ASA problem with IPSEC VPN data not passing

Unanswered Question
Apr 23rd, 2010


I am facing a starnge problem .

I have attached the diagram that i could make best.

Now problem is that:

I can ping from > all the IP address)

I can ping from ip) > ( single ip pass )

I can ping from ip) > 10.10.16.X ( all other ip except .22 fails )

I tried extended ping from router interface ip : ( secondary ) to ( all ip) and it is success.

The configuration and ACL ( Both side) seems to be ok, VPN Tunnel is also up thats why the data is passing and pinging.

Also we found that there are ACL hits in the router, But there is no ACL hits in the ASA ,also there is no duplicate ACL so there is no chance of hitting any other ACL.

Also single inteface in the router has been used for LAN as well as WAN and WAN connectivity is via wireless(ISP)

Plz find the config as below , As i can't share all the config and VPN details i am partially sharing the required one.

------------------ show version ------------------

Cisco IOS Software, 1841 Software (C1841-ADVIPSERVICESK9-M), Version 12.4(15)T10                                             , RELEASE SOFTWARE (fc3)
Technical Support:
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Mon 14-Sep-09 12:48 by prod_rel_team

ROM: System Bootstrap, Version 12.4(13r)T, RELEASE SOFTWARE (fc1)

SUZSOUTH-BGHALLI_WTG-TATANET uptime is 1 hour, 29 minutes
System returned to ROM by power-on
System image file is "flash:c1841-advipservicesk9-mz.124-15.T10.bin"

This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:

If you require further assistance please contact us by sending email to
[email protected].

Cisco 1841 (revision 7.0) with 236544K/25600K bytes of memory.
Processor board ID FHK135270VD
2 FastEthernet interfaces
2 Virtual Private Network (VPN) Modules
DRAM configuration is 64 bits wide with parity disabled.
191K bytes of NVRAM.
62720K bytes of ATA CompactFlash (Read/Write)

Configuration register is 0x2102

interface FastEthernet0/1
ip address secondary
ip address secondary
ip address
duplex auto
speed auto
crypto map Outside-Map

ip route

ip access-list extended Site_B_map
permit ip
permit ip


interface GigabitEthernet0/0
description ### WAN Interface ###
nameif Outside
security-level 0
ip address standby
interface GigabitEthernet0/1
description ### LAN Interface ###
nameif Inside
security-level 100
ip address standby

interface GigabitEthernet0/2
description LAN/STATE Failover Interface
interface GigabitEthernet0/3
nameif Outside-Backup
security-level 0
ip address

access-list ASA-Site-B-ACL extended permit ip                                 
access-list ASA-Site-B-ACL extended permit ip

access-list ASA-Site-B-ACL extended permit ip

route Outside 1 track 1
route Outside 1

ASA Version: 7.2(4)

Any help is appreciated



I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
rupam_chakra1983 Fri, 04/23/2010 - 22:11


Thanks for your response.

I will try to disable cef on the router, But can you plz let me know how cef can be a problem.

As cef seems to be used for fast switching based on the ip routing table,

HOwever after dsabling cef also the problem is still there

Appreciate your response.

Jennifer Halim Sat, 04/24/2010 - 01:45

I've seen many occasions where disabling cef resolves connectivity issue when configuration looks perfect. Just something to try that might resolve the issue.

Another check would be to see if the host that you are trying to reach has personal firewall that might be blocking inbound connection from different subnet which is again always the case that would prevent connectivity.

rupam_chakra1983 Sat, 04/24/2010 - 23:59

Also i have a doubt as why my acl in the ASA is not hitting .

Also there is no duplicate ACL , so no chance of hitting any false ACL.

But my ACL is hitting in the router side,its really confused.

skint Sun, 04/25/2010 - 03:16

/32 route pointing towards ASA, but /24 is not?  I would try the packet-tracer command here, being sure to run it twice and move troubleshooting further in from there.


rupam_chakra1983 Sun, 04/25/2010 - 07:27


Tanks for reply

What i understand is that among the mentioned two routes in ASA

route Outside 1 track 1
route Outside 1

the second one " route Outside 1 " this route format is not correct .

and we need to remove it and then check.

Federico Coto F... Sun, 04/25/2010 - 08:21


The first line is a default gateway with a metric 1 and being tracked.

The second line is incorrect.


rupam_chakra1983 Mon, 04/26/2010 - 02:11


I have removed the route and also dsabled cef in the remote router but no hope,

still problem is there, also plz let me know how idaelly the routing should ne for ipsec.

1. The route toward the remote subnet houls be pointed to ASA next hop or to the remote ipsec peer .

I have a doubt and also why my ACL is not hitting the ASA

skint Mon, 04/26/2010 - 05:26

The route to the remote network should point to the ASA. 


rupam_chakra1983 Mon, 04/26/2010 - 07:12


There is a certain modification in my previous post that was a typo( copy-paste) errosult are:

Tried  to ping from > all the IP address) : success

Tried  to ping from ip) > ( single ip pass  ) : success

Tried ping from ip) > 10.10.16.X ( all other ip except .22  fails ) : Fail

Tried to ping  from Any server in >  the router interface :  success

I tried extended ping from router interface  ip : ( secondary ) to ( random chekced live ip) and it is  success.



Jennifer Halim Mon, 04/26/2010 - 07:32

Check that all other ip in the subnet does not have personal firewall that blocks incoming connection from different subnets.

If you can ping and, that means the VPN is up and running fine, as crypto ACL is configured on subnet base (

99% of the time, it's the host itself that has personal firewall that blocks incoming connection.

rupam_chakra1983 Mon, 04/26/2010 - 07:40


I have checked and there is no personal firewall on end device as one of the device is pinging.

Second thing if data is passing i should get hits in ACL but i am not getting any hits, what can be the reason for  that.

The end device are not client PC they are some node which send collection data from equipment to server.

What can be the reason for not getting ACL hits i am running code 7.2(4) in ASA.


skint Mon, 04/26/2010 - 07:44

Try running the following command:

packet-tracer input Inside icmp 8 0 det

See if it's hitting the encrypt step, based on your messages and not seeing the counters increment, it would appear to be a routing issue.
rupam_chakra1983 Mon, 04/26/2010 - 07:48


I have done the packet tracer from GUI and it is getting passed and permitting from inside to outside the report says success , but i can't find out which ACL it is hitting in the tracer.

Is there any other way to check.

skint Mon, 04/26/2010 - 07:51

Try it from CLI, you can see if the action if VPN encrypt or VPN drop.  You should also see an increment on your interesting traffic ACL.


rupam_chakra1983 Tue, 04/27/2010 - 07:51


Thanks to all of you for sharing your ideas.

It seems that the packet for some of the remote device are nt reaching the remote router interface,

It may be a problem and we are planning to test the same.

Also at the remote end my router has oly one inetrface configured for LAN and WAn and Lan ip i have given as seondary and wan ip as primary to same interface.

.22 is a end host connected to the common switch where router and wireless device is connceted.

.22 is able to ping but the other ip cann't able to ping (.21,.23 etc)those are some power rating device, But from the Router LAN interface was able to ping the device the de the


This Discussion