VPN client through ASA

[tolinrome tolinrome]

I have a client that needs to establish a VPN client connection using ipsec to their corporate firewall, they are behind my ASA firewall which uses dynamic pat. The tunnel forms but no traffic passes. I've tried the following with no improvement:

Enabling ipsec pass through.

policy-map global_policy
           class inspection_default
            inspect ipsec-pass-thru

Enabling nat-t

crypto isakmp nat-traversal 20

Allowing udp4500 and isakmp udp500 and esp50, ah51 from inside to outside.

Nothing worked. Any other ideas as to why they cannot pass traffic through the tunnel although the tunnel connects?

Thanks.

[Aditya Ganjoo]

Hi,

Do we have a site to site between the local ASA and the corporate FW as well ?

If yes we cannot have both VPN client and the site to site up at the same time.

Regards,

Aditya

Please rate helpful posts.

[tolinrome tolinrome]

No, we do not. We have nothing connected to the 3rd party firewall that the client is trying to pass traffic through.

client--->local ASA--->Internet--->3rd party ASA

[Aditya Ganjoo]

Hi,

Does the phase 2 even come up ?

What is the output of show cry ipsec sa peer <remote peer> ?

If no then try to enable debug crypto ipsec 200 and share the output.

Regards,

Aditya

[tolinrome tolinrome]

no phase two and nothing in the logs.

[Aditya Ganjoo]

Hi,

Do you see the VPN client connected ?

What is the output of show vpn-sessiondb ra-ikev1-ipsec

Regards,

Aditya

[tolinrome tolinrome]

Thanks Aditya, but I have no control over the remote firewall and the user is not connecting to my firewall. My firewall is just being used for their internet connection.

[Aditya Ganjoo]

Hi,

Thanks for the update but we need phase 2 logs to determine the reason for this failure.

Since you have allowed ESP and also enabled ipsec passthrough on the ASA I do not think we do not anything else apart from these.

Debugs from the remote ASA would be helpful though. :)

Regards,

Aditya

Please rate helpful posts.

[Karsten Iwen]

Your whole responsibility is to open UDP/500 and UDP/4500 outbound (you don't need to open IP/50, IP/51). There's nothing more that you can do or have to do.

Your client needs to have NAT-T enabled on his client and on his corporate firewall.