Backstory: I have a site to site VPN from my ASA with 9.x firmware to a remote ASA with 8.2 firmware (NOT managed by me). We got the tunnel up and running quite a while ago, I ended up having to specifically add an ACL for ICMP.
The Problem: The other end provides AnyConnect SSL VPN connectivity and users connecting to the SSL VPN need access to my end of the site to site VPN, so I added to the existing subnets.
The Error:Running packet tracer from 10.10.10.5 destination: 192.168.99.5 I get:
VPN: Type - VPN Subtype - encrypt Action - DROP
RESULT: The packet is dropped INFO: (acl-drop) Flow is denied by configured rule
- My site=10.10.10.0/24
- Other site=10.1.0.0/16
- SSL VPN=192.168.99.0/24
The changes that I've made (added):
access-list VPN_ACCESS extended permit icmp 10.10.10.0 255.255.255.0 192.168.99.0 255.255.255.0 access-list VPN_ACCESS extended permit ip 10.10.10.0 255.255.255.0 192.168.99.0 255.255.255.0
And based upon this rule:
nat (inside,outside) source static LocalLAN LocalLAN destination static DM_INLINE_NETWORK_3 DM_INLINE_NETWORK_3
I also added added:
object-group network DM_INLINE_NETWORK_3 network-object object REMOTESSLVPN object network REMOTESSLVPN subnet 192.168.99.0 255.255.255.0
So, am I crazy, or shouldn't that work? What could I be missing? I recall that the initial setup between the sub 8.2 and the >8.3 firmware was a lot of trouble, but this should be simple. Does anyone have any insight?
EDIT: Here's the detailed packet trace from cli:
(config)# packet-tracer input inside tcp 10.10.10.0 80 192.168.99.0 $ Phase: 1 Type: ROUTE-LOOKUP Subtype: input Result: ALLOW Config: Additional Information: in 0.0.0.0 0.0.0.0 outside Phase: 2 Type: UN-NAT Subtype: static Result: ALLOW Config: nat (inside,outside) source static LocalLAN LocalLAN destination static > > DM_INLINE_NETWORK_3 DM_INLINE_NETWORK_3 Additional Information: NAT divert to egress interface outside Untranslate 192.168.99.0/80 to 192.168.99.0/80 Result: input-interface: inside input-status: up input-line-status: up output-interface: outside output-status: up output-line-status: up Action: drop Drop-reason: (sp-security-failed) Slowpath security checks failed