0

My end of the tunnel is on an ASAv in AWS. (version 9.14)

show crypto isakmp sa

4   IKE Peer: 212.239.x.y
    Type    : L2L             Role    : responder 
    Rekey   : no              State   : MM_ACTIVE 
asav(config)# show crypto ipsec sa peer 212.239.x.y
peer address: 212.239.x.y
    Crypto map tag: outside_map8, seq num: 3, local addr: 192.168.1.13

      access-list outside_cryptomap_client extended permit ip 192.168.10.0 255.255.255.0 host 10.11.0.168 
      local ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0)
      remote ident (addr/mask/prot/port): (10.11.0.168/255.255.255.255/0/0)
      current_peer: 212.239.122.230


      #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
      #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #TFC rcvd: 0, #TFC sent: 0
      #Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 192.168.1.13/4500, remote crypto endpt.: 212.239.x.y/4500
      path mtu 1500, ipsec overhead 66(44), media mtu 1500
      PMTU time remaining (sec): 0, DF policy: copy-df
      ICMP error validation: disabled, TFC packets: disabled
      current outbound spi: 28DDBAD7
      current inbound spi : 8E3584C7

    inbound esp sas:
      spi: 0x8E3584C7 (2385872071)
         SA State: active
         transform: esp-3des esp-sha-hmac no compression 
         in use settings ={L2L, Tunnel,  NAT-T-Encaps, IKEv1, }
         slot: 0, conn_id: 151, crypto-map: outside_map8
         sa timing: remaining key lifetime (kB/sec): (3915000/3011)
         IV size: 8 bytes
         replay detection support: Y
         Anti replay bitmap: 
          0x00000000 0x00000001
    outbound esp sas:
      spi: 0x28DDBAD7 (685619927)
         SA State: active
         transform: esp-3des esp-sha-hmac no compression 
         in use settings ={L2L, Tunnel,  NAT-T-Encaps, IKEv1, }
         slot: 0, conn_id: 151, crypto-map: outside_map8
         sa timing: remaining key lifetime (kB/sec): (3915000/3011)
         IV size: 8 bytes
         replay detection support: Y
         Anti replay bitmap: 
          0x00000000 0x00000001

However in the the debug logs i see this:

IKEv1 was unsuccessful at setting up a tunnel.  Map Tag = outside_map8.  Map Sequence Number = 3.
Tunnel Manager has failed to establish an L2L SA.  All configured IKE versions failed to establish the tunnel. Map Tag= outside_map8.  Map Sequence Number = 3.

How can the tunnel be up, but yet refuse to pass traffic?

packet-tracer input inside tcp 192.168.2.203 1065 10.11.0.168 80 detailed

Phase: 8
Type: VPN
Subtype: encrypt
Result: DROP
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 out id=0x7ff8b915de90, priority=70, domain=encrypt, deny=false
        hits=2030, user_data=0x0, cs_id=0x7ff8b98e08d0, reverse, flags=0x0, protocol=0
        src ip/id=192.168.10.0, mask=255.255.255.0, port=0, tag=any
        dst ip/id=10.11.0.168, mask=255.255.255.255, port=0, tag=any, dscp=0x0
        input_ifc=any, output_ifc=outside


4
  • 1
    The tunnel is not up. MM_active means it’s trying to establish. When the tunnel is up, you’ll see MM_Idle
    – Ron Trunk
    Jun 9, 2022 at 21:44
  • You need to show us the tunnel config from both sides so we can see what may be wrong. Without that, we can’t help.
    – Jesse P.
    Jun 9, 2022 at 22:34
  • @RonTrunk: all my tunnels that are up and passing traffic show "MM_ACTIVE". (from "sh crypto isakmp sa"). where would I see MM_Idle?
    – Chris Holt
    Jun 9, 2022 at 23:44
  • I'm pulling from memory here, but I think MM_Active on an ASA is equivalent to QM_idle on a router. I don't think MM_idle is a real state. Nov 18, 2022 at 0:27

1 Answer 1

1

There were 4 hosts on the remote side of the tunnel. I had accidentally listed them twice in the object group for the NAT rule. Once I corrected that mistake everything worked.

1
  • Good deal. Glad you figured it out.
    – Jesse P.
    Jun 10, 2022 at 0:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.