Yes they are both connected. See configs and other info in post below. SiteA-FwA# sh ospf interface outside outside is up, line protocol is up Internet Address 10.10.10.10 mask 255.255.255.0, Area 0 Process ID 1, Router ID 10.10.10.1, Network Type BROADCAST, Cost: 10 Transmit Delay is 1 sec, State DR, Priority 1 Designated Router (ID) 10.10.10.1, Interface address 10.10.10.10 No backup designated router on this network Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 oob-resync timeout 40 Hello due in 0:00:01 Supports Link-local Signaling (LLS) Cisco NSF helper support enabled IETF NSF helper support enabled Index 1/1, flood queue length 0 Next 0x0(0)/0x0(0) Last flood scan length is 0, maximum is 0 Last flood scan time is 0 msec, maximum is 0 msec Neighbor Count is 0, Adjacent neighbor count is 0 Suppress hello for 0 neighbor(s) ... View more

Removed all commands and just re-configured ospf globally without authentication and no bueno. Devices are connected from g0/0 on ASA to G2 on Router. Both interfaces can ping. ACL in ASA "permit ip any any. debug ip ospf adj on router show mismatched auth when authentication is NOT configured. Same debug on ASA shows nothing.    See configs below.     SiteA_Edge_RtA#ping 10.10.10.10 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.10.10.10, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms SiteA_Edge_RtA#sh ip os SiteA_Edge_RtA#sh ip ospf ne SiteA_Edge_RtA#sh ip ospf neighbor Neighbor ID Pri State Dead Time Address Interface 10.10.10.1 1 INIT/DROTHER 00:00:34 10.10.10.10 GigabitEthernet2 SiteA_Edge_RtA#   SiteA_Edge_RtA#debug ip ospf adj OSPF adjacency debugging is on SiteA_Edge_RtA# *Aug 23 00:13:08.349: OSPF-1 ADJ Gi2: Rcv pkt from 10.10.10.10 : Mismatched Authentication type. Input packet specified type 2, we use type 0 SiteA_Edge_RtA# *Aug 23 00:13:17.882: OSPF-1 ADJ Gi2: Rcv pkt from 10.10.10.10 : Mismatched Authentication type. Input packet specified type 2, we use type 0     SiteA_Edge_RtA#sh run Building configuration... Current configuration : 1604 bytes ! ! Last configuration change at 00:07:26 UTC Fri Aug 23 2019 ! version 16.6 service config service timestamps debug datetime msec service timestamps log datetime msec platform qfp utilization monitor load 80 no platform punt-keepalive disable-kernel-core platform console serial ! hostname SiteA_Edge_RtA ! boot-start-marker boot-end-marker ! ! ! no aaa new-model ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! subscriber templating ! ! ! ! ! ! ! multilink bundle-name authenticated ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! license udi pid CSR1000V sn 9OOMT5133QN diagnostic bootup level minimal spanning-tree extend system-id ! ! ! ! redundancy ! ! ! ! ! ! cdp run ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! interface Loopback0 ip address 1.1.1.1 255.255.255.255 ! interface GigabitEthernet1 ip address dhcp negotiation auto no mop enabled no mop sysid ! interface GigabitEthernet2 ip address 10.10.10.1 255.255.255.0 negotiation auto no mop enabled no mop sysid ! interface GigabitEthernet3 negotiation auto no mop enabled no mop sysid ! interface GigabitEthernet4 negotiation auto no mop enabled no mop sysid ! router ospf 1 router-id 1.1.1.1 network 10.10.10.0 0.0.0.255 area 0 ! ! virtual-service csr_mgmt ! ip forward-protocol nd no ip http server no ip http secure-server ip http client source-interface GigabitEthernet1 ! ip ssh server algorithm encryption aes128-ctr aes192-ctr aes256-ctr ip ssh client algorithm encryption aes128-ctr aes192-ctr aes256-ctr ! ! ! ! ! control-plane ! ! ! ! ! ! line con 0 stopbits 1 line vty 0 login line vty 1 login length 0 line vty 2 4 login ! ! ! ! ! ! end   -------------------------------------     SiteA-FwA# sh run : Saved : : Serial Number: 9A0VJB83X6B : Hardware: ASAv, 2048 MB RAM, CPU Pentium II 2660 MHz : ASA Version 9.8(2) ! hostname SiteA-FwA enable password $sha512$5000$gFovni0J+VrPq1y3c6Ugew==$w+PUD2dcCUM8dbSOd8Pqrg== pbkdf2 xlate per-session deny tcp any4 any4 xlate per-session deny tcp any4 any6 xlate per-session deny tcp any6 any4 xlate per-session deny tcp any6 any6 xlate per-session deny udp any4 any4 eq domain xlate per-session deny udp any4 any6 eq domain xlate per-session deny udp any6 any4 eq domain xlate per-session deny udp any6 any6 eq domain names ! interface GigabitEthernet0/0 nameif outside security-level 0 ip address 10.10.10.10 255.255.255.0 ! interface GigabitEthernet0/1 nameif Outside_Backup security-level 0 ip address 10.10.11.10 255.255.255.0 ! interface GigabitEthernet0/2 no nameif no security-level no ip address ! interface GigabitEthernet0/3 nameif inside security-level 100 ip address 192.168.1.254 255.255.255.0 ! interface GigabitEthernet0/4 no nameif no security-level no ip address ! interface GigabitEthernet0/5 no nameif no security-level no ip address ! interface Management0/0 shutdown no nameif no security-level ip address 10.255.1.185 255.255.0.0 ! ftp mode passive object network 192.168.0.0_obj subnet 192.168.0.0 255.255.0.0 object-group network SiteA_LAN network-object object 192.168.0.0_obj access-list outside_acl extended permit ip any any log access-list inside_acl extended permit ip any any access-list outside extended permit ip any any log pager lines 23 mtu outside 1500 mtu Outside_Backup 1500 mtu inside 1500 no failover no monitor-interface service-module icmp unreachable rate-limit 1 burst-size 1 no asdm history enable arp timeout 14400 no arp permit-nonconnected arp rate-limit 8192 access-group outside_acl in interface outside access-group inside_acl in interface inside router ospf 1 router-id 10.10.10.1 network 10.10.10.0 255.255.255.0 area 0 log-adj-changes ! route outside 0.0.0.0 0.0.0.0 10.10.10.1 1 timeout xlate 3:00:00 timeout pat-xlate 0:00:30 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 timeout conn-holddown 0:00:15 timeout igp stale-route 0:01:10 user-identity default-domain LOCAL aaa authentication login-history no snmp-server location no snmp-server contact crypto ipsec security-association pmtu-aging infinite crypto ca trustpoint _SmartCallHome_ServerCA no validation-usage crl configure crypto ca trustpool policy auto-import crypto ca certificate chain _SmartCallHome_ServerCA certificate ca 513fb9743870b73440418d30930699ff 30820538 30820420 a0030201 02021051 3fb97438 70b73440 418d3093 0699ff30 0d06092a 864886f7 0d01010b 05003081 ca310b30 09060355 04061302 55533117 30150603 55040a13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b 13165665 72695369 676e2054 72757374 204e6574 776f726b 313a3038 06035504 0b133128 63292032 30303620 56657269 5369676e 2c20496e 632e202d 20466f72 20617574 686f7269 7a656420 75736520 6f6e6c79 31453043 06035504 03133c56 65726953 69676e20 436c6173 73203320 5075626c 69632050 72696d61 72792043 65727469 66696361 74696f6e 20417574 686f7269 7479202d 20473530 1e170d31 33313033 31303030 3030305a 170d3233 31303330 32333539 35395a30 7e310b30 09060355 04061302 5553311d 301b0603 55040a13 1453796d 616e7465 6320436f 72706f72 6174696f 6e311f30 1d060355 040b1316 53796d61 6e746563 20547275 7374204e 6574776f 726b312f 302d0603 55040313 2653796d 616e7465 6320436c 61737320 33205365 63757265 20536572 76657220 4341202d 20473430 82012230 0d06092a 864886f7 0d010101 05000382 010f0030 82010a02 82010100 b2d805ca 1c742db5 175639c5 4a520996 e84bd80c f1689f9a 422862c3 a530537e 5511825b 037a0d2f e17904c9 b4967719 81019459 f9bcf77a 9927822d b783dd5a 277fb203 7a9c5325 e9481f46 4fc89d29 f8be7956 f6f7fdd9 3a68da8b 4b823341 12c3c83c ccd6967a 84211a22 04032717 8b1c6861 930f0e51 80331db4 b5ceeb7e d062acee b37b0174 ef6935eb cad53da9 ee9798ca 8daa440e 25994a15 96a4ce6d 02541f2a 6a26e206 3a6348ac b44cd175 9350ff13 2fd6dae1 c618f59f c9255df3 003ade26 4db42909 cd0f3d23 6f164a81 16fbf283 10c3b8d6 d855323d f1bd0fbd 8c52954a 16977a52 2163752f 16f9c466 bef5b509 d8ff2700 cd447c6f 4b3fb0f7 02030100 01a38201 63308201 5f301206 03551d13 0101ff04 08300601 01ff0201 00303006 03551d1f 04293027 3025a023 a021861f 68747470 3a2f2f73 312e7379 6d63622e 636f6d2f 70636133 2d67352e 63726c30 0e060355 1d0f0101 ff040403 02010630 2f06082b 06010505 07010104 23302130 1f06082b 06010505 07300186 13687474 703a2f2f 73322e73 796d6362 2e636f6d 306b0603 551d2004 64306230 60060a60 86480186 f8450107 36305230 2606082b 06010505 07020116 1a687474 703a2f2f 7777772e 73796d61 7574682e 636f6d2f 63707330 2806082b 06010505 07020230 1c1a1a68 7474703a 2f2f7777 772e7379 6d617574 682e636f 6d2f7270 61302906 03551d11 04223020 a41e301c 311a3018 06035504 03131153 796d616e 74656350 4b492d31 2d353334 301d0603 551d0e04 1604145f 60cf6190 55df8443 148a602a b2f57af4 4318ef30 1f060355 1d230418 30168014 7fd365a7 c2ddecbb f03009f3 4339fa02 af333133 300d0609 2a864886 f70d0101 0b050003 82010100 5e945649 dd8e2d65 f5c13651 b603e3da 9e7319f2 1f59ab58 7e6c2605 2cfa81d7 5c231722 2c3793f7 86ec85e6 b0a3fd1f e232a845 6fe1d9fb b9afd270 a0324265 bf84fe16 2a8f3fc5 a6d6a393 7d43e974 21913528 f463e92e edf7f55c 7f4b9ab5 20e90abd e045100c 14949a5d a5e34b91 e8249b46 4065f422 72cd99f8 8811f5f3 7fe63382 e6a8c57e fed008e2 25580871 68e6cda2 e614de4e 52242dfd e5791353 e75e2f2d 4d1b6d40 15522bf7 87897812 816ed94d aa2d78d4 c22c3d08 5f87919e 1f0eb0de 30526486 89aa9d66 9c0e760c 80f274d8 2af8b83a ced7d60f 11be6bab 14f5bd41 a0226389 f1ba0f6f 2963662d 3fac8c72 c5fbc7e4 d40ff23b 4f8c29c7 quit telnet timeout 5 ssh stricthostkeycheck ssh timeout 5 ssh key-exchange group dh-group1-sha1 console timeout 0 threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept dynamic-access-policy-record DfltAccessPolicy ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 no tcp-inspection policy-map global_policy class inspection_default inspect ip-options inspect netbios inspect rtsp inspect sunrpc inspect tftp inspect xdmcp inspect icmp inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect esmtp inspect sqlnet inspect sip inspect skinny policy-map type inspect dns migrated_dns_map_2 parameters message-length maximum client auto message-length maximum 512 no tcp-inspection policy-map type inspect dns migrated_dns_map_1 parameters message-length maximum client auto message-length maximum 512 no tcp-inspection ! service-policy global_policy global prompt hostname context no call-home reporting anonymous call-home profile CiscoTAC-1 no active destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address email callhome@cisco.com destination transport-method http subscribe-to-alert-group diagnostic subscribe-to-alert-group environment subscribe-to-alert-group inventory periodic monthly subscribe-to-alert-group configuration periodic monthly subscribe-to-alert-group telemetry periodic daily profile License destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService destination transport-method http Cryptochecksum:88b888aa64acc4e418b859adefc062e7 : end SiteA-FwA#   SiteA-FwA# ping 10.10.10.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.10.10.1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/6/10 ms SiteA-FwA# sh ospf ne ... View more

Hi sorry forgot to say I have ACLs on inside and outside interfaces "permit ip any any" ... View more

I don't see any other dynamic NAT rules and/or NAT rules that would apply to this traffic as no private IPs are being used. ... View more

Ok great! Restarted meaning generate interesting traffic? Also, currently have manual NAT statements translating the current 2 local source addresses to static original. I would need to add the new host IP to this statement as well correct? Since it is just translating to self/original, is this to make sure the 2 source addresses are not NATTED? ... View more

Great thanks but I don't see anything about configuring multiple object hosts under a manual NAT config. So lets say I have object_singlehost_1 and object_single_host2 that I want to add as a source in a Manual Nat statement, just like in the attachment above. I am not sure how to configure it via command line. The below does not configure it like in the attachment: nat (inside,outside) source static TEST_obj TEST2_obj destination static Outside_HP_Upstairs_WS Outside_HP_Upstairs_WS no-proxy-arp ... View more

In reference to this IPSEC VPN, I have the following, the DM objects are being natted to itself correct? I can replace the DM objects with a object-group containing both those objects correct? Why does X.X.X.30_new appear twice? nat (inside,outside) source static DM_INLINE_NETWORK_1 DM_INLINE_NETWORK_1 destination static X.X.X.30_object X.X.X.30_object ... View more