ASDM over L2L

[Erik-234577235]

hi,

I have 4 branch-offices connected via L2L to the main office (all 5505, 8.4.3)

When I compare the running configs, they look very similar, and so they should, because the branch-asas are all configured identically (internal IPs are different, outside is dhcp).

My problem is, that I cannot connect via asdm to some devices sometimes. They are all configured identically.

The worst case is, that 1 device is sometimes reachable and sometimes not.

Same thing with ICMP... sometimes I can ping an asa, sometimes not.

Is there a way how I can set the device to recognize the packets correct?

thx

DN

[Jennifer Halim]

Since your branch ASA outside interface is running on DHCP, when the VPN tunnel is down, the first connection needs to be initiated from the branch subnet. This is why you sometimes can't access the branch site because the main office can't initiate the VPN tunnel if the VPN tunnel to branch is down or if the SA has expires. To keep the tunnel up at all time, you can use probe/continuous ping/etc so you can always access the branch office. However, if the branch DHCP ip changes, then the first connection needs to be initiated from the branch.

Hope this answers your question.

[Erik-234577235]

Hi Jennifer,

thx for you answer. This might generally be true, but not in my case.

The tunnel is up and I reach the systems beyond the asas.

Even when the ping is running, I cannot access the asa.

Logout the asa from vpn and reconnect doesn't work. Tunnel comes up, but asa stays non-reachable.

thx

DN

[Jennifer Halim]

I assume that you access the ASA inside interface IP that is part of the crypto ACL, has "management-access inside" configured, and also "http inside" all configured?

Can you please share your config if the above has been configured?

[Erik-234577235]

Hi Jennifer,

it doesn't matter if I access the asa over the public ip or the internal.

With the internal ip it's most of the time not reachable, and over the public ip the asa is reachable as long as the tunnel is not up. As soon the tunnel is up, access over the public ip is not possible any more.

Config:

http 0.0.0.0 0.0.0.0 outside

http 0.0.0.0 0.0.0.0 inside

DN