cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1419
Views
0
Helpful
7
Replies
Beginner

VPN tunnel up but not passing traffic: pkts encaps 0 decaps 11

Hello,

I have configured a site-to-site VPN between linux and Cisco ASA 5510. Tunnel is up, but traffic is not being tunneled (i can not ping host from either site):

Crypto map tag: WAN_map, seq num: 2, local addr: 80.250.119.69

access-list WAN_cryptomap_2 extended permit ip 10.10.10.0 255.255.255.0 10.10.12.0 255.255.255.0
local ident (addr/mask/prot/port): (10.10.10.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (10.10.12.0/255.255.255.0/0/0)
current_peer: 80.235.86.212

#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 11, #pkts decrypt: 11, #pkts verify: 11
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0

local crypto endpt.: 80.250.119.69/4500, remote crypto endpt.: 80.235.86.212/4500
path mtu 1500, ipsec overhead 82, media mtu 1500
current outbound spi: 6C2FCCDC
current inbound spi : F6DCBDE6

inbound esp sas:
spi: 0xF6DCBDE6 (4141661670)
transform: esp-aes-256 esp-sha-hmac no compression
in use settings ={L2L, Tunnel, NAT-T-Encaps, }
slot: 0, conn_id: 1110016, crypto-map: WAN_map
sa timing: remaining key lifetime (sec): 27885
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000FFF
outbound esp sas:
spi: 0x6C2FCCDC (1815071964)
transform: esp-aes-256 esp-sha-hmac no compression
in use settings ={L2L, Tunnel, NAT-T-Encaps, }
slot: 0, conn_id: 1110016, crypto-map: WAN_map
sa timing: remaining key lifetime (sec): 27885
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001

Here is my running conf: http://pastebin.com/0FSfbbHE

7 REPLIES 7
VIP Advocate

Looks like packets are not

Looks like packets are not being encrypted on the ASA. Run a packet-tracer to simulate a packet through the ASA.

packet-tracer input Serv icmp <internal host> 8 0 <remote host> detailed.

Also, your identity NAT rules are below some of your port forwarding and static NAT rules. Try moving the order for the VPN NAT rules to the top so that there are no conflicts with other rules.

Beginner

Packet tracker output: 

Packet tracker output: 

Result of the command: "packet-tracer input Serv icmp 10.10.10.10 8 0 10.10.12.10 detailed"

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in LAN2-network 255.255.255.0 WAN

Phase: 2
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0xd9414ae8, priority=0, domain=inspect-ip-options, deny=true
hits=855552, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
input_ifc=Servers, output_ifc=any

Phase: 3
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
class-map inspection_default
match default-inspection-traffic
policy-map global_policy
class inspection_default
inspect icmp
service-policy global_policy global
Additional Information:
Forward Flow based lookup yields rule:
in id=0xd9bde9c0, priority=70, domain=inspect-icmp, deny=false
hits=77065, user_data=0xd9bdd9a0, cs_id=0x0, use_real_addr, flags=0x0, protocol=1
src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=0
dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, dscp=0x0
input_ifc=Servers, output_ifc=any

Phase: 4
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0xd94146c0, priority=66, domain=inspect-icmp-error, deny=false
hits=225387, user_data=0xd9413cd8, cs_id=0x0, use_real_addr, flags=0x0, protocol=1
src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=0
dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, dscp=0x0
input_ifc=Servers, output_ifc=any

Phase: 5
Type:
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0xd9bdfde8, priority=18, domain=flow-export, deny=false
hits=425531, user_data=0xd9bb0e70, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
input_ifc=Servers, output_ifc=any

Phase: 6
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (Servers,WAN) source static obj-10.10.10.0 obj-10.10.10.0 destination static LAN2-network LAN2-network no-proxy-arp route-lookup
Additional Information:
Static translate 10.10.10.10/0 to 10.10.10.10/0
Forward Flow based lookup yields rule:
in id=0xd94e3ec0, priority=6, domain=nat, deny=false
hits=94235, user_data=0xd94e3820, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
src ip/id=10.10.10.0, mask=255.255.255.0, port=0
dst ip/id=LAN2-network, mask=255.255.255.0, port=0, dscp=0x0
input_ifc=Servers, output_ifc=WAN

Phase: 7
Type: VPN
Subtype: encrypt
Result: DROP
Config:
Additional Information:
Forward Flow based lookup yields rule:
out id=0xd9afcb40, priority=70, domain=encrypt, deny=false
hits=95074, user_data=0x0, cs_id=0xd9369c70, reverse, flags=0x0, protocol=0
src ip/id=10.10.10.0, mask=255.255.255.0, port=0
dst ip/id=LAN2-network, mask=255.255.255.0, port=0, dscp=0x0
input_ifc=any, output_ifc=WAN

Result:
input-interface: Servers
input-status: up
input-line-status: up
output-interface: WAN
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

VIP Advocate

I see your problem now.

I see your problem now. Tunnel is established with peer in crypto map seq 2

Crypto map tag: WAN_map, seq num: 2, local add:x.x.x.x

But your crypto map seq 1 has the same source and destination proxies. Return traffic tries to match against first crypto map entry and establish a VPN - which is failing. You cannot have the same proxies for 2 tunnels as the first is always matched for outbound traffic.

Try reversing the order of the crypto map entries or changing crypto map seq 1 to have mutually exclusive proxies.

Beginner

Hello,

Hello,

This got me to ping my remote gateway Cisco -> linux. But when I try to ping from linux -> Cisco I get ping time out.

VIP Advocate

Do you see encaps and decaps

Do you see encaps and decaps on both sides? Also, did you make the change to the identity NAT rules order as I mentioned earlier?

Beginner

How do I move VPN NAT rules

How do I move VPN NAT rules on top?

Highlighted
Beginner

can you share the debug ?

can you share the debug ?

#debug crypto isa 127

#loggin on 

#loggin con 7

regards,

Mani