Hi Rahul,
The Hub-Site A and Hub-Site B tunnels are up. When I run show crypto ipsec sa I see entries for each subnet pair. For example: 10.25.0.0 (Site A) to 10.10.0.0 (Site B), 10.10.0.0 (Site B) to 10.25.0.0 (Site A) and 10.50.0.0 (Hub) to 10.25.0.0 (Site A):
Crypto map tag: outside_map, seq num: 6, local addr: 1.1.1.1
access-list outside_cryptomap_SiteB extended permit ip 10.25.0.0 255.255.0.0 10.10.0.0 255.255.0.0
local ident (addr/mask/prot/port): (10.25.0.0/255.255.0.0/0/0)
remote ident (addr/mask/prot/port): (10.10.0.0/255.255.0.0/0/0)
current_peer: 3.3.3.3
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 232, #pkts decrypt: 232, #pkts verify: 232
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#TFC rcvd: 0, #TFC sent: 0
#Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: 1.1.1.1/0, remote crypto endpt.: 3.3.3.3/0
path mtu 1500, ipsec overhead 74(44), media mtu 1500
PMTU time remaining (sec): 0, DF policy: copy-df
ICMP error validation: disabled, TFC packets: disabled
current outbound spi: B0DA1E28
current inbound spi : 88B61C10
inbound esp sas:
spi: 0x88B61C10 (2293636112)
transform: esp-aes-256 esp-sha-hmac no compression
in use settings ={L2L, Tunnel, IKEv1, }
slot: 0, conn_id: 76800000, crypto-map: outside_map
sa timing: remaining key lifetime (kB/sec): (4373955/17562)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0xFFFFFFFF 0xFFFFFFFF
outbound esp sas:
spi: 0xB0DA1E28 (2967084584)
transform: esp-aes-256 esp-sha-hmac no compression
in use settings ={L2L, Tunnel, IKEv1, }
slot: 0, conn_id: 76800000, crypto-map: outside_map
sa timing: remaining key lifetime (kB/sec): (4374000/17562)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
Crypto map tag: outside_map, seq num: 2, local addr: 1.1.1.1
access-list outside_cryptomap_SiteA extended permit ip 10.10.0.0 255.255.0.0 10.25.0.0 255.255.0.0
local ident (addr/mask/prot/port): (10.10.0.0/255.255.0.0/0/0)
remote ident (addr/mask/prot/port): (10.25.0.0/255.255.0.0/0/0)
current_peer: 2.2.2.2
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 623, #pkts decrypt: 623, #pkts verify: 623
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#TFC rcvd: 0, #TFC sent: 0
#Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: 1.1.1.1/0, remote crypto endpt.: 2.2.2.2/0
path mtu 1500, ipsec overhead 74(44), media mtu 1500
PMTU time remaining (sec): 0, DF policy: copy-df
ICMP error validation: disabled, TFC packets: disabled
current outbound spi: 41877D0F
current inbound spi : 0290153C
inbound esp sas:
spi: 0x0290153C (42997052)
transform: esp-aes-256 esp-sha-hmac no compression
in use settings ={L2L, Tunnel, IKEv1, }
slot: 0, conn_id: 76795904, crypto-map: outside_map
sa timing: remaining key lifetime (kB/sec): (4373853/12428)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0xFFFFFFFF 0xFFFFFFFF
outbound esp sas:
spi: 0x41877D0F (1099398415)
transform: esp-aes-256 esp-sha-hmac no compression
in use settings ={L2L, Tunnel, IKEv1, }
slot: 0, conn_id: 76795904, crypto-map: outside_map
sa timing: remaining key lifetime (kB/sec): (4374000/12428)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
Crypto map tag: outside_map, seq num: 2, local addr: 1.1.1.1
access-list outside_cryptomap_SiteA extended permit ip 10.50.0.0 255.255.0.0 10.25.0.0 255.255.0.0
local ident (addr/mask/prot/port): (10.50.0.0/255.255.0.0/0/0)
remote ident (addr/mask/prot/port): (10.25.0.0/255.255.0.0/0/0)
current_peer: 2.2.2.2
#pkts encaps: 9153909, #pkts encrypt: 9153909, #pkts digest: 9153909
#pkts decaps: 12535748, #pkts decrypt: 12535715, #pkts verify: 12535715
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 9153909, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#TFC rcvd: 0, #TFC sent: 0
#Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
#send errors: 0, #recv errors: 33
local crypto endpt.: 1.1.1.1/0, remote crypto endpt.: 2.2.2.2/0
path mtu 1500, ipsec overhead 74(44), media mtu 1500
PMTU time remaining (sec): 0, DF policy: copy-df
ICMP error validation: disabled, TFC packets: disabled
current outbound spi: 2ABDE286
current inbound spi : 033CB0E8
inbound esp sas:
spi: 0x033CB0E8 (54309096)
transform: esp-aes-256 esp-sha-hmac no compression
in use settings ={L2L, Tunnel, IKEv1, }
slot: 0, conn_id: 76795904, crypto-map: outside_map
sa timing: remaining key lifetime (kB/sec): (4373159/28326)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0xFFFFFFFF 0xFFFFFFFF
outbound esp sas:
spi: 0x2ABDE286 (717087366)
transform: esp-aes-256 esp-sha-hmac no compression
in use settings ={L2L, Tunnel, IKEv1, }
slot: 0, conn_id: 76795904, crypto-map: outside_map
sa timing: remaining key lifetime (kB/sec): (4372159/28326)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
>From the Hub, I can ping hosts in Site A and Site B - howewer, hosts in Site A can't ping hosts in Site B and vice-versa. If you look at the stats in the first two Cryptomaps above, you can see that no packets are being encapsulated: #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
So for some reason, packets sent from Site A to Site B (for example) are reaching the Hub and being decrypted, but not being encrypted and sent to Site B.
Regards
Alex
