EasyVPN - ASA5505 to ASA 5510

[gavinspost]

Hi

I would appreciate if anyone could help me on this, I have the following setup:

Internal network(branch)---->ASA5505 <------->BT ADSL(dynamic IP, NAT)<-------Internet------->ASA5510<----Internal network(HQ)

We have created an easyvpn between the branch ASA5505 and the HQ ASA5510 which is up, however we can ping a host in the HQ network from the branch network but we cannot ping hosts in the branch network from the HQ network. The ASA5505 has been configured in Network Extension Mode but there is not a route for the branch network in the routing table. As the ASA5505 is actually on a private IP address behind the BT ADSL router do I need to enable any static NAT rules or port forwarding? Also should I being using NAT on the ASA5505 or set it up just for routing.

Any thoughts would be greatly appreciated.

Gavin

[Vikas Saxena]

Internal network(branch)---->ASA5505 <------->BT ADSL(dynamic  IP, NAT)<-------Internet------->ASA5510<----Internal  network(HQ)

You can ping successfully from left to right but not from right to left.

Had this been a route issue then PING would not have been successful any way.

We need to check:

1. When you ping from right to left (HQ->BR) ,

- does the packet make it to the HQ FW

- Does the HQ FW encrypts it (do you see increasing TX in ipsec sa (sh cry ipsec sa))

- Do you see increasing RX in the BR (sh cry ipsec SA)

- Do you see increasing TX in the BR (if you see this, that means the echo request made it to the destination and echo reply came back - this probably will not be the case since you are here reading this )

- Does the echo request make it to the actual destination

- Do you see echo reply coming out of the destination

Check for any FW on the destination, If Windows XP and if Cisco VPN client installed, check for Stateful FW option in the VPN client. if on turn it off.

Try again.