Routing failed to locate next-hop IPSEC-VPN

[MarceloOrtiz2607]

Hi, In the network that I manage we have a firewall device Cisco Asa 5515 and we have 2 ISP links (outiside and ouside2)

I have ipsec configured for vpn access on both links. Through the interface outside2 I can access correctly, however, when I try to access through the outside, I cannot connect.

Checking the logs I found the following error

An error occurred when the ASA tried to find the next hop on an interface routing table.

Routing failed to locate next-hop for protocol from srcinterface:src IP/src port to dest interface:dest IP/dest port

Any idea that it may be failing?

Pd: the ipsec configuration is exactly the same for both interfaces, the static routes are configured in the device in the same way

Thank you in advance.

[Julio E. Moisa]

Hi

It looks like you have not create the static NAT to avoid the traffic is going to internet instead the VPN tunnel.

Regards. 

[MarceloOrtiz2607]

Hi,

Thanks for your answer a route to where it should generate?

I clarify that it is a VPN remote access tunnel

route outside2 0.0.0.0 0.0.0.0 200.68.xx.xxx 2 track 2

route outside 0.0.0.0 0.0.0.0 200.72.xx.xx 10
route outside3 0.0.0.0 0.0.0.0 186.10.xx.xx 30
route outside4 0.0.0.0 0.0.0.0 200.68.xx.xx 40
route outside5 0.0.0.0 0.0.0.0 200.113.xx.xxx 50

[Diana Karolina Rojas]

Las rutas hacia fuera se ven bien, podría ser lo que Julio te comenta acerca del NAT. Sería bueno tambien que pudieras ver los logs en tiempo real en el ASMD filtrandolos con la IP publica de la interfaz outside para ver mas detalles del inconveniente.

Saludos,

[MarceloOrtiz2607]

Hola!

gracias por tu respuesta.

al mirar los log el único error con el que cuento es el que menciono

An error occurred when the ASA tried to find the next hop on an interface routing table.

Routing failed to locate next-hop for protocol from srcinterface:src IP/src port to dest interface:dest IP/dest port

algún comando para verificar la configuración de los NAT?

Muchas gracias

[Diana Karolina Rojas]

Para revisar la configuración pues tendrías que revisar el show run directamente o verlo en la GUI del ASDM, hay algunos otros comandos para NAT, pero son para ver las traducciones o las estadísticas (como estos: show nat detail y show conn all). Respeto a los Logs yo no me resfiero a los Logs del CLI, generalmente el ASDM muestra mucho mas ¿no tienes acceso a la GUI? 

***Por favor no olvides calificar y/o marcar como solución las respuestas útiles, tu calificación promueve nuestra participación.***

Saludos,

[MarceloOrtiz2607]

Hola, esto es lo que veo en los registros de ASDM

Mar 25 2020

15:34:33

110003

Ifc

190.46.76.131

62465

Routing failed to locate next hop for udp from NP Identity Ifc:200.72.137.170/62465 to outside:190.46.76.131/62465

Mar 25 2020

15:34:32

713202

IP = 190.46.76.131

Duplicate first packet detected.  Ignoring packet.

Mar 25 2020

15:34:27

713202

IP = 190.46.76.131

Duplicate first packet detected.  Ignoring packet.

Mar 25 2020

15:34:22

713202

IP = 190.46.76.131

Duplicate first packet detected.  Ignoring packet.

Mar 25 2020

15:34:20

110003

Ifc

190.46.76.131

62465

Routing failed to locate next hop for udp from NP Identity Ifc:200.72.137.170/62465 to outside:190.46.76.131/62465

Mar 25 2020

15:34:20

713236

IP = 190.46.76.131

IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + KE (4) + NONCE (10) + ID (5) + HASH (8) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NAT-D (20) + NAT-D (20) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 440

Mar 25 2020

15:34:20

715048

Group = VPN-users-externos

IP = 190.46.76.131

Send Altiga/Cisco VPN3000/Cisco ASA GW VID

Mar 25 2020

15:34:20

715046

Group = VPN-users-externos

IP = 190.46.76.131

constructing VID payload

Mar 25 2020

15:34:20

715046

Group = VPN-users-externos

IP = 190.46.76.131

constructing Fragmentation VID + extended capabilities payload

Mar 25 2020

15:34:20

713906

Group = VPN-users-externos

IP = 190.46.76.131

computing NAT Discovery hash

Mar 25 2020

15:34:20

715046

Group = VPN-users-externos

IP = 190.46.76.131

constructing NAT-Discovery payload

Mar 25 2020

15:34:20

713906

Group = VPN-users-externos

IP = 190.46.76.131

computing NAT Discovery hash

Mar 25 2020

15:34:20

715046

Group = VPN-users-externos

IP = 190.46.76.131

constructing NAT-Discovery payload

Mar 25 2020

15:34:20

715046

Group = VPN-users-externos

IP = 190.46.76.131

constructing NAT-Traversal VID ver RFC payload

Mar 25 2020

15:34:20

715046

Group = VPN-users-externos

IP = 190.46.76.131

constructing dpd vid payload

Mar 25 2020

15:34:20

715046

Group = VPN-users-externos

IP = 190.46.76.131

constructing xauth V6 VID payload

Mar 25 2020

15:34:20

715046

Group = VPN-users-externos

IP = 190.46.76.131

constructing Cisco Unity VID payload

Mar 25 2020

15:34:20

715076

Group = VPN-users-externos

IP = 190.46.76.131

Computing hash for ISAKMP

Mar 25 2020

15:34:20

715046

Group = VPN-users-externos

IP = 190.46.76.131

constructing hash payload

Mar 25 2020

15:34:20

715046

Group = VPN-users-externos

IP = 190.46.76.131

constructing ID payload

Mar 25 2020

15:34:20

713906

Group = VPN-users-externos

IP = 190.46.76.131

Generating keys for Responder...

Mar 25 2020

15:34:20

715046

Group = VPN-users-externos

IP = 190.46.76.131

constructing nonce payload

Mar 25 2020

15:34:20

715046

Group = VPN-users-externos

IP = 190.46.76.131

constructing ke payload

Mar 25 2020

15:34:20

715046

Group = VPN-users-externos

IP = 190.46.76.131

constructing ISAKMP SA payload

Mar 25 2020

15:34:20

715028

Group = VPN-users-externos

IP = 190.46.76.131

IKE SA Proposal # 1

Transform # 14 acceptable  Matches global IKE entry # 2

Mar 25 2020

15:34:20

715047

Group = VPN-users-externos

IP = 190.46.76.131

processing IKE SA payload

Mar 25 2020

15:34:20

713906

IP = 190.46.76.131

Connection landed on tunnel_group VPN-users-externos

Mar 25 2020

15:34:20

715049

IP = 190.46.76.131

Received Cisco Unity client VID

Mar 25 2020

15:34:20

715047

IP = 190.46.76.131

processing VID payload

Mar 25 2020

15:34:20

715047

IP = 190.46.76.131

processing VID payload

Mar 25 2020

15:34:20

715047

IP = 190.46.76.131

processing VID payload

Mar 25 2020

15:34:20

715047

IP = 190.46.76.131

processing VID payload

Mar 25 2020

15:34:20

715047

IP = 190.46.76.131

processing VID payload

Mar 25 2020

15:34:20

715049

IP = 190.46.76.131

Received DPD VID

Mar 25 2020

15:34:20

715047

IP = 190.46.76.131

processing VID payload

Mar 25 2020

15:34:20

715049

IP = 190.46.76.131

Received NAT-Traversal RFC VID

Mar 25 2020

15:34:20

715047

IP = 190.46.76.131

processing VID payload

Mar 25 2020

15:34:20

715049

IP = 190.46.76.131

Received NAT-Traversal ver 03 VID

Mar 25 2020

15:34:20

715047

IP = 190.46.76.131

processing VID payload

Mar 25 2020

15:34:20

715049

IP = 190.46.76.131

Received NAT-Traversal ver 02 VID

Mar 25 2020

15:34:20

715047

IP = 190.46.76.131

processing VID payload

Mar 25 2020

15:34:20

715047

IP = 190.46.76.131

processing VID payload

Mar 25 2020

15:34:20

715047

IP = 190.46.76.131

processing VID payload

Mar 25 2020

15:34:20

715049

IP = 190.46.76.131

Received xauth V6 VID

Mar 25 2020

15:34:20

715047

IP = 190.46.76.131

processing VID payload

Mar 25 2020

15:34:20

715047

IP = 190.46.76.131

processing ID payload

Mar 25 2020

15:34:20

715047

IP = 190.46.76.131

processing nonce payload

Mar 25 2020

15:34:20

715047

IP = 190.46.76.131

processing ISA_KE payload

Mar 25 2020

15:34:20

715047

IP = 190.46.76.131

processing ke payload

Mar 25 2020

15:34:20

715047

IP = 190.46.76.131

processing SA payload

Mar 25 2020

15:34:20

713236

IP = 190.46.76.131

IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + KE (4) + NONCE (10) + ID (5) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 1162

Mar 25 2020

15:34:20

302015

190.46.76.131

500

200.72.137.170

500

Built inbound UDP connection 865322685 for outside:190.46.76.131/500 (190.46.76.131/500) to identity:200.72.137.170/500 (200.72.137.170/500)

[Diana Karolina Rojas]

Estoy de acuerdo con Julio, es eso o tienes un problema de ruteo en el firewall.

***Por favor no olvides calificar las respuestas útiles, tu calificación promueve nuestra participación.***

Saludos,

[Julio E. Moisa]

La configuracion que te puede faltar es la siguiente, tomalo como referencia:

object network PRIVATE-IP (Enterprise IP)

host 172.16.1.100

object network REMOTE-IP (My IP Address)

host 192.168.10.55

nat (INSIDE,OUTSIDE) source static PRIVATE-IP PRIVATE-IP destination static REMOTE-IP REMOTE-IP

Con esto evitas que tu trafico de la ip 172.16.1.100 se vaya hacia Internet en lugar de irse a traves del tunel VPN.

El INSIDE, indica por donde se conoce la red o IP corporativa,

El OUTSIDE es por donde saldra el trafico, en este caso creo que seria tu outside que esta dando problemas. 

Puedes agregar al final del NAT: no-proxy-arp  route-lookup, prueba con lo primero antes. 

Saludos. 

[MarceloOrtiz2607]

Hola Julio,

Muchas gracias por tu ayuda..

hay algo que no me queda claro, para el caso de ser una configuracion para VPN ipsec remote access cual seria la dirección remota?, esto teniendo en cuenta que dependera de cada direccion del cliente que se conecte a mi red.

revisando los nat encontre lo siguiente:

nat (inside,outside) source static redes-internas redes-internas destination static red-users-vpn red-users-vpn route-lookup
nat (outside,inside) source static red-users-vpn red-users-vpn destination static redes-internas redes-internas route-lookup
nat (inside,outside2) source static redes-internas redes-internas destination static red-users-vpn red-users-vpn route-lookup
nat (outside2,inside) source static red-users-vpn red-users-vpn destination static redes-internas redes-internas route-lookup

red-user-vpn es el pool de direcciones que se le asigna a los clientes

[Julio E. Moisa]

Hola

Es posible que nos puedas compartir la configuracion ocultando informacion sensible como llaves o contraseñas?

Saludos 

[Julio E. Moisa]

Hola

Tienes una configuracion similar:

access-list INSIDE-TO-OUTSIDE permit ip <RED corporativa a la que se le llegara por VPN>

<red del local pool>

nat (inside) 0 access-list INSIDE-TO-OUTSIDE

la otra forma es como te lo mostre previamente utilizando el NAT estatico donde el destino es la red del pool local que has creado.

Saludos