Routing SSL traffic over two firewalls

[Imran Ahmad]

Hello,

I hv an ASA facing internet and terminating SSL connections. Behind the ASA i have IOS Firewall which hosts the Servers need to be accessed through the SSL provided by the asa

The issue im having is : Users SSL coonections are terminated at the ASA fine, after that when i route those traffic into the IOS Firewall, the traffic does not reach destination servers.   The logs at ios FW shows following msg "Crypto packets re-cvd is not crypto  IPSEC packet"

Plz help me how to route those traffic terminated over ssl on the asa into the ios firewall

[Philip D'Ath]

To be more specific, is the ASA terminating AnyConnect SSL VPN connections?  Or are you using the portal functionality?

[Imran Ahmad]

Hi Philip,  that is not portal base, clients are connecting using anyconnect vpn client soft , that is a Client full vpn not clientless

[Philip D'Ath]

I suspect you mean IAS firewall, rather than IOS.

You aren't generating any IPSec traffic to IAS, so this error is a distraction.  You are only generating SSL traffic to the IAS firewall.

IAS is a pig of a product to get working correctly, and I don't envy you.  I would get rid of it if at all possible.

Does the ASA log show traffic flows happening to the IAS server?

[Imran Ahmad]

I do not mean IAS.   I mean IOS

Follow is my structure:

Remote (SSL) user >>>>Internet >>>> (Outside)ASA---(Inside)ASA>>>>E1_Link>>>>>IOS Firewall (ISR) >>>Servers

When remote ssl users connect to my ASA, they can reach and ping the IOS FW ip, but they can not reach the servers locating behind the IOS FW.   and I get the log msg I wrote in my first post

[Philip D'Ath]

Can the ASA ping the servers behind the ASA firewall?

Are you using split tunnelling?  If so, is the subnet behind the IOS router in the split tunnel list?

[Imran Ahmad]

Yes I can ping servers from the ASA. There is no split tunelling configured.

I am getting the following logs on the ios firewall router "crypto packet recieved is not IPSec packet"

that means there is some other issue rather the routing

[Philip D'Ath · Accepted solution]

I guess it is possible you an IPSec VPN configured on the IOS firewall whose encryption domain includes that being used by the SSL VPN client.

Has the IOS firewall got any IPSec VPN's configured?

[Imran Ahmad]

Yes that can be a good point. I have to check and will get back 

I have GetVPN configured and applied on the IOS firewall interface

[Philip D'Ath · Accepted solution]

Are you able to turn off GET VPN temporarily to see if that is the issue?

[Imran Ahmad]

Thanks a lot Philip,  the issue was exactly with the Getvpn configured on the IOS FW.   I excluded the SSL VPN ip-subnet from the GETVPN encryption domain and now works fine.

thanks again