Good day

I have some issues here I have built an L2l VPN from my location to AWS London, I can see that the tunnel is up but when I attempt to connect our local domain controller here in our office to AWS London I can see TCP timing out but UDP works. On my ACL I do not have any port restrictions so I am at a lost on why UDP works but not TCP. What I find strange is when TCP trys to connect I see in the logs the following:

Jun 05 2019 03:54:10: %ASA-6-302013: Built inbound TCP connection 408579111 for INSIDE:10.16.10.15/65059 (10.190.0.15/65059) to INSIDE:10.20.0.115/88 (10.20.0.115/88) Jun 05 2019 03:54:10: %ASA-6-302013: Built inbound TCP connection 408579112 for INSIDE:10.190.0.15/65059 (10.190.0.15/65059) to INSIDE:10.20.0.115/88 (10.20.0.115/88) Jun 05 2019 03:54:10: %ASA-4-419002: Duplicate TCP SYN from INSIDE:10.190.0.15/65059 to INSIDE:10.20.0.115/88 with different initial sequence number Jun 05 2019 03:54:10: %ASA-4-419002: Duplicate TCP SYN from INSIDE:10.190.0.15/65059 to INSIDE:10.20.0.115/88 with different initial sequence number Jun 05 2019 03:54:10: %ASA-4-419002: Duplicate TCP SYN from INSIDE:10.190.0.15/65059 to INSIDE:10.20.0.115/88 with different initial sequence number

My configs are as follows:

object network dw01 host 10.16.10.103

object network dw01-NATLDN host 10.190.0.103

object network dc03 host 10.16.10.15

object network dc03-NATLDN host 10.190.0.15

object-group network Amazon.LocalLDN network-object 10.190.0.0 255.255.255.0

object-group network Amazon-RemoteLDN network-object 10.20.0.0 255.255.0.0

access-list OUTSIDE_cryptomap_10 extended permit ip any object-group Amazon-RemoteLDN

access-list amznLDN-filter extended permit ip 10.20.0.0 255.255.0.0 10.190.0.0 255.255.255.0

nat (INSIDE,OUTSIDE) source static dw01 dw01-NATLDN destination static Amazon-RemoteLDN Amazon-RemoteLDN nat (INSIDE,any) source static network dc03 dc03-NATLDN destination static Amazon-RemoteLDN Amazon-RemoteLDN

crypto ipsec ikev1 transform-set transform-amzn esp-aes esp-sha-hmac

crypto map OUTSIDE_map 15 match address OUTSIDE_cryptomap_10 crypto map OUTSIDE_map 15 set pfs group2 crypto map OUTSIDE_map 15 set peer 52.56.71.96 3.8.226.22 crypto map OUTSIDE_map 15 set ikev1 transform-set transform-amzn crypto map OUTSIDE_map 15 set security-association lifetime seconds 3600 crypto map OUTSIDE_map 15 set nat-t-disable

tunnel-group 52.56.71.96 type ipsec-l2l tunnel-group 52.56.71.96 general-attributes default-group-policy Amazon-LDN tunnel-group 52.56.71.96 ipsec-attributes ikev1 pre-shared-key isakmp keepalive threshold 10 retry 10

group-policy Amazon-LDN internal group-policy Amazon-LDN attributes vpn-idle-timeout none vpn-session-timeout none vpn-filter value amznLDN-filter vpn-tunnel-protocol ikev1

Thank you in advance for your help!!

I have some issues here I have built an L2l VPN from my location to AWS London, I can see that the tunnel is up but when I attempt to connect our local domain controller here in our office to AWS London I can see TCP timing out but UDP works. On my ACL I do not have any port restrictions so I am at a lost on why UDP works but not TCP. What I find strange is when TCP trys to connect I see in the logs the following:

Jun 05 2019 03:54:10: %ASA-6-302013: Built inbound TCP connection 408579111 for INSIDE:10.16.10.15/65059 (10.190.0.15/65059) to INSIDE:10.20.0.115/88 (10.20.0.115/88)
Jun 05 2019 03:54:10: %ASA-6-302013: Built inbound TCP connection 408579112 for INSIDE:10.190.0.15/65059 (10.190.0.15/65059) to INSIDE:10.20.0.115/88 (10.20.0.115/88)
Jun 05 2019 03:54:10: %ASA-4-419002: Duplicate TCP SYN from INSIDE:10.190.0.15/65059 to INSIDE:10.20.0.115/88 with different initial sequence number
Jun 05 2019 03:54:10: %ASA-4-419002: Duplicate TCP SYN from INSIDE:10.190.0.15/65059 to INSIDE:10.20.0.115/88 with different initial sequence number
Jun 05 2019 03:54:10: %ASA-4-419002: Duplicate TCP SYN from INSIDE:10.190.0.15/65059 to INSIDE:10.20.0.115/88 with different initial sequence number

My configs are as follows:

object network dw01
 host 10.16.10.103

object network dw01-NATLDN
 host 10.190.0.103

object network dc03
 host 10.16.10.15

object network dc03-NATLDN
 host 10.190.0.15

object-group network Amazon.LocalLDN
 network-object 10.190.0.0 255.255.255.0

object-group network Amazon-RemoteLDN
 network-object 10.20.0.0 255.255.0.0

access-list OUTSIDE_cryptomap_10 extended permit ip any object-group Amazon-RemoteLDN

access-list amznLDN-filter extended permit ip 10.20.0.0 255.255.0.0 10.190.0.0 255.255.255.0


nat (INSIDE,OUTSIDE) source static dw01 dw01-NATLDN destination static Amazon-RemoteLDN Amazon-RemoteLDN
nat (INSIDE,any) source static network dc03 dc03-NATLDN destination static Amazon-RemoteLDN Amazon-RemoteLDN


crypto ipsec ikev1 transform-set transform-amzn esp-aes esp-sha-hmac

crypto map OUTSIDE_map 15 match address OUTSIDE_cryptomap_10
crypto map OUTSIDE_map 15 set pfs group2
crypto map OUTSIDE_map 15 set peer 52.56.71.96 3.8.226.22 
crypto map OUTSIDE_map 15 set ikev1 transform-set transform-amzn
crypto map OUTSIDE_map 15 set security-association lifetime seconds 3600
crypto map OUTSIDE_map 15 set nat-t-disable

tunnel-group 52.56.71.96 type ipsec-l2l
tunnel-group 52.56.71.96 general-attributes
 default-group-policy Amazon-LDN
tunnel-group 52.56.71.96 ipsec-attributes
 ikev1 pre-shared-key 
 isakmp keepalive threshold 10 retry 10

group-policy Amazon-LDN internal
group-policy Amazon-LDN attributes
 vpn-idle-timeout none
 vpn-session-timeout none
 vpn-filter value amznLDN-filter
 vpn-tunnel-protocol ikev1