The IPSec VPN realizes the network expansion, the firewall realizes the control and the filtering to the network traffic, therefore has the influence to the IPSec VPN communication.
The default ASA maintains a state session only for UDP/TCP traffic, and therefore discards the ESP traffic that is returned. There are two ways to solve the problem
One uses ACLs to release ESP traffic.
Two applications check IPSec VPN.
Experimental topology
R1 configuration:
Crypto ISAKMP Policy 10
ENCR 3DES
Authentication Pre-share
Group 2
Crypto ISAKMP key Cisco address 192.168.200.2 No-xauth
!
!
Crypto IPSec Transform-set Trans Esp-des Esp-md5-hmac
!
Crypto map R1 IPSEC-ISAKMP
Set Peer 192.168.200.2
Set Transform-set trans
Match Address VPN
!
Interface Loopback0
IP Address 1.1.1.1 255.255.255.0
!
Interface fastethernet0/0
IP address 192.168.100.1 255.255.255.0
Duplex Auto
Speed auto
Crypto map R1
IP Route 0.0.0.0 0.0.0.0 192.168.100.254
!
IP access-list Extended VPN
Permit IP 1.1.1.0 0.0.0.255 2.2.2.0 0.0.0.255
ASA configuration:
Interface ethernet0/0
Nameif outside
Security-level 0
IP address 192.168.100.254 255.255.255.0
!
Interface ETHERNET0/1
Nameif inside
Security-level 100
IP address 192.168.200.254 255.255.255.0