1. Check that NAT-T is enabled on both sides (on the ASA crypto isakmp nat-t and on the client side under the transport tab).
it is enabled on both the firewall and in the client.
2. Check that there's no Firewall or device blocking ESP on either side
i have openend every thing from outside
3. As a test include the command ''management-access inside'' and make sure that you can PING the inside IP of the ASA from the VPN client.
after putting this command it started pinging but it is not pinging the core switch the next hop of firewall on inside interface
4. When connected issue the command ''sh cry ips sa'' and check if packets are being encrypted/decrypted when sending traffic.
ASA(config)# sh crypto ipsec sa
interface: outside
Crypto map tag: SYSTEM_DEFAULT_CRYPTO_MAP, seq num: 65535, local addr: 254.254.254.254
local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
remote ident (addr/mask/prot/port): (10.X.122.50/255.255.255.255/0/0)
current_peer: 18.135.2.X, username: XXX
dynamic allocated peer ip: 10.X.122.50
#pkts encaps: 9, #pkts encrypt: 9, #pkts digest: 9
#pkts decaps: 533, #pkts decrypt: 533, #pkts verify: 533
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 9, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: 202.109.253.253/4500, remote crypto endpt.: 188.135.2.215/6405
path mtu 1500, ipsec overhead 82, media mtu 1500
current outbound spi: D32067D8
current inbound spi : B66D5F1D
inbound esp sas:
spi: 0xB66D5F1D (3060621085)
transform: esp-aes esp-sha-hmac no compression
in use settings ={RA, Tunnel, NAT-T-Encaps, }
slot: 0, conn_id: 98304, crypto-map: SYSTEM_DEFAULT_CRYPTO_MAP
sa timing: remaining key lifetime (sec): 28262
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0xFFFFFFFF 0xFFFFFFFF
outbound esp sas:
spi: 0xD32067D8 (3542116312)
transform: esp-aes esp-sha-hmac no compression
in use settings ={RA, Tunnel, NAT-T-Encaps, }
slot: 0, conn_id: 98304, crypto-map: SYSTEM_DEFAULT_CRYPTO_MAP
sa timing: remaining key lifetime (sec): 28253
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
5. A normal problem is that the ASA's inside LAN don't have a route back to the VPN pool range, check this as well.
I can see the host route for the vpn client by sh route output on ASA, On core switch the default route is pointing to ASA still i m not able to ping the core.
