VPN NOT CONNECTING

[Sharath Rajan]

Dears Kindly help me to fix my VPN Error 

I have FTD with FMC 

tried to connect VPN with SonicWALL not able to connect at all 

tried p2p and hub and spoke with IKE1 and 2 

I have multiple site with different firewall .its saying cant connect multiple VPN in single wan interface with same policy 

this is right please correct me 

> packet-tracer input INSIDE_LAN icmp 192.168.73.8 8 0 172.19.3.64

Phase: 1
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
nat (INSIDE_LAN,OUTSIDE_ISP) after-auto source static HQ-LANET HQ-LANET destination static HO-SONICWALL HO-SONICWALL
Additional Information:
NAT divert to egress interface OUTSIDE_ISP(vrfid:0)
Untranslate 172.19.3.64/0 to 172.19.3.64/0

Phase: 2
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group CSM_FW_ACL_ global
access-list CSM_FW_ACL_ advanced permit ip ifc INSIDE_LAN object-group FMC_INLINE_src_rule_268439562 ifc OUTSIDE_ISP object-group FMC_INLINE_dst_rule_268439562 rule-id 268439562
access-list CSM_FW_ACL_ remark rule-id 268439562: ACCESS POLICY: GRP-Policy - Mandatory
access-list CSM_FW_ACL_ remark rule-id 268439562: L7 RULE: FMC-SONICHO
object-group network FMC_INLINE_src_rule_268439562
description: Auto Generated by FMC from src of UnifiedNGFWRule# 1 (GRP-Policy/mandatory)
network-object object HO-SONICWALL
network-object object HQ-LANET
object-group network FMC_INLINE_dst_rule_268439562
description: Auto Generated by FMC from dst of UnifiedNGFWRule# 1 (GRP-Policy/mandatory)
network-object object HO-SONICWALL
network-object object HQ-LANET
Additional Information:
This packet will be sent to snort for additional processing where a verdict will be reached

Phase: 3
Type: CONN-SETTINGS
Subtype:
Result: ALLOW
Config:
class-map class-default
match any
policy-map global_policy
class class-default
set connection advanced-options UM_STATIC_TCP_MAP
service-policy global_policy global
Additional Information:

Phase: 4
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (INSIDE_LAN,OUTSIDE_ISP) after-auto source static HQ-LANET HQ-LANET destination static HO-SONICWALL HO-SONICWALL
Additional Information:
Static translate 192.168.73.8/0 to 192.168.73.8/0

Phase: 5
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 6
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 7
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group CSM_FW_ACL_ global
access-list CSM_FW_ACL_ advanced permit ip ifc INSIDE_LAN object-group FMC_INLINE_src_rule_268439562 ifc OUTSIDE_ISP object-group FMC_INLINE_dst_rule_268439562 rule-id 268439562
access-list CSM_FW_ACL_ remark rule-id 268439562: ACCESS POLICY: GRP-Policy - Mandatory
access-list CSM_FW_ACL_ remark rule-id 268439562: L7 RULE: FMC-SONICHO
object-group network FMC_INLINE_src_rule_268439562
description: Auto Generated by FMC from src of UnifiedNGFWRule# 1 (GRP-Policy/mandatory)
network-object object HO-SONICWALL
network-object object HQ-LANET
object-group network FMC_INLINE_dst_rule_268439562
description: Auto Generated by FMC from dst of UnifiedNGFWRule# 1 (GRP-Policy/mandatory)
network-object object HO-SONICWALL
network-object object HQ-LANET
Additional Information:
This packet will be sent to snort for additional processing where a verdict will be reached

Phase: 8
Type: CONN-SETTINGS
Subtype:
Result: ALLOW
Config:
class-map class-default
match any
policy-map global_policy
class class-default
set connection advanced-options UM_STATIC_TCP_MAP
service-policy global_policy global
Additional Information:

Phase: 9
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (INSIDE_LAN,OUTSIDE_ISP) after-auto source static HQ-LANET HQ-LANET destination static HO-SONICWALL HO-SONICWALL
Additional Information:
Static translate 192.168.73.8/0 to 192.168.73.8/0

Phase: 10
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 11
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 12
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group CSM_FW_ACL_ global
access-list CSM_FW_ACL_ advanced permit ip ifc INSIDE_LAN object-group FMC_INLINE_src_rule_268439562 ifc OUTSIDE_ISP object-group FMC_INLINE_dst_rule_268439562 rule-id 268439562
access-list CSM_FW_ACL_ remark rule-id 268439562: ACCESS POLICY: GRP-Policy - Mandatory
access-list CSM_FW_ACL_ remark rule-id 268439562: L7 RULE: FMC-SONICHO
object-group network FMC_INLINE_src_rule_268439562
description: Auto Generated by FMC from src of UnifiedNGFWRule# 1 (GRP-Policy/mandatory)
network-object object HO-SONICWALL
network-object object HQ-LANET
object-group network FMC_INLINE_dst_rule_268439562
description: Auto Generated by FMC from dst of UnifiedNGFWRule# 1 (GRP-Policy/mandatory)
network-object object HO-SONICWALL
network-object object HQ-LANET
Additional Information:
This packet will be sent to snort for additional processing where a verdict will be reached

Phase: 13
Type: CONN-SETTINGS
Subtype:
Result: ALLOW
Config:
class-map class-default
match any
policy-map global_policy
class class-default
set connection advanced-options UM_STATIC_TCP_MAP
service-policy global_policy global
Additional Information:

Phase: 14
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (INSIDE_LAN,OUTSIDE_ISP) after-auto source static HQ-LANET HQ-LANET destination static HO-SONICWALL HO-SONICWALL
Additional Information:
Static translate 192.168.73.8/0 to 192.168.73.8/0

Phase: 15
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 16
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 17
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group CSM_FW_ACL_ global
access-list CSM_FW_ACL_ advanced permit ip ifc INSIDE_LAN object-group FMC_INLINE_src_rule_268439562 ifc OUTSIDE_ISP object-group FMC_INLINE_dst_rule_268439562 rule-id 268439562
access-list CSM_FW_ACL_ remark rule-id 268439562: ACCESS POLICY: GRP-Policy - Mandatory
access-list CSM_FW_ACL_ remark rule-id 268439562: L7 RULE: FMC-SONICHO
object-group network FMC_INLINE_src_rule_268439562
description: Auto Generated by FMC from src of UnifiedNGFWRule# 1 (GRP-Policy/mandatory)
network-object object HO-SONICWALL
network-object object HQ-LANET
object-group network FMC_INLINE_dst_rule_268439562
description: Auto Generated by FMC from dst of UnifiedNGFWRule# 1 (GRP-Policy/mandatory)
network-object object HO-SONICWALL
network-object object HQ-LANET
Additional Information:
This packet will be sent to snort for additional processing where a verdict will be reached

Phase: 18
Type: CONN-SETTINGS
Subtype:
Result: ALLOW
Config:
class-map class-default
match any
policy-map global_policy
class class-default
set connection advanced-options UM_STATIC_TCP_MAP
service-policy global_policy global
Additional Information:

Phase: 19
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (INSIDE_LAN,OUTSIDE_ISP) after-auto source static HQ-LANET HQ-LANET destination static HO-SONICWALL HO-SONICWALL
Additional Information:
Static translate 192.168.73.8/0 to 192.168.73.8/0

Phase: 20
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 21
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 22
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group CSM_FW_ACL_ global
access-list CSM_FW_ACL_ advanced permit ip ifc INSIDE_LAN object-group FMC_INLINE_src_rule_268439562 ifc OUTSIDE_ISP object-group FMC_INLINE_dst_rule_268439562 rule-id 268439562
access-list CSM_FW_ACL_ remark rule-id 268439562: ACCESS POLICY: GRP-Policy - Mandatory
access-list CSM_FW_ACL_ remark rule-id 268439562: L7 RULE: FMC-SONICHO
object-group network FMC_INLINE_src_rule_268439562
description: Auto Generated by FMC from src of UnifiedNGFWRule# 1 (GRP-Policy/mandatory)
network-object object HO-SONICWALL
network-object object HQ-LANET
object-group network FMC_INLINE_dst_rule_268439562
description: Auto Generated by FMC from dst of UnifiedNGFWRule# 1 (GRP-Policy/mandatory)
network-object object HO-SONICWALL
network-object object HQ-LANET
Additional Information:
This packet will be sent to snort for additional processing where a verdict will be reached

Phase: 23
Type: CONN-SETTINGS
Subtype:
Result: ALLOW
Config:
class-map class-default
match any
policy-map global_policy
class class-default
set connection advanced-options UM_STATIC_TCP_MAP
service-policy global_policy global
Additional Information:

Phase: 24
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (INSIDE_LAN,OUTSIDE_ISP) after-auto source static HQ-LANET HQ-LANET destination static HO-SONICWALL HO-SONICWALL
Additional Information:
Static translate 192.168.73.8/0 to 192.168.73.8/0

Phase: 25
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 26
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 27
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
class-map inspection_default
match default-inspection-traffic
policy-map global_policy
class inspection_default
inspect icmp
service-policy global_policy global
Additional Information:

Phase: 28
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
Additional Information:

Phase: 29
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
nat (INSIDE_LAN,OUTSIDE_ISP) after-auto source static HQ-LANET HQ-LANET destination static HO-SONICWALL HO-SONICWALL
Additional Information:

Phase: 30
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 31
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 32
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 11312980, packet dispatched to next module

Phase: 33
Type: EXTERNAL-INSPECT
Subtype:
Result: ALLOW
Config:
Additional Information:
Application: 'SNORT Inspect'

Phase: 34
Type: SNORT
Subtype:
Result: ALLOW
Config:
Additional Information:
Snort Trace:
Packet: ICMP
Session: new snort session
Firewall: allow rule, id 268439562, allow
Snort id 3, NAP id 2, IPS id 0, Verdict PASS
Snort Verdict: (pass-packet) allow this packet

Phase: 35
Type: INPUT-ROUTE-LOOKUP-FROM-OUTPUT-ROUTE-LOOKUP
Subtype: Resolve Preferred Egress interface
Result: ALLOW
Config:
Additional Information:
Found next-hop 94.200.209.173 using egress ifc OUTSIDE_ISP(vrfid:0)

Phase: 36
Type: ADJACENCY-LOOKUP
Subtype: Resolve Nexthop IP address to MAC
Result: ALLOW
Config:
Additional Information:
Found adjacency entry for Next-hop 94.200.209.173 on interface OUTSIDE_ISP
Adjacency :Active
MAC address 20e0.9c28.0984 hits 30736 reference 7

Result:
input-interface: INSIDE_LAN(vrfid:0)
input-status: up
input-line-status: up
output-interface: OUTSIDE_ISP(vrfid:0)
output-status: up
output-line-status: up
Action: allow

before i got the error acl is droiping the vpn 

[Flavio Miranda]

Hi

 The information you share does not allow to see the basics steps for VPN. Does the tunnel is up between the two firewall? 

Show crypto ikev2 sa

[Sharath Rajan]

packet-tracer input OUTSIDE_ISP icmp 192.168.73.8 8 0 172.19.0.12

Phase: 1
Type: INPUT-ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
Found next-hop 94.200.209.173 using egress ifc OUTSIDE_ISP(vrfid:0)

Phase: 2
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group CSM_FW_ACL_ global
access-list CSM_FW_ACL_ advanced permit ip ifc OUTSIDE_ISP object-group FMC_INLINE_src_rule_268439562 ifc OUTSIDE_ISP object-group FMC_INLINE_dst_rule_268439562 rule-id 268439562
access-list CSM_FW_ACL_ remark rule-id 268439562: ACCESS POLICY: GRP-Policy - Mandatory
access-list CSM_FW_ACL_ remark rule-id 268439562: L7 RULE: FMC-SONICHO
object-group network FMC_INLINE_src_rule_268439562
description: Auto Generated by FMC from src of UnifiedNGFWRule# 1 (GRP-Policy/mandatory)
network-object object HO-SONICWALL
network-object object HQ-LANET
object-group network FMC_INLINE_dst_rule_268439562
description: Auto Generated by FMC from dst of UnifiedNGFWRule# 1 (GRP-Policy/mandatory)
network-object object HO-SONICWALL
network-object object HQ-LANET
Additional Information:
This packet will be sent to snort for additional processing where a verdict will be reached

Phase: 3
Type: CONN-SETTINGS
Subtype:
Result: ALLOW
Config:
class-map class-default
match any
policy-map global_policy
class class-default
set connection advanced-options UM_STATIC_TCP_MAP
service-policy global_policy global
Additional Information:

Phase: 4
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 5
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 6
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group CSM_FW_ACL_ global
access-list CSM_FW_ACL_ advanced permit ip ifc OUTSIDE_ISP object-group FMC_INLINE_src_rule_268439562 ifc OUTSIDE_ISP object-group FMC_INLINE_dst_rule_268439562 rule-id 268439562
access-list CSM_FW_ACL_ remark rule-id 268439562: ACCESS POLICY: GRP-Policy - Mandatory
access-list CSM_FW_ACL_ remark rule-id 268439562: L7 RULE: FMC-SONICHO
object-group network FMC_INLINE_src_rule_268439562
description: Auto Generated by FMC from src of UnifiedNGFWRule# 1 (GRP-Policy/mandatory)
network-object object HO-SONICWALL
network-object object HQ-LANET
object-group network FMC_INLINE_dst_rule_268439562
description: Auto Generated by FMC from dst of UnifiedNGFWRule# 1 (GRP-Policy/mandatory)
network-object object HO-SONICWALL
network-object object HQ-LANET
Additional Information:
This packet will be sent to snort for additional processing where a verdict will be reached

Phase: 7
Type: CONN-SETTINGS
Subtype:
Result: ALLOW
Config:
class-map class-default
match any
policy-map global_policy
class class-default
set connection advanced-options UM_STATIC_TCP_MAP
service-policy global_policy global
Additional Information:

Phase: 8
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 9
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 10
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group CSM_FW_ACL_ global
access-list CSM_FW_ACL_ advanced permit ip ifc OUTSIDE_ISP object-group FMC_INLINE_src_rule_268439562 ifc OUTSIDE_ISP object-group FMC_INLINE_dst_rule_268439562 rule-id 268439562
access-list CSM_FW_ACL_ remark rule-id 268439562: ACCESS POLICY: GRP-Policy - Mandatory
access-list CSM_FW_ACL_ remark rule-id 268439562: L7 RULE: FMC-SONICHO
object-group network FMC_INLINE_src_rule_268439562
description: Auto Generated by FMC from src of UnifiedNGFWRule# 1 (GRP-Policy/mandatory)
network-object object HO-SONICWALL
network-object object HQ-LANET
object-group network FMC_INLINE_dst_rule_268439562
description: Auto Generated by FMC from dst of UnifiedNGFWRule# 1 (GRP-Policy/mandatory)
network-object object HO-SONICWALL
network-object object HQ-LANET
Additional Information:
This packet will be sent to snort for additional processing where a verdict will be reached

Phase: 11
Type: CONN-SETTINGS
Subtype:
Result: ALLOW
Config:
class-map class-default
match any
policy-map global_policy
class class-default
set connection advanced-options UM_STATIC_TCP_MAP
service-policy global_policy global
Additional Information:

Phase: 12
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 13
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 14
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group CSM_FW_ACL_ global
access-list CSM_FW_ACL_ advanced permit ip ifc OUTSIDE_ISP object-group FMC_INLINE_src_rule_268439562 ifc OUTSIDE_ISP object-group FMC_INLINE_dst_rule_268439562 rule-id 268439562
access-list CSM_FW_ACL_ remark rule-id 268439562: ACCESS POLICY: GRP-Policy - Mandatory
access-list CSM_FW_ACL_ remark rule-id 268439562: L7 RULE: FMC-SONICHO
object-group network FMC_INLINE_src_rule_268439562
description: Auto Generated by FMC from src of UnifiedNGFWRule# 1 (GRP-Policy/mandatory)
network-object object HO-SONICWALL
network-object object HQ-LANET
object-group network FMC_INLINE_dst_rule_268439562
description: Auto Generated by FMC from dst of UnifiedNGFWRule# 1 (GRP-Policy/mandatory)
network-object object HO-SONICWALL
network-object object HQ-LANET
Additional Information:
This packet will be sent to snort for additional processing where a verdict will be reached

Phase: 15
Type: CONN-SETTINGS
Subtype:
Result: ALLOW
Config:
class-map class-default
match any
policy-map global_policy
class class-default
set connection advanced-options UM_STATIC_TCP_MAP
service-policy global_policy global
Additional Information:

Phase: 16
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 17
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 18
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
class-map inspection_default
match default-inspection-traffic
policy-map global_policy
class inspection_default
inspect icmp
service-policy global_policy global
Additional Information:

Phase: 19
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
Additional Information:

Phase: 20
Type: VPN
Subtype: ipsec-tunnel-flow
Result: ALLOW
Config:
Additional Information:

Phase: 21
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 22
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 23
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 11314960, packet dispatched to next module

Phase: 24
Type: EXTERNAL-INSPECT
Subtype:
Result: ALLOW
Config:
Additional Information:
Application: 'SNORT Inspect'

Phase: 25
Type: SNORT
Subtype:
Result: ALLOW
Config:
Additional Information:
Snort Trace:
Packet: ICMP
Session: new snort session
Firewall: allow rule, id 268439562, allow
Snort id 3, NAP id 2, IPS id 0, Verdict PASS
Snort Verdict: (pass-packet) allow this packet

Phase: 26
Type: INPUT-ROUTE-LOOKUP-FROM-OUTPUT-ROUTE-LOOKUP
Subtype: Resolve Preferred Egress interface
Result: ALLOW
Config:
Additional Information:
Found next-hop 94.200.209.173 using egress ifc OUTSIDE_ISP(vrfid:0)

Phase: 27
Type: ADJACENCY-LOOKUP
Subtype: Resolve Nexthop IP address to MAC
Result: ALLOW
Config:
Additional Information:
Found adjacency entry for Next-hop 94.200.209.173 on interface OUTSIDE_ISP
Adjacency :Active
MAC address 20e0.9c28.0984 hits 34715 reference 10

Result:
input-interface: OUTSIDE_ISP(vrfid:0)
input-status: up
input-line-status: up
output-interface: OUTSIDE_ISP(vrfid:0)
output-status: up
output-line-status: up
Action: allow

> show crypto ik
ikev1 ikev2
> show crypto ikev
ikev1 ikev2
> show crypto ikev2
sa stats
> show crypto ikev2 s
sa stats
> show crypto ikev2 sa

There are no IKEv2 SAs
>

[Sharath Rajan]

Thesre is ikev2 SA   please look on last command 

[Flavio Miranda]

It seems you have no tunnel at all

 Did you check with both sides matches the requirements for VPN.?

with no phase1 like this, dont make sense think about ACL yet.

You need to fegure out why the tunnel is not up first.

[Sharath Rajan]

> packet-tracer input INSIDE_LAN icmp 192.168.73.8 8 0 172.19.0.12

Phase: 1
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
nat (INSIDE_LAN,OUTSIDE_ISP) after-auto source static HQ-LANET HQ-LANET destination static HO-SONICWALL HO-SONICWALL
Additional Information:
NAT divert to egress interface OUTSIDE_ISP(vrfid:0)
Untranslate 172.19.0.12/0 to 172.19.0.12/0

Phase: 2
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group CSM_FW_ACL_ global
access-list CSM_FW_ACL_ advanced permit ip ifc INSIDE_LAN object HQ-LANET ifc OUTSIDE_ISP any4 rule-id 268436485
access-list CSM_FW_ACL_ remark rule-id 268436485: ACCESS POLICY: GRP-Policy - Mandatory
access-list CSM_FW_ACL_ remark rule-id 268436485: L7 RULE: LAN-to-WAN
Additional Information:
This packet will be sent to snort for additional processing where a verdict will be reached

Phase: 3
Type: CONN-SETTINGS
Subtype:
Result: ALLOW
Config:
class-map class-default
match any
policy-map global_policy
class class-default
set connection advanced-options UM_STATIC_TCP_MAP
service-policy global_policy global
Additional Information:

Phase: 4
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (INSIDE_LAN,OUTSIDE_ISP) after-auto source static HQ-LANET HQ-LANET destination static HO-SONICWALL HO-SONICWALL
Additional Information:
Static translate 192.168.73.8/0 to 192.168.73.8/0

Phase: 5
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 6
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 7
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group CSM_FW_ACL_ global
access-list CSM_FW_ACL_ advanced permit ip ifc INSIDE_LAN object HQ-LANET ifc OUTSIDE_ISP any4 rule-id 268436485
access-list CSM_FW_ACL_ remark rule-id 268436485: ACCESS POLICY: GRP-Policy - Mandatory
access-list CSM_FW_ACL_ remark rule-id 268436485: L7 RULE: LAN-to-WAN
Additional Information:
This packet will be sent to snort for additional processing where a verdict will be reached

Phase: 8
Type: CONN-SETTINGS
Subtype:
Result: ALLOW
Config:
class-map class-default
match any
policy-map global_policy
class class-default
set connection advanced-options UM_STATIC_TCP_MAP
service-policy global_policy global
Additional Information:

Phase: 9
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (INSIDE_LAN,OUTSIDE_ISP) after-auto source static HQ-LANET HQ-LANET destination static HO-SONICWALL HO-SONICWALL
Additional Information:
Static translate 192.168.73.8/0 to 192.168.73.8/0

Phase: 10
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 11
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 12
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group CSM_FW_ACL_ global
access-list CSM_FW_ACL_ advanced permit ip ifc INSIDE_LAN object HQ-LANET ifc OUTSIDE_ISP any4 rule-id 268436485
access-list CSM_FW_ACL_ remark rule-id 268436485: ACCESS POLICY: GRP-Policy - Mandatory
access-list CSM_FW_ACL_ remark rule-id 268436485: L7 RULE: LAN-to-WAN
Additional Information:
This packet will be sent to snort for additional processing where a verdict will be reached

Phase: 13
Type: CONN-SETTINGS
Subtype:
Result: ALLOW
Config:
class-map class-default
match any
policy-map global_policy
class class-default
set connection advanced-options UM_STATIC_TCP_MAP
service-policy global_policy global
Additional Information:

Phase: 14
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (INSIDE_LAN,OUTSIDE_ISP) after-auto source static HQ-LANET HQ-LANET destination static HO-SONICWALL HO-SONICWALL
Additional Information:
Static translate 192.168.73.8/0 to 192.168.73.8/0

Phase: 15
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 16
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 17
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group CSM_FW_ACL_ global
access-list CSM_FW_ACL_ advanced permit ip ifc INSIDE_LAN object HQ-LANET ifc OUTSIDE_ISP any4 rule-id 268436485
access-list CSM_FW_ACL_ remark rule-id 268436485: ACCESS POLICY: GRP-Policy - Mandatory
access-list CSM_FW_ACL_ remark rule-id 268436485: L7 RULE: LAN-to-WAN
Additional Information:
This packet will be sent to snort for additional processing where a verdict will be reached

Phase: 18
Type: CONN-SETTINGS
Subtype:
Result: ALLOW
Config:
class-map class-default
match any
policy-map global_policy
class class-default
set connection advanced-options UM_STATIC_TCP_MAP
service-policy global_policy global
Additional Information:

Phase: 19
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (INSIDE_LAN,OUTSIDE_ISP) after-auto source static HQ-LANET HQ-LANET destination static HO-SONICWALL HO-SONICWALL
Additional Information:
Static translate 192.168.73.8/0 to 192.168.73.8/0

Phase: 20
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 21
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 22
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group CSM_FW_ACL_ global
access-list CSM_FW_ACL_ advanced permit ip ifc INSIDE_LAN object HQ-LANET ifc OUTSIDE_ISP any4 rule-id 268436485
access-list CSM_FW_ACL_ remark rule-id 268436485: ACCESS POLICY: GRP-Policy - Mandatory
access-list CSM_FW_ACL_ remark rule-id 268436485: L7 RULE: LAN-to-WAN
Additional Information:
This packet will be sent to snort for additional processing where a verdict will be reached

Phase: 23
Type: CONN-SETTINGS
Subtype:
Result: ALLOW
Config:
class-map class-default
match any
policy-map global_policy
class class-default
set connection advanced-options UM_STATIC_TCP_MAP
service-policy global_policy global
Additional Information:

Phase: 24
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (INSIDE_LAN,OUTSIDE_ISP) after-auto source static HQ-LANET HQ-LANET destination static HO-SONICWALL HO-SONICWALL
Additional Information:
Static translate 192.168.73.8/0 to 192.168.73.8/0

Phase: 25
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 26
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 27
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
class-map inspection_default
match default-inspection-traffic
policy-map global_policy
class inspection_default
inspect icmp
service-policy global_policy global
Additional Information:

Phase: 28
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
Additional Information:

Phase: 29
Type: VPN
Subtype: encrypt
Result: DROP
Config:
Additional Information:

Result:
input-interface: INSIDE_LAN(vrfid:0)
input-status: up
input-line-status: up
output-interface: OUTSIDE_ISP(vrfid:0)
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule, Drop-location: frame 0x000056441a7fc874 flow (need-ike)/snp_sp_action_cb:1577

>

[Flavio Miranda]

Allow dont means much. What I am saying is you need to see the tunnel UP.

 Plus, you are looking only from FTD perspective while you have two firewall 

Yet, you have drop on the output

Phase: 29
Type: VPN
Subtype: encrypt
Result: DROP
Config:
Additional Information:

But I would not stick with packet tracer.

This can show you that the rules are in place but without phase 1 up, it only means one side is reasy.

[MHM Cisco World]

Asa have by defualt permit the vpn sysop connections 

Ftd need to allow traffic from out to in zone for traffic to pass.

So add acl allow from out to in zone for local lan to remote lan.

[Sharath Rajan]

Hello Sir 

We had discussed before this issue and you suggested if I am right 1 KEV2 Tunnel and rest all keep IKEv1 i tried that way also no luck getting ACL is dropping ..I have the idea only about ACP of FMC that I have already done any command please tell me direct apply to FTD I can add ""please consider"' 

[MHM Cisco World]

Oh @Sharath Rajan 
so you try my suggestion and you run two IKEv1 and IKEv2, until now that good,
here you post IKEv1 not UP ? or your return to IKEv2?

[Sharath Rajan]

@MHM Cisco World Sir I just cleaned my all VPN Tunnel which me getting trouble 

Now I have one 1 IKEV2 Point to Point VPN with SOnicwall its UP working fine 

trying to other tunnels with IKEv1 its not getting up 3 (4 sites are pending )

[MHM Cisco World]

You config different ACL for each VPN 
can check the traffic hit the ACL or not ? 

the issue if one Tunnel UP and later any other Tunnel not UP for policy based VPN is the traffic not hit the ACL of VPN. it always hit the first one 
so try ping from Local-LAN to remote-LAN for other VPN and check the ACL of first VPN is count is increase ??