ipsec site to site vpn decaps 0

[bluesea2010]

Hi,

I have the site to site VPN  to a remote site from ASA .

both site can't reach each other . 

pkts encaps there is some hit , but decaps is zero , does it mean  traffic leaving from ASA and not receiving from the  remote site ?

#pkts encaps: 9137, #pkts encrypt: 9137, #pkts digest: 9137
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0

sh crypto IPSec SA 

Crypto map tag: Test, seq num: 3, local addr: y.y.y.y

access-list cryptomap12 extended permit ip 10.0.5.0 255.255.255.0 192.168.2.0 255.255.255.0
local ident (addr/mask/prot/port): (10.0.5.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)
current_peer: x.x.x.x

#pkts encaps: 9137, #pkts encrypt: 9137, #pkts digest: 9137
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0

Thanks

[Rob Ingram]

@bluesea2010 can you check the remote end?

If the other end counters for decaps is increasing but no encaps, then this would usually indicate a NAT issue on the remote end or a routing issue. For NAT typically you'd define a NAT exemption rule to ensure traffic between those VPN networks is not unintentially being translated.

[bluesea2010]

Hi @Rob Ingram 

Thanks for the reply, another end I have only limited access..And it is not a cisco product. It is VMWare nsx.

I want to make sure the issue is not from ASA side .

sh crypto isakmp sa showing below , it means my phase 1 is ok ?

Session-id:6378, Status:UP-ACTIVE, IKE count:1, CHILD count:6

sh crypto IPSec SA also showing encryption. So packet is  going through the correct  tunnel 

Is there anything  need to be checked on ASA side 

Thanks

[Rob Ingram · Accepted solution]

@bluesea2010 Yes, you've established Phase 1 and 2. You could run packet-tracer to simulate the traffic flow and determine that traffic is not unintentially natted, although I doubt it has been as you probably wouldn't be encrypting the outbound traffic other wise. As already mentioned, check the remote end to determine if the traffic is decrypted and if they are unintentially translating the traffic or a routing issue.