ASA 5520 Denying All Tunneled IP Traffic

Unanswered Question
Feb 13th, 2008

250 remote sites use ezvpn to connect back to ASA 5520. Tunnels show active but do not pass any IP traffic. The only way to resolve issue is to "clear crypto ipsec sa". Don't know why this keeps occuring. Logs show messages of denying traffic for ex:

Feb 11 2008 14:42:42: %ASA-3-106014: Deny inbound icmp src outside: dst inside:x.x.x.x (type 8, code 0)

Feb 11 2008 14:42:42: %ASA-2-106006: Deny inbound UDP from x.x.x.x/2442 to on interface inside

Running 7.2(2) code. Has anyone seen this before and know what the problem is?


I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Anonymous (not verified) Tue, 02/19/2008 - 09:02

Try adding a PAT entry for the pool subnet from outside interface.also check if there is any routing problems


This Discussion