cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
410
Views
0
Helpful
4
Replies

ACEs not responding correctly ASA 5510

Charlie Mayes
Level 1
Level 1

                                 Hello Guys,

                                                  I have a VPN and I think something is not right with it the placement of the ACE's for the permit statement. First of all I want to I have ACL's 10, 20, 30, 40, 50 and 60. My 10 ACL has 6 ACE's and I am trying to add ACE 7 and 8 to it. When ever I add my ACE's 7 with the (lines command) It does not place the 2 ACE's I am adding behind line 6 in the 10 ACL. It actually starts all over like it is the first 10 ACL and list my lines as 1 and 2 instead of the 7 and 8 behind the current 10 ACE. Not only that but is put it under ACL 60 which I am concerned that this is why my VPN tunnel is not coming up. Is this causing the ASA to over look my ACE entriees because they are not at the top with the rest of the 10 ACL  ACEs? When I do a ping from the source network to the destination network in the to ACE's I added I do not see any hits on my ACE's when I perform a show access-list command.                   

1 Accepted Solution

Accepted Solutions

Jennifer Halim
Cisco Employee
Cisco Employee

Placement on the ACL for VPN crypto ACL is not important. What is important for crypto ACL is that it mirror image exactly on the other site of the tunnel.

If you have 10 lines of ACE on this site, the corresponding VPN peer should have 10 lines as well in reverse direction (mirror image).

The placement of the ACE does not need to be the same.

View solution in original post

4 Replies 4

Jennifer Halim
Cisco Employee
Cisco Employee

Placement on the ACL for VPN crypto ACL is not important. What is important for crypto ACL is that it mirror image exactly on the other site of the tunnel.

If you have 10 lines of ACE on this site, the corresponding VPN peer should have 10 lines as well in reverse direction (mirror image).

The placement of the ACE does not need to be the same.

                          The problem was I spelled a name of the ACl wrong by missing one letter. This is why it was creating new line number ACEs and is the sole reason why I could not add the entries to the existing ACL.Sorry my fault. Thanks.

Thanks for the update and rating.

                        No Problem,

                                          I am really thankful that you are willing to help people like me when I Mess Up the configs on these Cisco devices.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: