncrypto map global_map 20 match address outside_2_cryptomap_2\r\ncrypto map global_map 20 set pfs\r\ncrypto map global_map 20 set peer 2.2.2.2\r\ncrypto map global_map 20 set transform-set ESP-3DES-SHA\r\ncrypto map global_map 20 set security-association lifetime seconds 28800\r\ncrypto map global_map 20 set security-association lifetime kilobytes 4608000<\/code><\/pre>\n<p>The issue was that he had his dynamic mapping in the middle of his crypto sequence.  Once he moved it to the end, all was well:<\/p>\n<pre class=\"gs-code\"><code class=\"language-plaintext\">crypto map global_map 10 match address outside_1_cryptomap_1\r\ncrypto map global_map 10 set pfs\r\ncrypto map global_map 10 set peer 1.1.1.1\r\ncrypto map global_map 10 set transform-set ESP-AES-128-SHA\r\ncrypto map global_map 10 set security-association lifetime seconds 28800\r\ncrypto map global_map 10 set security-association lifetime kilobytes 4608000\r\ncrypto map global_map 20 match address outside_2_cryptomap_2\r\ncrypto map global_map 20 set pfs\r\ncrypto map global_map 20 set peer 2.2.2.2\r\ncrypto map global_map 20 set transform-set ESP-3DES-SHA\r\ncrypto map global_map 20 set security-association lifetime seconds 28800\r\ncrypto map global_map 20 set security-association lifetime kilobytes 4608000\r\ncrypto map global_map 65535 ipsec-isakmp dynamic global_dyn_map !!!!our dynamic at the end!!!<\/code><\/pre>\n<p>Every example I&#8217;ve ever seen had these dynamics at the end, but I didn&#8217;t think it would affect your L2Ls this way.<\/p>\n<p>Thanks for the tip Brian!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A friend of mine was telling me about an ASA issue he was having. His LAN-to-LAN tunnels would establish and cause intermittent connectivity issues.\u2026<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[16],"tags":[],"class_list":["post-346","post","type-post","status-publish","format-standard","hentry","category-cisco"],"_links":{"self":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/346","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=346"}],"version-history":[{"count":10,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/346\/revisions"}],"predecessor-version":[{"id":466,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/346\/revisions\/466"}],"wp:attachment":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=346"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=346"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=346"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}