"ASA VPN/IPsec with BGP Configuration Example" Issues

[Ralphy006]

Has anyone gotten this setup to work?

http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/118835-config-asa-00.html

I have it labbed out, and I am able to bring up VPN tunnel, a BGP neighborship, and routes propagate.

I see the routes for 172.16.20.0/24 and 172.16.30.0/24 on both devices. But, the subnets are unable to communicate.

Does 172.16.20.0/24 and 172.16.30.0/24 need to be added to the crypto map? Or should 172.16.20.0/24 and 172.16.30.0/24 be able to communicate through the tunnel without be explicitly added, relying on the BGP relationship?

Any help would be great, much thanks!

[rvarelac]

Hi Ralph, 

I recommend you to check the routing table of each device "show route ", also a packet-tracer will be helpful as well. Maybe an ACL or rule is dropping this traffic. 

Example:

packet-tracer input inside icmp <src IP > 8 0 <dst IP > detailed 

Hope it helps 

- Randy- 

[mvsheik123]

Hi,

You need to have Nonat rules on both end and ACL added to crypto rules.

hth

MS