Hi guys
ive recently setup a EazyVPN on a cisco 3g router with a ASA5520. the tunnel comes up ok and the remote users can browse the net.
The problem is accessing the lan behind the ASA. when you do a show cry ipsec sa at the ASA you get the following: (ive replaced IP's with the names of the LAN/IP
Crypto map tag: DYN_MAP, seq num: 100, local addr: ASA IP ADD
local ident (addr/mask/prot/port): (LAN BEHIND ASA/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (LAN BEHIND 3G router/255.255.255.0/0/0)
current_peer: 3G Router IP, username: xxxxxx
dynamic allocated peer ip: 0.0.0.0
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 249, #pkts decrypt: 249, #pkts verify: 249
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: ASA IP ADD/4500, remote crypto endpt.: 3G Router IP/40592
path mtu 1500, ipsec overhead 82, media mtu 1500
current outbound spi: 79BBD3C3
inbound esp sas:
spi: 0x483ABBD4 (1211808724)
transform: esp-aes-256 esp-sha-hmac none
in use settings ={RA, Tunnel, NAT-T-Encaps, }
slot: 0, conn_id: 13179, crypto-map: DYN_MAP
sa timing: remaining key lifetime (sec): 27555
IV size: 16 bytes
replay detection support: Y
outbound esp sas:
spi: 0x79BBD3C3 (2042352579)
transform: esp-aes-256 esp-sha-hmac none
in use settings ={RA, Tunnel, NAT-T-Encaps, }
slot: 0, conn_id: 13179, crypto-map: DYN_MAP
sa timing: remaining key lifetime (sec): 27555
IV size: 16 bytes
replay detection support: Y
as you can see the packets are not encapsulating for some reason. On the 3G router its the opposite where the packets arent decapsulating. On a site to site VPN this is normally when the interesting traffic ACL is incorrect - but im baffled with this on an EazyVPN setup.
I have allowed the no nat statements on the router and the ASA -
any pointers?
thanks
