11-20-2017 05:24 PM - edited 02-21-2020 06:47 AM
Hi,
I haven't had much luck on responses to this however here goes. I have an IPSEC VPN tunnel up and connected. I can ping a remote IP address from a local address however I cannot Telnet to Port 55019 of the same remote IP Address. It seems that the Telnet traffic does not get sent to the IPSEC Tunnel. When I run ping I can see that the Bytes Tx and Bytes Rx byte count in the result of the show vpn-sessiondb l2l . When I run the Telnet command from the same PC the count does not change which means that the Telnet traffic is not entering the VPN.
Would appreciate any assistance forthcoming.
11-21-2017 12:02 AM
Hi there,
What is the output of:
sh crypto map
If you have more that one crypto map entry, please tell us which index number it is.
cheers,
Seb.
11-21-2017 10:41 AM
11-21-2017 12:20 AM
Unless you have a really strange NAT-setup, it's likely that it is related to access-control (on your ASA or a device between the client and the ASA). Simulate the traffic with the packet-tracer and observe the output.
11-21-2017 10:53 AM
11-21-2017 12:26 PM
11-21-2017 01:28 PM
TCP is part of IP, if you have allowed IP there is no need to allow TCP (or UDP or ICMP, ...) in addition.
11-21-2017 01:31 PM
Okay so when I run the packet tracer it drops the packet on the outside interface there must be something else that I need to look at
11-21-2017 12:44 PM
11-21-2017 01:34 PM
You can't simulate it from outside. And only looking at the result of the inside packet-tracer is not enough. Is NAT doing something unexpected like changing the traffic that it doesn't match any more the crypto-definition? Based on the screenshot it could be something like that.
11-21-2017 01:47 PM
11-21-2017 02:06 PM
There are sections for NAT in the packet-tracer. Showing your NAT-config ("show run nat") could also help.
11-21-2017 02:18 PM
11-21-2017 02:48 PM
ok, that's a mess ...
But it seems that you need a NAT-exemption for that traffic at the top of the NAT rules.
11-21-2017 03:01 PM
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide