Hello there ,   It seems as though your lab setup could have a flaw , would you be able to share your physical cross connects lab diagram as well as your logical diagram vlans etc..  ? there could be many reasons your servers did not communicate correctly with the firewall when firewalls switched to the standby.   Below is a URL with a straight forward A/S deployment , go over this link, if you are introducing two switches in your design you need to keep in mind that if Active FW connects to one switch and the  Standby  to another switch both switches must be connected and they have to be able to be aware of  VLANs you have allocated for each of the firewall interfaces you have configured them with - proper cross connects and proper VLAN assignments in the switches is key to for proper fail-over events and systems to continue their communications  https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/91336-pix-activeactive-config.html   Additionally I have attached an basic site cross-connect diagram to help you with the physical aspect.  Again, if you do have configurations of your switches and firewall we could sanity check to see where is the flaw.       ... View more

For this to work you will need to enable same security level intra interface feature on you hub firewall by using the command "same-security-traffic permit intra-interface", you will also need to work on updating your encryption domain access list in your hub so that CustomerA and CustomerB traffic be able to flow between the two L2L tunnels via the hub firewall. I was able to find an example depicting your requirements - see the URL below , exclude the RA vpn section and focus on the two L2L tunnels and HQ firewall   https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/82020-addnetworkvpn.html     Hope this helps   ... View more

  You are missing the <source> statement e.g nat (dmz,outside) source static webserver-external-ip service tcp www www Try the above and see how that works you can always place a question mark  to provide addition options (config)# nat (dmz,outside) ? <1-2147483647> Position of NAT rule within before auto section after-auto Insert NAT rule after auto section source Source NAT parameters   ... View more

You have to either run a capture or debug dhcpd on the firewall to get some info as to why not getting the IPs from the firewall capture http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/116354-technote-asa-00.html debug dhcpd <events> http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/command/reference/cmd_ref/d1.html#wp2034318 ... View more

Hi,  Since you have SmarNet you should contact Cisco  TAC directly  and have them pin point the issue . http://www.cisco.com/cisco/web/support/index.html Regards ... View more

Hi Ankit,  You need to nat the traffic if you have conflicting networks at each end ,  what  applience  are you using.. asa what code,  router?  This is typical example for S2S   on asa 7.x-8.2.x  with overlapping networks http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080b37d0b.shtml ... View more

Hi Craig, Try enabling NAT-T ,  you have it disabled,  try that and let us know  e.g  crypto isakmp nat-traversal 20 troublesghooting reference http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a00807e0aca.shtml Regards ... View more

Hi Ankit, Your description sounds a NAT issue , the conenction flags mean waiting for sync ACKs -  if you are not trying to hide the server private IP you can use nat exempt rule [nonat] as part of your tunnel policy,  you do not need  static NAT in that case.     Regards ... View more

Hi Ryan, What  networks from the internal switch behind your firewall  are you trying to reach from RA network?   the packet capture you provided is  towards your switch gateway IP 10.37.194.1  which is directly connected interface to the firewall , but you have not shown  what other subnets  from your switch your RA Pool is unable to reach . You also have a routing process in place for eigrp , are you  eigrp peering with your internal switch?  if you are doing static routing  make sure your RA IP Pool network  10.254.37.0/24  is indeed routed back to  the FW inside interface IP 10.37.194.2, and perhaps provide more details  on your inside L3 logical topology and what networks  the RA pool is required to access. Regards ... View more

Miguel, Tu observacion de un par de VPN es correcta. 10 pares implica (peers) ,  puedes conectar con otro roteador o ASA al otro lado de la connecion - es decir - puedes establecer hasta 10 conneciones consecutivas e individuales  de ipsec VPN -  en tu caso 10 sucursales/officinas  serian 10 Ipsec tuneles individuales y seria el maximo y no mas -   por ejemplo si tubieras 20 sucursales/officinas necesitarias soporte para 20 Ipsec tuneles o pares (peers) . El mismo principio se aplica con SSL  tuneles  en conjuncion con  la descripcion del ASA5510 que soporta 250 VPN tuneles .  Saludos ... View more

Is hard to tell without a bit more topology information -  but looking at your route statement I would check if your 10.10.86.1 gateway has a route back for your VPN network - that is -  does your 10.10.86.1 router  knows about your VPN RA Subnet? I would also check  your access rules -    do you have access rules in your firewall allow  RA VPN subnet to access your management  subnet? Regards ... View more

See this link  there are   few examples you can reference -   scroll down to  IPSec on Router to Router http://www.cisco.com/en/US/tech/tk583/tk372/tech_configuration_examples_list.html ... View more

Hello Manuel, You can terminate the second tunnel at any of your firewall gateways in A or B , you will need to simply pay attention when creating the second tunnel from the 3rd party supplier company that you also allow them in the tunnel policy you currently have going between A-B . link bellow depicts almost the exact scenario for your requirement. http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00804675ac.shtml Good luck ... View more

If your netflow collector is on the other side of the VPN tunnel ,   on the firewall you are configuring netflow your Collector IP address must be configured as  if it were a host on your inside LAN  and not outside.   Is your  netflow configuration pointing to ( inside )  ?  ... View more