we are facing the issue explained below. packets are not being encapsulated, encrypted to the IPSec tunnel on following SA
10.118.32.0 255.255.240.0 10.100.0.0 255.255.255.0
ipsec sa clearing does not fix the problem.
asa version is ASA 9.2(2)4
FW1# packet-tracer input inside icmp 10.118.32.251 8 0 10.100.0.251 det
Phase: 1
Type: CAPTURE
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7fffa2d5ce40, priority=13, domain=capture, deny=false
hits=1492739, user_data=0x7fffa2266270, cs_id=0x0, l3_type=0x0
src mac=0000.0000.0000, mask=0000.0000.0000
dst mac=0000.0000.0000, mask=0000.0000.0000
input_ifc=inside, output_ifc=any
Phase: 2
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7fffa2208ab0, priority=1, domain=permit, deny=false
hits=82519006, user_data=0x0, cs_id=0x0, l3_type=0x8
src mac=0000.0000.0000, mask=0000.0000.0000
dst mac=0000.0000.0000, mask=0100.0000.0000
input_ifc=inside, output_ifc=any
Phase: 3
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
in 10.100.0.0 255.255.255.0 via 188.0.129.65, outside
Phase: 4
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
nat (inside,outside) source static aktau_networks aktau_networks destination static azersun_networks azersun_networks no-proxy-arp route-lookup
Additional Information:
NAT divert to egress interface outside
Untranslate 10.100.0.251/0 to 10.100.0.251/0
Phase: 5
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
in 10.118.32.0 255.255.255.0 inside
Phase: 6
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group inside_in in interface inside
access-list inside_in extended permit ip 10.118.32.0 255.255.240.0 any
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7fffa310ce20, priority=13, domain=permit, deny=false
hits=33658, user_data=0x7fff9e2d3f80, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
src ip/id=10.118.32.0, mask=255.255.240.0, port=0, tag=0
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
input_ifc=inside, output_ifc=any
Phase: 7
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (inside,outside) source static aktau_networks aktau_networks destination static azersun_networks azersun_networks no-proxy-arp route-lookup
Additional Information:
Static translate 10.118.32.251/0 to 10.118.32.251/0
Forward Flow based lookup yields rule:
in id=0x7fffa307efb0, priority=6, domain=nat, deny=false
hits=394641, user_data=0x7fffa2eda160, cs_id=0x0, flags=0x0, protocol=0
src ip/id=10.118.32.0, mask=255.255.240.0, port=0, tag=0
dst ip/id=10.100.0.0, mask=255.255.255.0, port=0, tag=0, dscp=0x0
input_ifc=inside, output_ifc=outside
Phase: 8
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7fffa1604d20, priority=0, domain=nat-per-session, deny=true
hits=14868368, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
input_ifc=any, output_ifc=any
Phase: 9
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7fffa2e4a150, priority=0, domain=inspect-ip-options, deny=true
hits=5320034, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
input_ifc=inside, output_ifc=any
Phase: 10
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
class-map inspection_default
match default-inspection-traffic
policy-map global_policy
class inspection_default
inspect icmp
service-policy global_policy global
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7fffa2109520, priority=70, domain=inspect-icmp, deny=false
hits=63772, user_data=0x7fffa2e5df90, cs_id=0x0, use_real_addr, flags=0x0, protocol=1
src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=0, tag=0
dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, tag=0, dscp=0x0
input_ifc=inside, output_ifc=any
Phase: 11
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7fffa2e49f50, priority=66, domain=inspect-icmp-error, deny=false
hits=63772, user_data=0x7fffa2115770, cs_id=0x0, use_real_addr, flags=0x0, protocol=1
src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=0, tag=0
dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, tag=0, dscp=0x0
input_ifc=inside, output_ifc=any
Phase: 12
Type: VPN
Subtype: encrypt
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
out id=0x7fffa184a260, priority=70, domain=encrypt, deny=false
hits=481343, user_data=0x8e5650c, cs_id=0x7fffa2d567f0, reverse, flags=0x0, protocol=0
src ip/id=10.118.32.0, mask=255.255.240.0, port=0, tag=0
dst ip/id=10.100.0.0, mask=255.255.255.0, port=0, tag=0, dscp=0x0
input_ifc=any, output_ifc=outside
Phase: 13
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
nat (inside,outside) source static aktau_networks aktau_networks destination static azersun_networks azersun_networks no-proxy-arp route-lookup
Additional Information:
Forward Flow based lookup yields rule:
out id=0x7fffa3671050, priority=6, domain=nat-reverse, deny=false
hits=399784, user_data=0x7fffa22b1cb0, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
src ip/id=10.118.32.0, mask=255.255.240.0, port=0, tag=0
dst ip/id=10.100.0.0, mask=255.255.255.0, port=0, tag=0, dscp=0x0
input_ifc=inside, output_ifc=outside
Phase: 14
Type: VPN
Subtype: ipsec-tunnel-flow
Result: ALLOW
Config:
Additional Information:
Reverse Flow based lookup yields rule:
in id=0x7fff9ab1f560, priority=70, domain=ipsec-tunnel-flow, deny=false
hits=616087, user_data=0x8e5954c, cs_id=0x7fffa2d567f0, reverse, flags=0x0, protocol=0
src ip/id=10.100.0.0, mask=255.255.255.0, port=0, tag=0
dst ip/id=10.118.32.0, mask=255.255.240.0, port=0, tag=0, dscp=0x0
input_ifc=outside, output_ifc=any
Phase: 15
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
Reverse Flow based lookup yields rule:
in id=0x7fffa1604d20, priority=0, domain=nat-per-session, deny=true
hits=14868370, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
input_ifc=any, output_ifc=any
Phase: 16
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Reverse Flow based lookup yields rule:
in id=0x7fffa2cfc970, priority=0, domain=inspect-ip-options, deny=true
hits=17030658, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
input_ifc=outside, output_ifc=any
Phase: 17
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 26223998, packet dispatched to next module
Module information for forward flow ...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_inspect_icmp
snp_fp_translate
snp_fp_adjacency
snp_fp_encrypt
snp_fp_fragment
snp_ifc_stat
Module information for reverse flow ...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_ipsec_tunnel_flow
snp_fp_translate
snp_fp_inspect_icmp
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat
Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: allow
===========================================================================
FW1# sh capture mon
2 packets captured
1: 02:04:56.656872 10.118.32.251 > 10.100.0.251: icmp: echo request
2: 02:04:58.654461 10.118.32.251 > 10.100.0.251: icmp: echo request
2 packets shown
============================================================================
Crypto map tag: crypto_map_outside_1, seq num: 2, local addr: 188.0.129.126
access-list vpn_azersun extended permit ip 10.118.32.0 255.255.240.0 10.100.0.0 255.255.255.0
local ident (addr/mask/prot/port): (10.118.32.0/255.255.240.0/0/0)
remote ident (addr/mask/prot/port): (10.100.0.0/255.255.255.0/0/0)
current_peer: 185.230.199.240
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 6417, #pkts decrypt: 6417, #pkts verify: 6417
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#TFC rcvd: 0, #TFC sent: 0
#Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: 188.0.129.126/500, remote crypto endpt.: 185.230.199.240/500
path mtu 1500, ipsec overhead 78(44), media mtu 1500
PMTU time remaining (sec): 0, DF policy: copy-df
ICMP error validation: disabled, TFC packets: disabled
current outbound spi: 7BAFAE72
current inbound spi : 79A4F213
inbound esp sas:
spi: 0x79A4F213 (2040853011)
transform: esp-aes-256 esp-sha-256-hmac no compression
in use settings ={L2L, Tunnel, PFS Group 14, IKEv2, }
slot: 0, conn_id: 2789376, crypto-map: crypto_map_outside_1
sa timing: remaining key lifetime (kB/sec): (4146861/24761)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0xFFFFFFFF 0xFFFFFFFF
outbound esp sas:
spi: 0x7BAFAE72 (2075111026)
transform: esp-aes-256 esp-sha-256-hmac no compression
in use settings ={L2L, Tunnel, PFS Group 14, IKEv2, }
slot: 0, conn_id: 2789376, crypto-map: crypto_map_outside_1
sa timing: remaining key lifetime (kB/sec): (3916800/24761)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
