Packet capture VPN SYN Error - No return traffic

[m.s.rees1]

Hi,

We are getting no response from a server over a VPN and the only thing I am getting with a packet capture is below. Can anyone point me in the right direction as to where the issue is? You can see the traffic outbound with data, but nothing ever returns.

Thanks

[Rob Ingram]

@m.s.rees1 run packet-tracer from the CLI of your ASA to confirm traffic is allowed and not unintentially NAT translated. Check "show crypto ipsec sa" and determine whether the encaps counters are increasing. If the decaps counters are not increasing then the peer is not returning traffic, the peer needs to check traffic is permitted on their firewall and the traffic is not unintentially translated.

[m.s.rees1]

Thanks for the reply. When running packet tracer all phases show ALLOW, with this as the end result:

The Show crypto ipsec sa retruns the following:

So I am getting 0 on the decaps. Do you think that is pointing to the peer, or could it still be my end?

[Rob Ingram]

@m.s.rees1 if your packet-tracer action is "allow" and you are encrypting the traffic and not receiving any return traffic, this generally points to a problem with the peer.

I assume packet-tracer confirms your crypto ACL is correct and traffic is not unintentially translated? If yes, talk to the peer.

[m.s.rees1]

Right ok, this my full capture:

We do have a NAT in place. My 172 address is using the NAT address 192.168.190.35, which you can see in phase 4. Does this look good?

packet-tracer input inside tcp 172.22.26.202 1234 192.168.190.2 http

Phase: 1
Type: CAPTURE
Subtype:
Result: ALLOW
Config:
Additional Information:
MAC Access list

Phase: 2
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list

Phase: 3
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
nat (inside,outside) source static server server_nat destination static peer_remote peer_remote
Additional Information:
NAT divert to egress interface outside
Untranslate 192.168.190.2/80 to 192.168.190.2/80

Phase: 4
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (inside,outside) source static server server_nat destination static peer_remote peer_remote
Additional Information:
Static translate 172.22.26.202/1234 to 192.168.190.35/1234

Phase: 5
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 6
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 7
Type: CAPTURE
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 8
Type: VPN
Subtype: encrypt
Result: ALLOW
Config:
Additional Information:

Phase: 9
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
nat (inside,outside) source static server server_nat destination static peer_remote peer_remote
Additional Information:

Phase: 10
Type: VPN
Subtype: ipsec-tunnel-flow
Result: ALLOW
Config:
Additional Information:

Phase: 11
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 12
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 13
Type: CAPTURE
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 14
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 8955569, packet dispatched to next module

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: allow

[Rob Ingram · Accepted solution]

@m.s.rees1 well I can determine you are intentially translating traffic to 192.168.190.35, so traffic is not unintentially translated behind the ASA outside interface IP, which is a common problem. So from what I can tell your configuration seems ok. Contact the peer and review the configuration and troubleshoot with them.

[m.s.rees1]

Great, thankyou for your input.

[MHM Cisco World]

Hi

I send you message to guide you how solve issue' check it.