02-16-2016 07:34 AM
Weird problem here. I have a Site-to-Site VPN that isn't working. Both ASAs have other Site-To-Site VPNs working on them. I know the configuration is correct because it was working fine for months and it hasn't changed.
I have both a successful Phase 1 and Phase 2 but both sides don't show any return traffic. When I do an ASP drop capture at the HQ, I see it dropping ESP packets from an unknown IP. These packets have to be coming from the remote side though because when I reboot the reboot ASA, the packets stop dropping. As soon as the ASA comes back up, I start seeing the packets drop again.
When I do a capture at the remote side, I see it dropping ESP packets from an unknown IP as well. This side also has a successful Phase 1 and Phase 2 but doesn't see any return traffic either.
Any ides on what might be causing this?
02-16-2016 04:35 PM
Can you post a "show crypto ipsec sa peer xxx" from each end please.
Is there anything sitting between the firewalls that is also doing NAT? Perhaps a router?
02-18-2016 09:15 AM
Not sure what the deal was. I completely removed the config and pasted it back in and started to work
Damn you Cisco.
I had already rebooted both devices too.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide