topic Re: Help with troubleshooting Firepower FTD VPN not passing traffic in Network Security

Help with troubleshooting Firepower FTD VPN not passing traffic

mhmservice — Fri, 21 Feb 2020 16:37:38 GMT

Hi all

I am currently building a proof of concept with the following topology. It is all built inside a single VMware ESXI host.

I intend to configure a full mesh VPN between all four FTD devices to route between the LAN subnets (10.1.0.0/24,10.2.0.0/24,10.3.0.0/24,10.4.0.0/24)

I have a basic "hide" NAT rule setup from inside to outside on each FTD and there is an "any-any" access control policy in place on all the firewalls to rule that out as an issue

PC 10.2.0.111 can ping the outside interface of FTD1 so I know the connectivity through R1 is working. The FMC can also connect to FTD2,FTD3,FTD4 management interfaces over R1 as they have been configured using this connection

The issue is I can't seem to ping the sites from each other, e.g. PC 10.2.0.111 is unable to ping 10.1.0.111. I have checked windows firewall is turned off on the VMs.

Here is the full mesh VPN config page from FMC:

I thought the problem was the NAT policy so I configured as follows to try to get connectivity to work on FTD1:

And on FTD2:

Show crypto ikev2 sa on FTD1 shows the tunnel (all other FTDs show similar)

I ran a trace and it says the traffic is allowed:

Does anyopne have more tips on how to troubleshoot this as i'm really stuck

All help appreciated

Re: Help with troubleshooting Firepower FTD VPN not passing traffic

matty-boy — Thu, 03 Jan 2019 15:57:50 GMT

Do you have access control policies to permit the traffic?

Re: Help with troubleshooting Firepower FTD VPN not passing traffic

mhmservice — Thu, 03 Jan 2019 16:26:31 GMT

I have the following policy on all FTD devices in place in an attempt to troubleshoot this:

Re: Help with troubleshooting Firepower FTD VPN not passing traffic

Sheraz.Salim — Thu, 03 Jan 2019 16:43:43 GMT

run a packet tracer to verify it first.

least it will tell you where the packet the droping

Re: Help with troubleshooting Firepower FTD VPN not passing traffic

mhmservice — Thu, 03 Jan 2019 16:50:55 GMT

I ran the following packet tracer and it says "DROP" for ipsec-tunnel-flow but im not sure what specifically that means

Re: Help with troubleshooting Firepower FTD VPN not passing traffic

Sheraz.Salim — Thu, 03 Jan 2019 17:14:27 GMT

i think you packet trace does not give accurate result in terms of vpn.

can you sent constant ping from Site1_Lan to Site2_Lan in mean time check if phase 1 and phase 2 come up.

if you have access to CLI on FTD give command

show crypto ikev1 sa

show crypto ipsec sa

Re: Help with troubleshooting Firepower FTD VPN not passing traffic

mhmservice — Fri, 04 Jan 2019 09:32:09 GMT

Sure

FTD1:

FTD2:

Re: Help with troubleshooting Firepower FTD VPN not passing traffic

Sheraz.Salim — Fri, 04 Jan 2019 09:35:01 GMT

can you please double check if the routing is properly in place. i can see the encap and no decap. most probably it could be a routing issue.

Re: Help with troubleshooting Firepower FTD VPN not passing traffic

mhmservice — Fri, 04 Jan 2019 09:56:18 GMT

I think that it is:

FTD1:

FTD2:

Re: Help with troubleshooting Firepower FTD VPN not passing traffic

Marvin Rhoads — Fri, 04 Jan 2019 11:15:08 GMT

Double check that FTD2 PC has FTD2 inside interface as its gateway. That's the routing that is suspect given your output that you shared.

Re: Help with troubleshooting Firepower FTD VPN not passing traffic

mhmservice — Tue, 08 Jan 2019 15:04:47 GMT

Finally fixed it ... subnet mask on PC 10.2.0.111 was set to 255.0.0.0 not 255.255.255.0 ...

Stupid mistake on my part, but a mystery solved!

Thanks for the hints