IPsec tunnel (AUTOMATIC NAT DETECTION STATUS) (Acl doesnot match proxy ids

kashif.ahmad837 · ‎11-22-2016

Hi all,

Can any body explain to me, that whether this problem is because of NAT mismatch, or ACL mismatch.

the snapshot is attached.

thanks,

JP Miranda Z · ‎11-22-2016

The first message you see about an automatic NAT detection is the NAT-T check, thats why you can see the remote end device is behind nat and yours is not.

This is definitely an ACL mismatch, i will recommend you to check both ends interesting traffic and make sure they are exactly mirrored.

Hope this info helps!!

Rate if helps you!!

-JP-

kashif.ahmad837 · ‎11-23-2016

Hi Miranda,

this is a dynamic site to site vpn, and all the other devices are connecting fine. and I compared the vpn configuration on those remote devices, they are exactly the same. but this one device would not keep its vpn up. it successfully complete the phase 2 but the session is disconnected immediately after. and the process start over and over.

JP Miranda Z · ‎11-23-2016

Hi kashif.ahmad837,

You can setup logging on the ASA to see the reason of the disconnection, without a reason or debugs then the tunnel is going down and also without checking the config will be kind of hard to point something out.

Hope this info helps!!

Rate if helps you!!

-JP-