**(Failed)Attempt at bringing up the tunnel using the required interface**

HUB-FW(config)# packet-tracer input Site-A_PTP icmp 10.45.54.13 0 0 100.100.226.10de

Phase: 1
Type: CAPTURE
Subtype:
Result: ALLOW
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0xae659910, priority=13, domain=capture, deny=false
        hits=534759511, user_data=0xb3009d40, cs_id=0x0, l3_type=0x0
        src mac=0000.0000.0000, mask=0000.0000.0000
        dst mac=0000.0000.0000, mask=0000.0000.0000
        input_ifc=SITE-A_PTP , output_ifc=any

Phase: 2
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0xad9a53d8, priority=1, domain=permit, deny=false
        hits=974716511, user_data=0x0, cs_id=0x0, l3_type=0x8
        src mac=0000.0000.0000, mask=0000.0000.0000
        dst mac=0000.0000.0000, mask=0100.0000.0000
        input_ifc=SITE-A_PTP , output_ifc=any

Phase: 3
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   0.0.0.0         0.0.0.0         OUTSIDE

Phase: 4
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group SACA in interface SITE-A_PTP 
access-list SBCA extended permit ip object-group Stark-Real object-group Stark-Remote
**Removed Object Group Entries – The fact that it’s polling an access-group had me questioning the access-group as the root cause of the failure, however, the next phase performs that NAT as required, when comparing to the following successful packet-trace***
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0xae5fb4e8, priority=13, domain=permit, deny=false
        hits=24, user_data=0xab098b40, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
        src ip/id=10.45.54.13, mask=255.255.255.255, port=0, tag=0
        dst ip/id=100.100.226.10, mask=255.255.255.255, port=0, tag=0, dscp=0x0
        input_ifc=SITE-A_PTP , output_ifc=any

Phase: 5
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (SITE-A_PTP ,OUTSIDE) source static Stark-Real Stark-Trans
Additional Information:
Static translate 10.45.54.13/0 to 10.65.80.113/0
 Forward Flow based lookup yields rule:
 in  id=0xb2e342a8, priority=6, domain=nat, deny=false
        hits=28, user_data=0xad243740, cs_id=0x0, flags=0x0, protocol=0
        src ip/id=10.45.54.13, mask=255.255.255.255, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=SITE-A_PTP , output_ifc=OUTSIDE

Phase: 6
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0xad3546b8, priority=0, domain=nat-per-session, deny=true
        hits=13359435, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=any, output_ifc=any

Phase: 7
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0xada4f520, priority=0, domain=inspect-ip-options, deny=true
        hits=9305351, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=SITE-A_PTP , output_ifc=any

Phase: 8
Type: VPN
Subtype: ipsec-tunnel-flow
Result: DROP
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0xae5e4130, priority=70, domain=ipsec-tunnel-flow, deny=false
        hits=7, user_data=0x12e00bc, cs_id=0xb2f7c970, reverse, flags=0x0, protocol=0
        src ip/id=10.45.54.13, mask=255.255.255.255, port=0, tag=0
        dst ip/id=100.100.226.10, mask=255.255.255.255, port=0, tag=0, dscp=0x0
        input_ifc=SITE-A_PTP , output_ifc=any

Result:
input-interface: SITE-A_PTP 
input-status: up
input-line-status: up
output-interface: OUTSIDE
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

FW1# packet-tracer input HUB-PUB icmp 10.45.54.13 0 0 100.100.226.10 detail
(the issue with bring up the tunnel is that I have to use the interface "HUB-PUB” instead of “Site-A_PTP”, which is where Site-A Traffic is being routed through.)
Phase: 1
Type: CAPTURE
Subtype:
Result: ALLOW
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0xb2fea4d0, priority=13, domain=capture, deny=false
        hits=10759169, user_data=0xb2e33390, cs_id=0x0, l3_type=0x0
        src mac=0000.0000.0000, mask=0000.0000.0000
        dst mac=0000.0000.0000, mask=0000.0000.0000
        input_ifc=HUB-PUB, output_ifc=any

Phase: 2
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0xb2ec8248, priority=1, domain=permit, deny=false
        hits=97938959, user_data=0x0, cs_id=0x0, l3_type=0x8
        src mac=0000.0000.0000, mask=0000.0000.0000
        dst mac=0000.0000.0000, mask=0100.0000.0000
        input_ifc=HUB-PUB, output_ifc=any

Phase: 3
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   100.100.226.10  255.255.255.255 Outside

Phase: 4
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (HUB-PUB,Outside) source static Site-A-Real SiteC-NAT
Additional Information:
Static translate 10.54.45.13/0 to 10.70.80.113/0
 Forward Flow based lookup yields rule:
 in  id=0xafa401e8, priority=6, domain=nat, deny=false
        hits=3, user_data=0xafa64968, cs_id=0x0, flags=0x0, protocol=0
        src ip/id=10.54.4513, mask=255.255.255.255, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=STARK-PUB, output_ifc=Outside

Phase: 5
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0xad3546b8, priority=0, domain=nat-per-session, deny=true
        hits=13225465, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=any, output_ifc=any

Phase: 6
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0xaeebcba0, priority=0, domain=inspect-ip-options, deny=true
        hits=10273883, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=HUB-PUB, output_ifc=any

Phase: 7
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0xaeebc660, priority=66, domain=inspect-icmp-error, deny=false
        hits=59371, user_data=0xb308d498, cs_id=0x0, use_real_addr, flags=0x0, protocol=1
        src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, tag=0, dscp=0x0
        input_ifc=HUB-PUB, output_ifc=any

Phase: 8
Type: VPN
Subtype: ipsec-tunnel-flow
Result: ALLOW
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0xaf0c08c0, priority=13, domain=ipsec-tunnel-flow, deny=true
        hits=566393, user_data=0x0, cs_id=0x0, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=HUB-PUB, output_ifc=any

Phase: 9
Type: VPN
Subtype: encrypt
Result: ALLOW
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 out id=0xaf0c52f0, priority=70, domain=encrypt, deny=false
        hits=2, user_data=0x12aa82c, cs_id=0xada13a58, reverse, flags=0x0, protocol=0
        src ip/id=10.70.80.113, mask=255.255.255.255, port=0, tag=0
        dst ip/id=100.100.226.10, mask=255.255.255.255, port=0, tag=0, dscp=0x0
        input_ifc=any, output_ifc=Outside

Phase: 10
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
nat (HUB-PUB,Outside) source static Site-A-Real Site-A-NAT
Additional Information:
 Forward Flow based lookup yields rule:
 out id=0xafa41360, priority=6, domain=nat-reverse, deny=false
        hits=2, user_data=0xad1f8668, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
        src ip/id=10.54.45.13, mask=255.255.255.255, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=HUB-PUB, output_ifc=Outside

Phase: 11
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 23561361, packet dispatched to next module
Module information for forward flow ...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_translate
snp_fp_adjacency
snp_fp_encrypt
snp_fp_fragment
snp_ifc_stat

Module information for reverse flow ...

Result:
input-interface: HUB-PUB
input-status: up
input-line-status: up
output-interface: Outside
output-status: up
output-line-status: up
Action: allow

**“HUB_PUB_cryptomap” is currently the name of the crypto map because I was initially creating this crypto for the HUB-PUB interface. That is no longer required. I have just left the crypto map name in place while troubleshooting. I thought I should clarify to avoid any confusion**

SH CRYPTO IPSEC SA PEER 200.XX.XX.69
hub_FW# sh cry ipsec sa peer 200.XX.XX.69
peer address: 200.XX.XX.69
    Crypto map tag: HUB_PUB_map, seq num: 1, local addr: 123.123.165.158

      access-list HUB_PUB_cryptomap extended permit ip host 10.70.80.113 host 100.100.226.10 log
      local ident (addr/mask/prot/port): (10.70.80.113/255.255.255.255/0/0)
      remote ident (addr/mask/prot/port): (100.100.226.10/255.255.255.255/0/0)
      current_peer: 200.XX.XX.69

      #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
      #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #TFC rcvd: 0, #TFC sent: 0
      #Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 123.123.165.158/0, remote crypto endpt.: 200.XX.XX.69/0
      path mtu 1500, ipsec overhead 74(44), media mtu 1500
      PMTU time remaining (sec): 0, DF policy: copy-df
      ICMP error validation: disabled, TFC packets: disabled
      current outbound spi: F9E9761B
      current inbound spi : 7788DC71

    inbound esp sas:
      spi: 0x7788DC71 (2005458033)
         transform: esp-aes-256 esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, IKEv1, }
         slot: 0, conn_id: 252039168, crypto-map: HUB_PUB_map
         sa timing: remaining key lifetime (kB/sec): (3915000/28287)
         IV size: 16 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00000001
    outbound esp sas:
      spi: 0xF9E9761B (4192826907)
         transform: esp-aes-256 esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, IKEv1, }
         slot: 0, conn_id: 252039168, crypto-map: HUB_PUB_map
         sa timing: remaining key lifetime (kB/sec): (3915000/28287)
         IV size: 16 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00000001