Hi,
Below are some stats, what is strange is that there are matches on the remote vlans I am pinging.....
show crypto ikev2 sa
IPv4 Crypto IKEv2 SA
Tunnel-id Local Remote fvrf/ivrf Status
2 xxx.xxx.xxx.134/500 xxx.xxx.xxx.2/500 none/none READY
Encr: 3DES, PRF: SHA1, Hash: SHA96, DH Grp:5, Auth sign: PSK, Auth verify: PSK
Life/Active Time: 300/183 sec
Tunnel-id Local Remote fvrf/ivrf Status
1 xxx.xxx.xxx.134/500 xxx.xxx.xxx.2/500 none/none READY
Encr: 3DES, PRF: SHA1, Hash: SHA96, DH Grp:5, Auth sign: PSK, Auth verify: PSK
Life/Active Time: 3600/190 sec
IPv6 Crypto IKEv2 SA
show crypto ipsec sa
interface: Ethernet0.100
Crypto map tag: CMAP-ASA, local addr xxx.xxx.xxx.134
protected vrf: (none)
local ident (addr/mask/prot/port): (172.16.10.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (172.16.60.0/255.255.255.0/0/0)
current_peer xxx.xxx.xxx.2 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 8855, #pkts encrypt: 8855, #pkts digest: 8855
#pkts decaps: 9178, #pkts decrypt: 9178, #pkts verify: 9178
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: xxx.xxx.xxx.134, remote crypto endpt.: xxx.xxx.xxx.2
plaintext mtu 1750, path mtu 1800, ip mtu 1800, ip mtu idb Ethernet0.100
current outbound spi: 0xFDFBE5B9(4261143993)
PFS (Y/N): N, DH group: none
inbound esp sas:
spi: 0x4631D65(73604453)
transform: esp-des esp-md5-hmac ,
in use settings ={Tunnel, }
conn id: 2005, flow_id: Onboard VPN:5, sibling_flags 80000040, crypto map: CMAP-ASA
sa timing: remaining key lifetime (k/sec): (4326069/3468)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE(ACTIVE)
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0xFDFBE5B9(4261143993)
transform: esp-des esp-md5-hmac ,
in use settings ={Tunnel, }
conn id: 2006, flow_id: Onboard VPN:6, sibling_flags 80000040, crypto map: CMAP-ASA
sa timing: remaining key lifetime (k/sec): (4325971/3468)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE(ACTIVE)
outbound ah sas:
outbound pcp sas:
protected vrf: (none)
local ident (addr/mask/prot/port): (172.16.10.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (10.0.100.0/255.255.255.0/0/0)
current_peer xxx.xxx.xxx.2 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 5, #recv errors 0
local crypto endpt.: xxx.xxx.xxx.134, remote crypto endpt.: xxx.xxx.xxx.2
plaintext mtu 1800, path mtu 1800, ip mtu 1800, ip mtu idb Ethernet0.100
current outbound spi: 0x0(0)
PFS (Y/N): N, DH group: none
inbound esp sas:
inbound ah sas:
inbound pcp sas:
outbound esp sas:
outbound ah sas:
outbound pcp sas:
protected vrf: (none)
local ident (addr/mask/prot/port): (172.16.10.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (172.16.254.0/255.255.255.0/0/0)
current_peer xxx.xxx.xxx.2 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: xxx.xxx.xxx.134, remote crypto endpt.: xxx.xxx.xxx.2
plaintext mtu 1800, path mtu 1800, ip mtu 1800, ip mtu idb Ethernet0.100
current outbound spi: 0x0(0)
PFS (Y/N): N, DH group: none
inbound esp sas:
inbound ah sas:
inbound pcp sas:
outbound esp sas:
outbound ah sas:
outbound pcp sas:
sh ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
a - application route
+ - replicated route, % - next hop override, p - overrides from PfR
Gateway of last resort is xxx.xxx.xxx.133 to network 0.0.0.0
S* 0.0.0.0/0 [1/0] via xxx.xxx.xxx.133
60.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C xxx.xxx.xxx.132/30 is directly connected, Ethernet0.100
L xxx.xxx.xxx.134/32 is directly connected, Ethernet0.100
172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
C 172.16.10.0/24 is directly connected, Vlan10
L 172.16.10.1/32 is directly connected, Vlan10
sh access-lists
Extended IP access list 100
10 deny ip 172.16.10.0 0.0.0.255 10.0.100.0 0.0.0.255 (5 matches)
20 deny ip 172.16.10.0 0.0.0.255 172.16.60.0 0.0.0.255 (14155 matches)
30 deny ip 172.16.10.0 0.0.0.255 172.16.254.0 0.0.0.255 (5 matches)
40 permit ip 172.16.10.0 0.0.0.255 any (341 matches)
Extended IP access list DFW-S2S-ASA
10 permit ip 172.16.10.0 0.0.0.255 172.16.60.0 0.0.0.255 (14155 matches)
20 permit ip 172.16.10.0 0.0.0.255 10.0.100.0 0.0.0.255 (5 matches)
30 permit ip 172.16.10.0 0.0.0.255 172.16.254.0 0.0.0.255 (5 matches)
cheers
