Timeline for Cisco ASAv not building up child SA
Current License: CC BY-SA 3.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 21, 2016 at 11:57 | history | bounty ended | Daniel | ||
| Jul 21, 2016 at 11:57 | vote | accept | Daniel | ||
| Jul 19, 2016 at 7:57 | comment | added | Daniel | Thanks for your answer. In the linked document I only find this sentence: "he IPsec tunnel establishes when the tunnel is initiated from the Router end only. ASA could not initiate a VPN tunnel because of the dynamic IPsec configuration.". Where do you get the information from that the P2 establishment of a child SA is not supported from the static endpoint towards the dynamic endpoint? | |
| Jul 18, 2016 at 20:40 | comment | added | kaisero | Unfortunetly it is not supported to initiate P2 to the dynamic peer. Theoretically it should be possible since the ASA knows the DST IP from P1 but according to cisco documentation the dynamic peer must establish the session. I have tested this scenario in the lab and can confirm that it is indeed not working. Reference: cisco.com/c/en/us/support/docs/security/… | |
| Jul 18, 2016 at 20:14 | comment | added | Daniel | Thank you for your answer! I am aware that the initial tunnel must be initiated from the router. The IKE Phase 1 has completed and the tunnel is basically there. The question is: does this also hold true for child SAs? In this moment I have the phase I tunnel, so why can't the ASA initiate the second child SA with the phase I tunnel in place? And yes, IP SLA is the workaround I have currently implemented, which for sure works. | |
| Jul 18, 2016 at 20:09 | history | answered | kaisero | CC BY-SA 3.0 |