Site-to-Site VPN Cisco ASA with MX Meraki only one way

[Agung1007]

Hi team,

just want to ask question,

what causing the S2S VPN (HO-ASA, Branch-MX Meraki) can only one way (for some subnet/ip segment))

From Client MX-Branch (10.8.14.x /24)  : able to reach/ping to HO-ASA client 10.0.210.x/24 & 192.168.27.x /24 ==> OK

From Client HO-ASA (10.0.210.x/24)  : able to reach/ping client MX-Branch 10.8.14.x /24 ==> OK

From Client HO-ASA (192.168.27.x /24 ) : UNABLE to reach/ping client MX-Branch 10.8.14.x /24 ==> NOK, what causing this  ?

Already check using Packet Tracer on ASA with Source IP : 192.168.27.52 , dest IP : 10.8.14.2, it says ALLOW (same as Source IP 10.0.210.20, dest IP : 10.8.14.2)

Note:

- ASA using FPR2130-Asa Mode version 9.12.4.48

- MX Meraki using MX95

- On HO-ASA, Subnet : 10.0.210.x /24 , 192.168.27.x /24

- On Branch-MX, subnet : 10.8.14.x /24

- Tunnel S2S VPN already established

[Pavan Gundu]

Please post the entire packet tracer output.

Also, re-verify if you have any overlapping crypto acl.

[Agung1007]

Hi Pavan,

kindly check attachment log , with Packet Tracer Source IP (from HO-ASA) :

- 192.168.27.52 to 10.8.14.1

- 10.0.210.20 to 10.8.14.1

- sh vpn-sessiondb detail l2l filter ipaddress 117.102.75.130
- show crypto ipsec sa peer 117.102.75.130 detail

while we packet tracer,

we ping from Dashboard meraki (MX-Meraki) to HO-ASA (192.168.27.x /24 & 10.0.210.x /24) and Reply/Reachable

but from HO-ASA to Mx-Branch  not reachable.

and already check, there's no overlap ip address with other Rules/NAT.

Thanks.

[MHM Cisco World]

The multi NAT in packet tracer indicates that there is issue with routing'

Do packet-tracer again but this time use 

Packet tracer input <outside> .....

I.e. flapp the packet tracer 

MHM

[Agung1007]

Hi 

Thanks for the reply.

What do you mean there's an issue with the Routing?
routing on the ASA ?

I Thought on ASA there's no need to add Routing for traffic S2S VPN ?

*as long the traffic is network define on NAT, which is local and Remote network ; i also create S2S Network on another Peer (Azure & another ASA) there's no added Routing on ASA to Peer VPN

already try your suggestion for Packet-Tracer with Interface Outside as Source,

The Result is deny (i think this due the Outside Network is not included on the NAT, usually i test packet tracer for source is Inside Interface) ==> PFA the attachment

Until today,

i still havent found what causing the issue that from HO-ASA unable to reach the MX-Branch (Ping Reply)

while on the MX-Branch, able to reach the HO-ASA (Ping no Reply)

Thanks, 

Best Regards.

[MHM Cisco World]

Did you config sysop connection vpn in Asa?

MHM

[Agung1007]

No,

As far as i know,

I have not config sysop connection VPN in ASA.

[MHM Cisco World]

Check it by 

Show run all

If this feature not enable then you will face drop in vpn traffic 

MHM