Adding Network to VPN Issue

[Patrick McHenry]

The output included is from the remote 5505 that is connecting a VPN to our main campus Firewall 5520. The VPN is working fine but, the other day I tried to add VLAN 28 to the VPN. It is not working. I believe I have entered exactly what I entered for the other VLANs. I've heard that sometimes you have to re-apply the cryptomap. Is this true? If not, do you have any other ideas?

Thanks, Pat

names

name 192.168.1.0 sjh_vlan2

name 192.168.2.0 sjh_vlan5

name 192.168.3.0 sjh_vlan6

name 192.168.4.0 sjh_vlan3

name 192.168.5.0 sjh_vlan12

name 192.168.6.0sjh_vlan17

name 192.168.7.0 sjh_vlan28

access-list outside_1_cryptomap extended permit ip 10.10.10.0 255.255.255.0 sjh_vlan2 255.255.252.0
access-list outside_1_cryptomap extended permit ip 10.10.10.0 255.255.255.0 sjh_vlan5 255.255.252.0
access-list outside_1_cryptomap extended permit ip 10.10.10.0 255.255.255.0 sjh_vlan6 255.255.252.0
access-list outside_1_cryptomap extended permit ip 10.10.10.0 255.255.255.0 sjh_vlan3 255.255.255.0
access-list outside_1_cryptomap extended permit ip 10.10.10.0 255.255.255.0 sjh_vlan12 255.255.255.0
access-list outside_1_cryptomap extended permit ip 10.10.10.0 255.255.255.0 sjh_vlan17 255.255.255.0
access-list outside_1_cryptomap extended permit ip 10.10.10.0 255.255.255.0 sjh_vlan28 255.255.255.0

access-list inside_nat0_outbound extended permit ip 10.10.10.0 255.255.255.0 sjh_vlan2 255.255.252.0
access-list inside_nat0_outbound extended permit ip 10.10.10.0 255.255.255.0 sjh_vlan5 255.255.252.0
access-list inside_nat0_outbound extended permit ip 10.10.10.0 255.255.255.0 sjh_vlan6 255.255.252.0
access-list inside_nat0_outbound extended permit ip 10.10.10.0 255.255.255.0 sjh_vlan3 255.255.255.0
access-list inside_nat0_outbound extended permit ip 10.10.10.0 255.255.255.0 sjh_vlan12 255.255.255.0
access-list inside_nat0_outbound extended permit ip 10.10.10.0 255.255.255.0 sjh_vlan17 255.255.255.0
access-list inside_nat0_outbound extended permit ip 10.10.10.0 255.255.255.0 sjh_vlan28 255.255.255.0

access-list inside_access_in extended permit ip 10.10.10.0 255.255.255.0 sjh_vlan2 255.255.252.0
access-list inside_access_in remark Allow unrestricted access to SJH network
access-list inside_access_in extended permit ip 10.10.10.0 255.255.255.0 sjh_vlan5 255.255.252.0
access-list inside_access_in remark Allow unrestricted access to SJH network
access-list inside_access_in extended permit ip 10.10.10.0 255.255.255.0 sjh_vlan6 255.255.252.0
access-list inside_access_in extended permit udp 10.10.10.0 255.255.255.0 any eq domain
access-list inside_access_in extended permit ip 10.10.10.0 255.255.255.0 sjh_vlan3 255.255.255.0
access-list inside_access_in remark Allow unrestricted access to SJH network
access-list inside_access_in extended permit ip 10.10.10.0 255.255.255.0 sjh_vlan12 255.255.255.0
access-list inside_access_in extended permit ip 10.10.10.0 255.255.255.0 sjh_vlan17 255.255.255.0
access-list inside_access_in extended permit ip 10.10.10.0 255.255.255.0 sjh_vlan28 255.255.255.0

[Jennifer Halim]

Have you add the mirror image ACL on the other side?

Also, you would need to clear the ipsec tunnel once you have added those ACL:

clear cry ipsec sa

clear cry isa sa

The tunnel will re-establish and the new subnet will be added as part of the tunnel negotiation.

[Patrick McHenry]

I do both: commands: clear cry ipsec sa and clear cry isa sa on the remote 5505?

Thanks.

[Jon Marshall]

Pat

Just to confirm, you have made the same changes on both ends ??

Jon

[Patrick McHenry]

Yes

[Jennifer Halim]

can you please share the output of the following from both end:

show cry ipsec sa

Also, I assume that VLAN 28 has/knows how to get to 10.10.10.0/24 via the ASA vpn tunnel?