S2S VPN Tunnel with AWS not establishing

[kbowles]

Hello everyone, 

Long time reader, first time requester. As the title states I am having issues getting a S2S IKEv1 tunnel to establish between my ASA 5516-x and our AWS VPC. I followed a guide to do this, and downloaded the config straight from AWS that said to copy and paste into the firewall and the tunnel should come up. If only my life was ever that easy. Anyone have experience doing this? If I run

clear crypto ikev1 *peer ip*

I can see the IKEv1 tunnel in a Wait_MM_MSG2 status for about 15 seconds before I start seeing that there are no IKEv1 tunnels. Please advise. Thank you!

[MHM Cisco World]

Can I see config of asa?

[kbowles]

I have scrubbed the config of IPs and names that are not relevant to the AWS issue I am having. I have also attached the config I was provided from AWS for reference. Please let me know what you see! I tried to run debug crypto ikev1 but nothing populated. 

[kbowles]

Here is also a snippet of what I have been seeing. 

[MHM Cisco World]

Your config have many s2s vpn

Can you try packet-tracer for ipsec and share result here

Note:- do packet-tracer twice to get results it can first one show drop

Note:- add detail keyword to end of packet tracer command 

MHM

[kbowles]

What is the command for packet-tracer ipsec? 

I usually do packet-tracer input *outside interface name* 8 0 34.215.53.147(aws interface ip)

[MHM Cisco World]

That it and add detail keyword to end

Share result here

MHM

[kbowles]

Please see attached. I can ping both of the amazon IPs but no tunnel is established still. 

[MHM Cisco World]

There is something wrong in packet tracer command it show packet loop

Can I see command you use 

MHM

[kbowles]

I used 

packet-tracer input *outside interface name* icmp *internal IP that should go through vpn* 8 0 *amazon IP* detailed

[MHM Cisco World]

packet-tracer input *inside interface name* icmp *internal IP that should go through vpn* 8 0 *amazon IP* detailed

The source interface is INSIDE not OUTSIDE

MHM

[kbowles]

Okay, I fixed the capture with using an internal IP to the IP that we need to be able to access across the vpn. I see it doing the NAT exemption but phase 11(vpn) drops. Ran the command twice to ensure. See photos. 

[MHM Cisco World]

Did you run it twice'

Make sure do packet tracer again and check if it drop in same phase or not.

MHM

[kbowles]

Yes I ran twice and both failed in the same spot.

[MHM Cisco World]

Show crypto isakmp sa

Only show me the tunnel end not work.

MHM