Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

flow denied error

Drop-reason: (acl-drop) Flow is denied by configured rule eeror on asa

When i run the packet tracer i am geeting above eeror

Phase 1 is up

But when i excute show crypto ipsec sa

i am not geeting any result

Please suggest

As check access-list, transformset from both side is matching

Put when ever i access the far end server Phase 1 is active but not able to access

  • Firewalling
New Member

flow denied error

I think the packet-tracer tool generates a real packet, wich will need the sa to be established.

Your ipsec tunnel is not established, if you don´t have an ipsec sa.

What output does the monitor-log bring if you try to establish the tunnel?

Try debugging for more information:

debug crypto ipsec, dont forget the term moni.

The output from both sides should help you to find the mistake in the configuration.

This widget could not be displayed.