topic Cisco FMC - VPN traffic is not matching the rules - Eventviewer Empty in Network Security

Cisco FMC - VPN traffic is not matching the rules - Eventviewer Empty

IvanAlvarenga25979 — Wed, 14 Jul 2021 15:48:48 GMT

Hi Guys,

I noticed that all the HITS COUNTS of all OUTSIDE rules are empty. I enabled LOGGING but I can't even see the traffic coming from Outside to Inside

Outise > IPSEC Tunnel > Inside

Any ideas why

thanks

Re: Cisco FMC - VPN traffic is not matching the rules - Eventviewer Empty

Rob Ingram — Wed, 14 Jul 2021 15:54:52 GMT

@IvanAlvarenga25979

Has the VPN been established? Run the command "show crypto ipsec sa" from the CLI of the FTD and check the encaps and decaps counters are increasing.

If the counters are not increasing, do you have a NAT exemption rule, that ensures traffic destined over the VPN is not unintentially translated.

Please provide a screenshot of your Access Control policies, related to the VPN acces.

Re: Cisco FMC - VPN traffic is not matching the rules - Eventviewer Empty

IvanAlvarenga25979 — Wed, 14 Jul 2021 16:49:00 GMT

Hi Rob,

The VPN is established and working fine. The only issue is that I can't see any hits from Outside to Inside. I can't even see the VPN traffic from Outside to Inside

I have NAT from INSIDE to OUTSIDE on both ends

Re: Cisco FMC - VPN traffic is not matching the rules - Eventviewer Empty

IvanAlvarenga25979 — Wed, 14 Jul 2021 18:46:27 GMT

The issue was the Bypass Access Control policy for decrypted traffic (sysopt permit-vpn)

it's disabled by default on the Cisco FDM, but enabled by default on the Cisco FMC.