1

I have some issues here I have built an L2l VPN from my location to AWS London, I can see that the tunnel is up but when I attempt to connect our local domain controller here in our office to AWS London I can see TCP timing out but UDP works. On my ACL I do not have any port restrictions so I am at a lost on why UDP works but not TCP. What I find strange is when TCP trys to connect I see in the logs the following:

Jun 05 2019 03:54:10: %ASA-6-302013: Built inbound TCP connection 408579111 for INSIDE:10.16.10.15/65059 (10.190.0.15/65059) to INSIDE:10.20.0.115/88 (10.20.0.115/88)
Jun 05 2019 03:54:10: %ASA-6-302013: Built inbound TCP connection 408579112 for INSIDE:10.190.0.15/65059 (10.190.0.15/65059) to INSIDE:10.20.0.115/88 (10.20.0.115/88)
Jun 05 2019 03:54:10: %ASA-4-419002: Duplicate TCP SYN from INSIDE:10.190.0.15/65059 to INSIDE:10.20.0.115/88 with different initial sequence number
Jun 05 2019 03:54:10: %ASA-4-419002: Duplicate TCP SYN from INSIDE:10.190.0.15/65059 to INSIDE:10.20.0.115/88 with different initial sequence number
Jun 05 2019 03:54:10: %ASA-4-419002: Duplicate TCP SYN from INSIDE:10.190.0.15/65059 to INSIDE:10.20.0.115/88 with different initial sequence number

I see a whole lot of this duplicate tcp SYN messages then it eventually times out.

My configs are as follows:

object network dw01
 host 10.16.10.103

object network dw01-NATLDN
 host 10.190.0.103

object network dc03
 host 10.16.10.15

object network dc03-NATLDN
 host 10.190.0.15

object-group network Amazon.LocalLDN
 network-object 10.190.0.0 255.255.255.0

object-group network Amazon-RemoteLDN
 network-object 10.20.0.0 255.255.0.0

access-list OUTSIDE_cryptomap_10 extended permit ip any object-group Amazon-RemoteLDN

access-list amznLDN-filter extended permit ip 10.20.0.0 255.255.0.0 10.190.0.0 255.255.255.0


nat (INSIDE,OUTSIDE) source static dw01 dw01-NATLDN destination static Amazon-RemoteLDN Amazon-RemoteLDN
nat (INSIDE,any) source static network dc03 dc03-NATLDN destination static Amazon-RemoteLDN Amazon-RemoteLDN


crypto ipsec ikev1 transform-set transform-amzn esp-aes esp-sha-hmac

crypto map OUTSIDE_map 15 match address OUTSIDE_cryptomap_10
crypto map OUTSIDE_map 15 set pfs group2
crypto map OUTSIDE_map 15 set peer 52.56.71.96 3.8.226.22 
crypto map OUTSIDE_map 15 set ikev1 transform-set transform-amzn
crypto map OUTSIDE_map 15 set security-association lifetime seconds 3600
crypto map OUTSIDE_map 15 set nat-t-disable

tunnel-group 52.56.71.96 type ipsec-l2l
tunnel-group 52.56.71.96 general-attributes
 default-group-policy Amazon-LDN
tunnel-group 52.56.71.96 ipsec-attributes
 ikev1 pre-shared-key 
 isakmp keepalive threshold 10 retry 10

group-policy Amazon-LDN internal
group-policy Amazon-LDN attributes
 vpn-idle-timeout none
 vpn-session-timeout none
 vpn-filter value amznLDN-filter
 vpn-tunnel-protocol ikev1 
  • Why did you disable NAT-T? I'd turn it back on. Not that that's your issue, but I wouldn't disable it. – Jesse P. Jun 5 '19 at 14:18
  • 1
    Also, please share a full sanitized config of your ASA. There are too many other variables that are unknown still. – Jesse P. Jun 5 '19 at 14:23
1

I know what the issue is but appreciate all that attempted to help so where is the problem. The subnet we are using for AWS is 10.20.0.0/24 now I was checking the routing on my firewall and finally notice this

route INSIDE 10.0.0.0 255.0.0.0 10.16.169.10 1

so because the AWS subnet falls into the 10 subnet according to the route it throws it back to the switch interface and that is why I am seeing that Duplicate SYNC message when I see the logs. Once we changed the AWS IP address to outside the 10 subnet it worked. Again thank you Jesse P for your help much appreciated!!!! Let me know if you have any questions

  • Nice. That's why it would have helped us to have seen a full config. Glad you figured it out wither way. Make sure to mark your answer as the solution so this question doesn't come up until the end of time as unsolved. – Jesse P. Jun 6 '19 at 11:41
  • Typo correction. Meant "either way". – Jesse P. Jun 6 '19 at 11:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.