ASA ipsec-vpn troubleshoot

[tianwen.zhao]

Hello everyone,

We built a ipsec-vpn tunnel between siteA(10.234.0.0/16) and siteB(10.176.0.0/16)

the tunnel is up now ,but siteA's subnet can't ping siteB's subnet

Here are the packet-tracer output:

ciscoasa# packet-tracer input inside_1 icmp 10.234.10.101 0 0 10.176.0.170

Phase: 1
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop x.x.x.x using egress ifc outside

Phase: 2
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
nat (inside_1,outside) source static SiteA_subnet1 SiteA_subnet1 destination static SiteB_subnet1 SiteB_subnet1 no-proxy-arp route-lookup
Additional Information:
NAT divert to egress interface outside
Untranslate 10.176.0.170/0 to 10.176.0.170/0

Phase: 3
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (inside_1,outside) source static SiteA_subnet1 SiteA_subnet1 destination static SiteB_subnet1 SiteB_subnet1 no-proxy-arp route-lookup
Additional Information:
Static translate 10.234.10.101/0 to 10.234.10.101/0

Phase: 4
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 5
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 6
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
class-map inspection_default
match default-inspection-traffic
policy-map global_policy
class inspection_default
inspect icmp
service-policy global_policy global
Additional Information:

Phase: 7
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
Additional Information:

Phase: 8
Type: VPN
Subtype: encrypt
Result: DROP
Config:
Additional Information:

Result:
input-interface: inside_1
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

In Phase: 8 ,the result is drop, What will cause this ?

Thank you for answers

[Francesco Molino · Accepted solution]

Hi

Just for validation, can you run the following command:
sh run all sysopt

Check if you have "sysopt connection permit-vpn".
If not, (probably you won't have it enabled yet), you'll have 2 options:
- Option 1: modify your acls to allow communications for these subnets
- Option 2: enable that command and all vpn flows will bypass your interfaces' acls.

[tianwen.zhao]

Thank you for your reply

ciscoasa# sho run all sysopt
no sysopt traffic detailed-statistics
no sysopt connection timewait
sysopt connection tcpmss 1380
sysopt connection tcpmss minimum 0
sysopt connection permit-vpn
sysopt connection reclassify-vpn
no sysopt connection preserve-vpn-flows
no sysopt radius ignore-secret
no sysopt noproxyarp outside
no sysopt noproxyarp inside_4
no sysopt noproxyarp inside_5
no sysopt noproxyarp inside
no sysopt noproxyarp inside_1
!
access-list vpn_acl extended permit ip 10.234.0.0 255.255.0.0 10.176.0.0 255.255.0.0
!
sysopt connection permit-vpn is enabled

Thanks

[Francesco Molino]

You marked as correct answer. Is your issue solved?

If still dropping, can you share your config please?

[tianwen.zhao]

Thank you Francesco.
The issue have been solved.
The problem is that the ipsec-vpn phase 2 configuration of siteB's firewall didn't match SiteA's

Thanks