Timeline for Troubleshooting ipsec ikev2 site to site vpn
Current License: CC BY-SA 4.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Dec 16, 2023 at 19:01 | comment | added | FrameHowitzer | Example of what? You just need a computer at each location. Try to ping from one to the other while you look at the debug output on the firewalls to determine if it is trying to bring up the VPN tunnel or what might be going wrong. Here is how to do some debug for VPN community.cisco.com/t5/vpn/… Use the 'term mon' command to see the output on the terminal. | |
| Dec 16, 2023 at 4:01 | comment | added | user1378803 | Can you give an example I have a hard time understanding. So should acl list specify host ip instead of network subnet? | |
| Dec 15, 2023 at 1:02 | comment | added | FrameHowitzer | Generally the policy should select the traffic to go into the tunnel. Your policy says traffic from/to 10.113.0.0 255.255.0.0 and 10.1.10.0 255.255.255.248 should go through the tunnel. You have to source it from a device with one of those IP addresses, not the firewall. The packet tracer feature can trigger the firewall to bring up the tunnel but it can't send traffic through the tunnel very easily. You should generate some traffic from a PC in one network to the other end of the VPN and watch debug output on the firewalls (debug crypto ipsec, debug crypto ikev1, debug crypto ike-common). | |
| Dec 14, 2023 at 19:56 | comment | added | user1378803 | Any ideas? What additional routes are needed? Is there a need to nat either side? | |
| Dec 13, 2023 at 22:58 | comment | added | user1378803 | Ron, no routing. I assumed it's over a tunnel and should work? Just sent all routes to the WAN of the ASA. | |
| Dec 13, 2023 at 22:42 | comment | added | Ron Maupin♦ | @user1378803, did you configure any routing across the tunnel? | |
| Dec 13, 2023 at 22:31 | comment | added | user1378803 | I did, there is a vpn tunnel session, but no traffic shown. Also cannot ping anything on the devices on the inside of the other firewall. | |
| Dec 13, 2023 at 21:25 | comment | added | FrameHowitzer | Your packet tracer output indicates that the VPN tunnel is up and working. Try checking the output of 'show crypto ipsec sa' to see if there is a VPN tunnel session and then verify whether traffic is going into it via the counters shown in the output of that command. Test pinging from a device inside one firewall to a device inside the other firewall and see if the counters on the output of 'show crypto ipsec sa' are incremented. | |
| Dec 13, 2023 at 20:34 | comment | added | user1378803 | Can you look again, I fixed to make it easier to look. I have reviewed, I don't see anything wrong? | |
| Dec 12, 2023 at 0:36 | history | answered | FrameHowitzer | CC BY-SA 4.0 |