Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

ACEs not responding correctly ASA 5510

                                 Hello Guys,

                                                  I have a VPN and I think something is not right with it the placement of the ACE's for the permit statement. First of all I want to I have ACL's 10, 20, 30, 40, 50 and 60. My 10 ACL has 6 ACE's and I am trying to add ACE 7 and 8 to it. When ever I add my ACE's 7 with the (lines command) It does not place the 2 ACE's I am adding behind line 6 in the 10 ACL. It actually starts all over like it is the first 10 ACL and list my lines as 1 and 2 instead of the 7 and 8 behind the current 10 ACE. Not only that but is put it under ACL 60 which I am concerned that this is why my VPN tunnel is not coming up. Is this causing the ASA to over look my ACE entriees because they are not at the top with the rest of the 10 ACL  ACEs? When I do a ping from the source network to the destination network in the to ACE's I added I do not see any hits on my ACE's when I perform a show access-list command.                   

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: ACEs not responding correctly ASA 5510

Placement on the ACL for VPN crypto ACL is not important. What is important for crypto ACL is that it mirror image exactly on the other site of the tunnel.

If you have 10 lines of ACE on this site, the corresponding VPN peer should have 10 lines as well in reverse direction (mirror image).

The placement of the ACE does not need to be the same.

4 REPLIES
Cisco Employee

Re: ACEs not responding correctly ASA 5510

Placement on the ACL for VPN crypto ACL is not important. What is important for crypto ACL is that it mirror image exactly on the other site of the tunnel.

If you have 10 lines of ACE on this site, the corresponding VPN peer should have 10 lines as well in reverse direction (mirror image).

The placement of the ACE does not need to be the same.

Community Member

Re: ACEs not responding correctly ASA 5510

                          The problem was I spelled a name of the ACl wrong by missing one letter. This is why it was creating new line number ACEs and is the sole reason why I could not add the entries to the existing ACL.Sorry my fault. Thanks.

Cisco Employee

Re: ACEs not responding correctly ASA 5510

Thanks for the update and rating.

Community Member

Re: ACEs not responding correctly ASA 5510

                        No Problem,

                                          I am really thankful that you are willing to help people like me when I Mess Up the configs on these Cisco devices.

207
Views
0
Helpful
4
Replies
CreatePlease to create content