cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
600
Views
0
Helpful
7
Replies

Site to Site VPN, One way traffic brings the VPn UP but not the other way.

t4tauseef33
Level 1
Level 1

Hi All,

I have configured the Site to site vpn between 2 ASA 5520 firewalls say site A and Site B. The problem is that.

If site A initiate the traffic, it brings the VPn up and both sites can communicate with each other.If site A stop the traffic then after 5 minutes if site B sends the traffic it dropped unless the site A sends the traffic. even one packet from site A allow the site B to communicate. This is a very strange problem never encountered before. your help in this case would be helpfull for me.

Thanks

7 Replies 7

andrew.prince
Level 10
Level 10

check to see if the VPN's are configured for "bi-directional" connectivity. Site B could be configured for "answer-only"

HTH.

s.haszard
Level 1
Level 1

Very new to Cisco but have experienced similar before.

Check your ACL lists. If site A has a subset of site B then it will establish the VPN tunnel only from site A.

e.g

Site A network is 192.168.0.0/24

Site B network is 10.10.10.0/24

(with either an additional network e.g DMZ or just an ACL artifact of 172.1.1.0/24)

Site A ACL (IPSec rule list)

192.168.0.0/24 --> 10.10.10.0/24

Site B ACL (IPSec rule list)

10.10.10.0/24 --> 192.168.0.0/24

172.1.1.0/24--> 192.168.0.0/24

If your ACL's are like this then site A will establish an IPSEC tunnel, but site B will not.

Hi

first of all i have only created a VPN only between 2 windows machine by using /32 subnet mask. Secondly both sites are in bidirectional mode.

show crypto ipsec sa gives the following information.

SITE B show command

ping from SITE B to SITE A

#pkts encaps: 29, #pkts encrypt: 29, #pkts digest: 29

#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0

#pkts compressed: 0, #pkts decompressed: 0

#pkts not compressed: 29, #pkts comp failed: 0, #pkts decomp failed: 0

while on SITE A, i have not recived any packet

#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0

#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0

#pkts compressed: 0, #pkts decompressed: 0

#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0

its mean vpn comes up, SITE B encrypts the traffic and forward to SITE A, but SITE A does not recieve it for any reason.

if i try to ping from SITE A to SITE B machine. then both are able to communicate. if i stop traffic for 5 minutes between these sites then after onwards the SITE B not able to communicate with SITE A unless Site A sends the traffic.

Tauseef,

Can you post a "sanitised" config for both ends - this will reduce the amount of emails in the thread!

singhsaju
Level 4
Level 4

Hi,

Do you have more than one VPN tunnel at Site B ? Can you please post configs as requested earlier?

Saju

jpoplawski
Level 1
Level 1

Check nat0 ACL and Crypto ACL. Post the config if possible, if you need further help.

a.alekseev
Level 7
Level 7

show the configurations on both sides.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: