Hi All,
I have about 110 5505's in the field. I just went through each unit and added two new subnets to the object-group that is called in the already established VPN tunnel to the data center. I had no problems doing this except for when an ASA is using 901-k8 code.
What happens is I will add the new subnets to the object group, and then initiate pings from the data center side from a PC on the new interesting subnet,, and I get no replies. What I end up needing to do is reload the far-end 5505, and when/if it comes back up, everything works fine. It is every 901-k8 unit I have, without fail. I've tried clearing/bouncing the tunnel and that doesn't seem to matter. I've tried unapplying then reapplying the transform-set, which also didn't help. I've tried unapplying and reapplying management-access inside; No luck. I log into the far-end 5505 ASDM sniffer and send pings from the interesting new subnet on the data center side, and I see them showing up in the 5505 but I get no replies on my local PC. I try to telnet from data center side new subnet into the 5505 and I see the attempt on the sniffer showing "cisco asa flow terminated by tcp intercept." So the traffic is getting there, over the tunnel (because telnet traffic wouldn't be allowed in otherwise), it just seems like the 5505 is confused on how to talk back.
If possible, I'd like a less intrusive way of getting this to work without needing to reload the units, as I am physically 6,000 miles away from most of the 901-k8's and god forbid they don't come back up after the reload.
Any insight is appreciated.
Thanks.
