Hello Guys,
I need a help here.
I never had this type of problem, maybe someone can help me to solv this problem.
I have an VPN site to site between RV320 and my cisco ASA.
I can ping the both sites, i can see that the port 80 is open, but i cant open my web application.
I try put an PHP page for test and it works fine.
I already try change my cisco ASA for Two RV320, and two Meraki MX64, and i have sucess to access my web application.
So the problem is in my concentrator ASA.
Follow the scenario:
Customer ------------RV320 ----------===Internet===-----------ASA-------------Web server
Customer IP: 192.168.13.30
Web server IP: 10.160.3.130
asa5520-frw/customer# sh crypto ipsec sa detail
interface: outside
Crypto map tag: sitecustomer, seq num: 2, local addr: 177.X.X.X
access-list l2l_plu-con_net extended permit ip 10.160.3.0 255.255.255.0 192.168.13.0 255.255.255.0
local ident (addr/mask/prot/port): (10.160.3.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.13.0/255.255.255.0/0/0)
current_peer: 177.X.X.X
#pkts encaps: 4242, #pkts encrypt: 4242, #pkts digest: 4242
#pkts decaps: 4219, #pkts decrypt: 4219, #pkts verify: 4219
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 4242, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#TFC rcvd: 0, #TFC sent: 0
#Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
#pkts no sa (send): 0, #pkts invalid sa (rcv): 0
#pkts encaps failed (send): 0, #pkts decaps failed (rcv): 0
#pkts invalid prot (rcv): 0, #pkts verify failed: 0
#pkts invalid identity (rcv): 0, #pkts invalid len (rcv): 0
#pkts invalid pad (rcv): 0,
#pkts invalid ip version (rcv): 0,
#pkts replay rollover (send): 0, #pkts replay rollover (rcv): 0
#pkts replay failed (rcv): 0
#pkts min mtu frag failed (send): 0, #pkts bad frag offset (rcv): 0
#pkts internal err (send): 0, #pkts internal err (rcv): 0
local crypto endpt.: 177.X.X.X/0, remote crypto endpt.: 177.X.X.X/0
path mtu 1500, ipsec overhead 58(36), media mtu 1500
PMTU time remaining (sec): 0, DF policy: clear-df
ICMP error validation: disabled, TFC packets: disabled
current outbound spi: 0D26E0B5
current inbound spi : 24D543B0
inbound esp sas:
spi: 0x24D543B0 (617956272)
transform: esp-3des esp-sha-hmac no compression
in use settings ={L2L, Tunnel, IKEv1, }
slot: 0, conn_id: 2510848, crypto-map: sitecustomer
sa timing: remaining key lifetime (sec): 28765
IV size: 8 bytes
replay detection support: Y
Anti replay bitmap:
0x00000003 0xFFFFFFFF
outbound esp sas:
spi: 0x0D26E0B5 (220651701)
transform: esp-3des esp-sha-hmac no compression
in use settings ={L2L, Tunnel, IKEv1, }
I see in the side ASA some tcp retransmissions and tcp dup ack, but i dont have sure that is the problem, because i dont see error in the command above.
22 3.425484 10.160.3.130 192.168.13.30 TCP 63 [TCP Retransmission] 80 → 58722 [PSH, ACK] Seq=1407 Ack=1455 Win=32512 Len=5 80 58722 Cisco_73:01:56 Cisco_73:01:56
23 3.427712 192.168.13.30 10.160.3.130 TCP 70 [TCP Dup ACK 18#1] 58722 → 80 [ACK] Seq=1455 Ack=912 Win=65868 Len=0 SLE=1407 SRE=1412 58722 80 a2:76:1e:00:00:38 a2:76:1e:00:00:38
24 3.437309 10.160.3.130 192.168.13.30 TCP 553 [TCP Retransmission] 80 → 58722 [PSH, ACK] Seq=912 Ack=1455 Win=32512 Len=495 80 58722 Cisco_73:01:56 Cisco_73:01:56
25 3.682420 10.160.3.130 192.168.13.30 TCP 553 [TCP Retransmission] 80 → 58722 [PSH, ACK] Seq=912 Ack=1455 Win=32512 Len=495 80 58722 Cisco_73:01:56 Cisco_73:01:56
Best Regards.
