ASA VPN not encrypting traffic

[Infrastructure Team]

Hi all, Hope someone can point me to the one bit I've obviously missed.

I've got two replicated VPN's with GRE.  IPSEC from ASA -> K9 remote Router passing GRE tunnel traffic from Core loopback to K9 remote Router loopback.

One connection works fine, the second one is failing to encrypt traffic.

I've checked the crypto and both are the same.

I've checked the ACL's and both are the same.

I've checked the NAT statements and both are the same.

(with the exceptions of the remote IP's)

One connection is encrypting traffic (bsu mobile), the other isn't encrypting outgoing traffic (preston).

Packet captures on the ASA show the packets from loopback interfaces on the inside, but only the not working connection on the outside interface.  Wireshark captures mirroring the ports show EIGRP packets inside for the both connections tunnel interfaces, but only the not working tunnel on the outside of the firewall.

Packet tracer shows the same results for both connections.

[Philip D'Ath]

Does the ASA have a route to the remote loopback interface out its outside interface?

[Infrastructure Team]

It does have a route. 

Latest test, the crypto ACL shows no hits.  If I change the source IP in that ACL to say my PC rather than our GRE router, and make a connection attempt, the ACL is hit, and the packet is encrypted.  Change the ACL back to our core Loopback interface address and it stops encrypting the traffic.

This Loopback interface is used for the working tunnel.

[Philip D'Ath]

You are not using policy routing anywhere, are you?

This sounds like a software bug.  What model ASA are you using and what software version are you running on it?

[Infrastructure Team]

ASA 5525 on 9.4 (4) 5

However just after 8pm last night the firewall suddenly started sending encrypted packets, after a few hours of being left alone.

Now I just need to figure out why EIGRP isn't associating, despite seeing packets in both directions, and initial eigrp associate on the GRE.

[Philip D'Ath]

I would consider going to the next gold star release, 9.6(3).

https://software.cisco.com/download/release.html?mdfid=284143129&catid=268438162&softwareid=280775065&release=9.4.4&relind=AVAILABLE&rellifecycle=&reltype=latest