I have two remote sites (PIX501's) connecting to the hub (2811). All sites can talk to all sites. For the spokes to talk, they go through the hub. I'm trying add a third site and I can get connectivity to the hub no problem, but not the spokes. Below is a show crypto ipsec sa from the new site.
Hub site: 192.168.12.0 /24
Remote site A: 192.168.13.0 /24 (working)
Remote site B: 192.168.14.0 /24 (working)
Remote site C: 192.168.15.0 /24 (not working)
There is also a diagram attached that show all this a little better.
This looks good other than there are no remotes sites. Connectivity to this network is just fine and it is the hub.
access-list 130 extended permit ip 192.168.15.0 255.255.255.0 192.168.12.0 255.255.255.0
local ident (addr/mask/prot/port): (192.168.15.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.12.0/255.255.255.0/0/0)
Here is the same command from one of the working sites.
local ident (addr/mask/prot/port): (192.168.13.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.12.0/255.255.255.0/0/0)
local ident (addr/mask/prot/port): (192.168.13.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.15.0/255.255.255.0/0/0)
local ident (addr/mask/prot/port): (192.168.13.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.14.0/255.255.255.0/0/0)
As you can see it builds the tunnel to the hub and each remote site. I can't get the new ASA to do the same. It looks to me like the problem is on the hub. I've removed the crypto map from the interface, built the VPN config multiple times, etc, etc. Please tell me I'm missing something easy. Thanks.
