Jennifer,

Thanks, but that did not resolve the isue.  I still have no phase 1 traffic.

James

If the remote end initiates the traffic, does it bring both phase 1 and phase 2 and is the traffic passing now?

Can you pls share the config from remote end.

If the remote end initiates traffic, the tunnel forms.  However traffic does not pass.  As I look at statistics, my end decrypts as they send packets, but does not encrypt for the return traffic.

If my end sends traffic, the tunnel never forms.

I do not have access to the remot eend, and they are not very cooperative in sharing the config.

Since the tunnel forms when they initiate traffic, but I cannot form or return - does that not indicate an "interesting traffic" issue at my end?

Crypto ACL needs to mirror image on both end, and sounds like it might not have mirror image. Without knowing what is exactly configured on the remote end, we can't be sure if it is mirror image or not.

Also, the remote end might be configured to only allow it to initiate the tunnel, and does not allow your ASA to initiate the tunnel towards the Juniper end.

Try to run the following debug on the ASA to see if we can spot any further error:

debug cry isa

debug cry ipsec

no debug info shows.

Here is all the other end has sent me:

remote LAN - 192.168.191.0/24

local LAN - 66.18.106.160/27

Gateway - 207.98.218.26

Phase 1

               Authentication - Pre-Share

               DH Group - 2

               Encryption AES-CBC (128)

               Hash - SHA1

               LIfetime 86400

Phase 2

               PFS - NO

               Encryption - AES-CBC(128)

               Authentication Algorithm - SHA1

               Authentication Algorithm - MD5

I hve sent an email requesting verification of:

1. That their end is in Main M0de

2.  That they are permitting all ip traffic from 66.18.160.160/27 to 192.168.191.0/24

3.  That they are set for bi-directional establishement of the tunnel

Phase 2, authentication algorithm should only be SHA1, not SHA1 and MD5.

When they try to initiate the tunnel, pls run debugs on your ASA. Also share the output of: show cry isa sa, and show cry ipsec sa.

OK, here is really strange.

I turned on debug and asked that they initiate the traffic.  The tunnel came up and traffic now passes.  However, if the tunnel times out, I cannot initiate the traffic.

Do you still want the Debugs?

yes pls

RomanInternalMedicine#  sho crypto isakmp sa

   Active SA: 2
    Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 2

1   IKE Peer: 207.98.229.154
    Type    : L2L             Role    : responder
    Rekey   : no              State   : MM_ACTIVE
2   IKE Peer: 66.18.99.68
    Type    : L2L             Role    : responder
    Rekey   : no              State   : MM_ACTIVE
RomanInternalMedicine# sho crypto ipsec sa
interface: outside
    Crypto map tag: dynmap, seq num: 10, local addr: 207.98.218.26

      local ident (addr/mask/prot/port): (192.168.190.0/255.255.255.0/0/0)
      remote ident (addr/mask/prot/port): (172.16.100.0/255.255.255.0/0/0)
      current_peer: 207.98.229.154

      #pkts encaps: 1349, #pkts encrypt: 1349, #pkts digest: 1349
      #pkts decaps: 1349, #pkts decrypt: 1349, #pkts verify: 1349
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 1349, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 207.98.218.26, remote crypto endpt.: 207.98.229.154

      path mtu 1500, ipsec overhead 58, media mtu 1500
      current outbound spi: 6A53A558

    inbound esp sas:
      spi: 0x89DE6137 (2313052471)
         transform: esp-des esp-md5-hmac none
         in use settings ={L2L, Tunnel, }
         slot: 0, conn_id: 2, crypto-map: dynmap
         sa timing: remaining key lifetime (kB/sec): (4274920/27446)
         IV size: 8 bytes
         replay detection support: Y
    outbound esp sas:
      spi: 0x6A53A558 (1783866712)
         transform: esp-des esp-md5-hmac none
         in use settings ={L2L, Tunnel, }
         slot: 0, conn_id: 2, crypto-map: dynmap
         sa timing: remaining key lifetime (kB/sec): (4274920/27445)
         IV size: 8 bytes
         replay detection support: Y

    Crypto map tag: romanmap, seq num: 10, local addr: 207.98.218.26

      access-list VPN permit ip 192.168.191.0 255.255.255.0 66.18.106.160 255.255.255.224
      local ident (addr/mask/prot/port): (192.168.191.0/255.255.255.0/0/0)
      remote ident (addr/mask/prot/port): (66.18.106.160/255.255.255.224/0/0)
      current_peer: 66.18.99.68

      #pkts encaps: 600, #pkts encrypt: 600, #pkts digest: 600
      #pkts decaps: 600, #pkts decrypt: 600, #pkts verify: 600
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 600, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 207.98.218.26, remote crypto endpt.: 66.18.99.68

      path mtu 1500, ipsec overhead 74, media mtu 1500
      current outbound spi: CE9B009B

    inbound esp sas:
      spi: 0x363C733C (909931324)
         transform: esp-aes esp-sha-hmac none
         in use settings ={L2L, Tunnel, }
         slot: 0, conn_id: 3, crypto-map: romanmap
         sa timing: remaining key lifetime (sec): 27884
         IV size: 16 bytes
         replay detection support: Y
    outbound esp sas:
      spi: 0xCE9B009B (3466264731)
         transform: esp-aes esp-sha-hmac none
         in use settings ={L2L, Tunnel, }
         slot: 0, conn_id: 3, crypto-map: romanmap
         sa timing: remaining key lifetime (sec): 27884
         IV size: 16 bytes
         replay detection support: Y

and the debugs output?

Jennifer,

Thanks for your help.  Here is the solution.  Correct the NAt 0 list as your suggested.  And re-confirm (as I had done) that the other end was set for bi-directional tunnel formation.

Of course, they canged nothing (wink,wink)

Tunnel is up and traffic is passing

LOL, that's what they always say

Great to hear all is good now.

Sad, but true.... thanks again

James