hi all ,
i have a topology as
(192.168.0.0/24)LAN1----------------asa1---------------internet-----------------------asa2------------------LAN2(192.168.2.0/24)
now , lan 1 can reach lan 2 by site to site vpn
but i have a question :
when i have
#sh crypto ipsec sa
====================================================================
interface: outside
Crypto map tag: Azure_IPSecCryptoMap, seq num: 2, local addr: xxxx
access-list outside_cryptomap extended permit ip 192.168.0.0 255.255.255.0 any
local ident (addr/mask/prot/port): (192.168.0.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)
current_peer: xxxxx
#pkts encaps: 294823, #pkts encrypt: 294823, #pkts digest: 294823
#pkts decaps: 208795, #pkts decrypt: 208795, #pkts verify: 208795
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 294823, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: xxxxxxxxxx/0, remote crypto endpt.: xxxxxxxx/0
path mtu 1500, ipsec overhead 74, media mtu 1500
current outbound spi: 81F3ABF6
current inbound spi : FAE91312
inbound esp sas:
spi: 0xFAE91312 (4209578770)
transform: esp-aes esp-sha-hmac no compression
in use settings ={L2L, Tunnel, PFS Group 2, }
slot: 0, conn_id: 10670080, crypto-map: Azure_IPSecCryptoMap
sa timing: remaining key lifetime (kB/sec): (4373327/621)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0xFFFFFFFF 0xFFFFFFFF
outbound esp sas:
spi: 0x81F3ABF6 (2180230134)
transform: esp-aes esp-sha-hmac no compression
in use settings ={L2L, Tunnel, PFS Group 2, }
slot: 0, conn_id: 10670080, crypto-map: Azure_IPSecCryptoMap
sa timing: remaining key lifetime (kB/sec): (4370375/621)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
================================================================================
my problem is ,
that my asa1 lan1 only reach asa2 if its destination was to subnet 192.168.2.0/24 , i mean if requested internet i cant reach it !!!
note that the crypto_map acl says destination "any" will go to asa2 , but why when i requested the destioantion of lan2 it responce , and if i requested 8.8.8.8 it dont reach asa2 ??
i used packet tracer to investigate , it seems as a stuck !!!
how to change the remote idnet as in the red line above ??? i think it is the issue that preventing mefrom reaching internet by asa2
agian ,
what issue in the asa has relation to the remote idnet and how i can change it ?
any help ?
regards
