ASA deencaps but no encaps packet, Site-to-Site VPN Router->ASA

[mirza.dzafic1]

Hello everyone,

We have IPSec site-to-site VPN between Cisco router and Cisco ASA. ASA have static ip, and router have dynamic public IP. When i run show crypto ipsec sa i see that packets on ASA is deencapsulated, but not encapsulated when going back. 

Does anyone know any solution for this problem?

Thanks

[Rob Ingram]

@mirza.dzafic1 possibly a NAT issue, do you have a NAT exemption rule between the local and remote VPN networks to ensure traffic is not unintentially translated?

Example:

object network LOCAL
 subnet 20.1.1.0 255.255.255.0
object network REMOTE
 subnet 10.1.1.0 255.255.255.0
!
nat (INSIDE,OUTSIDE) source static LOCAL LOCAL destination static REMOTE REMOTE 

[mirza.dzafic1]

Hello @Rob Ingram 

Yes i have NAT exemption rule between ASA local network and Cisco router local network.

[Rob Ingram]

@mirza.dzafic1 ok, from the ASA run packet-tracer from the CLI to simulate the traffic flow - provide the output for review.

Provide the output of "show nat detail".

[mirza.dzafic1]

@Rob Ingram  i attached requested file. 

[Rob Ingram]

@mirza.dzafic1 have you got a VPN Filter configured?

Phase: 10
Type: ACCESS-LIST
Subtype: filter-aaa
Result: DROP

Provide your configuration if unsure.

[mirza.dzafic1]

@Rob Ingram 

i am not sure about vpn filer, but i didnt configure it. i attached the configuration for vpn on cisco asa side 

[Rob Ingram · Accepted solution]

@mirza.dzafic1 not enough information. The VPN filter is configured under the group policy (which is associated to the tunnel group), using the command syntax "vpn-filter value XXXXX" <<< look for this command in your configuration. Remove it or amend the associated ACL to permit the traffic.

[mirza.dzafic1]

@Rob Ingram 

Hi Rob. Thanks for detailed instruction. tunnel-group DefaultL2LGroup had a group policy, and in that group policy was vpn filter.I removed vpn-filter and it seems now it is everything ok.

Thank you very much.