Hi,
Seems that the traffic fails in the Phase where the traffic is matched against the VPN configurations. I mean it matches the VPN configurations but at the moment that the "packet-tracer" command has been entered the L2L VPN connection is either not up already or it has tried to negotiate but it has failed. Notice though that if the L2L VPN connection is down when the "packet-tracer" is first entered to the ASA then the first time will always fail. This is because it first command only initiates the VPN negotiation and the second time you enter the command the VPN negotiation should already gone through. If not then there is naturally a problem.
I have had some similiar problems with ASA Failover pairs and VPN but in software level 8.2 only so far.
Once the problem was when migrating a L2L VPN connection by changing the remote peer IP address. After we had to roll back and change back to the old peer one subnet of the L2L VPN connection failed negotiation just like above. A change in the Active device corrected the problem.
In other situation a L2L VPN connection that had been operating fine for 1 year stopped working for a single subnet. The "packet-tracer" test suggested that everything was fine but the traffic was not forwarded to the VPN connection. It seemed like the traffic was forwarded unencrypted through the firewall. Again, changing the active unit in the Failover pair corrected the situation.
Both cases have only happened once to in the space of 6 years so have not really been that common. I guess it might be possible that its such an uncommon bug that it has not been reported/recorded on Ciscos side.
I guess the only way to be sure would be to debug the problem but usually its not option in a situation where the VPN connection is used actively and production environments depend on it :)
- Jouni
