FPR2110 ASA Code outside access list denies tunneled traffic.

[Garry Cross]

This is the first time configuring a VPN L2L between an FPR2110 running ASA software and another real ASA.

We found that the outside access list was denying the tunneled traffic.

We needed to add permit ip 172.16.0.0 255.255.0.0 any to the ACL in order for communication to work.

Cisco Adaptive Security Appliance Software Version 9.10(1) <context>
Firepower Extensible Operating System Version 2.4(1.103)

I can't imagine that this is working as designed.

Thanks for any insight.

[Rob Ingram · Accepted solution]

@Garry Cross 

To permit any packets that come from an IPsec tunnel without checking ACLs for the source and destination interfaces, enter the sysopt connection permit-vpn command in global configuration mode.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa99/configuration/vpn/asa-99-vpn-config/vpn-params.html

[Garry Cross]

Thank you. It would appear someone configured the no form of that command.

act# show run | inc sysopt
no sysopt connection permit-vpn