Avatar of operationsbze
operationsbze asked on

Cisco L2L VPN

Good day All,
I have a slight problem that  I am trying to resolve, I have and ASA which is being used to provide VPN.  The existing config has Remote access tunnels authenticated via digital certificate and an Lan to Lan tunnel which are being terminated on the internal interface of the ASA.  I now need to create and DMZ interface that will also be the terminating interface for another L2L tunnel.  My problem is that the tunnel is established for the DMZ and i can see data being transmitted and recieved when i look at the VPN tunnels under monitor, however i can't ping devices accross the tunnel between the DMZ and the remote site.  Please find attached config on device and drawing with logical setup.

Avatar of undefined
Last Comment

8/22/2022 - Mon

lots of views but no responses

access-list Outside_nat0_outbound extended permit ip object-group Maskall-RTAC

The above shouldn't be needed, and could possibly be causing your problem if this affects the rpf check. You should only need the nat 0 on the "inside" interface which for this scenario is Systemplanning.

Also, you have nat-t disabled on that crypto map. Although this isn't necessarily a problem, just make sure that's what you really want.

This is tough to troubleshoot because you can only use packet-tracer one direction. Would you be able to post the packet-tracer output for traffic going from Systemplanning to RTAC?

Thanks for the response Rauenpc, I've tried the tunnel without that ACL entry and it didn't make a difference, but will remove it just to be on the safe side.  I had to disable NAT-T because the tunnel refused to come up if i enabled that functionality.  I am trying to connect a Cisco ASA and an Oncell 3150 but doesn't seem to be going my way at the moment .
Your help has saved me hundreds of hours of internet surfing.

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
See how we're fighting big data
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question

because no other user provided a solution that worked and as such i had to do the research on my own to find the problem.