debug asa packet output

by: _jesper_Posted on 2009-03-03 at 09:03:00ID: 23785738

When you look at the crypto connections, what do you see? Run these commands using CLI:

sh crypto isakmp sa
-> show SAs between two peers

sh crypto ipsec sa
-> show IPsec SAs built between peers

sh crypto engine connection active
-> show each phase 2 SA built

Setup debug and have the client attempt a connect. Immediately after the attempt, turn debug off:

debug crypto isakmp
debug crypto ipsec
debug crypt engine

Turn it off -> no debug all

by: brucehunterPosted on 2009-03-03 at 09:25:30ID: 23785994

Thanks for you answer

My VPN is working fine because I can connect to certain subnets on the other side. Its just that i cant connect to one subnet even though ive allowed it in the ACL. I was looking for a debug that i can run to show packets leaving the outside interface so i can eliminate the ASA as the source of the problem

by: _jesper_Posted on 2009-03-03 at 09:52:23ID: 23786253

If the VPN is working, then check both ACLs - they should be an exact inverse match.

Looking at the SA information may help.

by: DonbooPosted on 2009-03-03 at 10:32:13ID: 23786705

If you can see that the counter on the macth access-list increases then you hit the VPN tunnel and show crypto ipsec sa should give you the number of encrypted packets indicating the you send packets out of the interface. If you are right then the decrypted packets should be 0.

Crypto map tag: ipsec, seq num: 30, local addr: x.x.x.z (your end point)
 
      access-list ipsec-start permit ip host x.x.x.x(local end) host y.y.y.y (remote end) 
      local ident (addr/mask/prot/port): (x.x.x.x/255.255.255.255/0/0)
      remote ident (addr/mask/prot/port): (y.y.y.y/255.255.255.255/0/0)
      current_peer: z.z.z.z (Their end point)
 
      #pkts encaps: 6108, #pkts encrypt: 6108, #pkts digest: 6108 (Indicates your transmitted packets)
      #pkts decaps: 6755, #pkts decrypt: 6755, #pkts verify: 6755 (Indicates your Recieved packets)
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 6108, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0
 
      local crypto endpt.: w.w.w.w, remote crypto endpt.: z.z.z.z
 
      path mtu 1450, ipsec overhead 58, media mtu 1500
      current outbound spi: E989A772
 
    inbound esp sas:
      spi: 0x4CB24116 (1286750486)
         transform: esp-3des esp-sha-hmac none 
         in use settings ={L2L, Tunnel, }
         slot: 0, conn_id: 7112, crypto-map: ipsec
         sa timing: remaining key lifetime (kB/sec): (4274995/1796)
         IV size: 8 bytes
         replay detection support: Y
    outbound esp sas:
      spi: 0xE989A772 (3918112626)
         transform: esp-3des esp-sha-hmac none 
         in use settings ={L2L, Tunnel, }
         slot: 0, conn_id: 7112, crypto-map: ipsec
         sa timing: remaining key lifetime (kB/sec): (4274994/1795)
         IV size: 8 bytes
         replay detection support: Y

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:

Select all Open in new window

by: ricks_vPosted on 2009-03-03 at 17:16:46ID: 23790854

lets narrow down the issue
try
#sysopt connection permit-vpn (this will bypass acl and nat for vpn traffic)

if it's still an issue, i would be 90% sure it's issue at their end..

let us know how it goes..

by: DonbooPosted on 2009-03-04 at 00:24:38ID: 23792678

Since there is access to the other 3 subnets behind the VPN tunnel it means that the tunnel is up and running so "sysopt connection permit-vpn" would do nothing as its not about getting the VPN traffic to the ASA but about getting traffic through the exsisting tunnel.

by: brucehunterPosted on 2009-03-04 at 02:52:41ID: 23793440

Yes the "sysopt connection permit-vpn" is enabled and the access-list that allows me to connect to 193.58.69.x on the other side is incrementing every time i do a ping. Also when i run packet tracer from the GUI it ticks all the boxes. The person on the other side of the tunnel can ping me from the subnet in question but i cant ping him, which suggest to me that his firewall is allowing established packets back in but not unestablished. Would you say the issue is definatly on the far end or is there another test i can do ?

by: DonbooPosted on 2009-03-04 at 11:25:46ID: 23798304

If he can ping you but you cant ping him then somewhere in his end ICMP echo is blocked and ICMP echo-reply is allowed. So if thats the case I am not in doubt the problem is in their end ofcause provided you are not doing any filtering in your end :D.

Question

debug asa packet output

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

Network Security

Network Software Firewalls

Cisco PIX Firewall

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Need individual assistance?

Our experts are ready to help.

Want to learn from the best?

Read articles from industry experts.

Working on a long term project?

Store your work and research.

What Makes Experts Exchange Unique?

Trusted by the world's most respected brands.

Faithfully serving IT professionals since 1996.

Related Solutions

Free Tech Articles

Cloud Class Webinars

Join the Community

Give a Little. Get a Lot.

Answers

3 Ways to Join

The Experts

The Experts

Testimonials

Testimonials

Testimonials

Business Clients

Business Clients

In the Press

In the Press

In the Press