Cisco ASA ikev2 local selector

[andreycgipokorskiy]

Hello Everyone! 

We have the VPN installed with a remote client, but I have not seen a local/remote selector for some IP range in the VPN tunnel. The ACL is already set and an interesting IP subnet has been added to it.
I have a question, how will the selectors be added to the tunnel?
Is it added by the ACL and crypto map?
Is it possible if the remote site does not have our IP address added or removed from his (client's) ACL, and for that reason we don't see a remote/local selector for that subnet in the tunnel?

Thank you!                                                                                                                                                             Regards,                                                                                                                                                                  AP

[Rob Ingram]

@andreycgipokorskiy assuming you have configured a policy based VPN (with a crypto map), then the crypto ACL needs modifying to specify the new networks to be encrypted.

If you are running a routed based VPN with a VTI, this does not use a crypto ACL to specify what should be encrypted. You just need to ensure the route is advertised using the dynamic routing protocol. If not using a routing protcol, the remote peer would need to define a static route over the tunnel.

[andreycgipokorskiy]

Hello Rob
If I got it right the selector mean that the selectors are the IP or range that been added to ACL and that ACL was added to crypto-map. Is it correct? And if we didn't see the local and remote selector in the tunnel it is mean that other side (client) have no or removed our IP from his ACL?

Thank you!

[Rob Ingram]

Hi @andreycgipokorskiy yes, the traffic selector refers to the interesting traffic defined in the ACL that should be encrypted.

Interesting traffic would need to be sent to/from the local/remote traffic selector in order for the IPSec SA to be established. So if you do not see the IPSec SA for the traffic selector, either there is a problem on the local or remote end or simply you just need to generate some traffic.

[andreycgipokorskiy]

Thanks for your help Rob!

[MHM Cisco World]

you dont see selector are the new LAN you add can ping other side ??

[andreycgipokorskiy]

Hello MHM

No I can't as this IP on client side and ICMP is not allowed

[MHM Cisco World]

not ICMP any traffic can pass between new local LAN and remote LAN ?

[andreycgipokorskiy]

Hello MHM
I can't ping remote LAN IP
I tried to find if the remote site lost our external IP in ACL
No lack