I have an ASA 5505 connecting in via EasyVPN to an ASA 5510. The tunnel comes up (both ISAKMP and IPSEC create a security association)- traffic is not flowing both ways. If I ping from the network with the hub (5510)- I can ping a node on the remote network (5505) side. If I ping the other way around- I cannot ping devices on the hub network. Here is the relevant configs:
ASA5510:
crypto dynamic-map dynmap 10 set transform-set 3des-md5 3des-sha des-md5 des-sha aes-256-md5
crypto dynamic-map dynmap 10 set reverse-route
crypto map VPN 20 ipsec-isakmp dynamic dynmap
crypto map VPN interface outside
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 73
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp nat-traversal 3600
crypto isakmp ipsec-over-tcp port 10000
group-policy MPEZvpn internal
group-policy MPEZvpn attributes
dns-server value 192.168.36.2 192.168.253.3
dhcp-network-scope 172.16.64.0
vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
split-tunnel-policy tunnelall
default-domain value morganusa.local
nem enable
webvpn
svc keep-installer installed
svc ask enable default webvpn timeout 5
username fort worth password XXXXXX encrypted
tunnel-group MPEZvpn type remote-access
tunnel-group MPEZvpn general-attributes
address-pool mpezvpn
default-group-policy MPEZvpn
dhcp-server 192.168.253.3
tunnel-group MPEZvpn webvpn-attributes
radius-reject-message
group-alias MPEZvpn enable
tunnel-group MPEZvpn ipsec-attributes
pre-shared-key *
and the show crypto ipsec sa:
Crypto map tag: dynmap, seq num: 10, local addr: XX.XX.XX.XX
local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
remote ident (addr/mask/prot/port): (192.168.136.0/255.255.255.0/0/0)
current_peer: 66.60.73.202, username: fortworth
dynamic allocated peer ip: 0.0.0.0
#pkts encaps: 110, #pkts encrypt: 110, #pkts digest: 110
#pkts decaps: 3282, #pkts decrypt: 3282, #pkts verify: 3282
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 110, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: XX.XX.XX.XX/4500, remote crypto endpt.: XX.XX.XX.XX/4500
path mtu 1500, ipsec overhead 66, media mtu 1500
current outbound spi: 308103ED
inbound esp sas:
spi: 0xA9A6DA42 (2846284354)
transform: esp-3des esp-md5-hmac none
in use settings ={RA, Tunnel, NAT-T-Encaps, }
slot: 0, conn_id: 258048, crypto-map: dynmap
sa timing: remaining key lifetime (sec): 26480
IV size: 8 bytes
replay detection support: Y
outbound esp sas:
spi: 0x308103ED (813761517)
transform: esp-3des esp-md5-hmac none
in use settings ={RA, Tunnel, NAT-T-Encaps, }
slot: 0, conn_id: 258048, crypto-map: dynmap
sa timing: remaining key lifetime (sec): 26480
IV size: 8 bytes
replay detection support: Y
ASA 5505 side:
vpnclient server XX.XX.XX.XX
vpnclient mode network-extension-mode
vpnclient vpngroup MPEZvpn password ********
vpnclient username fortworth password ********
vpnclient management tunnel 192.168.136.0 255.255.255.0
vpnclient enable
Crypto map tag: _vpnc_cm, seq num: 10, local addr: 192.168.123.126
access-list _vpnc_acl permit ip 192.168.136.0 255.255.255.0 any
local ident (addr/mask/prot/port): (192.168.136.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
current_peer: XX.XX.XX.XX, username: XX.XX.XX.XX
dynamic allocated peer ip: 0.0.0.0
#pkts encaps: 3391, #pkts encrypt: 3391, #pkts digest: 3391
#pkts decaps: 110, #pkts decrypt: 110, #pkts verify: 110
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 3391, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: 192.168.123.126/4500, remote crypto endpt.: XX.XX.XX.XX/4500
path mtu 1500, ipsec overhead 66, media mtu 1500
current outbound spi: A9A6DA42
inbound esp sas:
spi: 0x308103ED (813761517)
transform: esp-3des esp-md5-hmac none
in use settings ={RA, Tunnel, NAT-T-Encaps, }
slot: 0, conn_id: 1, crypto-map: _vpnc_cm
sa timing: remaining key lifetime (sec): 26287
IV size: 8 bytes
replay detection support: Y
outbound esp sas:
spi: 0xA9A6DA42 (2846284354)
transform: esp-3des esp-md5-hmac none
in use settings ={RA, Tunnel, NAT-T-Encaps, }
slot: 0, conn_id: 1, crypto-map: _vpnc_cm
sa timing: remaining key lifetime (sec): 26287
IV size: 8 bytes
replay detection support: Y
Once again- I can ping devices from the main network to the remote network- but not the other way around. Any ideas on what changes need to be made? The remote network is behind another firewall (ASA5505)- doing NAT- but has all ports open on a static translate to the EasyVPN firewall.
Thanks!
