I'm having a problem with vpn traffic that terminates on my ASA version 7.2(1)4
As soon as I turn on a IM inspection rule and configure an IM map to log only, the vpn traffic seems to pass, but while connecting via rdp I get an error "Because of an error in data encryption..." and am then kicked out of my terminal services session. Outlook exhibits similar behavior in that I can make the connection and open outlook, but no message are sent or received. Has anyone seem similar behavior?
some additional info, I ran a capture type asp drop all command and found this in the output
10.4.0.13 is the server I'm trying to rdp into and 192.168.8.143 is my address while connected via vpn. Also ran sh asp drop after first clearing the stats and get this, however I'm not sure if the 2 can be tied together to see where my traffic from 10.4.0.13 is being dropped to 192.168.8.143
A vpn-filter is applied to post-decrypted traffic after it exits a tunnel and pre-encrypted traffic before it enters a tunnel. When a
vpn-filter is applied to a group-policy that governs Remote Access VPN client connections, the ACL should be configured with the client assigned IP addresses in the "src_ip" position of the ACL and the local network in the
"dest_ip" position of the ACL. When a vpn-filter is applied to a group-policy that governs a LAN to LAN VPN connection, the ACL should be configured with the remote network in the "src_ip" position of the ACL and the local network in the "dest_ip" position of the ACL. Caution should be exercised when constructing the ACLs for use with the vpn-filter feature.
The ACLs are constructed with the post-decrypted traffic in mind, however, they are also applied to the traffic in the opposite direction. For this pre-encrypted traffic that is destined for the tunnel, the ACLs are constructed with the "src_ip" and "dest_ip" positions swapped.
Interesting work around, but I guess this is a bug? Traffic shouldn't get dropped because of an IM inspection map. I do remember a syslog message once about the length of packets being too long. Is there a way I can look a bit deeper into the cause of that message?
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
[toc:faq]Introduction:This document describes details on how NAT-T
works.Background:ESP encrypts all critical information, encapsulating
the entire inner TCP/UDP datagram within an ESP header. ESP is an IP
protocol in the same sense that TCP and UDP are I...