Error on passing traffic between VPNs on ASA

Unanswered Question
Jul 19th, 2010

I've got a strange error - icmp goes OK, and TCP gives error in both ways:

07/19/10 13:19:49 [192.168.12.132] (local4.crit) Jul 19 2010  13:22:27 asa5540 : %ASA-2-106001: Inbound TCP connection denied from 8.77.0.10/4461 to 1.4.0.1/443 flags SYN  on interface dmz

Please, take a look on attached config. I'm fiting with that sinse last Friday and no luck yet...

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Jennifer Halim Mon, 07/19/2010 - 08:49

There doesn't seem to be any NAT configuration in the config attached. Do you configure NAT exemption for traffic between DMZ and the other side of the VPN LAN? ACL also looks OK as you pretty much allow any traffic between the 2 subnets.

vladmorozov Tue, 07/20/2010 - 06:39

Hi, halijenn!

Thanks for advice, but I don't think it would work:

1. Since I have "same-security-traffic permit inter-interface", NAT rules and exemptions is not in use.

2. ICMP works fine without NAT exempt.

Small update - I've tried to use Cisco ASDM packet tracer and test connection from one IP to another. As it show, there are TCP and UDP drop in ACL after routing and VPN lookup, but I don't have any idea what kind of ACL it can be. And ICMP traces fine.

vladmorozov Mon, 08/02/2010 - 23:18

The solution is to check VPN filter ACLs - it was not set and so inherit from VPN filter for default policy and it was strict enough to deny required traffic.

Actions

This Discussion