One way communication site to site VPN between ASA and SRX

[adamabel]

Hello I'm having some trouble getting two specific networks over a site to site VPN to talk properly. 

On the ASA network 10.0.4.0/24 needs to reach networks 10.34.0.0/16 and 172.18.5.0/24 which are on the Juniper SRX and visa versa.  At the moment I can get the 10.0.4.0/24 and other networks on the ASA to start a session to any of the networks on the SRX but the reserve does not work.  I have looked at a number of threads already and gone over my configuration several times and can't see why it's not working.  At moment I'm trying to rule out the Cisco while I rule out the Juniper as the problem. 

My configuration is quite large so to help the relevant access-lists and interfaces are as follows

access-list acl-NOCAR-CORP-cust-manage-vpn

access-list nonat-dmz1

interface gig0/1.40

nameif dmz1

cryptomap map RAmap 50

[Mohammed al Baqari]

It seems that your acls aren't mirrored between both sites. The masks on
the SRX are larger than the one on ASA hence ASA can initiate but not the
other way around.

Ensure mirrors ACLs

**** please remember to rate useful posts

[adamabel]

Attached is the SRX configuration. 

[Marius Gunnerud]

Your encryption domain on the SRX are inconsistent and missing entries compared to the ASA.  I suggest correcting this and then let us know the updated status.

Trusted to untrusted is missing 3 entries while untrusted to trusted is missing 2 entries.  Also, the 10.0.4.0/24 to 10.34.0.0/16 covers many of the other entries so perhaps consider cleaning up the configuration at both ends by removing the more specific entries and keeping the full subnet entries.

Trusted to untrusted missing entries:

access-list acl-NOCAR-CORP-cust-manage-vpn extended permit ip 10.0.4.0 255.255.255.0 10.34.0.0 255.255.0.0

access-list acl-NOCAR-CORP-cust-manage-vpn extended permit ip host 10.0.4.11 172.18.5.0 255.255.255.0

access-list acl-NOCAR-CORP-cust-manage-vpn extended permit ip 10.0.4.0 255.255.255.0 172.18.5.0 255.255.255.0

Trusted to untrusted missing entries:

access-list acl-NOCAR-CORP-cust-manage-vpn extended permit ip 10.0.4.0 255.255.255.0 10.34.0.0 255.255.0.0

access-list acl-NOCAR-CORP-cust-manage-vpn extended permit ip host 10.0.4.11 172.18.5.0 255.255.255.0