Awesome response. Thanks so much! I was trying and trying to figure out how "the egg got scrambled before I cracked it open" and that makes a ton more sense.
Just so I can rule out everything on my side (and because I had to swap out the router unexpectedly) here's what I look like presently.
GSI-ASA5508X-FW1(config)# sh nat
Auto NAT Policies (Section 2)
1 (any) to (outside) source dynamic obj_any interface
translate_hits = 0, untranslate_hits = 0
Manual NAT Policies (Section 3)
1 (Management) to (outside) source dynamic any interface
translate_hits = 0, untranslate_hits = 0
GSI-ASA5508X-FW1(config)# sh run crypto map
crypto map outside_map 1 match address outside_cryptomap
crypto map outside_map 1 set peer XXX.138.219.67
crypto map outside_map 1 set ikev1 transform-set ESP-DES-SHA ESP-AES-128-SHA
crypto map outside_map interface outside
GSI-ASA5508X-FW1(config)# sh crypto isakmp sa
IKEv1 SAs:
Active SA: 1
Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1
1 IKE Peer: XXX.138.219.67
Type : L2L Role : responder
Rekey : no State : MM_ACTIVE
There are no IKEv2 SAs
GSI-ASA5508X-FW1(config)#
GSI-ASA5508X-FW1(config)# sh crypto ipsec sa
interface: outside
Crypto map tag: outside_map, seq num: 1, local addr: XXX.204.254.115
access-list outside_cryptomap extended permit ip 10.3.2.0 255.255.255.0 192.168.0.0 255.255.0.0
local ident (addr/mask/prot/port): (10.3.2.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.0.0/255.255.0.0/0/0)
current_peer: XXX.138.219.67
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 275, #pkts decrypt: 275, #pkts verify: 275
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#TFC rcvd: 0, #TFC sent: 0
#Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: 50.204.254.115/0, remote crypto endpt.: XXX.138.219.67/0
path mtu 1500, ipsec overhead 58(36), media mtu 1500
PMTU time remaining (sec): 0, DF policy: copy-df
ICMP error validation: disabled, TFC packets: disabled
current outbound spi: CDDE8862
current inbound spi : D73C7B7A
inbound esp sas:
spi: 0xD73C7B7A (3611065210)
SA State: active
transform: esp-des esp-sha-hmac no compression
in use settings ={L2L, Tunnel, IKEv1, }
slot: 0, conn_id: 21561344, crypto-map: outside_map
sa timing: remaining key lifetime (kB/sec): (3914983/2207)
IV size: 8 bytes
replay detection support: Y
Anti replay bitmap:
0xFFFFFFFF 0xFFFFFFFF
outbound esp sas:
spi: 0xCDDE8862 (3453913186)
SA State: active
transform: esp-des esp-sha-hmac no compression
in use settings ={L2L, Tunnel, IKEv1, }
slot: 0, conn_id: 21561344, crypto-map: outside_map
sa timing: remaining key lifetime (kB/sec): (3915000/2205)
IV size: 8 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
GSI-ASA5508X-FW1(config)#
I'm back to where I was on a fresh new router ... again. What are the steps to doing what Flavio suggested? I certainly want to be 100% sure that I fix all possible issues on my end of this thing. I've probably done it at some point in years past, but I don't remember it.
Thanks to both of you! Site to Site Tunneling with ASA and SRX is a bigger mess than I'd imagined.
