ideally get some debug from the ASA and from the ASR.
Could be due to PFS value not defined on Phase 2 or the vaules mis-match. if PFS vaule are defined than try to change the vaule to lowers than work it out.
Also take the logs from both ASR and on the ASA.
for the ASR
ip access-listetd extended VPNCAP
permit ip host x.x.x.x host y.y.y.y
permit ip host y.y.y.y host x.x.x.x
!
monitor capture mycap access-list VPNCAP
monitor capture mycap limit duration 1000
monitor capture mycap interface GigabitEthernet 0/0/1 both (Internet Facing Interface)
monitor capture mycap buffer circular size ---
monitor capture mycap start
monitor capture mycap stop
monitor capture mycap export tftp://b.b.b.b/mycap.pcap
on the ASA code.
capture VPNCAP type iskamp interface outside match ip host x.x.x.x host y.y.y.y
debug crypto condition peer x.x.x.x
debug crypto ikev2 platfrom 127
debug crypto ikev2 protocol 127
debug crypto ipsec 127
!
logging buffer-size 248
logging monitor debugging
copy /pcap capture:<capture-name> tftp://<server-ip-address
could you please share the pcap file to have look what is happening.
please do not forget to rate.
