IPSec ASA5510 To RVS4000

[Robert Ho]

Hi,

We built a VPN tunnel between the sites but traffic only seem to be able to initiate in one direction.

SiteA has the RVS with 192.168.15.0/24

SiteB has the ASA with 192.168.11.0/24

We are able to ping/rdp/etc from SiteA to SiteB but not able from the other direction.

Here are some logs:

%ASA-3-106014: Deny inbound icmp src Inside:192.168.11.1 dst Inside:192.168.15.10 (type 8, code 0)
%ASA-3-106014: Deny inbound icmp src Inside:192.168.11.1 dst Inside:192.168.15.10 (type 8, code 0)

Any input is appreciated.

Thanks

-robert

[Federico Coto Fajardo]

Hi,

You say that traffic from the ASA side to the other side won't work.

Do you see packets encrypted/decrypted incrementing when sending traffic in this direction? (with the command ''sh cry ips sa'' on the ASA).

This will show if packet is indeed being sent thru the tunnel.

Federico.

[Robert Ho]

Yes, we do see packets across the tunnel but that is because we are able to initiate traffic from siteA to siteB.

We can ping/rdp/etc from any node in siteA to siteB.

It's only when we try to initiate from siteB to siteA that it fails.

Your help is appreciated.

Thanks

-robert

[Federico Coto Fajardo]

Yes but is there too much traffic flowing to do a test?

I was suggesting to check if the packets encrypted/decrypted increment on the ASA side when initiating the tunnel from the ASA side.

Federico.

[Robert Ho]

we intiate a telnet connection from siteB to siteA and do not see the counter increment in the output of sh crypto ips sa

it gets denied by the asa?

ASA-2-106001: Inbound TCP connection denied from 192.168.11.1/53954 to 192.168.16.254/23 flags SYN  on interface Inside

[Federico Coto Fajardo]

Do you have an ACL applied to the inside interface in the inbound direction that is not allowing this traffic?

Federico.

[Robert Ho]

hi, there are no acl's applied on the inside interface.

the only acl's configured are the outside and the one that is applied to no-nat.

do we need one to be applied on the inside interface? we never had to before.

thanks

-robert

[Gustavo Medina]

Hi Robert,

Please check the routing and static translations on the ASA, as per:

%ASA-3-106014: Deny inbound icmp src Inside:192.168.11.1 dst Inside:192.168.15.10 (type 8, code 0)

That traffic is not being sent through the outside interface which is the interface I assume has the crypto map applied on it.

You can run a "debug icmp trace" when running a ping test from the 192.168.11.x to the 192.168.15.x in order to see where that ping is going.

The output of a packet-tracer would be helpful also, it would be great if you could provide it:

packet-tracer input inside icmp 192.168.11.5 8 0 192.168.15.10 detailed

Regards,

[Robert Ho]

hi jose, there is no specific route configured.

we thought the asa would punt it directly to the outside/vpn since the tunnel is up?

thanks

-robert