IPSec between Cisco 5510 & OCI

[alomaprice02]

Greetings everyone, I’m writing to you out of sheer desperation, but I’ll give it a try anyway—maybe the collective intelligence here can help:

I’m trying to set up a site-to-site VPN between an on-premise network and an Oracle Cloud Infrastructure (OCI) tenant. The CPE is a Cisco 5510 running version 9.1.7 (which, according to Oracle, means it uses policy-based routing). On the on-prem side, there are two non-overlapping subnets, while on the cloud side there’s only one.

When I configure the subnets on both sides (cloud and Cisco), two SAs (Security Associations) are established—one for each subnet. Both are shown as UP on the cloud side, but only one is available on the CPE at any given time. So, even though both are flagged as UP in the cloud, only one actually works.

The problem is that I don’t have direct access to the device, so I’m somewhat in the dark at the moment. Has anyone here experienced something similar and might have an idea what could be tried or checked?

Of course I‘ll provide more details, just let me know what you need, I tried to sum it up as much as possible 🙂

[Enes Simnica]

gDay to u @alomaprice02 ur situation is a known limitation with the ASA 5510 when using policy-based VPNs. Cuase it only supports one proxy ID or and crypto acl enrty If I remember correctly... per tunnel at a time. And since OCI brings up two SAs (that is one per subnet), only one works from the ASA side.

If u check the Cisco docs, u'll see that u have some steps to fix this, such as: 

• Combine both on-prem subnets into a single crypto ACL entry , or
• Migrate to route-based VPN using VTI or
• Split into two separate tunnels, one per subnet.....

and long story short, basically its not Oci, its a limitation of the older Asa....

hope it helps and enjoy ur weekend!!!

-Enes

[Rob Ingram]

@alomaprice02 are you running IKEv1 or IKEv2? Can you provide the output of "show crypto ipsec sa" and "show crypto isakmp sa"

You should seriously consider replacing the ASA 5510 asap, as the hardware and the software version are well out of support.

[vishalbhandari]

According to me, you’re running into a common limitation with policy-based VPNs on older Cisco ASA models like the 5510. In a policy-based setup, each interesting traffic ACL (matching local and remote subnets) creates its own Security Association (SA). Since you have two on-prem subnets and one cloud subnet, the ASA is trying to create two SAs—one per subnet pair.

The issue is that ASAs running 9.1.x handle multiple SAs over the same tunnel in a limited way. Essentially, only one SA can be “active” at a time if both share the same crypto map entry and peer. The other may show as up on the OCI side, but the ASA will only pass traffic for one of them. That’s why it looks like both are UP on Oracle’s side, but only one actually works.