I try to set up a site to site IPsec between an Ericsson router and a Cisco ASA, as shown below:
My tunnel is UP and R1 seems to be working fine. However, my ASA does not forward traffic between local and remote subnets:
act/Lab2/FWasa1# show cryp ipse sa interface: outside_access Crypto map tag: acces_map, seq num: 1, local addr: x.x.x.x access-list crypto_map extended permit ip 100.100.0.0 255.255.255.0 100.100.1.0 255.255.255.0 local ident (addr/mask/prot/port): (100.100.0.0/255.255.255.0/0/0) remote ident (addr/mask/prot/port): (100.100.1.0/255.255.255.0/0/0) current_peer: y.y.y.y #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 #pkts decaps: 2640, #pkts decrypt: 2640, #pkts verify: 2640 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0 #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0 #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0 #TFC rcvd: 0, #TFC sent: 0 #Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0 #send errors: 0, #recv errors: 0 act/Lab2/FWasa1# show access-list crypto_map access-list crypto_map; 2 elements; name hash: 0x2b034900 access-list crypto_map line 1 extended permit ip object local_network object remote_network (hitcnt=8) 0xd0d5d370 access-list crypto_map line 1 extended permit ip 100.100.0.0 255.255.255.0 100.100.1.0 255.255.255.0 (hitcnt=8) 0xd0d5d370 access-list crypto_map line 2 extended permit icmp object local_network object remote_network (hitcnt=0) 0x1adc0eab access-list crypto_map line 2 extended permit icmp 100.100.0.0 255.255.255.0 100.100.1.0 255.255.255.0 (hitcnt=0) 0x1adc0eab act/Lab2/FWasa1# packet-tracer input locale_interface icmp 100.100.0.1 8 0 100.100.1.1 Phase: 2 Type: ROUTE-LOOKUP Subtype: Resolve Egress Interface Result: ALLOW Config: Additional Information: found next-hop x.x.x.x using egress ifc outside_access Phase: 2 Type: ACCESS-LIST Subtype: Result: DROP Config: Implicit Rule Additional Information: Forward Flow based lookup yields rule: in id=0x7f98cedfc200, priority=501, domain=permit, deny=true hits=6, user_data=0x7, cs_id=0x0, reverse, flags=0x0, protocol=0 src ip/id=100.100.0.1, mask=255.255.255.255, port=0, tag=any dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0 input_ifc=locale_interface, output_ifc=any Result: input-interface: locale_interface input-status: up input-line-status: up output-interface: outside_access output-status: up output-line-status: up Action: drop Drop-reason: (acl-drop) Flow is denied by configured rule
As you can see, the ACL displayed with
show crypto ipsec sa only contains one rule instead of two, as shown with
show access-list crypto_map. The first command output shows as well ingress encrypted data, which correspond to a ping I sent from 100.100.1.1 (without receiving any answer).
packet-tracer displays, either with ICMP or TCP, that packets are dropped by an ACL. How can I find out which ACL is responsible for this drop and continue to troubleshoot my issue?
EDIT: For whatever reason, end to end ping works if the source or destination IP is not 100.100.0.1, which is the ASA local interface IP. If I use the same
packet-tracer command with IP
100.100.0.2 instead of
100.100.0.1, then it just works fine. I don't understand this behavior, but at least it solves my issue. Any information is still appreciated about why this specific IP is not able to be transported towards the other side.