ACEs not responding correctly ASA 5510

Answered Question
Jun 23rd, 2010

                                 Hello Guys,

                                                  I have a VPN and I think something is not right with it the placement of the ACE's for the permit statement. First of all I want to I have ACL's 10, 20, 30, 40, 50 and 60. My 10 ACL has 6 ACE's and I am trying to add ACE 7 and 8 to it. When ever I add my ACE's 7 with the (lines command) It does not place the 2 ACE's I am adding behind line 6 in the 10 ACL. It actually starts all over like it is the first 10 ACL and list my lines as 1 and 2 instead of the 7 and 8 behind the current 10 ACE. Not only that but is put it under ACL 60 which I am concerned that this is why my VPN tunnel is not coming up. Is this causing the ASA to over look my ACE entriees because they are not at the top with the rest of the 10 ACL  ACEs? When I do a ping from the source network to the destination network in the to ACE's I added I do not see any hits on my ACE's when I perform a show access-list command.                   

I have this problem too.
0 votes
Correct Answer by Jennifer Halim about 6 years 7 months ago

Placement on the ACL for VPN crypto ACL is not important. What is important for crypto ACL is that it mirror image exactly on the other site of the tunnel.

If you have 10 lines of ACE on this site, the corresponding VPN peer should have 10 lines as well in reverse direction (mirror image).

The placement of the ACE does not need to be the same.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
Jennifer Halim Wed, 06/23/2010 - 18:11

Placement on the ACL for VPN crypto ACL is not important. What is important for crypto ACL is that it mirror image exactly on the other site of the tunnel.

If you have 10 lines of ACE on this site, the corresponding VPN peer should have 10 lines as well in reverse direction (mirror image).

The placement of the ACE does not need to be the same.

Charlie Mayes Wed, 06/23/2010 - 18:39

                          The problem was I spelled a name of the ACl wrong by missing one letter. This is why it was creating new line number ACEs and is the sole reason why I could not add the entries to the existing ACL.Sorry my fault. Thanks.

Charlie Mayes Thu, 06/24/2010 - 05:54

                        No Problem,

                                          I am really thankful that you are willing to help people like me when I Mess Up the configs on these Cisco devices.

Actions

This Discussion