Site-to-Site VPN issue

[Kimberly Adams]

Hello All,

I have a site to site VPN between an ASA5540 and an ASA5510.  The tunnel is up and passing traffic between all networks but one.  The network that is not passing traffic is allowed in the object group for access on both sides, but when running a show crypto ipsec sa I get the following:

HOST SIDE - 5540

#pkts encaps: 275063, #pkts encrypt: 275062, #pkts digest: 275062
      #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 275063, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 1, #fragments created: 0
      #PMTUs sent: 1, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0

REMOTE SIDE - 5510

  #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
      #pkts decaps: 187550, #pkts decrypt: 187550, #pkts verify: 187550
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0

Please let me know if anyone out there has any ideas on this one.  I currently don't have access to the remote side but host side is accessible.

Thanks,

Kimberly

[Federico Coto Fajardo]

Hi Kimberly,

The problem most likely is on the remote side because you have no packets encrypted for this network.

Please double-check that the network is included in the interesting traffic for this tunnel and that is not included

for other tunnel.

Please do a test:

Try to PING the remote LAN from the central side and see if packets are being encrypted (host side).

This will show if packets are being sent through the tunnel.

If packets are being encrypted, then check if the remote side is decrypting the packets.

This will show if the packets through the tunnel are reaching the remote site.

Do the same test in the other way.

The whole idea is to check which side is not encrypting and that's where the problem is.

Federico.

[Kimberly Adams]

Federico,

I know the remote site is the one that is not encrypting data at all.  That was obvious from the portions of IPSEC I put in the orginal post.  I am looking for what could be causing this.  I have verified the allowed networks and the one not working is listed.  I now have a way to access the remote firewall.

Cheers,

Kimberly

[Federico Coto Fajardo]

Kimberly,

The output of the sh cry ips sa is only valid at the moment of testing so I not took anything obvious out of it.

But, if the remote site is not encrypting (therefore the host side is not decrypting), then the problem is on the remote site.

Now... what could be wrong on the remote site?

Well... Problem could be either NAT, route or VPN.

Could you check the NAT config, the route and the VPN (interesting traffic) on the remote site?

Federico.

[Kimberly Adams]

Federico,

I thought I would update you on the status on this issue.  I checked the NAT/NoNAT and all was fine.  The remote site decided to reload their firewall after-hours and then it all started to work.  Nothing within the routing or NATs or anything else was changed.

This is just one of those flukes that needs a reload....I guess, but I hate that answer here in the Cisco Networking World.

Thanks for the assistance.

Kimberly