Hi,
We are trying to establish a site-to site VPN tunnel between a Cisco ASA 5550 Software Version 9.1(5) and a Fortigate device.
The tunnel comes up ok and shows as active :
6 IKE Peer: xxx.xxx.xxx.xxx
Type : L2L Role : initiator
Rekey : no State : MM_ACTIVE
But no traffic can cross the tunnel. We get the following message:
%ASA-4-402116: IPSEC: Received an ESP packet (SPI= 0xF5BC3CE4, sequence number= 0x4) from xxx.xxx.xxx (user= xxx.xxx.xxx.xxx) to yyy.yyy.yyy.yyy. The decapsulated inner packet doesn't match the negotiated policy in the SA. The packet specifies its destination as zz.zz.zz.zz, its source as mm.mm.mm.mm, and its protocol as icmp. The SA specifies its local proxy as dd.dd.dd.dd/255.255.255.240/ip/0 and its remote_proxy as mm.mm.mm.mm/255.255.255.255/ip/0.
