1

I've some problem with IPSEC tunnel between Cisco ASA and Fortigate. For some reason, packet 10.12.4.0/12 to 192.168.0.0/16 drops by ASA, despite the fact 192.168.0.0/16 is present in crypto ACL. Can you help me find out the cause of the problem? Why scr 10.12.4.0/24 dst 192.168.0.0/16 packets are drops?

You can see packets drop from a packet-tracker output:

packet-tracer input inside icmp 10.12.4.100 0 8 192.168.2.30 detailed 

Phase: 10
Type: VPN
Subtype: encrypt
Result: **DROP**
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 out id=0xccc567c8, priority=70, domain=encrypt, deny=false
        hits=4, user_data=0x0, cs_id=0xccc53c18, reverse, flags=0x0, protocol=0
        src ip/id=10.12.7.0, mask=255.255.255.0, port=0, tag=0
        dst ip/id=192.168.0.0, mask=255.255.0.0, port=0, tag=0, dscp=0x0
        input_ifc=any, output_ifc=outside

But if I do packet-tracer to another dst ip address which present in crypto ACL, that packet allow:

packet-tracer input inside icmp 10.12.4.100 0 8 172.16.213.1 detailed 

Phase: 9
Type: VPN
Subtype: encrypt
Result: ALLOW
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 out id=0xcc201ca0, priority=70, domain=encrypt, deny=false
        hits=2259, user_data=0x7cd824, cs_id=0xccc4b3f0, reverse, flags=0x0, protocol=0
        src ip/id=10.12.4.0, mask=255.255.255.0, port=0, tag=0
        dst ip/id=172.16.0.0, mask=255.255.0.0, port=0, tag=0, dscp=0x0
        input_ifc=any, output_ifc=outside

The whole sh run crypto is:

object-group network GO-nets
 network-object 172.16.0.0 255.255.0.0
 network-object 172.17.0.0 255.255.0.0
 network-object 10.12.0.0 255.255.255.0
 network-object 172.18.114.0 255.255.255.0
 network-object 192.168.0.0 255.255.0.0

object network inside-net
 subnet 10.12.4.0 255.255.255.0

access-list 100 extended permit ip object inside-net object-group GO-nets

crypto ipsec ikev1 transform-set myset esp-3des esp-md5-hmac 
crypto ipsec security-association pmtu-aging infinite
crypto map outside_map 20 match address 100
crypto map outside_map 20 set peer xxx 
crypto map outside_map 20 set ikev1 transform-set myset
crypto map outside_map 23 match address 103
crypto map outside_map 23 set peer xxx 
crypto map outside_map 23 set ikev1 transform-set myset
crypto map outside_map interface outside
crypto ca trustpool policy
crypto ikev1 enable outside
crypto ikev1 policy 10
 authentication pre-share
 encryption 3des
 hash md5
 group 5
 lifetime 28800
tunnel-group xxx type ipsec-l2l
tunnel-group xxx ipsec-attributes
 ikev1 pre-shared-key *****
tunnel-group xxx type ipsec-l2l
tunnel-group xxx ipsec-attributes
 ikev1 pre-shared-key *****
!
3
  • When you use packet-tracer to simulate VPN traffic you have to run it at least twice before you'll see accurate behavior (whether allowed or denied) because the first attempt will bring up the tunnel but packet-tracer will continue before the tunnel has fully been established, so you run it a second time to see the results now that the tunnel is established and won't cause a delay. If the tunnel is already established before you run the first packet-tracer, and it's still being denied, THAT is indicative of a problem we can work on, but you'll need to post sanitized configs from both firewalls – Jesse P. Mar 26 at 14:34
  • Do you still require assistance or did you figure out what you needed? – Jesse P. Mar 28 at 0:59
  • I'm going to vote to close this question because you haven't responded to whether or not you still need assistance. – Jesse P. Apr 21 at 2:19

Browse other questions tagged or ask your own question.