Hi All,
I am trying to setup the site to site vpn from Head office to branch office. Head
office has ASA1 and branch office has ASA2. ASA1 has configured with remote VPn and
Site to site vpn. Remote VPN works fine. ASA2 has configured with only Site 2 site
VPN. Both the ASA are 5505.
Phase 1 is successfully completed and it shows MM_Active in both ASAs. But I am not able ping from one site pc to other site. if you see the results at the bottom it shows the head office ASA1 is able to decrypt the packets but not able to encrypt.
branch office ASA2 is able encryp the packets but not able to decrypt.
When I tried for packet tracer the packet dropped saysing VPN lookup. I have attached it with the case.
Could some one help me on this.
ASA1
route x.x..1.0 255.255.255.0 [1/0] via Outside-Network, outside
tunnel-group 2.2.2.2 type ipsec-l2l
tunnel-group 2.2.2.2 ipsec-attributes
crypto map DIV-MAP 10 ipsec-isakmp dynamic RVPN-MAP
crypto dynamic-map IPSEC-VPN 10 set transform-set esp-3des esp-sha-hmac
crypto dynamic-map IPSEC-VPN 10 set reverse-route
crypto map DIV-MAP 20 match address S2S
crypto map DIV-MAP 20 set peer 2.2.2.2
crypto map DIV-MAP 20 set transform-set esp-3des esp-sha-hmac
IKE Peer: 2.2.2.2
Type : L2L Role : responder
Rekey : no State : MM_ACTIVE
Crypto map tag: RVPN-MAP, seq num: 10, local addr: Outside-Network
local ident (addr/mask/prot/port): (x.x.100.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (x.x.1.0/255.255.255.0/0/0)
current_peer: 2.2.2.2
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 89, #pkts decrypt: 89, #pkts verify: 89
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: Outside-Network, remote crypto endpt.:2.2.2.2
path mtu 1500, ipsec overhead 58, media mtu 1500
current outbound spi: AC93D2BC
inbound esp sas:
spi: 0xE2A3F913 (3802396947)
transform: esp-3des esp-sha-hmac none
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 263, crypto-map: RVPN-MAP
ASA2:
route x.x.100.0 255.255.255.0 [1/0] via Outside-Network, outside
tunnel-group 1.1.1.1 type ipsec-l2l
tunnel-group 1.1.1.1 ipsec-attributes
crypto map DIV-MAP 10 ipsec-isakmp dynamic RVPN-MAP
crypto dynamic-map IPSEC-VPN 10 set transform-set esp-3des esp-sha-hmac
crypto dynamic-map IPSEC-VPN 10 set reverse-route
crypto map DIV-MAP 20 match address S2S
crypto map DIV-MAP 20 set peer 1.1.1.1
crypto map DIV-MAP 20 set transform-set esp-3des esp-sha-hmac
IKE Peer: 1.1.1.1
Type : L2L Role : Initiator
Rekey : no State : MM_ACTIVE Crypto map tag: S-MAP, seq num:
1, local addr: 99.76.209.61
local ident (addr/mask/prot/port): (x.x.1.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (x.x.100.0/255.255.255.0/0/0)
current_peer: 1.1.1.1
#pkts encaps: 89, #pkts encrypt: 89, #pkts digest: 89
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 89, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: 2.2.2.2, remote crypto endpt.: 1.1.1.1
path mtu 1500, ipsec overhead 58, media mtu 1500
current outbound spi: E2A3F913
inbound esp sas:
spi: 0xAC93D2BC (2895368892)
transform: esp-3des esp-sha-hmac none
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 198, crypto-map: S-MAP
sa timing: remaining key lifetime (kB/sec): (4275000/26421)
IV size: 8 bytes
replay detection support: Y
outbound esp sas:
spi: 0xE2A3F913 (3802396947)
transform: esp-3des esp-sha-hmac none
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 198, crypto-map: S-MAP
sa timing: remaining key lifetime (kB/sec): (4274992/26421)
