L2L tunnel up, not passing traffic...all of a sudden

I've had a tunnel in place on a 5505 to a remote network i don't control...so my troubleshooting there is limited.  But the tunnel has been in place for over a year without issue.  Suddenly it doesn't appear to be passing traffic.  But it is in at least one direction.  
Remote network:192.168.191.0/24
Local ASA side: 10.220.78.0/24
I had a constant ping started from 192.168.191.10 > 10.220.78.23
Which is a Windows server pinging a Windows workstation.
When i debug icmp on the ASA i get:
ICMP echo request from outside:192.168.191.10 to inside:10.220.78.23 ID=1 seq=2866 len=32
ICMP echo reply from inside:10.220.78.23 to outside:192.168.191.10 ID=1 seq=2866 len=32
Which confirms to me that the remote network is in fact traversing the tunnel and hitting the 10.220.78.23 device, which is in fact responding, and the reply is being sent out the ASA.
The tunnel negotiates and comes up any time I reset it, by all accounts it looks correct.
The problem is not limited to ICMP as I'm unable to net use or map drives, nor can 192.168.191.10 print to the printer at 10.220.78.20.
But once i saw the icmp trace output I pretty much figured it has to be on the remote end...so....
My question, can I absolutely infer from this that the issue resides on the remote end?

Some additional info.  Aside from the ping they have running from the remote network, which is shown in the above icmp trace, if i run packet tracer from the local network to the remote, tunnel's up/traffic is allowed.  Not a big surprise since the tunnel does negotiate and stay up.
I captured packets from the ASA and I can see the local 10.220.78.23 device sending the reply to 192.168.191.10.  Matching up with the icmp trace.
I had them run a packet capture on their firewall and confirmed, the ICMP requests from 192.168.191.10 are being encapsulated and sent on the tunnel.  Again confirmed in my mind since i see the requests on the ASA.  But they don't ever see the response.
There's no tcp adjust mss command on the ASA but there's this in the config:
ASA# sh run all sys
no sysopt connection timewait
sysopt connection tcpmss 1380
sysopt connection tcpmss minimum 0
sysopt connection permit-vpn
sysopt connection reclassify-vpn
no sysopt connection preserve-vpn-flows
no sysopt nodnsalias inbound
no sysopt nodnsalias outbound
no sysopt radius ignore-secret
no sysopt noproxyarp inside
no sysopt noproxyarp outside
Any other ideas?

Similar Messages

  • Cisco 881 ISR IPSec VPN Tunnel does not pass traffic from the vlan.

    I have a cisco 881 ISR Router with a site-to-site IPsec vpn tunnel to a mikrotik device on the other end (I inherited this from my client). The tunnel is constructed properly and is up, however traffic does not pass or get routed to the FA4 interface. I see in my packet captures that it hits the vlan1 interface (vlans are required on the L2 ports) and does not pass to the tunnel.
    This is my configuration:
    141Kerioth#sh config
    Using 3763 out of 262136 bytes
    ! Last configuration change at 01:02:41 UTC Mon May 26 2014 by admin
    version 15.2
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname 141Kerioth
    boot-start-marker
    boot-end-marker
    logging buffered 51200 warnings
    aaa new-model
    141Kerioth#do wr mem
                  ^
    % Invalid input detected at '^' marker.
    141Kerioth#wr mem
    Building configuration...
    [OK]
    141Kerioth#sh run
    Building configuration...
    Current configuration : 5053 bytes
    ! Last configuration change at 01:38:06 UTC Mon May 26 2014 by admin
    version 15.2
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname 141Kerioth
    boot-start-marker
    boot-end-marker
    logging buffered 51200 warnings
    aaa new-model
    aaa authentication login default local
    aaa authentication ppp default local
    aaa session-id common
    memory-size iomem 10
    crypto pki trustpoint TP-self-signed-580381394
     enrollment selfsigned
     subject-name cn=IOS-Self-Signed-Certificate-580381394
     revocation-check none
     rsakeypair TP-self-signed-580381394
    crypto pki certificate chain TP-self-signed-580381394
     certificate self-signed 01
      30820229 30820192 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
      30312E30 2C060355 04031325 494F532D 53656C66 2D536967 6E65642D 43657274
      69666963 6174652D 35383033 38313339 34301E17 0D313430 35323231 38323333
      365A170D 32303031 30313030 30303030 5A303031 2E302C06 03550403 1325494F
      532D5365 6C662D53 69676E65 642D4365 72746966 69636174 652D3538 30333831
      33393430 819F300D 06092A86 4886F70D 01010105 0003818D 00308189 02818100
      B001A012 2CA6970C 0648798B 2A786704 84F2D989 83974B19 9B4287F2 4503D2C9
      173F23C4 FF34D160 202A7565 4A1CE08B 60B3ADAE 6E19EE6E 9CD39E72 71F9650E
      930F22FE C4441F9C 2D7DD420 71F75DFC 3CCAC94E BA304685 E0E62658 A3E8D01C
      D01D7D6A 5AF0B0E6 3CF6AF3A B7E51F83 9BF6D38E 65254E1F 71369718 ADADD691
      02030100 01A35330 51300F06 03551D13 0101FF04 05300301 01FF301F 0603551D
      23041830 168014D6 24878F12 1FFADF2F 537A438E 6DD7FB6B D79E4130 1D060355
      1D0E0416 0414D624 878F121F FADF2F53 7A438E6D D7FB6BD7 9E41300D 06092A86
      4886F70D 01010505 00038181 00771667 FCA66002 8AB9E5FB F210012F C50B586F
      9A9640BB 45B4CEFD 030A38C0 E610AAC8 B41EF3C4 E55810F9 B2C727CF C1DEFCF1
      0846E7BC 1D95420E 5DADB5F8 EFE7EB37 B5433B80 4FF787D4 B1F2A527 06F065A4
      00522E97 A9D2335C E83C4AE1 E68D7A41 9D0046A7 ADCC282B 7527F84D E71CC567
      14EF37EA 15E57AD0 3C5D01F3 EF
            quit
    ip dhcp excluded-address 10.0.16.1
    ip dhcp pool ccp-pool
     import all
     network 10.0.16.0 255.255.255.0
     default-router 10.0.16.1
     dns-server 8.8.8.8
     lease 0 2
    ip domain name kerioth.com
    ip host hostname.domain z.z.z.z
    ip name-server 8.8.8.8
    ip name-server 4.2.2.2
    ip cef
    no ipv6 cef
    license udi pid CISCO881-K9 sn FTX180483DD
    username admin privilege 15 secret 4 CmmfIy.RPySmo4Q2gEIZ2jlr3J.bTBAszoe5Bry0z4c
    username meadowbrook privilege 0 password 0 $8UBr#Ux
    username meadowbrook autocommand exit
    policy-map type inspect outbound-policy
    crypto isakmp policy 1
     encr 3des
     authentication pre-share
     group 5
    crypto isakmp key 141Township address z.z.z.z
    crypto isakmp keepalive 10
    crypto ipsec transform-set TS esp-3des esp-sha-hmac
     mode tunnel
    crypto map mymap 10 ipsec-isakmp
     set peer z.z.z.z
     set transform-set TS
     match address 115
    interface Loopback0
     no ip address
    interface Tunnel1
     no ip address
    interface FastEthernet0
     no ip address
    interface FastEthernet1
     no ip address
    interface FastEthernet2
     no ip address
    interface FastEthernet3
     no ip address
    interface FastEthernet4
     description $FW_OUTSIDE_WAN$
     ip address 50.y.y.y 255.255.255.240
     ip nat outside
     ip virtual-reassembly in
     duplex auto
     speed auto
     crypto map mymap
    interface Vlan1
     description $ETH_LAN$
     ip address 10.0.16.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
     ip tcp adjust-mss 1452
    ip forward-protocol nd
    ip http server
    ip http access-class 23
    ip http authentication local
    ip http secure-server
    ip http timeout-policy idle 60 life 86400 requests 10000
    ip nat inside source list 115 interface Vlan1 overload
    ip nat inside source list 199 interface FastEthernet4 overload
    ip nat inside source route-map nonat interface FastEthernet4 overload
    ip route 0.0.0.0 0.0.0.0 50.x.x.x
    access-list 110 deny   ip 10.0.16.0 0.0.0.255 10.0.1.0 0.0.0.255
    access-list 110 permit ip 10.0.16.0 0.0.0.255 any
    access-list 115 permit ip 10.0.16.0 0.0.0.255 10.0.1.0 0.0.0.255
    access-list 144 permit icmp host c.c.c.c host 10.0.1.50
    access-list 144 permit icmp host p.p.p.p host 10.0.16.105
    access-list 199 permit ip a.a.a.a 0.0.0.255 any
    no cdp run
    route-map nonat permit 10
     match ip address 100
    line con 0
     no modem enable
    line aux 0
    line vty 0 4
     access-class 1 in
     exec-timeout 30 0
     privilege level 15
     transport preferred ssh
     transport input ssh
    line vty 5 15
     access-class 23 in
     privilege level 15
     transport input telnet ssh
    cns trusted-server all-agents x.x.x.x
    cns trusted-server all-agents hostname
    cns trusted-server all-agents hostname.domain
    cns id hardware-serial
    cns id hardware-serial event
    cns id hardware-serial image
    cns event hostname.domain 11011
    cns config initial hostname.domain 80
    cns config partial hostname.domain 80
    cns exec 80
    end

    Why do you have following command on the PIX?
    crypto map outside_map 40 set transform-set 165.228.x.x
    Also you have this transform set on the PIX:
    crypto ipsec transform-set 10.112.60.0 esp-aes-256 esp-sha-hmac
    This does not match the transfor set on the router:
    crypto ipsec transform-set tritest esp-3des esp-md5-hmac
    Where are you using the access-list/route-map
    101 ?

  • When my phone is powered on and not in use all of a sudden the Samsung Galazy 5 then Samsung and the verizon logo comes on to frequent all threw out the day . Has this happened to anyone else ?

    When my phone is powered on and not in use all of a sudden the Samsung Galaxy 5 then Samsung and Verizon logo comes on tell me to check my battery cover, I have checked it and it is secure but it still continues to happen all day long. Has this happened to anyone else?

    My phone is 5 days old and does the exact same thing.
    Just check the box that says do not show again when it pops up. That should Stop the pop ups all the time.
    I am very dissapointed with my phone .  My S5 has been very buggy, likes to freeze up , lags , drains battery in about 4-5 hours, loses data connection in "Good Signal" areas ( drops down to 3g and 1x data or says 4g lte but Web pages fail to load , say no data connection). Camera has also crashed on me twice already.

  • My ipod does not recognize touch all of a sudden. It is on, but I cannot use it because it won't recognize my touch! Help please!

    My ipod does not recognize touch all of a sudden. It is on, but I cannot use it because it won't recognize my touch! Help please!

    -You stated: " It is on, but I cannot use it "
    Does this mean that the iPod works fine but when you connect the iPod to your computer iTunes does not see - your iPod?
    - Have you tried:
    iPhone, iPad, iPod touch: Device not recognized in iTunes for Mac OS X
    - If you really have OSX 10.6.x (not 10.5.8 as stated) try:
    Mac OS X v10.6 or later: iOS device not recognized in iTunes after restart
    - Have you tried another cable and USB port?
    - If the iPod is not working then there are other things to try.

  • Cisco ASA 5505 Site to Site VPN tunnel up, but not passing traffic

    Thanks to a previous thread, I do have a 5505 up and running, and passing data....
    https://supportforums.cisco.com/message/3900751
    Now I am trying to get a IPSEC VPN tunnel working.
    I actually have it up (IKE phase 1 & 2 both passed), but it is not sending/receiving data through the tunnel.
    The networks concerned:
    name 10.0.0.0  Eventual  (HQ Site behind Firewall)
    name 1.1.1.0  CFS  (Public Network Gateway for Palo Alto Firewall - Firewall IP: 1.1.1.1)
    name 2.2.2.0  T1  (Remote site - Outside interface of 5505: 2.2.2.2)
    name 10.209.0.0  Local  (Remote Network - internal interface of 5505: 10.209.0.3)
    On a ping to the HQ network from behind the ASA, I get....
    portmap translation creation failed for icmp src inside:10.209.0.9 dst inside:10.0.0.33 (type 8, code 0)
    I am suspecting that there is a NAT error and/or a lack of a static route for the rest of the 10.0.0.0 traffic, and that I may have to exempt/route the traffic for the HQ network (10.0.0.0), but I haven't been able to get the correct entries to make it work.
    Below is the config.
    Can anyone see if there is something sticking out?
    : Saved
    ASA Version 8.2(5)
    hostname ciscoasa
    enable password 8Ry2YjIyt7RRXU24 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 10.0.0.0 Eventual
    name 10.209.0.0 Local
    name 2.2.2.0 T1
    name 1.1.1.0 CFS
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 0
    ip address 10.209.0.3 255.0.0.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address 2.2.2.2 255.255.255.248
    time-range Indefinite
    ftp mode passive
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object-group protocol DM_INLINE_PROTOCOL_1
    protocol-object ip
    protocol-object icmp
    protocol-object udp
    protocol-object tcp
    object-group network DM_INLINE_NETWORK_1
    network-object Eventual 255.0.0.0
    network-object T1 255.255.255.248
    network-object CFS 255.255.255.240
    access-list outside_1_cryptomap extended permit ip Local 255.255.255.0 object-group DM_INLINE_NETWORK_1
    pager lines 24
    logging enable
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any outside
    icmp permit any inside
    asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 1 0.0.0.0 0.0.0.0
    route outside 0.0.0.0 0.0.0.0 67.139.113.217 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http Eventual 255.0.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer 1.1.1.1
    crypto map outside_map 1 set transform-set ESP-3DES-MD5
    crypto map outside_map 1 set phase1-mode aggressive
    crypto map outside_map interface outside
    crypto ca trustpoint _SmartCallHome_ServerCA
    crl configure
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 28800
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    dhcpd address 10.209.0.201-10.209.0.232 inside
    dhcpd dns 8.8.8.8 8.8.4.4 interface inside
    dhcpd auto_config outside interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy DfltGrpPolicy attributes
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    group-policy FTMGP internal
    group-policy FTMGP attributes
    vpn-idle-timeout none
    vpn-filter none
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    tunnel-group 1.1.1.1 type ipsec-l2l
    tunnel-group 1.1.1.1 general-attributes
    default-group-policy FTMGP
    tunnel-group 1.1.1.1 ipsec-attributes
    pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    call-home reporting anonymous
    Cryptochecksum:701d8da28ee256692a1e49d904e9cb04
    : end
    asdm location Eventual 255.0.0.0 inside
    asdm location Local 255.255.255.0 inside
    asdm location T1 255.255.255.248 inside
    asdm location CFS 255.255.255.240 inside
    asdm history enable
    Thank You.

    I'm just re-engaging on the firewall this afternoon, but right now I'm getting request timed out on the pings....
    Here's the output requested:
    Result of the command: "show crypto isakmp sa"
    Active SA: 1
    Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
    Total IKE SA: 1
    1 IKE Peer: 1.1.1.1
    Type : L2L Role : initiator
    Rekey : no State : AM_ACTIVE
    Result of the command: "show crypto ipsec sa"
    interface: outside
    Crypto map tag: outside_map, seq num: 1, local addr: 2.2.2.2
    access-list outside_1_cryptomap extended permit ip 10.209.0.0 255.255.255.0 10.0.0.0 255.0.0.0
    local ident (addr/mask/prot/port): (Local/255.255.255.0/0/0)
    remote ident (addr/mask/prot/port): (Eventual/255.0.0.0/0/0)
    current_peer: 1.1.1.1
    #pkts encaps: 84, #pkts encrypt: 84, #pkts digest: 84
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 84, #pkts comp failed: 0, #pkts decomp failed: 0
    #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
    #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
    #send errors: 0, #recv errors: 0
    local crypto endpt.: 2.2.2.2, remote crypto endpt.: 1.1.1.1
    path mtu 1500, ipsec overhead 58, media mtu 1500
    current outbound spi: 8FC06BD1
    current inbound spi : 42EC16F4
    inbound esp sas:
    spi: 0x42EC16F4 (1122768628)
    transform: esp-3des esp-md5-hmac no compression
    in use settings ={L2L, Tunnel, PFS Group 2, }
    slot: 0, conn_id: 4096, crypto-map: outside_map
    sa timing: remaining key lifetime (kB/sec): (62207/28464)
    IV size: 8 bytes
    replay detection support: Y
    Anti replay bitmap:
    0x00000000 0x00000001
    outbound esp sas:
    spi: 0x8FC06BD1 (2411752401)
    transform: esp-3des esp-md5-hmac no compression
    in use settings ={L2L, Tunnel, PFS Group 2, }
    slot: 0, conn_id: 4096, crypto-map: outside_map
    sa timing: remaining key lifetime (kB/sec): (62201/28464)
    IV size: 8 bytes
    replay detection support: Y
    Anti replay bitmap:
    0x00000000 0x00000001
    Here's the current config:
    : Saved
    ASA Version 8.2(5)
    hostname ciscoasa
    enable password 8Ry2YjIyt7RRXU24 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 10.0.0.0 Eventual
    name 10.209.0.0 Local
    name 67.139.113.216 T1
    name 1.1.1.0 IntegraCFS
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 0
    ip address 10.209.0.3 255.0.0.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address 2.2.2.2 255.255.255.248
    time-range Indefinite
    ftp mode passive
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object-group protocol DM_INLINE_PROTOCOL_1
    protocol-object ip
    protocol-object icmp
    protocol-object udp
    protocol-object tcp
    object-group network DM_INLINE_NETWORK_1
    network-object Eventual 255.0.0.0
    network-object T1 255.255.255.248
    network-object IntegraCFS 255.255.255.240
    access-list outside_1_cryptomap extended permit ip Local 255.255.255.0 object-group DM_INLINE_NETWORK_1
    access-list No_NAT extended permit ip Local 255.255.255.0 Eventual 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any inside
    icmp permit any outside
    asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list No_NAT
    nat (inside) 1 0.0.0.0 0.0.0.0
    route outside 0.0.0.0 0.0.0.0 2.2.2.0 1
    route outside Eventual 255.255.255.0 1.1.1.1 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http Eventual 255.0.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer 1.1.1.1
    crypto map outside_map 1 set transform-set ESP-3DES-MD5
    crypto map outside_map 1 set security-association lifetime kilobytes 65535
    crypto map outside_map 1 set phase1-mode aggressive
    crypto map outside_map interface outside
    crypto ca trustpoint _SmartCallHome_ServerCA
    crl configure
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 28800
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    dhcpd address 10.209.0.201-10.209.0.232 inside
    dhcpd dns 8.8.8.8 8.8.4.4 interface inside
    dhcpd auto_config outside interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy DfltGrpPolicy attributes
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    group-policy FTMGP internal
    group-policy FTMGP attributes
    vpn-idle-timeout none
    vpn-filter none
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    tunnel-group 1.1.1.1 type ipsec-l2l
    tunnel-group 1.1.1.1 general-attributes
    default-group-policy FTMGP
    tunnel-group 1.1.1.1 ipsec-attributes
    pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
    message-length maximum client auto
    message-length maximum 512
    policy-map global_policy
    class inspection_default
    inspect dns preset_dns_map
    inspect ftp
    inspect h323 h225
    inspect h323 ras
    inspect rsh
    inspect rtsp
    inspect esmtp
    inspect sqlnet
    inspect skinny
    inspect sunrpc
    inspect xdmcp
    inspect sip
    inspect netbios
    inspect tftp
    inspect ip-options
    inspect icmp
    service-policy global_policy global
    prompt hostname context
    call-home reporting anonymous
    Cryptochecksum:301e573544ce0f89b3c597bdfe2c414a
    : end
    asdm location Eventual 255.0.0.0 inside
    asdm location Local 255.255.255.0 inside
    asdm location T1 255.255.255.248 inside
    asdm location IntegraCFS 255.255.255.240 inside
    asdm history enable

  • Site to Site VPN Between Two ASA 5505's Up But Not Passing Traffic

    hello,
    i am setting up a site to site vpn between two asa 5505's.  the tunnel is up but i cannot get it to pass traffic and i have run out of ideas at this point.  i am on site as i am posting this question and only have about 4 hours left to figure this out, so any help asap is greatly appreciated.  i'll post the configs below along with the output of sh crypto isakmp sa and sh ipsec sa.
    FYI the asa's are different versions, one is 9.2 the other is 8.2
    Note: 1.1.1.1 = public ip for Site A 2.2.2.2 = public ip for site B
    Site A running config:
    Result of the command: "sh run"
    : Saved
    ASA Version 8.2(2)
    hostname csol-asa
    enable password WI19w3dXj6ANP8c6 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 192.168.1.0 san_antonio_inside
    interface Vlan1
     nameif inside
     security-level 100
     ip address 192.168.2.1 255.255.255.0
    interface Vlan2
     nameif outside
     security-level 0
     ip address 1.1.1.1 255.255.255.248
    interface Ethernet0/0
     switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    ftp mode passive
    dns domain-lookup inside
    dns server-group DefaultDNS
     name-server 24.93.41.125
     name-server 24.93.41.126
    object-group network NETWORK_OBJ_192.168.2.0_24
    access-list inside_access_out extended permit ip any any
    access-list outside_access_out extended permit ip any any
    access-list outside_access_in extended permit icmp any any
    access-list outside_access_in_1 extended permit icmp any interface outside
    access-list outside_access_in_1 extended permit tcp any interface outside eq pop3
    access-list outside_access_in_1 extended permit tcp any interface outside eq 8100
    access-list outside_access_in_1 extended permit udp any interface outside eq 8100
    access-list outside_access_in_1 extended permit udp any interface outside eq 1025
    access-list outside_access_in_1 extended permit tcp any interface outside eq 1025
    access-list outside_access_in_1 extended permit tcp any interface outside eq 5020
    access-list outside_access_in_1 extended permit tcp any interface outside eq 8080
    access-list outside_access_in_1 extended permit tcp any interface outside eq www
    access-list outside_access_in_1 extended permit ip san_antonio_inside 255.255.255.0 any
    access-list outside_1_cryptomap extended permit ip 192.168.2.0 255.255.255.0 host san_antonio_inside
    access-list outside_1_cryptomap_1 extended permit ip 192.168.2.0 255.255.255.0 san_antonio_inside 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.2.0 255.255.255.0 san_antonio_inside 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    nat-control
    global (inside) 2 interface
    global (outside) 101 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 101 0.0.0.0 0.0.0.0
    static (inside,outside) tcp interface pop3 192.168.2.249 pop3 netmask 255.255.255.255
    static (inside,outside) tcp interface 8100 192.168.2.161 8100 netmask 255.255.255.255
    static (inside,outside) udp interface 8100 192.168.2.161 8100 netmask 255.255.255.255
    static (inside,outside) udp interface 1025 192.168.2.161 1025 netmask 255.255.255.255
    static (inside,outside) tcp interface 5020 192.168.2.8 5020 netmask 255.255.255.255
    static (inside,outside) tcp interface 8080 192.168.2.251 8080 netmask 255.255.255.255
    static (inside,inside) tcp interface www 192.168.2.8 www netmask 255.255.255.255
    static (inside,outside) tcp interface 1025 192.168.2.161 1025 netmask 255.255.255.255
    access-group inside_access_out out interface inside
    access-group outside_access_in_1 in interface outside
    route outside 0.0.0.0 0.0.0.0 1.1.1.1 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 192.168.2.0 255.255.255.0 inside
    http 2.2.2.2 255.255.255.255 outside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA-TRANS mode transport
    crypto ipsec transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-AES-128-MD5-TRANS mode transport
    crypto ipsec transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA-TRANS mode transport
    crypto ipsec transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-MD5-TRANS mode transport
    crypto ipsec transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-SHA-TRANS mode transport
    crypto ipsec transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-MD5-TRANS mode transport
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA-TRANS mode transport
    crypto ipsec transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5-TRANS mode transport
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-SHA-TRANS mode transport
    crypto ipsec transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-DES-MD5-TRANS mode transport
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map outside_map1 1 match address outside_1_cryptomap_1
    crypto map outside_map1 1 set peer 2.2.2.2
    crypto map outside_map1 1 set transform-set ESP-3DES-SHA
    crypto map outside_map1 interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
     authentication pre-share
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd address 192.168.2.30-192.168.2.155 inside
    dhcpd dns 24.93.41.125 24.93.41.126 interface inside
    dhcpd domain corporatesolutionsfw.local interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
     anyconnect-essentials
    group-policy DfltGrpPolicy attributes
    tunnel-group 2.2.2.2 type ipsec-l2l
    tunnel-group 2.2.2.2 ipsec-attributes
     pre-shared-key *****
    prompt hostname context
    call-home
     profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:021cf43a4211a99232849372c380dda2
    : end
    Site A sh crypto isakmp sa:
    Active SA: 1
        Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
    Total IKE SA: 1
    1   IKE Peer: 2.2.2.2
        Type    : L2L             Role    : responder
        Rekey   : no              State   : MM_ACTIVE
    Site A sh ipsec sa:
    Result of the command: "sh ipsec sa"
    interface: outside
        Crypto map tag: outside_map1, seq num: 1, local addr: 1.1.1.1
          access-list outside_1_cryptomap_1 extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
          local ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)
          remote ident (addr/mask/prot/port): (san_antonio_inside/255.255.255.0/0/0)
          current_peer: 2.2.2.2
          #pkts encaps: 1, #pkts encrypt: 1, #pkts digest: 1
          #pkts decaps: 239, #pkts decrypt: 239, #pkts verify: 239
          #pkts compressed: 0, #pkts decompressed: 0
          #pkts not compressed: 1, #pkts comp failed: 0, #pkts decomp failed: 0
          #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
          #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
          #send errors: 0, #recv errors: 0
          local crypto endpt.: 1.1.1.1, remote crypto endpt.: 71.40.110.179
          path mtu 1500, ipsec overhead 58, media mtu 1500
          current outbound spi: C1074C40
          current inbound spi : B21273A9
        inbound esp sas:
          spi: 0xB21273A9 (2987553705)
             transform: esp-3des esp-sha-hmac no compression
             in use settings ={L2L, Tunnel, }
             slot: 0, conn_id: 1691648, crypto-map: outside_map1
             sa timing: remaining key lifetime (kB/sec): (3914989/27694)
             IV size: 8 bytes
             replay detection support: Y
             Anti replay bitmap:
              0xFFFFFFFF 0xFFFFFFFF
        outbound esp sas:
          spi: 0xC1074C40 (3238480960)
             transform: esp-3des esp-sha-hmac no compression
             in use settings ={L2L, Tunnel, }
             slot: 0, conn_id: 1691648, crypto-map: outside_map1
             sa timing: remaining key lifetime (kB/sec): (3914999/27694)
             IV size: 8 bytes
             replay detection support: Y
             Anti replay bitmap:
              0x00000000 0x00000001
    Site B running config:
    Result of the command: "sh run"
    : Saved
    : Serial Number: JMX184640WY
    : Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz
    ASA Version 9.2(2)4
    hostname CSOLSAASA
    enable password WI19w3dXj6ANP8c6 encrypted
    xlate per-session deny tcp any4 any4
    xlate per-session deny tcp any4 any6
    xlate per-session deny tcp any6 any4
    xlate per-session deny tcp any6 any6
    xlate per-session deny udp any4 any4 eq domain
    xlate per-session deny udp any4 any6 eq domain
    xlate per-session deny udp any6 any4 eq domain
    xlate per-session deny udp any6 any6 eq domain
    names
    interface Ethernet0/0
     switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
     nameif inside
     security-level 100
     ip address 192.168.1.1 255.255.255.0
    interface Vlan2
     nameif outside
     security-level 0
     ip address 2.2.2.2 255.255.255.248
    ftp mode passive
    object network NETWORK_OBJ_192.168.1.0_24
     subnet 192.168.1.0 255.255.255.0
    object network mcallen_network
     subnet 192.168.2.0 255.255.255.0
    access-list outside_cryptomap extended permit ip object NETWORK_OBJ_192.168.1.0_24 object mcallen_network
    access-list outside_access_in extended permit ip object mcallen_network 192.168.1.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-731-101.bin
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,outside) source static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 destination static mcallen_network mcallen_network no-proxy-arp route-lookup
    nat (inside,outside) after-auto source dynamic any interface
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 2.2.2.2 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
    crypto ipsec ikev2 ipsec-proposal DES
     protocol esp encryption des
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
     protocol esp encryption 3des
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
     protocol esp encryption aes
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
     protocol esp encryption aes-192
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
     protocol esp encryption aes-256
     protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto map outside_map3 1 match address outside_cryptomap
    crypto map outside_map3 1 set peer 1.1.1.1
    crypto map outside_map3 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map3 interface outside
    crypto ca trustpool policy
    crypto ikev2 policy 1
     encryption aes-256
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 10
     encryption aes-192
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 20
     encryption aes
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 30
     encryption 3des
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 40
     encryption des
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 enable outside
    crypto ikev1 enable outside
    crypto ikev1 policy 120
     authentication pre-share
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    telnet timeout 5
    ssh stricthostkeycheck
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    dhcpd address 192.168.1.200-192.168.1.250 inside
    dhcpd dns 24.93.41.125 24.93.41.126 interface inside
    dhcpd domain CSOLSA.LOCAL interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
     anyconnect-essentials
    group-policy DfltGrpPolicy attributes
     vpn-tunnel-protocol ikev1
    tunnel-group 1.1.1.1 type ipsec-l2l
    tunnel-group 1.1.1.1 ipsec-attributes
     ikev1 pre-shared-key *****
    policy-map type inspect dns preset_dns_map
     parameters
      message-length maximum client auto
      message-length maximum 512
    prompt hostname context
    no call-home reporting anonymous
    call-home
     profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:4e058021a6e84ac7956dca0e5a143b8d
    : end
    Site B sh crypto isakmp sa:
    Result of the command: "sh crypto isakmp sa"
    IKEv1 SAs:
       Active SA: 1
        Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
    Total IKE SA: 1
    1   IKE Peer: 1.1.1.1
        Type    : L2L             Role    : initiator
        Rekey   : no              State   : MM_ACTIVE
    There are no IKEv2 SAs
    Site B sh ipsec sa:
    Result of the command: "sh ipsec sa"
    interface: outside
        Crypto map tag: outside_map3, seq num: 1, local addr: 71.40.110.179
          access-list outside_cryptomap extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
          local ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
          remote ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)
          current_peer: 1.1.1.1
          #pkts encaps: 286, #pkts encrypt: 286, #pkts digest: 286
          #pkts decaps: 1, #pkts decrypt: 1, #pkts verify: 1
          #pkts compressed: 0, #pkts decompressed: 0
          #pkts not compressed: 286, #pkts comp failed: 0, #pkts decomp failed: 0
          #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
          #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
          #TFC rcvd: 0, #TFC sent: 0
          #Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
          #send errors: 0, #recv errors: 0
          local crypto endpt.: 2.2.2.2/0, remote crypto endpt.: 1.1.1.1/0
          path mtu 1500, ipsec overhead 58(36), media mtu 1500
          PMTU time remaining (sec): 0, DF policy: copy-df
          ICMP error validation: disabled, TFC packets: disabled
          current outbound spi: B21273A9
          current inbound spi : C1074C40
        inbound esp sas:
          spi: 0xC1074C40 (3238480960)
             transform: esp-3des esp-sha-hmac no compression
             in use settings ={L2L, Tunnel, IKEv1, }
             slot: 0, conn_id: 28672, crypto-map: outside_map3
             sa timing: remaining key lifetime (kB/sec): (4373999/27456)
             IV size: 8 bytes
             replay detection support: Y
             Anti replay bitmap:
              0x00000000 0x00000003
        outbound esp sas:
          spi: 0xB21273A9 (2987553705)
             transform: esp-3des esp-sha-hmac no compression
             in use settings ={L2L, Tunnel, IKEv1, }
             slot: 0, conn_id: 28672, crypto-map: outside_map3
             sa timing: remaining key lifetime (kB/sec): (4373987/27456)
             IV size: 8 bytes
             replay detection support: Y
             Anti replay bitmap:
              0x00000000 0x00000001

    Hi Keegan,
    Your tunnel is up and encrypting traffic one way, the other end is not able to encrypt the traffic.
    I would suggest to do a 'clear xlate'?  Sometimes if you setup the nonat configuration after you've attempted other configurations, you need to 'clear xlate' before the previous NAT configuration is cleared and the new one works.
    HTH
    "Please rate useful posts"

  • Remote Access VPN connecting but not passing traffic

    I have a remote access VPN configured on a device here. I'm able to connect a device and it assigns me an IP address out of the pool, and injects the routes to its local network, but I'm not able to pass any traffic through the VPN and none of the IPSec SA counters increment for the dial-in connection. I've compared the config here to the samples from documentation and I don't know what I'm missing. Config is below.
    3118-FWL001(config)# sho run
    : Saved
    ASA Version 7.2(3)
    hostname 3118-FWL001
    domain-name rr-rentals.com
    enable password hEgvNHfNHV8zypPu encrypted
    names
    interface Vlan1
     nameif inside
     security-level 100
     ip address 192.168.10.1 255.255.255.0
    interface Vlan2
     nameif outside
     security-level 0
     ip address 199.X.X.162 255.255.255.248
    interface Ethernet0/0
     switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    passwd 2KFQnbNIdI.2KYOU encrypted
    banner exec
    banner exec
    banner exec
    banner exec Any attempted or unauthorized access, use, or modification is prohibited.
    banner exec Unauthorized users may face criminal and/or civil penalties.
    banner exec The use of this system may be monitored and recorded.
    banner exec If the monitoring reveals possible evidence of criminal activity, Adhost can
    banner exec provide the records to law enforcement.
    banner exec Be safe!  Do not share your access information with anyone!
    banner exec
    banner exec
    banner exec
    banner asdm
    banner asdm
    banner asdm
    banner asdm Any attempted or unauthorized access, use, or modification is prohibited.
    banner asdm Unauthorized users may face criminal and/or civil penalties.
    banner asdm The use of this system may be monitored and recorded.
    banner asdm If the monitoring reveals possible evidence of criminal activity, Adhost can
    banner asdm provide the records to law enforcement.
    banner asdm Be safe!  Do not share your access information with anyone!
    banner asdm
    banner asdm
    banner asdm
    ftp mode passive
    dns server-group DefaultDNS
     domain-name rr-rentals.com
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    access-list outside_acl extended permit ip any host 199.X.X.163
    access-list outside_acl extended permit icmp any any echo
    access-list outside_acl extended permit icmp any any echo-reply
    access-list outside_acl extended permit tcp 216.X.X.64 255.255.255.192 any
    access-list outside_acl extended permit tcp host 76.X.X.166 any eq 3389
    access-list outside_acl extended permit tcp 67.X.X.192 255.255.255.224 any eq 3389
    access-list outside_acl extended permit tcp any any eq ftp
    access-list outside_acl extended permit tcp any any eq ftp-data
    access-list outside_acl extended permit tcp host 72.X.X.71 any eq 3389
    access-list outside_acl extended permit tcp host 26.X.X.155 any eq 3389
    access-list outside_acl extended permit tcp host 24.X.X.155 any eq 3389
    access-list outside_acl extended permit icmp any any unreachable
    access-list outside_acl extended permit icmp any any time-exceeded
    access-list outside_acl extended permit tcp host 71.X.X.170 any eq 3389
    access-list outside_acl extended permit tcp host 24.X.X.200 any eq 3389
    access-list inside_nat0_outbound extended permit ip 192.168.10.0 255.255.255.0 192.168.1.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.10.0 255.255.255.0 192.168.2.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.10.0 255.255.255.0 192.168.4.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.10.0 255.255.255.0 192.168.3.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.10.0 255.255.255.0 192.168.20.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.20.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.20.0 255.255.255.0 192.168.1.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.20.0 255.255.255.0 192.168.10.0 255.255.255.0
    access-list outside_1_cryptomap extended permit ip 192.168.10.0 255.255.255.0 192.168.1.0 255.255.255.0
    access-list outside_1_cryptomap extended permit ip 192.168.20.0 255.255.255.0 192.168.1.0 255.255.255.0
    access-list outside_2_cryptomap extended permit ip 192.168.10.0 255.255.255.0 192.168.2.0 255.255.255.0
    access-list outside_4_cryptomap extended permit ip 192.168.10.0 255.255.255.0 192.168.4.0 255.255.255.0
    access-list outside_3_cryptomap extended permit ip 192.168.10.0 255.255.255.0 192.168.3.0 255.255.255.0
    access-list rr-vpn_splitTunnelAcl standard permit 192.168.10.0 255.255.255.0
    access-list rr-vpn_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0
    pager lines 24
    logging enable
    logging buffer-size 1048576
    logging buffered debugging
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool vpnpool 192.168.20.1-192.168.20.254 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-523.bin
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    static (inside,outside) 199.X.X.163 192.168.10.2 netmask 255.255.255.255
    access-group outside_acl in interface outside
    route outside 0.0.0.0 0.0.0.0 199.X.X.161 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout uauth 0:05:00 absolute
    aaa authentication ssh console LOCAL
    aaa authentication http console LOCAL
    aaa authentication enable console LOCAL
    aaa authentication serial console LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    http 216.X.X.64 255.255.255.192 outside
    http 0.0.0.0 0.0.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    sysopt connection tcpmss 1200
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map outside_dyn_map 20 set pfs
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer 50.X.X.58
    crypto map outside_map 1 set transform-set ESP-AES-128-SHA
    crypto map outside_map 2 match address outside_2_cryptomap
    crypto map outside_map 2 set pfs
    crypto map outside_map 2 set peer 75.X.X.253
    crypto map outside_map 2 set transform-set ESP-AES-128-SHA
    crypto map outside_map 3 match address outside_3_cryptomap
    crypto map outside_map 3 set pfs
    crypto map outside_map 3 set peer 173.X.X.69
    crypto map outside_map 3 set transform-set ESP-AES-128-SHA
    crypto map outside_map 4 match address outside_4_cryptomap
    crypto map outside_map 4 set pfs
    crypto map outside_map 4 set peer 70.X.X.194
    crypto map outside_map 4 set transform-set ESP-AES-128-SHA
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
     authentication pre-share
     encryption aes
     hash sha
     group 5
     lifetime 86400
    crypto isakmp policy 30
     authentication pre-share
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    telnet timeout 5
    ssh 192.168.10.2 255.255.255.255 inside
    ssh 192.168.0.0 255.255.0.0 inside
    ssh 216.X.X.64 255.255.255.192 outside
    ssh 50.X.X.58 255.255.255.255 outside
    ssh timeout 60
    ssh version 2
    console timeout 0
    management-access inside
    class-map inspection_default
     match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
     parameters
      message-length maximum 512
    policy-map global_policy
     class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect icmp
      inspect icmp error
    service-policy global_policy global
    tftp-server outside 216.X.X.116 3118-FWL001.config
    group-policy rr-vpn internal
    group-policy rr-vpn attributes
     dns-server value 216.X.X.12 66.X.X.11
     vpn-tunnel-protocol IPSec
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value rr-vpn_splitTunnelAcl
    username rrlee password B6rKS8LmKC50oIXK encrypted privilege 0
    username rrlee attributes
     vpn-group-policy rr-vpn
    username cschirado password QYICGrOFAZ9iPWpp encrypted privilege 0
    username cschirado attributes
     vpn-group-policy rr-vpn
    username daniel password SZsXZCSuVXcFn9NB encrypted privilege 15
    username adhostadm password 7P2Y2Ow1o0.VSjvh encrypted privilege 15
    username troy password amZKsxVU.8N9kKPb encrypted privilege 0
    username troy attributes
     vpn-group-policy rr-vpn
    username troyr password Hek9zbMrM6wEDSfi encrypted privilege 15
    username druiz password 33oau7XOcvhJ3DMv encrypted privilege 0
    username druiz attributes
     vpn-group-policy rr-vpn
    username theresa password qWsPnR.vfjXzlunC encrypted privilege 0
    username theresa attributes
     vpn-group-policy rr-vpn
    username kevin password R5DPfUVhzGCEg6pu encrypted privilege 0
    username kevin attributes
     vpn-group-policy rr-vpn
    username andrea password MyhIPdH6UJQDon77 encrypted privilege 0
    username andrea attributes
     vpn-group-policy rr-vpn
    tunnel-group 50.X.X.58 type ipsec-l2l
    tunnel-group 50.X.X.58 ipsec-attributes
     pre-shared-key *
    tunnel-group 75.X.X.253 type ipsec-l2l
    tunnel-group 75.X.X.253 ipsec-attributes
     pre-shared-key *
    tunnel-group 72.X.X.71 type ipsec-l2l
    tunnel-group 72.X.X.71 ipsec-attributes
     pre-shared-key *
    tunnel-group 173.X.X.69 type ipsec-l2l
    tunnel-group 173.X.X.69 ipsec-attributes
     pre-shared-key *
    tunnel-group rr-vpn type ipsec-ra
    tunnel-group rr-vpn general-attributes
     address-pool vpnpool
     default-group-policy rr-vpn
    tunnel-group rr-vpn ipsec-attributes
     pre-shared-key *
    tunnel-group 70.X.X.194 type ipsec-l2l
    tunnel-group 70.X.X.194 ipsec-attributes
     pre-shared-key *
    prompt hostname context

    Here are the results of the commands you requested. I'm not able to ping either direction.
    Thanks,
    James
    3118-FWL001# sho cry isa sa
       Active SA: 5
        Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
    Total IKE SA: 5
    1   IKE Peer: 50.34.254.58
        Type    : L2L             Role    : responder
        Rekey   : no              State   : MM_ACTIVE
    2   IKE Peer: 173.10.71.69
        Type    : L2L             Role    : responder
        Rekey   : no              State   : MM_ACTIVE
    3   IKE Peer: 75.151.109.253
        Type    : L2L             Role    : initiator
        Rekey   : no              State   : MM_ACTIVE
    4   IKE Peer: 70.99.88.194
        Type    : L2L             Role    : initiator
        Rekey   : no              State   : MM_ACTIVE
    5   IKE Peer: 216.211.143.85
        Type    : user            Role    : responder
        Rekey   : no              State   : AM_ACTIVE
    3118-FWL001# sho cry ips sa
    interface: outside
        Crypto map tag: outside_dyn_map, seq num: 20, local addr: 199.21.66.162
          local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
          remote ident (addr/mask/prot/port): (192.168.20.2/255.255.255.255/0/0)
          current_peer: 216.211.143.85, username: kevin
          dynamic allocated peer ip: 192.168.20.2
          #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
          #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
          #pkts compressed: 0, #pkts decompressed: 0
          #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
          #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
          #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
          #send errors: 0, #recv errors: 0
          local crypto endpt.: 199.21.66.162, remote crypto endpt.: 216.211.143.85
          path mtu 1500, ipsec overhead 58, media mtu 1500
          current outbound spi: CBF94621
        inbound esp sas:
          spi: 0x8D8279CA (2374138314)
             transform: esp-3des esp-sha-hmac none
             in use settings ={RA, Tunnel, }
             slot: 0, conn_id: 200, crypto-map: outside_dyn_map
             sa timing: remaining key lifetime (sec): 28715
             IV size: 8 bytes
             replay detection support: Y
        outbound esp sas:
          spi: 0xCBF94621 (3422111265)
             transform: esp-3des esp-sha-hmac none
             in use settings ={RA, Tunnel, }
             slot: 0, conn_id: 200, crypto-map: outside_dyn_map
             sa timing: remaining key lifetime (sec): 28715
             IV size: 8 bytes
             replay detection support: Y
        Crypto map tag: outside_map, seq num: 1, local addr: 199.21.66.162
          access-list outside_1_cryptomap permit ip 192.168.10.0 255.255.255.0 192.168.1.0 255.255.255.0
          local ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0)
          remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
          current_peer: 50.34.254.58
          #pkts encaps: 15356573, #pkts encrypt: 15356573, #pkts digest: 15356573
          #pkts decaps: 9021115, #pkts decrypt: 9021114, #pkts verify: 9021114
          #pkts compressed: 0, #pkts decompressed: 0
          #pkts not compressed: 15356573, #pkts comp failed: 0, #pkts decomp failed: 0
          #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
          #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
          #send errors: 0, #recv errors: 0
          local crypto endpt.: 199.21.66.162, remote crypto endpt.: 50.34.254.58
          path mtu 1500, ipsec overhead 74, media mtu 1500
          current outbound spi: FE16571B
        inbound esp sas:
          spi: 0x78BD7E4F (2025684559)
             transform: esp-aes esp-sha-hmac none
             in use settings ={L2L, Tunnel, PFS Group 2, }
             slot: 0, conn_id: 86, crypto-map: outside_map
             sa timing: remaining key lifetime (kB/sec): (4263158/5788)
             IV size: 16 bytes
             replay detection support: Y
        outbound esp sas:
          spi: 0xFE16571B (4262876955)
             transform: esp-aes esp-sha-hmac none
             in use settings ={L2L, Tunnel, PFS Group 2, }
             slot: 0, conn_id: 86, crypto-map: outside_map
             sa timing: remaining key lifetime (kB/sec): (4064653/5788)
             IV size: 16 bytes
             replay detection support: Y
        Crypto map tag: outside_map, seq num: 4, local addr: 199.21.66.162
          access-list outside_4_cryptomap permit ip 192.168.10.0 255.255.255.0 192.168.4.0 255.255.255.0
          local ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0)
          remote ident (addr/mask/prot/port): (192.168.4.0/255.255.255.0/0/0)
          current_peer: 70.99.88.194
          #pkts encaps: 491814, #pkts encrypt: 491814, #pkts digest: 491814
          #pkts decaps: 416810, #pkts decrypt: 416810, #pkts verify: 416810
          #pkts compressed: 0, #pkts decompressed: 0
          #pkts not compressed: 491814, #pkts comp failed: 0, #pkts decomp failed: 0
          #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
          #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
          #send errors: 0, #recv errors: 0
          local crypto endpt.: 199.21.66.162, remote crypto endpt.: 70.99.88.194
          path mtu 1500, ipsec overhead 74, media mtu 1500
          current outbound spi: 533F55E1
        inbound esp sas:
          spi: 0xE2F461AD (3807666605)
             transform: esp-aes esp-sha-hmac none
             in use settings ={L2L, Tunnel, PFS Group 2, }
             slot: 0, conn_id: 194, crypto-map: outside_map
             sa timing: remaining key lifetime (kB/sec): (4273818/27167)
             IV size: 16 bytes
             replay detection support: Y
        outbound esp sas:
          spi: 0x533F55E1 (1396659681)
             transform: esp-aes esp-sha-hmac none
             in use settings ={L2L, Tunnel, PFS Group 2, }
             slot: 0, conn_id: 194, crypto-map: outside_map
             sa timing: remaining key lifetime (kB/sec): (4266133/27167)
             IV size: 16 bytes
             replay detection support: Y
        Crypto map tag: outside_map, seq num: 2, local addr: 199.21.66.162
          access-list outside_2_cryptomap permit ip 192.168.10.0 255.255.255.0 192.168.2.0 255.255.255.0
          local ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0)
          remote ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)
          current_peer: 75.151.109.253
          #pkts encaps: 207718, #pkts encrypt: 207718, #pkts digest: 207718
          #pkts decaps: 142739, #pkts decrypt: 142739, #pkts verify: 142739
          #pkts compressed: 0, #pkts decompressed: 0
          #pkts not compressed: 207722, #pkts comp failed: 0, #pkts decomp failed: 0
          #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
          #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
          #send errors: 0, #recv errors: 0
          local crypto endpt.: 199.21.66.162, remote crypto endpt.: 75.151.109.253
          path mtu 1500, ipsec overhead 74, media mtu 1500
          current outbound spi: 8D74AC18
        inbound esp sas:
          spi: 0x0CF7F70B (217577227)
             transform: esp-aes esp-sha-hmac none
             in use settings ={L2L, Tunnel, PFS Group 2, }
             slot: 0, conn_id: 195, crypto-map: outside_map
             sa timing: remaining key lifetime (kB/sec): (4274490/23242)
             IV size: 16 bytes
             replay detection support: Y
        outbound esp sas:
          spi: 0x8D74AC18 (2373233688)
             transform: esp-aes esp-sha-hmac none
             in use settings ={L2L, Tunnel, PFS Group 2, }
             slot: 0, conn_id: 195, crypto-map: outside_map
             sa timing: remaining key lifetime (kB/sec): (4270718/23242)
             IV size: 16 bytes
             replay detection support: Y
        Crypto map tag: outside_map, seq num: 3, local addr: 199.21.66.162
          access-list outside_3_cryptomap permit ip 192.168.10.0 255.255.255.0 192.168.3.0 255.255.255.0
          local ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0)
          remote ident (addr/mask/prot/port): (192.168.3.0/255.255.255.0/0/0)
          current_peer: 173.10.71.69
          #pkts encaps: 3427935, #pkts encrypt: 3427935, #pkts digest: 3427935
          #pkts decaps: 2006044, #pkts decrypt: 2006044, #pkts verify: 2006044
          #pkts compressed: 0, #pkts decompressed: 0
          #pkts not compressed: 3427935, #pkts comp failed: 0, #pkts decomp failed: 0
          #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
          #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
          #send errors: 0, #recv errors: 0
          local crypto endpt.: 199.21.66.162, remote crypto endpt.: 173.10.71.69
          path mtu 1500, ipsec overhead 74, media mtu 1500
          current outbound spi: 2E8A6147
        inbound esp sas:
          spi: 0x467968AB (1182361771)
             transform: esp-aes esp-sha-hmac none
             in use settings ={L2L, Tunnel, PFS Group 2, }
             slot: 0, conn_id: 154, crypto-map: outside_map
             sa timing: remaining key lifetime (kB/sec): (4270213/18597)
             IV size: 16 bytes
             replay detection support: Y
        outbound esp sas:
          spi: 0x2E8A6147 (780820807)
             transform: esp-aes esp-sha-hmac none
             in use settings ={L2L, Tunnel, PFS Group 2, }
             slot: 0, conn_id: 154, crypto-map: outside_map
             sa timing: remaining key lifetime (kB/sec): (4162093/18597)
             IV size: 16 bytes
             replay detection support: Y
    3118-FWL001# sho run route
    route outside 0.0.0.0 0.0.0.0 199.21.66.161 1

  • Cisco ASA & Router Site to Site VPN up but not passing traffic

    Dear all,
    Please help me the attached document vpn issue, site-to-site vpn is up but I am not able to passing traffic.
    Advance Thanks
    ahossain

    ASA#
    ASA Version 8.2(1)
    hostname Active
    domain-name test.com
    interface Ethernet0/0
    description LAN/STATE Failover Interface
    interface Ethernet0/1
    speed 100
    nameif outside
    security-level 0
    ip address 212.71.53.38 255.255.255.224 standby 212.71.53.37
    interface Ethernet0/2
    nameif DMZ
    security-level 50
    ip address 192.168.50.1 255.255.255.0 standby 192.168.50.4
    interface Ethernet0/3
    description INSIDE
    speed 100
    nameif inside
    security-level 100
    ip address 10.1.1.1 255.255.255.0 standby 10.1.1.2
    interface Management0/0
    shutdown
    no nameif
    no security-level
    no ip address
    boot system disk0:/asa821-k8.bin
    boot config disk0:/running-config
    ftp mode passive
    dns server-group DefaultDNS
    domain-name test.com
    access-list deny-flow-max 1
    access-list alert-interval 2
    access-list allow extended permit ip any any
    access-list VPN extended permit ip any any
    access-list OUTSIDE extended permit ip any any
    access-list al-outside extended permit ip any host 212.107.106.129
    access-list al-outside extended permit ip any any
    access-list encrypt_acl extended permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0
    access-list outside_access_in extended permit ip any any
    access-list inside_access_out extended permit ip any any
    access-list DMZ_access_out extended permit ip any any
    access-list inside_access_in extended permit ip any any
    access-list DMZ_access_in extended permit ip any any
    access-list outside_access_in_1 extended permit ip any any
    access-list no-nat extended permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0
    pager lines 24
    mtu outside 1500
    mtu DMZ 1500
    mtu inside 1500
    failover
    failover lan unit primary
    failover lan interface failover Ethernet0/0
    failover key *****
    failover link failover Ethernet0/0
    failover interface ip failover 10.10.10.1 255.255.255.252 standby 10.10.10.2
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any outside
    icmp permit any DMZ
    icmp permit any inside
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    access-group outside_access_in_1 in interface outside
    route outside 0.0.0.0 0.0.0.0 212.71.53.36 1
    route outside 10.2.2.0 255.255.255.0 212.71.53.36 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication http console LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http 0.0.0.0 0.0.0.0 outside
    no snmp-server location
    no snmp-server contact
    service resetoutside
    crypto ipsec transform-set mal esp-3des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map mal 10 set peer 212.107.106.129
    crypto map IPSec_map 10 match address encrypt_acl
    crypto map IPSec_map 10 set peer 212.107.106.129
    crypto map IPSec_map 10 set transform-set mal
    crypto map IPSec_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 86400
    telnet 0.0.0.0 0.0.0.0 outside
    crypto isakmp policy 10
    encr 3des
    hash md5
    authentication pre-share
    group 2
    crypto isakmp key XXXXXX address 212.71.53.38
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec transform-set mal esp-3des esp-md5-hmac
    crypto map mal 10 ipsec-isakmp
    set peer 212.71.53.38
    set transform-set mal
    match address 120
    interface Loopback0
    ip address 10.3.3.1 255.255.255.0
    ip virtual-reassembly in
    interface Embedded-Service-Engine0/0
    no ip address
    shutdown
    interface GigabitEthernet0/0
    ip address 172.20.34.54 255.255.255.252
    ip nat outside
    ip virtual-reassembly in
    load-interval 30
    duplex auto
    speed auto
    crypto map mal
    interface GigabitEthernet0/1
    ip address 212.107.106.129 255.255.255.248
    ip nat outside
    ip virtual-reassembly in
    no ip route-cache
    duplex auto
    speed auto
    crypto map mal
    interface GigabitEthernet0/2
    description *!* LAN *!*
    ip address 10.2.2.1 255.255.255.0
    ip nat inside
    ip virtual-reassembly in
    duplex auto
    speed auto
    ip forward-protocol nd
    ip http server
    ip http secure-server
    ip nat pool OUTPOOL 212.107.106.132 212.107.106.132 netmask 255.255.255.248
    ip nat inside source route-map nonat pool OUTPOOL overload
    ip route 0.0.0.0 0.0.0.0 172.20.34.53
    ip route 10.1.1.0 255.255.255.0 212.107.106.130
    ip route 192.168.50.0 255.255.255.0 212.71.53.38
    ip access-list extended outside
    remark CCP_ACL Category=1
    permit ip any any log
    ip access-list extended outside1
    remark CCP_ACL Category=1
    permit ip any any log
    access-list 110 permit tcp 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255
    access-list 120 permit ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255
    access-list 130 deny   ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255
    access-list 130 deny   ip 10.2.2.0 0.0.0.255 192.168.50.0 0.0.0.255
    access-list 130 permit ip 10.2.2.0 0.0.0.255 any
    route-map nonat permit 10
    match ip address 130
    control-plane
    ASA Version 8.2(1)
    hostname Active
    domain-name test.com
    interface Ethernet0/0
    description LAN/STATE Failover Interface
    interface Ethernet0/1
    speed 100
    nameif outside
    security-level 0
    ip address 212.71.53.38 255.255.255.224 standby 212.71.53.37
    interface Ethernet0/2
    nameif DMZ
    security-level 50
    ip address 192.168.50.1 255.255.255.0 standby 192.168.50.4
    interface Ethernet0/3
    description INSIDE
    speed 100
    nameif inside
    security-level 100
    ip address 10.1.1.1 255.255.255.0 standby 10.1.1.2
    interface Management0/0
    shutdown
    no nameif
    no security-level
    no ip address
    boot system disk0:/asa821-k8.bin
    boot config disk0:/running-config
    ftp mode passive
    dns server-group DefaultDNS
    domain-name test.com
    access-list deny-flow-max 1
    access-list alert-interval 2
    access-list allow extended permit ip any any
    access-list VPN extended permit ip any any
    access-list OUTSIDE extended permit ip any any
    access-list al-outside extended permit ip any host 212.107.106.129
    access-list al-outside extended permit ip any any
    access-list encrypt_acl extended permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0
    access-list outside_access_in extended permit ip any any
    access-list inside_access_out extended permit ip any any
    access-list DMZ_access_out extended permit ip any any
    access-list inside_access_in extended permit ip any any
    access-list DMZ_access_in extended permit ip any any
    access-list outside_access_in_1 extended permit ip any any
    access-list no-nat extended permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0
    pager lines 24
    mtu outside 1500
    mtu DMZ 1500
    mtu inside 1500
    failover
    failover lan unit primary
    failover lan interface failover Ethernet0/0
    failover key *****
    failover link failover Ethernet0/0
    failover interface ip failover 10.10.10.1 255.255.255.252 standby 10.10.10.2
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any outside
    icmp permit any DMZ
    icmp permit any inside
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    access-group outside_access_in_1 in interface outside
    route outside 0.0.0.0 0.0.0.0 212.71.53.36 1
    route outside 10.2.2.0 255.255.255.0 212.71.53.36 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication http console LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http 0.0.0.0 0.0.0.0 outside
    no snmp-server location
    no snmp-server contact
    service resetoutside
    crypto ipsec transform-set mal esp-3des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map mal 10 set peer 212.107.106.129
    crypto map IPSec_map 10 match address encrypt_acl
    crypto map IPSec_map 10 set peer 212.107.106.129
    crypto map IPSec_map 10 set transform-set mal
    crypto map IPSec_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 86400
    telnet 0.0.0.0 0.0.0.0 outside
    ==================================================================
    Remote-Router#
    crypto isakmp policy 10
    encr 3des
    hash md5
    authentication pre-share
    group 2
    crypto isakmp key XXXXXX address 212.71.53.38
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec transform-set mal esp-3des esp-md5-hmac
    crypto map mal 10 ipsec-isakmp
    set peer 212.71.53.38
    set transform-set mal
    match address 120
    interface Loopback0
    ip address 10.3.3.1 255.255.255.0
    ip virtual-reassembly in
    interface Embedded-Service-Engine0/0
    no ip address
    shutdown
    interface GigabitEthernet0/0
    ip address 172.20.34.54 255.255.255.252
    ip nat outside
    ip virtual-reassembly in
    load-interval 30
    duplex auto
    speed auto
    crypto map mal
    interface GigabitEthernet0/1
    ip address 212.107.106.129 255.255.255.248
    ip nat outside
    ip virtual-reassembly in
    no ip route-cache
    duplex auto
    speed auto
    crypto map mal
    interface GigabitEthernet0/2
    description *!* LAN *!*
    ip address 10.2.2.1 255.255.255.0
    ip nat inside
    ip virtual-reassembly in
    duplex auto
    speed auto
    ip forward-protocol nd
    ip http server
    ip http secure-server
    ip nat pool OUTPOOL 212.107.106.132 212.107.106.132 netmask 255.255.255.248
    ip nat inside source route-map nonat pool OUTPOOL overload
    ip route 0.0.0.0 0.0.0.0 172.20.34.53
    ip route 10.1.1.0 255.255.255.0 212.107.106.130
    ip route 192.168.50.0 255.255.255.0 212.71.53.38
    ip access-list extended outside
    remark CCP_ACL Category=1
    permit ip any any log
    ip access-list extended outside1
    remark CCP_ACL Category=1
    permit ip any any log
    access-list 110 permit tcp 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255
    access-list 120 permit ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255
    access-list 130 deny   ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255
    access-list 130 deny   ip 10.2.2.0 0.0.0.255 192.168.50.0 0.0.0.255
    access-list 130 permit ip 10.2.2.0 0.0.0.255 any
    route-map nonat permit 10
    match ip address 130
    control-plane

  • 3230 Mobile Access Router not Passing Traffic across WMICs

    I'm unable to pass traffic across the WMICs. I've assigned the BVIs ip addresses in the same subnet and I'm seeing the devices associated. I attached the configurations.
    Thanks,

    A ruggedized router in a flexible and compact design, ideally suited to create mobile networks in and around vehicles.
    Here is the URL for the furthere information for grounding in the vehicales and description :
    http://www.cisco.com/en/US/prod/collateral/routers/ps272/prod_presentation0900aecd802948c0.pdf
    http://www.cisco.com/en/US/products/hw/routers/ps272/ps4375/index.html

  • Airplay is not working , remote does not find library all of a sudden

    I am having atypical problem.  Sometime in the afternoon all of a sudden my Airplay connection from iMac hard disk to Airport Express is not working or is stopped and then started and then stopped.  So in other words not stable. As far as the Apple expert trained service guy is telling me all wifi components are installed ok. meaning Aiprot Extreme as router and 3 airport express n-verisons ( latest models ) . Still it is not working properly.
    What i see is that the Wifi conection on the iMac is sometimes not working in particllur hours of the afternoon .  It goes of and has to be restarted by hand ( does not reconnect automatically. ).
    I hope somebody has some clues what could be the problem why my airplay is not stable...  ?

    how many batteries do you have and if you hve more than one it does it with both batteries? If you only have one battry that battery made be bad, batteries are fairly inexxpensive I would buy another battery first.Those cameras are selling for $200 new now with just a quick search. Anyway Id try another battery.

  • FF will not run Amazon all of the sudden

    FF will not run Amazon Just started all of the sudden IE will run Amazon

    Reload web page(s) and bypass the cache.
    * Press and hold Shift and left-click the Reload button.
    * Press "Ctrl + F5" or press "Ctrl + Shift + R" (Windows,Linux)
    * Press "Cmd + Shift + R" (MAC)
    Clear the cache and the cookies from sites that cause problems.
    "Clear the Cache":
    * Tools > Options > Advanced > Network > Offline Storage (Cache): "Clear Now"
    "Remove Cookies" from sites causing problems:
    * Tools > Options > Privacy > Cookies: "Show Cookies"
    Start Firefox in <u>[[Safe Mode]]</u> to check if one of the extensions is causing the problem (switch to the DEFAULT theme: Firefox (Tools) > Add-ons > Appearance/Themes).
    *Don't make any changes on the Safe mode start window.
    *https://support.mozilla.com/kb/Safe+Mode

  • International texts not going through all of a sudden - ATT, Iphone4

    Hello,
    Long story short - I have one contact that I text regularly in Shanghai, China (I'm in the USA). I have an international texting plan on my AT&T account that gives me a better price. I have been texting her for almost 3 months without problem. Well, I recently went to visit her in Shanghai,and since I have returned from China, she no longer receives any of my texts. I get texts from her just fine, and when I send them to her, they don't bounce back and I get no error messages. So on my end everything looks like it went through. I had her verify that she can get texts from others in the US and there is no problems there. It is just from me that they don't show up on her end. I spent over an hour on the phone with AT&T today and basically got nowhere. They have identified no problems as of yet and just had me reset my network settings. I was told to call back tomorrow if if didn't work. Well it didn't. They asked me several times if the phone was dropped, exposed to water, etc...Nothing physically has caused any phone damage. I can receive texts from her internationally, and all of my domestic texts come and go through just fine. I'm guessing something got squirlly after I returned to the US somehow. The phone obviously recognized where I was because I couldn't access several features without turning data roaming on, which I never did. I changed no setings at all while I was gone. They also suggested it my be version 6.0, but again, this was installed well before my trip and there were no issues after installitation. The problems didn't start until I returned to the states. Any ideas? I appreciate and advice you may have.
    Jay

        I know the importance of ensuring your device and service is working properly kthompson91. To clarify, are you getting restricted when anyone calls you or just one specific number? What make and model phone do you have? Are you also having issues with not getting text messages from a certain number?
    Thank You,
    MichelleL_VZW
    VZW Support
    Follow us on Twitter @VZWSUPPORT

  • Signature images not staying centered all of a sudden

    Leopard, Mail.
    We have 3 signatures, two with images in them (just dragged in from image files on the machine).
    I do not know how the first signature was created (most likely a remnant from Tiger Mail), but it looks fine, the included image centers with the text without issue. However, when I create a new signature, type in the text, place an image, select all and center align, it looks great, UNTIL I click out of it and then click back in this particular signature, and then the text is still centered, but the image is back to being left aligned.
    I've create 3 new test signatures and it does this every single time. I then tested this on 3 other Leopard machines (including my own, 50 miles away) and it does the same thing.
    Bug? So strange. Text remains centered, images revert to left aligned after clicking out and clicking back in the signature in question.
    Thank you for any help, or if you see this also.

    I've tested this on 4 other Leopard machines, and the same thing is happening (different offices).
    Could someone please confirm this for me? Strange that no one else has seen this "bug"...
    Thank you very much.

  • Wifi will not turn on all of a sudden in my S4.

    Started on 6/30/14.  The wifi icon, will turn a dull green when touched for about 15 seconds, then it goes back to grey and won't scan or turn-on.  It was working just fine the night before.  On 7/1/14, it worked briefly (for about an hour), then it stopped and hasn't worked since.  I did not updates, app downloads, etc recently.

        Thank you for reaching back out to us, columbine8. If your phone is still experiencing these issues even through Safe Mode, it sounds like something may have changed with the software. If it was done by a possible OS update or app update, safe mode will not override it. A factory reset will. I would recommend that step only after you have backed up all your important content. Please keep us updated.
    NicandroN_VZW
    Follow us on twitter@VZWSupport

  • Keyboard / Mouse not working correctly all of a sudden

    I spilt a little of my drink on my keyboard, but I dried it up with a towel immediately and it seemed fine. I probably was pressing multiple buttons while I was drying it off though. After I got done, the keyboard and mouse are not working right. I can only type my password into the OSX logon screen, then I can't type anything anywhere. When I left click with my mouse, it opens a dialog box instead of clicking (unless I'm clicking on a menu).
    What should I do to get it working right again?
    Thanks

    Also, when I open Word and could type in it one time, it just showed boxes even though I was using times new roman.

Maybe you are looking for

  • Change Sales Order category to custom category in CIF

    Hi, I am CIFing Sales Order from ECC to APO, as per my requirement I need to change the category of sales order for which their are no confirmation. The Sales order get CIFed to APO in standard category BM and i want to change to custom category ZM I

  • Role and Profile Distribution

    Hello! I want to distribute defined roles to another system. For now i realize that about the transportation management. I configured an central user administration. Is it possible to disitribute roles with all data (authorization, menus, ...) automa

  • Une erreur indéterminée s'est produite

    Bonjour, je travaille quotidiennement sur Illustrator CC 2014 sur MAC PRO avec OSX 10.7.5 (équipé de 10 Go RAM). Lors de l'enregistrement, j'ai ce message qui apparaît de façon aléatoire : "une erreur indéterminée s'est produite". C'est vraiment très

  • Trouble with Adobe Application Manager

    I'm getting the above error whenever I try to update any adobe applications.  It claims I have more than one iteration of it open, but my dock claims I only am trying o open the one instance.  Help.  (I'm running cc on a windows 7 laptop.)

  • How to archive a project with files

    Ok the job is done and now i would like to move the project with files from my laptop to a backup hard disk. I saw that in project manager there is a tool to do that, but what if i already have the video files already copied to the external drive and