I have two IPSEC tunnels with an ASA in the middle

Site A - /24 (

Site B - /24

ASA - /24 (

Site A - /24 can reach the ASA and Site B successfully

ASA can reach Site A and Site B successfully

Site B can reach ASA but fails to ping Site A

I've been running a continuous ping from and see this on the ASA:

4|Feb 28 2019 10:01:53|402116: IPSEC: Received an ESP packet (SPI= 0x41AD96C1, sequence number= 0x17BF) from (user= to The decapsulated inner packet doesn't match the negotiated policy in the SA. The packet specifies its destination as, its source as, and its protocol as icmp. The SA specifies its local proxy as and its remote_proxy as

I've looked this up and it describes the message as a NAT error but nothing specific. Could someone please explain what this error could potentially be caused by?

I have attached the following:

Site A VPN Site B VPN Cisco ASA Cisco ASA_shownatdetail

I hope someone can point me in the right direction. Thanks in advance.

  • 1
    That error indicates you are routing traffic into a VPN that isn't setup for it. The ASA is a security device; sending traffic into the tunnel for which there is no match address will fail. It either needs to be covered by that ACL, or NAT'd to something that is.
    – Ricky
    Mar 2 '19 at 19:36
  • @Ricky Beam Thanks for the reply Ricky. I think the ACLs and crypto maps are correct as I have the following configured: crypto map external-vpns 320 match address crypto map external-vpns 600 match address Formac crypto map external-vpns 600 set peer I also have ACLS permitting the relevant subnets. When you say NAT, do I need to nat Site B ( to Cisco ASA subnet ( Site A can see Cisco ASA subnet. Thanks in advance
    – BillyCee
    Mar 3 '19 at 6:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.