VPN Problem

[marcio.tormente]

Hello Folks!

I create a new VPN between ASA 5555 alredy in production and 5506 that is new.

The VPN comes UP, but ther is no traffic and I have no idea why.

In attache is the logs packet tracer, sh cryp ipsec sa and sh isakmp sa.

Thanks

Marcio

[Edvin Lux]

Marcio,

From your trace file it looks like some traffic is being encrypted and decrypted.  Are you only having trouble reaching  10.55.19.207 from 192.168.2.200?

[Aditya Ganjoo]

Hi Marcio,

On checking the log file I see that one subnet is facing this issue and we need to make sure the rules on the local ASA with IP 201.23.100.130:

access-list Lan1_cryptomap_12 extended permit ip 10.12.20.0 255.255.255.0 10.55.61.0 255.255.255.0 

It seems we are not encrypting the subnet.

Please check the NAT and the route for this subnet.

Regards,

Aditya

Please rate helpful posts and mark correct answers.

[marcio.tormente]

Hello folks!

Thanks for you support again.

I was in the midle of the window and I had few time to solve this problem, for this reason I delete the VPN and create again, but it works only when I create the VPN simultaneously in both side.

When I create each site separately didn´t work, anyone know why it happen?

Now everthing is working, I just don´t inderstand why I had to create the VPN in the same time in both sites.

[Aditya Ganjoo]

Hi Marcio,

This should not be the ideal case.

We do not need to create the VPN at the same time.

We needed debugs to know what was leading to the failure of the VPN tunnel.

What is the remote device on the other side ?

But glad the issue has been resolved.

Regards,

Aditya

Please rate helpful posts and mark correct answers.

[marcio.tormente]

The VPN was created usin ASA 5555 in one side and 5506 in the other side and the end of device is workstation.

Both ASA are using 9.52 IOS version and 6.0 firepower version.

I spend more than 10 hours trying to solve this problem, my last option was delete and create again.

Other strange thing is that on the ASA 5506 some times I create network object and this object disapear and I didn´t make a reload just change the fron one tab such as "Objects" to "Remote Access VPN".

[Aditya Ganjoo]

Hi Marcio,

This is pretty weird that the objects were deleted from the ASDM.

I checked for some bugs on this code but could not find one.

Regarding the VPN status we needed some debug info/logs to understand what caused this failure.

Could you again create a new object and navigate to Remote VPN and check ?

Please share the show version of the ASA.

Regards,

Aditya

Please rate helpful posts and mark correct answers.

[marcio.tormente]

Hello Aditya,

Yes, very weird, I alredy create others objects and nothing happen.

follow the sh ver:

ASA-BRA# sh ver

Cisco Adaptive Security Appliance Software Version 9.5(2)
Device Manager Version 7.5(2)153

Compiled on Sat 28-Nov-15 00:16 PST by builders
System image file is "disk0:/asa952-lfbff-k8.SPA"
Config file at boot was "startup-config"

ASA-BRA up 16 hours 31 mins

Hardware: ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cores)
Internal ATA Compact Flash, 8192MB
BIOS Flash M25P64 @ 0xfed01000, 16384KB

Encryption hardware device : Cisco ASA Crypto on-board accelerator (revision 0x1)
Number of accelerators: 1

1: Ext: GigabitEthernet1/1 : address is ecbd.1d5f.c82a, irq 255
2: Ext: GigabitEthernet1/2 : address is ecbd.1d5f.c82b, irq 255
3: Ext: GigabitEthernet1/3 : address is ecbd.1d5f.c82c, irq 255
4: Ext: GigabitEthernet1/4 : address is ecbd.1d5f.c82d, irq 255
5: Ext: GigabitEthernet1/5 : address is ecbd.1d5f.c82e, irq 255
6: Ext: GigabitEthernet1/6 : address is ecbd.1d5f.c82f, irq 255
7: Ext: GigabitEthernet1/7 : address is ecbd.1d5f.c830, irq 255
8: Ext: GigabitEthernet1/8 : address is ecbd.1d5f.c831, irq 255
9: Int: Internal-Data1/1 : address is ecbd.1d5f.c829, irq 255
10: Int: Internal-Data1/2 : address is 0000.0001.0002, irq 0
11: Int: Internal-Control1/1 : address is 0000.0001.0001, irq 0
12: Int: Internal-Data1/3 : address is 0000.0001.0003, irq 0
13: Ext: Management1/1 : address is ecbd.1d5f.c829, irq 0

Licensed features for this platform:
Maximum Physical Interfaces : Unlimited perpetual
Maximum VLANs : 5 perpetual
Inside Hosts : Unlimited perpetual
Failover : Disabled perpetual
Encryption-DES : Enabled perpetual
Encryption-3DES-AES : Enabled perpetual
Carrier : Disabled perpetual
AnyConnect Premium Peers : 2 perpetual
AnyConnect Essentials : Disabled perpetual
Other VPN Peers : 10 perpetual
Total VPN Peers : 12 perpetual
AnyConnect for Mobile : Disabled perpetual
AnyConnect for Cisco VPN Phone : Disabled perpetual
Advanced Endpoint Assessment : Disabled perpetual
Shared License : Disabled perpetual
Total UC Proxy Sessions : 2 perpetual
Botnet Traffic Filter : Disabled perpetual
Cluster : Disabled perpetual

This platform has a Base license.

Serial Number: JAD193402O2
Running Permanent Activation Key: 0x7c3eff50 0xb866993e 0xc42225c8 0xa94474d8 0x0f0a3486
Configuration register is 0x1
Image type : Release
Key Version : A
Configuration last modified by Administrator at 13:33:23.867 BRST Thu Apr 14 2016
ASA-BRA#

[Aditya Ganjoo · Accepted solution]

Hi Marcio,

Could you please upgrade your ASDM to 7.6(1) which is the recommended ASDM version for ASA 9.5.2 and test ?

You should not face any issue on that.

Regards,

Aditya

Please rate helpful posts and mark correct answers.

[marcio.tormente]

Hello Aditya,

After update, the ASDM seems better.

Thanks