Two ASA tunnels, only some remote peers are reachable

Hi, very strange issue here ...
Brief overview ..... I have one ASA with two tunnels. Each going to a different 3rd party Checkpoint firewall (site A, site B)
Each site has two servers (A1, A2, B1, B2)
I can only connect to A1 and B1. any connection to A2 and B2 fails.
I have defined B2 and A2 in the crypto map to be protected.
If I only have B2 or A2 in the crypto map ACL then the tunnel fails. Phase 1 does not come up. Its as if the ASA is ignoring the entries for B2 and A2.
ASA running 8.4(2).
I have also trashed the VPN and built via the wizard, same result.
Any thoughts greatly appreciated.
Regards
Paul

Hi,
To my understanding the Phase1 should not be affected by the configurations you set in the Phase2 ACL defining interesting traffic.
Though it would naturally mean that your VPN negotiation would still fail.
It would seem to me that if the secondary A2 and B2 addresses dont work along with the A1 and B1 or even alone by themselves that the remote ends would have been configured incorrectly. Though it would seem wierd if this happens on 2 different connections. Unless ofcourse the same person handled the remote end configurations?
If you want we could certainly check your ASAs configurations for any problems after which you could ask the remote site management to go through the configurations.
You have also the ability to use the "packet-tracer" command to define what is happening.
The format is this
packet-tracer input tcp
Just modify the above to suite your situation. The is the ASA interface behind which your connecting host is. (Dont use ASA interface IP addresses as the source)
Can you take the above command output when you are trying to connect to A2 and B2 hosts. Please take the command output twice from each and then copy/paste the second commands output here on the forums. Why I ask you to take the output twice is because you would need the first command just to bring up the L2L VPN connection and it coudlnt go through completely. The second command output should on the other hand succeed if configurations are correct. If it doesnt go through then the problem is probably configurations between the local and remote site.
You can also use the command "show crypto ipsec sa peer " to see if the both devices of the L2L VPN Connection have been able to form the connection.
- Jouni

Similar Messages

  • T550 only some FN keys are working

    Is there an area to manage FN keys on the newer T series laptops?  I noticed when I got it that I could not use the hotkeys that are for F9 through F12 and that was not too big of a deal as they are search and such but I was checking the turn off wireless key (f8) and it does not seem to work.  For my work I often have to turn off the wireless as I program alot of ethernet based devices.  I also just installed windows 10 and I can't remember if it worked before on windows 8 was on or if it just stopped working (I just got this laptop a week or so ago).  If I could manage them myself that would be great!  Any help is apreciated.  Maybe a driver is wrong?

    Obviously this registry cleaner has sterilized the registry and you lose some functions. Try to fix this reinstalling Toshiba tools and utilities. As R2D2 wrote start with Toshiba common modules. It must be installed at first.
    Bye and good luck!

  • HT1338 HI i mail app does no more work, only some Icloud 'me' are visible and not even all of them show up. How can I solve this?? thanks!

    Hi I cannot anymore use the mail application. It does no more laod my mails and wont send new ones. Next to my inbox I get a   !   sign
    thanks for your help

    What version of OS X and Mail are you running?

  • My iTunes library is gone on my iPhone and only some purchase iTunes are able to be played?

    I am getting an error message when I try to play on some songs that I purchased. Some of my iTunes play whole other have a red biz next to the song. Also my whole iTunes library is now gone?

    connect to itunes let it sync
    once its finished go to itunes library and fing the eye supervillan song and clck on it and click delete on keyboard. then click keep file. then snyc your device again. check your iphone after snyc and click music and see if you find the song again

  • Only some iTunes movies are seen by iMovie

    I have around 60 video clips in my iTunes library, yet only 4 show up in iMovie '08 under "iPhoto Videos". Every clip in my library was shot with the same camera, using the same settings, same codec.
    This is a fresh Leopard install with iMovie '08.

    I'm not sure I understand, what makes you think itunes content should show up in iphoto videos.

  • Diapresentation: some photo's are not there

    I use Iphoto 7.1.5. I have a problem with the "diavoorstelling"/ slideshow. Some photo's are not displayed. I checked them but I donot see any difference between the photos that are displayed during the slideshow and the photos that are not. All photos are in the same map and have the same characteristics.
    I tried to rebuild , using alt+ cmd , but it doesnot help: als photos are in Iphoto, but only some of them are used in a slideshow of an album that i chosse.
    Is it possible that the use of PICASA gives these problems?

    When I try to add photos from PhotoStream into my iPhoto Library a message appears asking to view the photo in the library (as if it were already imported).
    How exacly are you trying to import from the Photo Stream? Dragging from the stream to the events? Ctrl-clicking or right clicking?
    If "Show in Library" does not show the event, then your iPhoto Library may need repairing or rebuilding;  try to run the iPhoto Library First Aid Tools, if you have not already done so. See this post by Old Toad on how to do it:    Rebuild iPhoto Library Version 11:
    Regards
    Léonie

  • On Importing raw images to Lightroom  only some of the images will import.

    I have used LightRoom for years and just started having this issue.  I select all of my raw images and "Open with" LightRoom 5. I can view all of the images that I want to import. It then imports only some. There are times it will import some and then freezes up in Import mode. I have even converted  images to dng and found it to do the same thing.  As a professional photographer this is frustrating!

    If you mean "Open With" in your operating system, I am surprised that you get any images to import this way. As far as I know, Adobe has (tried to) disable this as a method of importing photos, and so I doubt you will find any help here in this forum on this matter, as this is not a function of Lightroom (although you used to be able to do it in earlier versions).

  • Anyone help?  The photos on my iphone do not all upload automatically to my pc, only some of them.

    Anyone help?  The photos on my iphone do not all upload automatically to my pc, only some of them.

    Are they all Camera Roll pics?
    Only Camera Roll pics can be imported.

  • Why two remote keys are genrated in data manager when i'm syndicating the same records twice

    Hi Experts,
    Please guide me that will there be any problem if two remot keys are getting generated for the same system thougt we are expecting to update the same Business Partner Number in ECC.
    Also We are able to see two different business partner number(in ECC this is KUNNR in KNA1)
    Please guide me how to proceed so that when we syndicate the same set of records we want to get update the records in ECC for the same KUNNR.
    We don't want to get another KUNNR for the same records.
    Thanks!
    Pankaj

    "barbara" wrote in message
    news:506500000008000000FAC20000-1077587809000@exch​ange.ni.com...
    > I'm using the simulation interface toolkit V2.0 but it works only the
    > first time after the installation. When I restart again my computer it
    > doesn't work any more. Why??????????
    >
    ---snip
    I am not familiar with the different software that you mentioned but as a
    first step I would check compatibility which is done as below:
    Get original operating system CD that was used to install Windows XP on the
    machine in your post. When Windows XP is inserted into CD ROM drive it
    normally will ask you to conduct compatibility check for the current
    installation. See what it says.
    HTH
    Mohan Pawar
    ----snip

  • Two separate L2L tunnels between same two ASA

    I have a large MPLS fully meshed network with two main locations, both of which have an ASA with internet access as well as the MPLS access.  I need to be able to provide a backup connection between the two main locations in the event one of the MPLS links to one or the other goes down.
    I am considering using a L2L IPSEC tunnel between the two ASA's but the interesting traffic for the tunnel is different depending on which of the links is down and there fore I would need two different tunnels.  I have my servers and remote desktop servers at one of the main sites and the other main site has another organization attached to it externally that the servers must be able to access.
    Is there a way of creating two separate L2L tunnels between the two ASA's?  Could I perhaps assign two public IP addresses to each of the ASA's and then create the tunnels between different endpoints on each ASA?
    Does anyone have another possible solution to the problem? 
    Gene

    You should be able to do what you want using IP SLA. Please see this excellent blog post which documents one way to accomplish it.
    Hope this helps.

  • "Device Manager is running in read-only mode because you are running it on a remote computer" when local

    Hello - since configuring a Windows Web Server 2008 R2 x64 to be hardened for an internet-facing deployment I receive this:
    "Device Manager is running in read-only mode because you are running it on a remote computer."
    when entering Device Manager.
    I have tried reversing the changes I have made, such as:
    - Re-adding Client for Microsoft Networks
    - Re-enabling NetBIOS over TCP-IP
    - Re-adding File and Printer Sharing
    - Disabling the Windows Firewall in all profiles (public, domain, private)
    I get no joy. It looks like a Microsoft ballsup. I'll try and use Process Monitor to have a look. Google returns only 1 page for this error.
    Luke

    Got it.
    After my changes to DHCP and static IPs the machine picked up the IP address of another server on my little home LAN. The hostname in IPCONFIG was different to the actual server computer name and so this led Device Manager to think the connection and the
    local machine were different.
    What an odd and infuriating problem. My thoughts on this are that Microsoft should be more verbose with error messages and their causes. For example, displaying the values of the assertion would help diagnose a problem; "The host-name www02.farm.brand.com
    that you are connecting from does not match the local host-name rest01.dev.farm.brand.com. Connections from remote computers can only use Device Manager in read-only mode; some options will be disabled."
    When troubleshooting, the main thing on an engineer's mind is "what has led Windows to its [unexpected] conclusion?"
    Luke

  • Vi server enable remote control of only some controls

    Hi guys,
    Does anyone know of a way to allow control of only some front panel controls when using the web publishing tool? I have some controls that I do not want used remotely (it could be unsafe) and some that I would like to use remotely.
    Thanks!
    Christopher
    Solved!
    Go to Solution.

    That's odd. Just to verify, open the properties by right clicking a fron panel element and selecting Properties (se Menu.jpg).
    Then, you will get you to the element's Properties window (see Properties window.jpg). The window title can vary depending on the element.
    Finally, scoll to the Security tab at the right end of the window (see Security.jpg).
    On another page: what LabVIEW version are you using? Maybe I can find why you don't have the option with that information.
    Camilo V.
    Applications Engineer
    National Instruments
    www.ni.com/support
    Attachments:
    Menu.jpg ‏29 KB
    Properties window.jpg ‏36 KB
    Security.jpg ‏38 KB

  • Why is it when i update my status on facebook from iohone it splits the updates into two differents boxes with some funky symbol. I have uninstall facebook and installed it over and it still does it. only the facebook IPHONE app.

    why is it when i update my status on facebook from iphone it splits the updates into two differents boxes with some funky symbols at the beginning.. I have uninstall facebook and installed it over and it still does it. only the facebook IPHONE app where it says to update staus text to FBOOK  i have already update my phone too.
    if i go on the facebook site and update there through a brower on iphone it will work fine just cant us IPHONE mobile upload,  . But its a pain of not using my IPHONE APP for facebook cause it does that.

    The warranty entitles you to complimentary phone support for the first 90 days of ownership.

  • Birthday calendar for only some of my contacts are showing up twice in my iPhone. They are not showing up twice tho on my iMac. No, I do not have duplicate names in my address book either. Any idea how to fix that?

    my birthday events for only some of my contacts are showing up twice in my iPhone. They are not showing up twice tho on my iMac. No, I do not have duplicate names in my address book either. Any idea how to fix that?

    I have uploaded the InDesign file so that you can take a closer look at:
    http://www.hsdesign.comuf.com/downloads/
    The file is called "Template_File.indd"
    So, as discussed the main issues are:
    1) The TOC doesn't generate all the listings (only those with the applied paragraph style "Heading 1 - Appendix")
    2) When I try to create a new pargraph style and apply it to existing or new text, it reads the pargraph style in the Paragraph Style menu, but the style doesn't actually apply.
    Hopefully you can figure something out from this. I really appreciate your help.
    Thanks!

  • HT201077 I am a new iphone 5 user and set it up to use icloud to store pictures, etc. I set up my home computer afterwards, but only some pictures are on the icloud. How do I view the rest of my pictures on my  home computer? Where are they stored?

    Only some of my pictures are on iCloud that are currently stored on my phone. Where are the others? Why aren't all the pictures from my iPhone showing in the iCloud? I can't find the pictures I saved from my ipodtouch, either....

    Only some of my pictures are on iCloud that are currently stored on my phone. Where are the others? Why aren't all the pictures from my iPhone showing in the iCloud? I can't find the pictures I saved from my ipodtouch, either....

Maybe you are looking for