VPN tunnel up but not passing traffic: pkts encaps 0 decaps 11

[raidokuvarnet]

Hello,

I have configured a site-to-site VPN between linux and Cisco ASA 5510. Tunnel is up, but traffic is not being tunneled (i can not ping host from either site):

Crypto map tag: WAN_map, seq num: 2, local addr: 80.250.119.69

access-list WAN_cryptomap_2 extended permit ip 10.10.10.0 255.255.255.0 10.10.12.0 255.255.255.0
local ident (addr/mask/prot/port): (10.10.10.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (10.10.12.0/255.255.255.0/0/0)
current_peer: 80.235.86.212

#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 11, #pkts decrypt: 11, #pkts verify: 11
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0

local crypto endpt.: 80.250.119.69/4500, remote crypto endpt.: 80.235.86.212/4500
path mtu 1500, ipsec overhead 82, media mtu 1500
current outbound spi: 6C2FCCDC
current inbound spi : F6DCBDE6

inbound esp sas:
spi: 0xF6DCBDE6 (4141661670)
transform: esp-aes-256 esp-sha-hmac no compression
in use settings ={L2L, Tunnel, NAT-T-Encaps, }
slot: 0, conn_id: 1110016, crypto-map: WAN_map
sa timing: remaining key lifetime (sec): 27885
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000FFF
outbound esp sas:
spi: 0x6C2FCCDC (1815071964)
transform: esp-aes-256 esp-sha-hmac no compression
in use settings ={L2L, Tunnel, NAT-T-Encaps, }
slot: 0, conn_id: 1110016, crypto-map: WAN_map
sa timing: remaining key lifetime (sec): 27885
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001

Here is my running conf: http://pastebin.com/0FSfbbHE

[Rahul Govindan]

Looks like packets are not being encrypted on the ASA. Run a packet-tracer to simulate a packet through the ASA.

packet-tracer input Serv icmp <internal host> 8 0 <remote host> detailed.

Also, your identity NAT rules are below some of your port forwarding and static NAT rules. Try moving the order for the VPN NAT rules to the top so that there are no conflicts with other rules.

[raidokuvarnet]

Packet tracker output: 

Result of the command: "packet-tracer input Serv icmp 10.10.10.10 8 0 10.10.12.10 detailed"

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in LAN2-network 255.255.255.0 WAN

Phase: 2
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0xd9414ae8, priority=0, domain=inspect-ip-options, deny=true
hits=855552, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
input_ifc=Servers, output_ifc=any

Phase: 3
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
class-map inspection_default
match default-inspection-traffic
policy-map global_policy
class inspection_default
inspect icmp
service-policy global_policy global
Additional Information:
Forward Flow based lookup yields rule:
in id=0xd9bde9c0, priority=70, domain=inspect-icmp, deny=false
hits=77065, user_data=0xd9bdd9a0, cs_id=0x0, use_real_addr, flags=0x0, protocol=1
src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=0
dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, dscp=0x0
input_ifc=Servers, output_ifc=any

Phase: 4
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0xd94146c0, priority=66, domain=inspect-icmp-error, deny=false
hits=225387, user_data=0xd9413cd8, cs_id=0x0, use_real_addr, flags=0x0, protocol=1
src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=0
dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, dscp=0x0
input_ifc=Servers, output_ifc=any

Phase: 5
Type:
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0xd9bdfde8, priority=18, domain=flow-export, deny=false
hits=425531, user_data=0xd9bb0e70, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
input_ifc=Servers, output_ifc=any

Phase: 6
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (Servers,WAN) source static obj-10.10.10.0 obj-10.10.10.0 destination static LAN2-network LAN2-network no-proxy-arp route-lookup
Additional Information:
Static translate 10.10.10.10/0 to 10.10.10.10/0
Forward Flow based lookup yields rule:
in id=0xd94e3ec0, priority=6, domain=nat, deny=false
hits=94235, user_data=0xd94e3820, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
src ip/id=10.10.10.0, mask=255.255.255.0, port=0
dst ip/id=LAN2-network, mask=255.255.255.0, port=0, dscp=0x0
input_ifc=Servers, output_ifc=WAN

Phase: 7
Type: VPN
Subtype: encrypt
Result: DROP
Config:
Additional Information:
Forward Flow based lookup yields rule:
out id=0xd9afcb40, priority=70, domain=encrypt, deny=false
hits=95074, user_data=0x0, cs_id=0xd9369c70, reverse, flags=0x0, protocol=0
src ip/id=10.10.10.0, mask=255.255.255.0, port=0
dst ip/id=LAN2-network, mask=255.255.255.0, port=0, dscp=0x0
input_ifc=any, output_ifc=WAN

Result:
input-interface: Servers
input-status: up
input-line-status: up
output-interface: WAN
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

[Rahul Govindan]

I see your problem now. Tunnel is established with peer in crypto map seq 2

Crypto map tag: WAN_map, seq num: 2, local add:x.x.x.x

But your crypto map seq 1 has the same source and destination proxies. Return traffic tries to match against first crypto map entry and establish a VPN - which is failing. You cannot have the same proxies for 2 tunnels as the first is always matched for outbound traffic.

Try reversing the order of the crypto map entries or changing crypto map seq 1 to have mutually exclusive proxies.

[raidokuvarnet]

Hello,

This got me to ping my remote gateway Cisco -> linux. But when I try to ping from linux -> Cisco I get ping time out.

[Rahul Govindan]

Do you see encaps and decaps on both sides? Also, did you make the change to the identity NAT rules order as I mentioned earlier?

[raidokuvarnet]

How do I move VPN NAT rules on top?

[MANI .P]

can you share the debug ?

#debug crypto isa 127

#loggin on 

#loggin con 7

regards,

Mani