Hello,
I have asa (8.2) in headquarter as hub, cisco 18xx in branches as spoke. I need make routing between remote LANs. On one side i have 192.168.211.0/24 on the other is 192.168.212.0/24. Ipsec phase 1 and phase 2 are ok but i can't ping from from 192.168.211.0/24 to 192.168.212.0/24 and vice versa. Packet trace says:
Phase: 8
Type: VPN
Subtype: encrypt
Result: DROP
Config:
Additional Information:
Forward Flow based lookup yields rule:
out id=0xd83fd240, priority=70, domain=encrypt, deny=false
hits=53, user_data=0x0, cs_id=0xd7b688c8, reverse, flags=0x0, protocol=0
src ip=192.168.211.0, mask=255.255.255.0, port=0
dst ip=192.168.212.0, mask=255.255.255.0, port=0, dscp=0x0
Drop-reason: (acl-drop) Flow is denied by configured rule
My config on asa:
crypto acl:
access-list test-p1-p2 line 1 extended permit ip 192.168.211.0 255.255.255.0 192.168.212.0 255.255.255.0
access-list test-p2-p1 line 2 extended permit ip 192.168.212.0 255.255.255.0 192.168.211.0 255.255.255.0
access-list nonat line 40 extended permit ip 192.168.211.0 255.255.255.0 192.168.212.0 255.255.255.0 (hitcnt=0)
access-list nonat line 41 extended permit ip 192.168.212.0 255.255.255.0 192.168.211.0 255.255.255.0 (hitcnt=0)
#outside interface
access-list outside line 1 extended permit ip 192.168.211.0 255.255.255.0 192.168.212.0 255.255.255.0
access-list outside line 2 extended permit ip 192.168.212.0 255.255.255.0 192.168.211.0 255.255.255.0
routing between remote lan:
route outside 192.168.211.0 255.255.255.0 194.146.123.1 1
route outside 192.168.212.0 255.255.255.0 194.146.123.1 1
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
What i'm doing wrong or what i have missing ?
Thanks for help
Peter
