VPN between ASA and router

Unanswered Question
Sep 11th, 2008


I had a working vpn configuration between a local and a remote router; the remote router is not under my administration.

Now I moved the vpn termination from my side to an ASA5540 software version 8.0(3). The tunnel is up but there is no reachability. The "show crypto ipsec sa" on the ASA shows encapsulated packets but NO decapsulated packets! Routing and no_nat are properly configured.

Any idea?

Many thanks.

I have this problem too.
1 vote
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
georges.merhej Thu, 09/11/2008 - 11:21

Hi Joe,

They didn't change anything from there side! It was fully working exactly before I've migrated to the ASA!

Have you used the packet tracer feature in the ASDM?

I would run a packet from source to destination using your adsm and see if it is fully going out as planned.

I suspect a stale xlate on the firewall, perhaps the other side that didnt change is hearing a different source that it wants?

Another option to consider is since the other side is using IOS (right?) they may be using GRE/IPSEC of some type and need to re-config to work with the ASA.


georges.merhej Thu, 09/11/2008 - 11:54

I've attached the old router configuration.

Using the packet tracer:

inside-outside -> everything is fine

outside-inside -> ipsec-spoof detected! it's a normal behavior right?

francisco_1 Thu, 09/11/2008 - 12:12

For traffic that enters the security appliance through a VPN tunnel and is then decrypted, the sysopt connection permit-vpn command in global configuration mode to allow the traffic to bypass interface access lists.

can you do some debug on the ASA.

debug crypto ipsec and debug crypto isakmp and send us the output


francisco_1 Thu, 09/11/2008 - 12:27

try from global"clear crypto ipsec sa" and "clear xlate". Also get them to do the same on the other side.

do a continous ping to the other side

going back over the notes your provided;

see the issue now?

DE-DC-INT-FW01# show crypto ipsec sa

Crypto map tag: IPSec-VPN, seq num: 40, local addr:

and now...

interface GigabitEthernet0/1

description $ES_WAN$$FW_OUTSIDE$

bandwidth 1000

ip address

ip access-group 101 in

ip verify unicast reverse-path

no ip redirects

no ip unreachables

no ip proxy-arp

ip virtual-reassembly

ip route-cache flow

ip tcp adjust-mss 1200

crypto map VPN

so, my question,

what is in front of the asa, and does it arp reach the ASA to get to

where does the ASA has this addr config'd?


georges.merhej Thu, 09/11/2008 - 12:33

the was the ip address of the outside interface of the router, now the router is removed and the same ip is configured on the outside interface of the ASA.

georges.merhej Thu, 09/11/2008 - 12:37

the vpn is terminated on the outside interface, so there is no need for isakmp on the inside, right?

francisco_1 Thu, 09/11/2008 - 12:47

mmm yeah. i checked on my lab ASA 5520 on a working tunnel and i have it enable on the inside/outside as well.

georges.merhej Thu, 09/11/2008 - 13:01

yeah other tunnels are active! the 213 is the outside ip of the asa; the conncetion is like this now:

asa (public -> sw (layer2)-> router (private IP with no security controls)->ISP

francisco_1 Thu, 09/11/2008 - 13:03

joe's got a point here. according to the logs

DPD (Dead Peer Discovery).

IPSec has a mechanism for a peer to send a notification to its peer when it is deleting a SA. This notification is sent via IKE. However, there can be situations in which this notification never gets sent. A usual reason for this is that the peer goes dead too abruptly e.g. system crash, unplugging the Ethernet cable, etc. Due to such events, one peer could keep sending data to the dead peer and it results in data loss. For this, a Dead Peer Discovery (DPD) mechanism is used. Make sure nothing is blocking the ipsec traffic between your ASA/Router

georges.merhej Thu, 09/11/2008 - 13:08

There's only a layer 2 switch between the router and the ASA and no security controls are configured on the router:(

georges.merhej Fri, 09/12/2008 - 00:43


It's resolved by editing the crypto/no_nat access-lists to match only host by host! It's really weird that it was not working with subnet to subnet access-list.

jimmyc_2 Wed, 05/29/2013 - 07:33

Thanks for posting the solution.  Any future info on this?   jimmyc


This Discussion