Site2site VPN (RV325 Router & ASA firewall 5555)

[andrwalk]

All

Unfortunately I have a customer that is exposed from a service coverage point of view (which we are currently resolving & proposing a direct SmartNet service).

However just wondering whether anyone would be able to provide some guidance on the following issue;

I can see the VPN tunnel activated between the ASA5555 and RV325 device.

Client devices connected to the RV device (and using its DHCP) are unable to log onto the network domain which is behind the firewall.

They cannot ping LAN subnets behind the firewall even though these LAN subnets and client DHCP scope are allowed via the VPN tunnel.

Any help would be much appreciated

Andrew

[David Johan Castro Fernandez · Accepted solution]

Hi Andrew,

On this case, we will need to see the counters of the SAs built on both sides, on the ASA:

- show crypto isakmp sa --> check if Phase 1 is up 

- Show crypto ipsec sa peer <Peer IP address>--> Check if the ASA is encrypting or decrypting the traffic.

    + If you see encaps and no decaps on the ASA, it is most likely an issue on the remote side.

    + If you see decaps and no encaps, it is a misconfiguration on the ASA

Recommended steps from the ASA perspective:

* Make sure the traffic is matching at both sides

* Make sure there is NAT exemption, to avoid the traffic from being NATed dynamically

* Review the Routing, to see if the traffic from the RV325 is being reached from the outside of the ASA (Use tracert or Packet tracer)

* Make sure there is not overlapping on your side, with the destination address. Also make sure that there is not other site to site set up with the same destination.

* After this clear the SAs on both sides, on the ASA command --> clear crypto ipsec sa peer <Peer IP address>.

Please proceed to rate and mark as correct this post if it was helpful!

David Castro,

Regards,