06-23-2010 09:36 AM
Hello Guys,
I have a VPN and I think something is not right with it the placement of the ACE's for the permit statement. First of all I want to I have ACL's 10, 20, 30, 40, 50 and 60. My 10 ACL has 6 ACE's and I am trying to add ACE 7 and 8 to it. When ever I add my ACE's 7 with the (lines command) It does not place the 2 ACE's I am adding behind line 6 in the 10 ACL. It actually starts all over like it is the first 10 ACL and list my lines as 1 and 2 instead of the 7 and 8 behind the current 10 ACE. Not only that but is put it under ACL 60 which I am concerned that this is why my VPN tunnel is not coming up. Is this causing the ASA to over look my ACE entriees because they are not at the top with the rest of the 10 ACL ACEs? When I do a ping from the source network to the destination network in the to ACE's I added I do not see any hits on my ACE's when I perform a show access-list command.
Solved! Go to Solution.
06-23-2010 06:11 PM
Placement on the ACL for VPN crypto ACL is not important. What is important for crypto ACL is that it mirror image exactly on the other site of the tunnel.
If you have 10 lines of ACE on this site, the corresponding VPN peer should have 10 lines as well in reverse direction (mirror image).
The placement of the ACE does not need to be the same.
06-23-2010 06:11 PM
Placement on the ACL for VPN crypto ACL is not important. What is important for crypto ACL is that it mirror image exactly on the other site of the tunnel.
If you have 10 lines of ACE on this site, the corresponding VPN peer should have 10 lines as well in reverse direction (mirror image).
The placement of the ACE does not need to be the same.
06-23-2010 06:39 PM
The problem was I spelled a name of the ACl wrong by missing one letter. This is why it was creating new line number ACEs and is the sole reason why I could not add the entries to the existing ACL.Sorry my fault. Thanks.
06-23-2010 07:20 PM
Thanks for the update and rating.
06-24-2010 05:54 AM
No Problem,
I am really thankful that you are willing to help people like me when I Mess Up the configs on these Cisco devices.
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: