Routing failed to locate next hop for TCP from outside:

[yuchenglai]

I have a vendor who uses an ASA at his end to build VPN tunnel to us. He gets the following error when he attempts to send traffic to us through the VPN tunnel. One thing to point out is that I am able to see his syn packet come to the destination host located behind my side of the tunnel as well seeing as the syn, ack packet but never seeing the return ack packet. The appliance at the other end of the tunnel generated this error in their ASDM:

Routing failed to locate next hop for TCP from outside:our host:our port to inside: their host: their port.

My thinking is that the TCP SYN,ACK is not getting to their host explaining why the last ACK of the TCP 3way handshake is never seen at my side.

Any comments would be appreciated

[John Blakley]

I'm assuming this is ASA --> ASA? On both ends, the ACL that's on the outside interface needs to allow esp, udp 500, and (possibly) AH through the firewall.

So if their public IP is 5.5.5.5, your ACL would be:

access-list VPN permit udp host 5.5.5.5 host eq isakmp

access-list VPN permit esp host 5.5.5.5 host

access-list VPN permit ah host 5.5.5.5 host

HTH,

John

[yuchenglai]

Nortel on my end, ASA on their end. I will suggest that to them and see if that helps.

[John Blakley]

Make sure you don't have PFS set on either side also.

John

[yuchenglai]

John,

From what I understand, this is sounding more like IPSec than a route issue?

[husycisco]

Hello Yu-Cheng,

Can you ask remote end if they have more than 1 interfaces facing internet with public IPs, and ask if they already have a route for for your subnet to somewhere else (maybe they have a site-to-site vpn with another company that has the same subnet with yours, or an internal network routed inside)

Also please ask them to run "debug crypto isakmp" and "debug crypto ipsec" and let them send you the output for you to paste here.

Regards

[yuchenglai]

It turns out that this problem has been resolved by fixing a route problem on at the distant end controlled by the vendor. As the syslog message suggested they forgot to create a route on their border router/VPN Device to their newly created DMZ.