ASA dymaic crypto role intiator / responder problem

[jorge_cortez]

hi,

can anyone help me, im building a VPN  site to site between ASA and Meraki (dynamic crypto map), so te firewall is configured to wait for vpn request from everywhere, the vpn builds fine and I can have a ping from the branch (meraki site), but if i try to initiate the ping from the central site (asa site) it doesn't responde until I initiate a ping from the meraki side, so its looks like something about the initiator and responder role in the vpn configuration, actually the cisco asa has the responder role in the crypto.

What can I do to permit my communication from the central site to the branch without the need to send a ping from the branch?

regards

Jorge Cortez

[jorge_cortez]

BTW the vpn tunnel is active and i have communication between other networks (the ones that the branch office initiate), but there is one network that the branch office desn´t initiate and that is where i have the problem (the sys admin networks Who needs to remote desktop the branch office server)

[Karsten Iwen]

Do you have a static IP on the Branch/Meraki side? Then you can configure it as a static crypto map which can be initiated from both sides.

If you only have a dynamic IP on the Brach-side, then you have to make sure that something from that side is permanently sending traffic.

[jorge_cortez]

thank you Karsten, so its the normal behaviour? the tunnel is initiated and i have SA (show ipsec sa), but only in the networks that the remote side send traffic to the central office, but for the network where the sysadmin is trying to remote desktop the server i don't see the network in the show ipsec sa until I send a ping from the branch office to that network.

[Karsten Iwen]

Yes, the ASA is only the responder if configured with a dynamic crypto map.

[jorge_cortez]

thank you I thought that initiator / responder role was important only for the phase 1, but now I see that also take action in the phase 2 communication right? that`s because as i told you the vpn is up and running for some networks but not for other where the initiation has not begin from the meraki side