Changing SSL to IPSec in ASA5510

[Michael Seden]

I've got a Data Center with an ASA5510, which has both a SSL tunnel for AnyConnect and an IPSec tunnel going to an ASA5505 at the Office in the outside interface.

For remote users with ASA5505's I've got two tunnels built, one to the DC and one to the office. No problems, can talk to both locations. For users that have to use Anyconnect, there is seamless access to the data center, but when the IP/TCP and  SSL headers are removed, and the ASA see's it is going to the office, is in not getting re-incapsulated by IPSec to go back out the IPSec tunnel.

Has anyone encountered this and is there a solution?

Thanks,

Mike Seden

Business Technology Architects

[micturne]

Thanks for posting Mike and great use of whiteboard shots.  I'll run this one by the megaminds and see what we can find for you.

[admin11111]

I'm glad there is a mega-mind out there because mine is fixin' to explode! I am just about ready to start a TAC case with it. I would be glad to share configs if needed, but will have to go through the 'Change' Procedure to make any. Thanks for your reply and letting me know that there is hope. My Obi-Wan makes me whiteboard everything....

[ROBERTO TACCON · Accepted solution]

Which software version are you using ?

check this BUG CSCty32412

https://supportforums.cisco.com/thread/2149125

ASA: Anyconnect u-turn to ipsec tunnel fails

Symptom:

ASA after a upgrade to 8.4.3.1 or later, anyconnect traffic that will uturn (hairpin) to a ipsec lan

to lan tunnel is dropped.

The show asp drop shows the following reason:

Expired VPN context (vpn-context-expired)

No log message is generated for the drops.

Issue is seen on ASA 8.2.5.26 as well

Conditions:

Anyconnect client uturns into a ipsec lan to lan tunnel.

Fixed-In

8.4(4)

9.0(1)

9.1(1)

9.0(0.99)

8.4(3.105)

100.8(33.3)M

100.8(0.126)M

8.2(5.29)

100.7(13.73)M

100.7(6.78)M

100.8(11.20)M

100.9(2.1)M

100.8(27.7)M

100.9(0.1)M

8.4(4.99)

100.8(34.1)M

[Michael Seden]

I see that ASA version 8.4(3)8 is what is currently running.

[Michael Seden]

I used the bugtool to see what was what, and the powers that be decided we need to upgrade. Our current version definately hits in the bug zone. Thank you so much for your help.