For running some tests on a few new temporarysites I have bought some Edgerouter Lite-3 as I did not receive funding to buy Cisco equipment. As I have seen many good stories about connectivity between the EdgeMax products and Cisco I figured I try it out.
I'm running in to some issues and I hope it is to my lack of experience with the products. First I'll try to explain the site infrastructure;
SITE A: This is where the Cisco ASA is located
WAN IP: x.x.x.y
IKE:
HASH sha512
Encryption aes256
Authenthication pre-share
DH 5
Mode Main Mode
ESP
hash sha512
encryption aes256
SEL 28800
Mode: Tunnel
PFS Disabled
Subnet 10.10.10.0/24
SITE B: This is where the Edgeroute Lite is located with the following vpn configuration; (remove any identifiers)
WAN IP: y.y.y.x
ipsec {
auto-firewall-nat-exclude enable
disable-uniqreqids
esp-group *** {
compression disable
lifetime 28800
mode tunnel
pfs disable
proposal 1 {
encryption aes256
hash sha512
}
}
ike-group *** {
lifetime 28800
proposal 1 {
dh-group 5
encryption aes256
hash sha512
}
}
logging {
log-level 2
log-modes ike
log-modes esp
log-modes cfg
}
nat-traversal disable
site-to-site {
peer x.x.x.y {
authentication {
mode pre-shared-secret
pre-shared-secret thisisasecret![Man Happy Man Happy]()
}
connection-type initiate
default-esp-group ***
ike-group ***
local-address y.y.y.x
tunnel 1 {
esp-group ***
local {
prefix 10.10.11.0/24
}
remote {
prefix 10.10.10.0/24
}
}
}
}
}
However nothing seems to happen after configuring the vpn. I do not see any traffic on the ASA side and when checking the logging on the Edgerouter I do not see anything in the log except for the startup: The restart VPN command does work, but doesn't get things going;
Aug 7 21:37:13 00[DMN] Starting IKE charon daemon (strongSwan 5.2.2, Linux 3.10.20-UBNT, mips64)
show vpn ipsec sa
<empty result>
show vpn ipsec status
IPSec Process Running PID: 9048
0 Active IPsec Tunnels
I have changed the loglevel as you can see in the config but I see nothing;
When I'm trying to get some more info with "sudo swanctl --log" I expect to see some more details, but the log is empty.
For the time being I have completely removed the firewall on the WAN interface on the edgerouter, accepting all packets and protocols so this cannot be an issue;
When I check the traffic going out of the edgerouter with tcpdump I do not see any connection attempts whatsoever. If I connect my laptop to the edgerouter I have functional internet and I can reach the ASA's ip address.
Can anyone point me in the right direction?
Very thankful for any insight. If you require any additional info, please don't hesitate to ask