I am new to Cisco ASA and ASDM. Struggling with difference from IOS devices. Network layout is as follows:

AWS VPC -- IPsec tunnel -- ASA-5505 -- LAN


  1. IPsec tunnel is up.
  2. AWS can reach LAN connected devices.
  3. LAN connected devices can reach the internet.

However I have these two problems:

  1. LAN interface of ASA cannot ping to Internet.
  2. SLA monitoring isn't working. (Maybe related to point 1?)

Below I have inserted most of my running-config(and route table). I removed the crypto config and I have hid some octets of WAN addresses with xxx. Hopefully there is enough configuration here to be helpful in troubleshooting. If some additional information would be helpful please ask.

(Sorry, there was probably a better way to format the running-config below.)

ciscoasa# show running-config  
: Saved  
ASA Version 9.1(2)8  
interface Ethernet0/0  
 switchport access vlan 2  
interface Ethernet0/1  
interface Ethernet0/2  
interface Ethernet0/3  
interface Ethernet0/4  
interface Ethernet0/5  
interface Ethernet0/6  
interface Ethernet0/7  
interface Vlan1  
 nameif inside  
 security-level 100  
 ip address  
interface Vlan2  
 nameif outside  
 security-level 0  
 ip address xxx.152.29.xxx  
ftp mode passive  
object network inside-subnet-1  
object network AWS-inside-subnet  
object network NETWORK_OBJ_192.168.0.0_24  
object-group protocol DM_INLINE_PROTOCOL_1  
 protocol-object ip  
 protocol-object icmp  
access-list outside_cryptomap extended permit object-group DM_INLINE_PROTOCOL_1 object AWS-inside-subnet  
pager lines 24  
logging enable  
logging asdm informational  
mtu outside 1500  
mtu inside 1500  
no failover  
icmp unreachable rate-limit 1 burst-size 1  
no asdm history enable  
arp timeout 14400  
no arp permit-nonconnected  
nat (inside,outside) source static NETWORK_OBJ_192.168.0.0_24 NETWORK_OBJ_192.168.0.0_24 destination static AWS-inside-subnet AWS-inside-subnet  
object network inside-subnet-1  
 nat (inside,outside) dynamic interface  
route outside xxx.152.29.xxx 1  

http server enable  
http inside  
no snmp-server location  
no snmp-server contact  

sla monitor 1  
 type echo protocol ipIcmpEcho interface outside  
 frequency 30  
sla monitor schedule 1 life forever start-time now  
ssh inside  
ssh timeout 20  
ssh key-exchange group dh-group1-sha1  
console timeout 0  
class-map inspection_default  
 match default-inspection-traffic  
policy-map type inspect dns preset_dns_map  
  message-length maximum client auto  
  message-length maximum 512  
policy-map global_policy  
 class inspection_default  
  inspect dns preset_dns_map  
  inspect ftp  
  inspect h323 h225  
  inspect h323 ras  
  inspect rsh  
  inspect rtsp  
  inspect esmtp  
  inspect sqlnet  
  inspect skinny  
  inspect sunrpc  
  inspect xdmcp  
  inspect sip  
  inspect netbios  
  inspect tftp  
  inspect ip-options  
  inspect icmp  
: end  
ciscoasa# show route  

Gateway of last resort is xxx.152.29.xxx to network  

C    xxx.152.29.xxx is directly connected, outside  
C is directly connected, inside  
S* [1/0] via xxx.152.29.xxx, outside  
  • The destination in the SLA is part of AWS-inside-subnet, which I presume is at the other end of a L2L tunnel?
    – hertitu
    Sep 7, 2016 at 7:22
  • Can you try configuring "management-access inside" and see if that helps?
    – hertitu
    Sep 7, 2016 at 7:30
  • Yes, destination address in the SLA is the first address in the AWS-inside-subnet. Also the tunnel is up and passing traffic. However, the tunnel won't stay up unless I ping from a LAN connected device to the AWS VPC subnet. Therefore I assume the SLA isn't working. Sep 7, 2016 at 14:52
  • Please can you include the command you're using to ping 'the Internet' from the LAN interface? I'm assuming you're using ping x.x.x.x source x.x.x.x ? Can you post the output too?
    – Mark
    Sep 7, 2016 at 19:01
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it.
    – Ron Maupin
    Aug 7, 2017 at 13:45

2 Answers 2


To get the IP SLA to work, change your crypto ACL from:

access-list outside_cryptomap extended permit object-group DM_INLINE_PROTOCOL_1 object AWS-inside-subnet  

to :

access-list outside_cryptomap extended permit object-group DM_INLINE_PROTOCOL_1 any4 object AWS-inside-subnet

And, of course, do the same (in reverse) at the remote peer.

This way the IP SLA (which is sourced from the ASA's outside ip address) also gets tunnelled.

src: http://www.tunnelsup.com/troubleshooting-vpn-between-cisco-asa-and-amazon-aws

Edit: note that if there is any traffic between AWS and the Internet, the suggested config change may break things as it may cause that traffic to traverse the tunnel now (depending on how the other side is configured).

Edit2: this should also make a regular ping work, if you source it from the outside interface. To be honest I'm not sure if a ping from the inside interface can ever work - it might if you enable management-access inside. That should at least allow you to ping the inside interface from AWS.

  • I implemented the changes suggested above (access-list and management-access), however they did not fix my issue. Thanks you for the attention. Sep 14, 2016 at 12:55
  • in the output of "show crypto ipsec sa" do you see an entry for your outside ip address ? Are the encrypt/decrypt counters increasing when you ping?
    – hertitu
    Sep 14, 2016 at 15:10
  • Yes. I see:Crypto map tag: outside_map, seq num: 1, local addr: xxx.152.29.xxx and #pkts encaps: 218, #pkts encrypt: 218, #pkts digest: 218 #pkts decaps: 185, #pkts decrypt: 185, #pkts verify: 185 Sep 14, 2016 at 21:32
  • @stephenmuth ok, of course the counters may be increasing due to other traffic so maybe try this: ping timeout 0 repeat 1000 and then check the ipsec counters again; have they increased (both encrypt and decrypt) with 1000 or more?
    – hertitu
    Sep 18, 2016 at 10:21

Type these commands in the CLI (starting from the config you provided):

management-access inside
access-list outside_cryptomap extended permit ip object NETWORK_OBJ_192.168.0.0_24 object AWS-inside-subnet
no access-list outside_cryptomap extended permit object-group DM_INLINE_PROTOCOL_1 object AWS-inside-subnet
nat (inside,outside) source static NETWORK_OBJ_192.168.0.0_24 NETWORK_OBJ_192.168.0.0_24 destination static AWS-inside-subnet AWS-inside-subnet no-proxy-arp route-lookup
nat (inside outside) after-auto source dynamic any interface
object network inside-subnet-1
no nat (inside,outside) dynamic interface
ip sla monitor 1
no type echo protocol ipIcmpEcho interface outside
type echo protocol ipIcmpEcho source-ipaddr
track 1 rtr 1 reachability

After you type the above commands, exit configuration mode and clear the ipsec sa to restart the tunnel. The SLA monitor should start working. If not, you might want to try another 192.168.0.x address for the source-ip parameter.

Also, your ASA IOS image is very old! It is possible you are encountering a VPN bug. I highly recommend upgrading to 9.1(7)19 (asa917-19-k8.bin)

See https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160210-asa-ike for more information

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.