Thank you for the additional information. From the original post I understood the problem to be about issues to ping the remote tunnel address. I now understand that user access to remote resources is impacted and that certainly indicates that there is an issue to investigate. I agree that seeing the configs from both sides would be a good place to start.    HTH   Rick ... View more

Perhaps we can get some clarification about this situation. Am I correct in understanding that this involves a single ASA establishing VPN to a single SonicWall? I am not clear how the 2 sites are connected and where the ASA fits into this.   If we are talking just about tunnels, then @balaji.bandi is correct that with a second IP address that a second tunnel could be used. But I do not think that is the case when we introduce IPSEC. Unless things have changed since the last time I looked into it Cisco did not support 2 IPSEC connections to a single remote peer.   HTH   Rick ... View more

I am interested in this part of the original post   One specific client is using an ASA and his side of the tunnel will occasionally go down, however when I go to look at the tunnel, my side will show UP-ACTIVE. what commands are you using to see this? Can you post that output? If you execute the command(s), wait a bit, and execute again does the output change?   HTH   Rick   ... View more

Those suggested access lists are checking the source address of traffic and make sense when applied on public facing interfaces of your edge routers. They could be quite harmful if applied on inward facing interfaces of edge routers or on routers inside your network. It is likely that your network will be using some subnets from 10, or from 172.16, or from 192.168 and you would not want to deny their traffic. So apply the anti spoofing access lists only on the edge routers.   HTH   Rick ... View more

Assuming that permissions are set to allow it, if <filename> already exists in the directory of the tftp server and if you execute the command to copy then the old file will be overwritten by the new file.   HTH   Rick ... View more

There are things that we do not know about this environment which probably impact the answers that we might give. If I understand correctly this is a GRE tunnel with IPSEC. We do not know if this is a traditional IPSEC with a crypto map or is a VTI implementation. GRE with crypto map typically does not include the tunnel subnet as interesting traffic. In that case attempts to ping the tunnel remote address would not be encrypted and would not show up in show crypto ipsec sa. If this is VTI then attempts to ping the tunnel remote address would be encrypted and would show up in show crypto ipsec sa.   If the IPSEC seems to be running clean then I would not worry if some pings to the remote tunnel address are dropped.   HTH   Rick ... View more

You are welcome. This community is an excellent place to ask questions and to learn about networking. I hope to see you continue to be active in the community.   HTH   Rick ... View more

The limited information is slightly helpful. If you use UC tools for reporting then the polling report is generated from their activity and their measurement. I do not have enough information with that to offer much of an answer. But it seems to me that it is quite possible that issues with the controller as well as issues with ISP would be capable of causing a polling report to fail.   HTH   Rick ... View more

There are several things in your post for which we would like some clarification. When you mention hardware VPN what is it that you mean? Is this a VPN using a hardware device dedicated to encrypting the traffic using the VPN? Is this a VPN using a hardware firewall dedicated to VPN? Is this a VPN using a general purpose firewall? Or something else?   When you mention polling what is it that you mean? Is it actually some device polling a remote device? Is it something that is checking for Internet connectivity? Is it something that is checking for access to resources through the VPN?   If we knew more about what you are looking for we might be able to provide better suggestions.   HTH   Rick ... View more

There are multiple things in this post to comment about. The config does show that ip routing is enabled, does show that there is a user vlan (vlan 1) and a guest vlan (vlan 2), that each vlan does have a layer 3 vlan interface with an appropriate address, and that there is a default route with 10.1.1.254 as the next hop. All of these seem appropriate and based on them I would expect that routing for the guest vlan should work. If it does not then we need to investigate several possibilities of what could be the issue. 1) does the switch see the upstream gateway and the downstream guest device? Do show arp on the switch and verify that there is an entry for the upstream gateway and an entry for the downstream guest device. 2) does the upstream gateway have a route for subnet 10.1.123.0 (and as a curiosity what mask is used for that route)? 3) can the upstream gateway ping both 10.1.1.252 and 10.1.123.14? 4) can the guest device ping its gateway 10.1.123.14? And can the guest device ping the switch interface for vlan 1 10.1.1.252? And can the guest device ping the gateway at 10.1.1.254?   It seems to me that this issue has at least 2 parts. The first part is what we are dealing with so far in terms of basic ip connectivity and basic ip routing. We need to get that straightened out and working then can consider the second part which is that the guest should access the Internet but not devices in the user vlan.   I will also comment on something that seems odd but is not directly related to the main issue of this post. There is another vlan configured, vlan 10. Depending on which comment is correct it is either for a WAN router or is for LAN2. There are switch ports assigned to this vlan but no SVI. So what this vlan is and how it might work is not clear.   HTH   Rick ... View more

Thank you for posting the configuration. I do find several things in it to comment about. - you have configured an access list for the outside interface. But it is not applied to the outside interface. So it is not being used.  - you have included icmp and icmp error in the policy map and so they are being inspected. And therefore I believe that it does not matter that the access list is not applied to the outside interface. With icmp and icmp error being inspected I would expect that the error responses would be allowed. - I suggest that the thresholds for icmp unreachable should be increased. icmp unreachable rate-limit 1 burst-size 1 I found this in some Cisco documentation:   Increasing the rate limit, along with enabling the set connection decrement-ttl command in a service policy, is required to allow a traceroute through the ASA that shows the ASA as one of the hops. Here is the link if you want more details https://www.cisco.com/c/en/us/td/docs/security/asa/asa93/configuration/firewall/asa-firewall-cli/access-rules.html - if increasing the threshold does not solve the issue then I wonder about the icmp rules you configure on the inside interface icmp permit any inside icmp permit any echo-reply inside and wonder if you might also need icmp permit any outside   HTH   Rick ... View more

You have given us verbal description of what you enter. It would help us if you would show us the exact command you enter and the output (or no output) that you receive.   HTH   Rick ... View more

I do not understand clearly the original post. Perhaps the original poster can post screen shots of the command that does not work and of the command that does work?   HTH   Rick ... View more

The original poster asks about using ASDM to view logs that relate to problems with a configured VPN. I believe that there are several aspects to this question. First is the aspect of how to use ASDM to view log messages. Correct configuration of logging on the ASA (including logging asdm) should allow them to use ASDM to view syslog messages. The second aspect of the question is whether syslog will include messages about failures in IKE negotiation. If debug for crypto isakmp is enabled then syslog should contain messages about IKE negotiation. But if there is no debug running then I do not believe that syslog would contain messages about IKE negotiation. The third aspect of the question is whether the original poster wants to see messages in real time (or near real time) or wants to see messages from some time in the past. The ASA has limited ability to store syslog messages. So you should be able to see messages in real time or near real time. But to see messages from a time in the past you probably need to have some device in the network that will receive and store the syslog messages from the ASA.   HTH   Rick ... View more