Hi,
Ran into a problem during upgrade of a ASAv 30 today.
The firewall runs in an ESXi server on version 9.15.1 with E1000 interfaces.
There is 4 site to site VPNs configured, two route based and two IPSec with crypto maps.
The firewall are also terminating AnyConnect connections.
Due to some issues with performance we decided to upgrade the firewall to version 9.18.2 and with the VMXNET3 interfaces. Sat up a new firewall "besides" the old one and copied the config.
Everything looks exactly the same, checked multiple times to ensure its identical.
The only errors during setup was with the Trust-Points witch was recreated.
When we activate the new firewall all of the VPN Peers get a Deny IP Spoof so no connection is established.
AnyConnect connections gets denied.
No other issues, all of the other traffic works as it should.
Error: Deny IP spoof from (Peer IP) to <ASA Outside int IP> on interface outside
Have tried to disable anti spoofing for the interface.
No routing issues, the only missing routes from the table is the VPN routes.
No NAT issues, only 6 statements besides the PAT rules (3).
Have tried to move the MAC addresses in VMware.
When we activate the old firewall everything comes back online and is working.
Anybody have any ideas what can be causing this behavior?
