Create well-organized and polished visualizations of your virtual and backup environments when planning VMware vSphere, Microsoft Hyper-V or Veeam deployments. It helps you to gain better visibility and valuable business insights.
Course Of The Month
6 days, 23 hours left to enrollBecome a Premium Member and unlock a new, free course in leading technologies each month.
Solved
Site to Site VPN access problem
Posted on 2011-02-16
i have configured the site to site vpn between ASA 5510 and 5505. VPN is established but i can't access the resources. i have two subnet on ASA 5510, one is 192.168.x.x and other 172.16.x.x. i can access every thing from 192.168.x.x subnet but not from 172.16.x.x subnet. i have only one subnet on ASA 5505 that is 172.17.x.x. they can access the subnet 192.168.x.x but not the 172.16.x.x subnet. previously it worked fine but now we have problem. we have not changed anything.
i verified the all configuration on both sides and it look like fine. i checked the access lists, nat, etc. i also tested with bulletin cisco packet tracer and it is showing everything fine. i have also other branch offices and everything working fine there.
please guide me, how i can troubleshoot and solve this problem?
Thanks in advance
i verified the all configuration on both sides and it look like fine. i checked the access lists, nat, etc. i also tested with bulletin cisco packet tracer and it is showing everything fine. i have also other branch offices and everything working fine there.
please guide me, how i can troubleshoot and solve this problem?
Thanks in advance
[X]
Welcome to Experts Exchange
Add your voice to the tech community where 5M+ people just like you are talking about what matters.
- Help others & share knowledge
- Earn cash & points
- Learn & ask questions
-
4
2
7 Comments
ASA 5505 Access lists
access-list nonat extended permit ip 172.17.24.0 255.255.248.0 172.16.0.0 255.240.0.0
access-list nonat extended permit ip 172.17.24.0 255.255.248.0 192.168.0.0 255.255.0.0
access-list crypto-se extended permit ip 172.17.24.0 255.255.248.0 172.16.0.0 255.240.0.0
access-list crypto-se extended permit ip 172.17.24.0 255.255.248.0 192.168.0.0 255.255.0.0
ASA 5510 Access lists
access-list crypto-fi extended permit ip 172.16.0.0 255.240.0.0 172.17.24.0 255.255.248.0
access-list crypto-fi extended permit ip 192.168.0.0 255.255.0.0 172.17.24.0 255.255.248.0
access-list inside_nat0_outbound extended permit ip 172.16.0.0 255.240.0.0 172.16.0.0 255.240.0.0
access-list inside_nat0_outbound extended permit ip 172.16.0.0 255.240.0.0 192.168.0.0 255.255.0.0
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.0.0 192.168.0.0 255.255.0.0
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.0.0 172.16.0.0 255.240.0.0
access-list nonat extended permit ip 172.17.24.0 255.255.248.0 172.16.0.0 255.240.0.0
access-list nonat extended permit ip 172.17.24.0 255.255.248.0 192.168.0.0 255.255.0.0
access-list crypto-se extended permit ip 172.17.24.0 255.255.248.0 172.16.0.0 255.240.0.0
access-list crypto-se extended permit ip 172.17.24.0 255.255.248.0 192.168.0.0 255.255.0.0
ASA 5510 Access lists
access-list crypto-fi extended permit ip 172.16.0.0 255.240.0.0 172.17.24.0 255.255.248.0
access-list crypto-fi extended permit ip 192.168.0.0 255.255.0.0 172.17.24.0 255.255.248.0
access-list inside_nat0_outbound extended permit ip 172.16.0.0 255.240.0.0 172.16.0.0 255.240.0.0
access-list inside_nat0_outbound extended permit ip 172.16.0.0 255.240.0.0 192.168.0.0 255.255.0.0
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.0.0 192.168.0.0 255.255.0.0
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.0.0 172.16.0.0 255.240.0.0
I would log onto the 5505 and issue the following:
sh cry ips sa
This should show you something like this:
reynoldshome#sh cry ips sa
interface: FastEthernet4
Crypto map tag: VPN, local addr 96.11.X.X
protected vrf: (none)
local ident (addr/mask/prot/port): (10.1.3.0/255.255.255.0/0/
remote ident (addr/mask/prot/port): (10.1.0.0/255.255.0.0/0/0)
current_peer 65.23.X.X port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 5578, #pkts encrypt: 5578, #pkts digest: 5578
#pkts decaps: 1754, #pkts decrypt: 1754, #pkts verify: 1754
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 135, #recv errors 0
make sure you the networks are listed and enc and decry packets are incrementing. You can do a source ping to generate traffic:
ping 172.16.0.1 source 172.17.24.1
That will tell you if the traffic is leaving the device.
sh cry ips sa
This should show you something like this:
reynoldshome#sh cry ips sa
interface: FastEthernet4
Crypto map tag: VPN, local addr 96.11.X.X
protected vrf: (none)
local ident (addr/mask/prot/port): (10.1.3.0/255.255.255.0/0/
remote ident (addr/mask/prot/port): (10.1.0.0/255.255.0.0/0/0)
current_peer 65.23.X.X port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 5578, #pkts encrypt: 5578, #pkts digest: 5578
#pkts decaps: 1754, #pkts decrypt: 1754, #pkts verify: 1754
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 135, #recv errors 0
make sure you the networks are listed and enc and decry packets are incrementing. You can do a source ping to generate traffic:
ping 172.16.0.1 source 172.17.24.1
That will tell you if the traffic is leaving the device.
i run the sh cry ipsec sa on ASA 5505
#pkts encaps: 154, #pkts encrypt: 154, #pkts digest: 154
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 154, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0
i run the sh cry ipsec sa on ASA 5510
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 154, #pkts decrypt: 154, #pkts verify: 154
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0
it look like traffic is coming from ASA 5505 to ASA 5510. But not going from ASA 5510 to ASA 5505.
any suggestion, why traffic not leaving from ASA 5510.
Thanks in advance
#pkts encaps: 154, #pkts encrypt: 154, #pkts digest: 154
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 154, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0
i run the sh cry ipsec sa on ASA 5510
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 154, #pkts decrypt: 154, #pkts verify: 154
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0
it look like traffic is coming from ASA 5505 to ASA 5510. But not going from ASA 5510 to ASA 5505.
any suggestion, why traffic not leaving from ASA 5510.
Thanks in advance
Featured Post
Watch and learn how ATEN provided a total control system solution including seamless switching matrix switch, HDBaseT extenders, PDU, lighting control to build an interactive eFuture classroom.
Question has a verified solution.
If you are experiencing a similar issue, please ask a related question
There’s a movement in Information Technology (IT), and while it’s hard to define, it is gaining momentum. Some call it “stream-lined IT;” others call it “thin-model IT.”
Powerful tools can do wonders, but only in the right hands. Nowhere is this more obvious than with the cloud.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Suggested Courses
Course of the Month6 days, 23 hours left to enroll
Earn Certification
Cisco CCNA Collaboration: CIVND2
$197.00$177.30
Earn Certification
Cisco CCNA Security: IINS v3.0
$197.00$177.30
726 members asked questions and received personalized solutions in the past 7 days.
Join the community of 500,000 technology professionals and ask your questions.