1

Cisco ASA 5506-X connected to two ISP - main and standby channel, interfaces outside_1 and outside_2. IPSec works via outside_1, but does not work via outside_2, if outside_1 down. At this moment Internet works, means SLA works correctly. I check with Packet-Tracer:

packet-tracer in inside tcp 10.20.2.8 www 172.31.10.9 www

Phase: 1
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
nat (inside,outside_1) source static LAN LAN destination static MSKNET MSKNET
Additional Information:
NAT divert to egress interface outside_1
Untranslate 172.31.10.9/80 to 172.31.10.9/80

Phase: 2
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (inside,outside_1) source static LAN LAN destination static MSKNET MSKNET
Additional Information:
Static translate 10.20.2.8/80 to 10.20.2.8/80

Phase: 3
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 4
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 5
Type: VPN
Subtype: encrypt
Result: DROP
Config:
Additional Information:

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside_1
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

But:

S* 0.0.0.0 0.0.0.0 [1/0] via , outside_2

IPSec traffic go via outside_1 only.

Config:

ASA Version 9.8(2)
!
interface GigabitEthernet1/1
 description PRIMARY_CHANNEL
 mac-address cccc.dddd.bbbb
 nameif outside_1
 security-level 0
 ip address dhcp setroute
!
interface GigabitEthernet1/2
 description STANDBY_CHANNEL
 mac-address aaaa.4444.5555
 nameif outside_2
 security-level 0
 ip address dhcp setroute
!
interface GigabitEthernet1/3
 nameif inside
 security-level 100
 ip address 10.20.2.1 255.255.255.0
!
object network INTERNET-1
 subnet 10.20.2.0 255.255.255.0
 description PRIMARY_CHANNEL
object network INTERNET-2
 subnet 10.20.2.0 255.255.255.0
 description STANDBY_CHANNEL
object network LAN 
 subnet 10.20.2.0 255.255.255.0 
!
access-list moscow_ipsec extended permit ip object LAN object-group MSKNET
pager lines 24
logging asdm informational
mtu outside_1 1500
mtu outside_2 1500
mtu inside 1500
no failover
no monitor-interface service-module
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
nat (inside,outside_1) source static LAN LAN destination static MSKNET MSKNET
nat (inside,outside_2) source static LAN LAN destination static MSKNET MSKNET
!
object network INTERNET-1
 nat (inside,outside_1) dynamic interface
object network INTERNET-2
 nat (inside,outside_2) dynamic interface
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
aaa authentication http console LOCAL
aaa authentication serial console LOCAL
aaa authentication login-history
no snmp-server location
no snmp-server contact
sla monitor 1
 type echo protocol ipIcmpEcho 11.22.33.44 interface outside_1
 num-packets 3
 timeout 500
 frequency 3
sla monitor schedule 1 life forever start-time now
service sw-reset-button
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec security-association pmtu-aging infinite
crypto map MSK 10 match address moscow_ipsec
crypto map MSK 10 set pfs
crypto map MSK 10 set peer 11.22.33.44
crypto map MSK 10 set ikev1 transform-set ESP-AES-256-SHA
crypto map MSK interface outside_1
crypto map MSK interface outside_2
crypto ca trustpool policy
crypto isakmp nat-traversal 10
crypto ikev1 enable outside_1
crypto ikev1 enable outside_2
crypto ikev1 policy 10
 authentication pre-share
 encryption aes-256
 hash sha
 group 2
 lifetime 86400
!
track 1 rtr 1 reachability
tunnel-group 11.22.33.44 type ipsec-l2l
tunnel-group 11.22.33.44 ipsec-attributes
 ikev1 pre-shared-key *****
!
class-map inspection_default
 match default-inspection-traffic
!

UPD: Removed cable from outside_1 and IPSec started:

KEv1 SAs:

   Active SA: 1
    Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1

1   IKE Peer: 11.22.33.44
    Type    : L2L             Role    : responder
    Rekey   : no              State   : MM_ACTIVE

There are no IKEv2 SAs 

But not for long:

IKEv1 SAs:

   Active SA: 1
    Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1

1   IKE Peer: 11.22.33.44
    Type    : user            Role    : initiator
    Rekey   : no              State   : MM_WAIT_MSG2

There are no IKEv2 SAs

From other side:

Session Type: LAN-to-LAN

Connection   : 99.99.99.99
Index        : 12009                  IP Addr      : 99.99.99.99
Protocol     : IKEv1 IPsec
Encryption   : IKEv1: (1)AES256  IPsec: (1)AES256
Hashing      : IKEv1: (1)SHA1  IPsec: (1)SHA1
Bytes Tx     : 223                    Bytes Rx     : 0
Login Time   : 16:27:25 MSK Thu Jan 9 2020
Duration     : 0h:00m:20s 

UPD2: Firewall rebooted, link outside_1 is down and IPSec started.

Session Type: LAN-to-LAN

Connection   : 99.99.99.99
Index        : 12014                  IP Addr      : 99.99.99.99
Protocol     : IKEv1 IPsec
Encryption   : IKEv1: (1)AES256  IPsec: (1)AES256
Hashing      : IKEv1: (1)SHA1  IPsec: (1)SHA1
Bytes Tx     : 20065                  Bytes Rx     : 12338
Login Time   : 16:43:55 MSK Thu Jan 9 2020
Duration     : 0h:06m:05s
  • Unless you simply didn't include it in your config output, your NAT-exempt statements are referencing an object-group called MSKNET that doesn't actually exist in your configs, so the NAT exemptions are doing nothing and traffic will always hit your global NAT statements. – Jesse P. Jan 9 at 16:47
  • @JesseP. The object-group MSKNET is exist and not empty. I just didn't include it in the sample configuration, because I don't think it's the case. – Ruslan Jan 9 at 18:50
  • 1
    Okay. In the future, please don't leave things like that out of the config output - NAT (or lack thereof) can be where the problem is, and without seeing all of the details such as an object/object-group being referenced in a NAT statement, we may end up giving incorrect information or be unable to help at all. – Jesse P. Jan 9 at 19:04
  • @JesseP. I got it. Thank you! Problem solved. Decision bellow by Ricky Beam. – Ruslan Jan 9 at 19:11
  • 1
    Cool. Please keep in mind the comment I added to Ricky's answer, to avoid issues caused by NAT'ing to the wrong interface because of using the "any" statement. – Jesse P. Jan 9 at 19:23
2

Your before-auto nat is forcing traffic to outside_1. Try changing the two nat (inside,outside_#) statements to a single nat (inside,any) rule.

(I have a similar setup to intentionally drive SMTP traffic to a specific interface -- and address.)

| improve this answer | |
  • 1
    You should try to avoid using "any" in a NAT statement - it can cause traffic to be incorrectly NATed or exempted from NAT, and send raffic through the wrong interface. If you're going to do it, you should make sure to also add route-lookup and possibly no-proxy-arp to the end of the statement. – Jesse P. Jan 9 at 16:51
  • @RickyBeam Thank you so much! IPSec strated via outside_2! :-) Session Type: LAN-to-LAN Connection : Index : 59728 IP Addr : Protocol : IKEv1 IPsec Encryption : IKEv1: (1)AES256 IPsec: (3)AES256 Hashing : IKEv1: (1)SHA1 IPsec: (3)SHA1 Bytes Tx : 81675 Bytes Rx : 235083 Login Time : 21:55:13 TAVRIDA Thu Jan 9 2020 Duration : 0h:14m:01s – Ruslan Jan 9 at 19:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.