0

I have two IPSEC tunnels with an ASA in the middle

Site A - 10.20.4.0 /24 (65.176.80.84)

Site B - 192.168.142.0 /24

ASA - 10.99.206.0 /24 (95.12.22.33

Site A - 10.20.4.0 /24 can reach the ASA and Site B successfully

ASA can reach Site A and Site B successfully

Site B can reach ASA but fails to ping Site A

I've been running a continuous ping from 192.168.142.25 and see this on the ASA:

4|Feb 28 2019 10:01:53|402116: IPSEC: Received an ESP packet (SPI= 0x41AD96C1, sequence number= 0x17BF) from 35.176.80.84 (user= 65.176.80.84) to 95.12.22.33. The decapsulated inner packet doesn't match the negotiated policy in the SA. The packet specifies its destination as 10.20.4.1, its source as 192.168.142.25, and its protocol as icmp. The SA specifies its local proxy as 10.99.206.0/255.255.255.0/ip/0 and its remote_proxy as 192.168.142.0/255.255.255.0/ip/0.

I've looked this up and it describes the message as a NAT error but nothing specific. Could someone please explain what this error could potentially be caused by?

I have attached the following:

Site A VPN Site B VPN Cisco ASA Cisco ASA_shownatdetail

I hope someone can point me in the right direction. Thanks in advance.

  • 1
    That error indicates you are routing traffic into a VPN that isn't setup for it. The ASA is a security device; sending traffic into the tunnel for which there is no match address will fail. It either needs to be covered by that ACL, or NAT'd to something that is. – Ricky Beam Mar 2 at 19:36
  • @Ricky Beam Thanks for the reply Ricky. I think the ACLs and crypto maps are correct as I have the following configured: crypto map external-vpns 320 match address 81.49.11.243_Calverton crypto map external-vpns 600 match address Formac crypto map external-vpns 600 set peer 65.176.80.84 I also have ACLS permitting the relevant subnets. When you say NAT, do I need to nat Site B (192.168.142.0) to Cisco ASA subnet (10.99.206.0)? Site A can see Cisco ASA subnet. Thanks in advance – BillyCee Mar 3 at 6:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.