×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

ASA55xx Series Site-to-Site tunnel problem

Unanswered Question
Nov 8th, 2011
User Badges:


Hi guys,


I have a serios problem debugging an Site-toSite VPN Tunnel issue and hope to find some help here.

Let me first explain the preconditions:

The tunnel is established between ASA5505 and ASA5510. On both devices runs the 8.4.1 Software. On ASA5510 site I use B-Class network devided in several C-Class networks (172.20.0.0/16 devidet in 172.20.10.0/24, 172.20.20.0/24 and so on). The other site is a smaller Network with 172.16.1.1/28.


I created on both sites the tunnel specific configuration and everything work's fine, the tunnel comes up and traffic flows.

So far so good, but now the problem:

After adding one more C-Class network to the cryptomaps, there was no traffic flow possible between this C-Class network and the other Site, the other traffic flows like before. Exchanging this C-Class network by another everything is fine, traffic flows. If I substitute in my cryptomaps all the C-Class networks with the B-Class network, I was able to pass traffic from the non-working C-Class network to the other Site.


So, only this one specific C-Class network won't work properly.

I begin to debug this by myself but become stuck on this point


ciscoasa# packet-tracer input inside icmp 172.16.1.3 8 0 172.20.10.1 detailed

…#All other Phases passed with allowed.


Phase: 8

Type: VPN

Subtype: encrypt

Result: DROP

Config:

Additional Information:

Forward Flow based lookup yields rule:

out id=0xcb8e0270, priority=70, domain=encrypt, deny=false

hits=3, user_data=0x0, cs_id=0xcb3d34f8, reverse, flags=0x0, protocol=0

src ip/id=172.16.1.0, mask=255.255.255.240, port=0

dst ip/id=172.20.10.0, mask=255.255.255.0, port=0, dscp=0x0


Result:

input-interface: inside

input-status: up

input-line-status: up

output-interface: outside

output-status: up

output-line-status: up

Action: drop

Drop-reason: (acl-drop) Flow is denied by configured rule


The other sites output is identicly, expect the src and dst are switched

How can I find the rule which is the reason for the dropped Packages? Do you have any other advices for me, debugging this problem?


Please let me know anymore info that is needed.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.

Actions

This Discussion

Related Content