I have two IPSEC tunnels with an ASA in the middle
Site A - 10.20.4.0 /24 (188.8.131.52)
Site B - 192.168.142.0 /24
ASA - 10.99.206.0 /24 (184.108.40.206
Site A - 10.20.4.0 /24 can reach the ASA and Site B successfully
ASA can reach Site A and Site B successfully
Site B can reach ASA but fails to ping Site A
I've been running a continuous ping from 192.168.142.25 and see this on the ASA:
4|Feb 28 2019 10:01:53|402116: IPSEC: Received an ESP packet (SPI= 0x41AD96C1, sequence number= 0x17BF) from 220.127.116.11 (user= 18.104.22.168) to 22.214.171.124. The decapsulated inner packet doesn't match the negotiated policy in the SA. The packet specifies its destination as 10.20.4.1, its source as 192.168.142.25, and its protocol as icmp. The SA specifies its local proxy as 10.99.206.0/255.255.255.0/ip/0 and its remote_proxy as 192.168.142.0/255.255.255.0/ip/0.
I've looked this up and it describes the message as a NAT error but nothing specific. Could someone please explain what this error could potentially be caused by?
I have attached the following:
I hope someone can point me in the right direction. Thanks in advance.