I ran into a little bit of an odd issue this morning. I have a site-to-site VPN tunnel that is up and correctly passing traffic between two sites. Interesting traffic is specified as a /24 at the remote site, and /16 at the headend, and the IPSEC SA is coming up correctly based off of the ACL that specifies that traffic. The head end has multiple subnets, a core router...etc. The remote end is a single subnet.

The tunnel is up, and traffic is passing over the tunnel (not traffic to the static devices, traffic to DHCP devices)... for whatever reason though, I was unable to ping devices statically assigned at the remote end from the head end. As soon as I logged into the ASA5505 at the remote end and initiated a ping directly to the static devices, pings from the head end started working. I've never seen this type of behavior from an ASA before, and I've installed dozens of them in similar fashion. Anyone know why this is happening? Maybe an arp setting, or something of the sort?

The ASA at the remote end is on 9.1(6)6. The head-end firewall is a provider-hosted context on a Palo Alto firewall.

  • From your question it looks like you have end to end logical connectivity and this is a bug. I would start an asp drop capture and start the ping to the static host then see what drops you’re seeing Gareth – Owensteam Feb 15 '18 at 14:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.