Hello everyone,
Need some help please on the following issue.
My company is using IPSEC VPN for remote access and 2 x ASA5525 (let say ASA A - OS version 9.4(4)5 and ASA B OS version 9.8(3)21).
We are using different group of users with different rights each using aaa radius ACL (with a Radius/LDAP infrastructure).
We are using two CallManager (not Cisco) , active/active for our ToIP need, with a virtual IP (let say 10.10.10.10) to get to these servers. That means, the ToIP client send a , for e.g. a udp SIP registry request toward that virtual IP (10.10.10.10) and gets the reply from one of the physical IP addresses ( let say 10.10.10.1 or 10.10.10.2).
The CallManager servers are located internally (inside).
The issue is the following:
For the users connected through VPN to ASA A, the traffic is authorized with no explicit permit ACE rule on the aaa radius ACL.
On the other hand, users connected to ASA B get the traffic droped by the implicit deny of the aaa radius ACL (reveled through the use of packet-tracer command).
My question is , since the configuration is typically the same on both ASAs , what could be wrong ?
Note that: i tried to authorize the traffic by adding an ACE rule, but i got no hint , and the traffic still drops.
