Routed VPN with Azure getting packets drop

[Luis Seyler]

Hi, I recently created a routed STS VPN against Azure, tunnel comes up but the traffic is being dropped when the communication starts at the side of the ASA,

asp captures for traffic that should go trhough the tunnel shows the following messages 

         Drop-reason: (np-socket-closed) Dropped pending packets in a closed socket

packet tracer shows that traffic should go out without problems

Wondering if I'm missing something

[Marius Gunnerud]

We had the same issue.  Unfortunately we were unable to find a solution and ended up using regular s2s crypto maps instead.  We did not report this to Cisco due to the time constraint we had for getting this to work, but I am assuming it is a bug.

[Luis Seyler]

Thanks for that response! I'll try to see if the client can open a case with Cisco before the next session to see if they can help.

In any case, policy based worked without a problem? Provider told us they had an issue with another client using ASA and they had issues with policy based too.

[Luis Seyler · Accepted solution]

I was not able to find the root of the problem but we did manage to get the routed VPN working

We used the BGP IP of the Azure configuration as the next hop in the tunnel for its own subnet

route Azure_tunnel 10.0.9.0 255.255.255.0 10.0.9.14

In our case the inside network of Azure was NATed and used the next hop that was configured before for all other subnets in Azure with an IP from APIPA (I think this IP doesn't really matter)

route Azure_tunnel 172.31.5.16 255.255.255.240 169.254.225.2 - We had the tunnel set up with 169.254.225.1/30, to my understanding this IP doesn't really matter.

It seems all we actually needed was to add the Azure Network 10.0.9.0 where the IP for BGP lived

[MHM Cisco World]

follow