Having a problem with a new site with the far end behind a firewall. Tunnel interface is up/up, routes are there but nothing is being encapsulated across the tunnel. I see decaps but no traffic passing from hub to spoke. I cannot ping the far end of the tunnel interface either which is a /30. I have no access to the far end currently (have the config file) so trying to make this work from the hub end but not having much luck.
I have other identical configs working without issue but this one is not and no idea why. Assuming a routing issue on the far end but I should at least be able to ping the far end of the tunnel 172.21.8.13 no?
Tunnel6 172.21.8.14 YES manual up up
interface Tunnel6
ip address 172.21.8.14 255.255.255.252
ip mtu 1400
ip tcp adjust-mss 1360
tunnel source GigabitEthernet0/0/0
tunnel mode ipsec ipv4
tunnel destination 99.66.77.88
tunnel protection ipsec profile ikev2-
end
Crypto map tag: Tunnel6-head-0, local addr 88.55.66.77
protected vrf: (none)
local ident (addr/mask/prot/port): (88.55.66.77/255.255.255.255/47/0)
remote ident (addr/mask/prot/port): (192.168.2.2/255.255.255.255/47/0)
current_peer 99.66.77.88 port 64917
PERMIT, flags={}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 349, #pkts decrypt: 349, #pkts verify: 349
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 88.55.66.77, remote crypto endpt.: 99.66.77.88
plaintext mtu 1422, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0/0
current outbound spi: 0x85BEAFA7(2243866535)
PFS (Y/N): N, DH group: none
inbound esp sas:
spi: 0x97864AAC(2542160556)
transform: esp-256-aes esp-sha256-hmac ,
in use settings ={Tunnel UDP-Encaps, }
conn id: 8517, flow_id: ESG:6517, sibling_flags FFFFFFFF80000048, crypto map: Tunnel6-head-0
sa timing: remaining key lifetime (k/sec): (4607966/3412)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE(ACTIVE)
