09-11-2008 11:03 AM - edited 03-11-2019 06:43 AM
Hello,
I had a working vpn configuration between a local and a remote router; the remote router is not under my administration.
Now I moved the vpn termination from my side to an ASA5540 software version 8.0(3). The tunnel is up but there is no reachability. The "show crypto ipsec sa" on the ASA shows encapsulated packets but NO decapsulated packets! Routing and no_nat are properly configured.
Any idea?
Many thanks.
09-11-2008 12:47 PM
mmm yeah. i checked on my lab ASA 5520 on a working tunnel and i have it enable on the inside/outside as well.
09-11-2008 12:54 PM
I have tunnels configured and the same interface and working perfectly
09-11-2008 12:57 PM
you mean you have other tunnels active on the ASA?
09-11-2008 12:57 PM
right, so the router is gone, but
what device is in front of the ASA?
What interface is the 213. address on? outside?
09-11-2008 01:01 PM
yeah other tunnels are active! the 213 is the outside ip of the asa; the conncetion is like this now:
asa (public 213.184.187.98) -> sw (layer2)-> router (private IP with no security controls)->ISP
09-11-2008 01:03 PM
joe's got a point here. according to the logs
DPD (Dead Peer Discovery).
IPSec has a mechanism for a peer to send a notification to its peer when it is deleting a SA. This notification is sent via IKE. However, there can be situations in which this notification never gets sent. A usual reason for this is that the peer goes dead too abruptly e.g. system crash, unplugging the Ethernet cable, etc. Due to such events, one peer could keep sending data to the dead peer and it results in data loss. For this, a Dead Peer Discovery (DPD) mechanism is used. Make sure nothing is blocking the ipsec traffic between your ASA/Router
09-11-2008 01:08 PM
There's only a layer 2 switch between the router and the ASA and no security controls are configured on the router:(
09-11-2008 01:25 PM
please re-enable nat-t, clear the tunnel and bring it back up by pinging to the crypto acl destination from the source.
please past your entire asa config (sanatized of course!)
Worse case, we can do a webex to get it solved.
-Joe
09-11-2008 01:40 PM
09-11-2008 12:14 PM
my next educated guess;
turn off nat-t on the ASA the other side may not support it, not have it configured or UDP 4500 may filtered somewhere in the path
no crypto isakmp nat-traversal
now clear ipsec sa on the sa, and continue testing... send interesting traffic to bring the tunnel back up
09-11-2008 10:45 PM
Georges/Joseph, Is this sorted?
Please let me know
Francisco
09-12-2008 12:43 AM
Guys,
It's resolved by editing the crypto/no_nat access-lists to match only host by host! It's really weird that it was not working with subnet to subnet access-list.
09-12-2008 12:45 AM
interesting!
05-29-2013 07:33 AM
Thanks for posting the solution. Any future info on this? jimmyc
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide