I ditched the Juniper as I didn't get any answers on the forums and in its place have put a cisco 877. Again, the tunnel comes back but the ASA cannot route back down the tunnel.
If i run show crypto ipsec sa on the ASA I get this:
Crypto map tag: outside_map, seq num: 2, local addr: PublicIPSiteB
access-list outside_2_cryptomap permit ip 172.16.50.0 255.255.255.0 172.16.40.0 255.255.255.0
local ident (addr/mask/prot/port): (172.16.50.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (172.16.40.0/255.255.255.0/0/0)
current_peer: PublicIPSiteA
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 57, #pkts decrypt: 57, #pkts verify: 57
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: SiteBPublicIP, remote crypto endpt.: SiteAPublicIP
path mtu 1500, ipsec overhead 58, media mtu 1500
current outbound spi: 3B937781
inbound esp sas:
spi: 0x34A136FC (882980604)
transform: esp-3des esp-sha-hmac none
in use settings ={L2L, Tunnel, PFS Group 2, }
slot: 0, conn_id: 152, crypto-map: outside_map
sa timing: remaining key lifetime (kB/sec): (92773/3365)
IV size: 8 bytes
replay detection support: Y
outbound esp sas:
spi: 0x3B937781 (999520129)
transform: esp-3des esp-sha-hmac none
in use settings ={L2L, Tunnel, PFS Group 2, }
slot: 0, conn_id: 152, crypto-map: outside_map
sa timing: remaining key lifetime (kB/sec): (92773/3365)
IV size: 8 bytes
replay detection support: Y
As per the above, I think that packets are reaching the ASA (Site B), but when you ping back from SiteB to A you get:
| 6 | Aug 12 2011 | 12:03:07 | 110003 | | | Routing failed to locate next hop for icmp from NP Identity Ifc:172.16.50.254/0 to inside-test:172.16.40.254/0 |
I have the following VLANS set up on the ASA
interface Vlan1 (this is the first site-to-site-vpn)
nameif inside
security-level 100
ip address 10.0.64.1 255.255.224.0
!
interface Vlan2
nameif outside
security-level 0
ip address SiteBPublicIP
!
interface Vlan3
nameif dmz
security-level 50
ip address dhcp
!
interface Vlan15
nameif inside-test (For second site-to-site VPN)
security-level 100
ip address 172.16.50.254 255.255.255.0
Do I have to do anything to the VLANS to get inside-test to route outside over the VPN?
i've tried route outside 172.16.40.0 255.255.255.0 SiteAPublicIP which doesn't have any effect.
Cheers
