We have a L2L VPN tunnel up between ASA5505 and Sonicwall but I can not ping cross the tunnel. ICMP is allowed on both sides.
I have access to ASA5505 (8.32-k8) but I dont have access for Sonicwall. I have various other L2L tunnels up and running so basic config and cryptopmap is configured correct.
Local has also been natted to a public IP(100.100.100.1), some VPN tunnels access it using public IP and some VPN tunnels access it using private IP.
I am able to see encaps and decaps is happening. Other party is seeing my packets and confirmed that packets are being sent back.
I have bounced the tunnel. Cleared ARP and XLATE and I even reloaded ASA5505 but no help.
Here is the config in concern:
object-group network objLocalHost
network-object host 192.168.220.251
object-group network objRemoteHost
network-object host 10.0.70.3
access-list acl_map_56 extended permit ip object-group objLocalHost object-group objRemoteHost
nat (inside,any) source static objLocalHost objLocalHost destination static objRemoteHost objRemoteHost unidirectional
object network objLocalHost
nat (inside,outside) static 100.100.100.1 dns
crypto map mymap 56 match address acl_map_56
crypto map mymap 56 set peer 200.200.200.200
crypto map mymap 56 set transform-set ESP-3DES-SHA
tunnel-group 200.200.200.200 type ipsec-l2l
tunnel-group 200.200.200.200 ipsec-attributes
pre-shared-key *****
ASA is sending ICMP request but not seeing any reply
asa5505# debug icmp trace 255
debug icmp trace enabled at level 255
ICMP echo request from inside:192.168.220.251 to outside:10.0.70.3 ID=512 seq=13328 len=32
ICMP echo request from inside:192.168.220.251 to outside:10.0.70.3 ID=512 seq=13584 len=32
ICMP echo request from inside:192.168.220.251 to outside:10.0.70.3 ID=512 seq=13840 len=32
I do not see hitcnt increasing with continous ping on.
evlabfw# sh access-list acl_map_56
access-list acl_map_56 line 1 extended permit ip host 192.168.220.251 host 10.0.70.3 (hitcnt=8)
isakmp detail shows that tunnel is ACTIVE.
ASA5505# sh cry isakmp sa detail
IKE Peer: 200.200.200.200
Type : L2L Role : initiator
Rekey : no State : MM_ACTIVE
Encrypt : 3des Hash : SHA
Auth : preshared Lifetime: 86400
Lifetime Remaining: 71507
ipsec details shows that packet are being encaps and decaps
asa5505# sh cry ipsec sa peer 200.200.200.200 detail
peer address: 200.200.200.200
Crypto map tag: mymap, seq num: 56, local addr: 100.100.100.100
access-list acl_PiedMont extended permit ip host 192.168.220.251 host 10.0.70.3
local ident (addr/mask/prot/port): (192.168.220.251/255.255.255.255/0/0)
remote ident (addr/mask/prot/port): (10.0.70.3/255.255.255.255/0/0)
current_peer: 200.200.200.200
#pkts encaps: 2284, #pkts encrypt: 2284, #pkts digest: 2284
#pkts decaps: 2284, #pkts decrypt: 2284, #pkts verify: 2284
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 2284, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#pkts no sa (send): 0, #pkts invalid sa (rcv): 0
#pkts encaps failed (send): 0, #pkts decaps failed (rcv): 0
#pkts invalid prot (rcv): 0, #pkts verify failed: 0
#pkts invalid identity (rcv): 0, #pkts invalid len (rcv): 0
#pkts invalid pad (rcv): 0,
#pkts invalid ip version (rcv): 0,
#pkts replay rollover (send): 0, #pkts replay rollover (rcv): 0
#pkts replay failed (rcv): 0
#pkts min mtu frag failed (send): 0, #pkts bad frag offset (rcv): 0
#pkts internal err (send): 0, #pkts internal err (rcv): 0
local crypto endpt.: 100.100.100.100/0, remote crypto endpt.: 200.200.200.200/0
path mtu 1500, ipsec overhead 58, media mtu 1500
current outbound spi: DF580A74
current inbound spi : 9E86360C
inbound esp sas:
spi: 0x9E86360C (2659595788)
transform: esp-3des esp-sha-hmac no compression
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 8265728, crypto-map: mymap
sa timing: remaining key lifetime (kB/sec): (4373865/16220)
IV size: 8 bytes
replay detection support: Y
Anti replay bitmap:
0xFFFFFFFF 0xFFFFFFFF
outbound esp sas:
spi: 0xDF580A74 (3747089012)
transform: esp-3des esp-sha-hmac no compression
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 8265728, crypto-map: mymap
sa timing: remaining key lifetime (kB/sec): (4373865/16220)
IV size: 8 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
