Troubleshooting ipsec ikev2 site to site vpn

Question

I assume, for peer IP we use, is the wan interface of the Cisco ASA and not the gateway of the ISP correct? Also, all routes should go to the same IP of the wan interface correct?

So we have two Cisco ASA 5500 series and a pair of ISPs connected for redundancy. We want to route the traffic to go through our ISP2. But the problem I don't have experience in is this ISP does not route our static IPs for us. We have a block of static IPs facing the public, and have to have a router which points all the traffic to our router/gateway which points all the traffic to the ISP.

Setting up the site to site VPN, I have set up to go out the ISP2 interface which has an assigned static ip on our ASA but can't seem to get things working. Right now, all traffic has a static rule to send all traffic to the ISP gateway on the router at the edge going to the hand off.

Configs of both sites ASA are below and the show crypto ipsec sa and trace routes. Usually the first trace route fails, not sure if this is normal? Second time usually always works and we could see the session start up in the ASDM session profile. However, can't ping between networks. Ideas?

Site A

 ---------------------------------------------------- 
Objects
 ---------------------------------------------------- 
object network DataSeg13  subnet 10.113.0.0 255.255.0.0 
object network
 SiteBRemote10.1.10.0Network subnet 10.1.10.0 255.255.255.248
 
 
 
 
 ---------------------------------------------------- 
Define IKEv2 Policy:
 ---------------------------------------------------- 
crypto ikev2 policy 1  encryption aes-256  integrity sha  group 5 2  prf sha 
 lifetime seconds 86400 crypto ikev2 enable ISP_2_WANInterface
 
 
 ---------------------------------------------------- 
Define IPsec Transform Set:
 ---------------------------------------------------- 
crypto ipsec ikev2 ipsec-proposal AES256  protocol esp encryption aes-256  protocol
 esp integrity sha-1 md5
 
 
 ---------------------------------------------------- 
Create Tunnel Group:
 ---------------------------------------------------- 
tunnel-group [SITE B PUBLIC WAN IP] type ipsec-l2l tunnel-group [SITE B PUBLIC WAN
 IP] general-attributes  default-group-policy GroupPolicy_[SITE B
 PUBLIC WAN IP] tunnel-group [SITE B PUBLIC WAN IP] ipsec-attributes
 ikev2 remote-authentication pre-shared-key ***** ikev2
 local-authentication pre-shared-key *****
 
 
 
 
 
 
 
 ---------------------------------------------------- 
Configure Crypto Map:
 ---------------------------------------------------- 
crypto map ISP_2_WANInterface_map 3 match address ISP_2_WANInterface_cryptomap
 crypto map ISP_2_WANInterface_map 3 set peer [SITE B PUBLIC WAN IP]
 crypto map ISP_2_WANInterface_map 3 set ikev2 ipsec-proposal AES256
 AES192 AES 3DES DES crypto map ISP_2_WANInterface_map interface
 ISP_2_WANInterface
 
 crypto map ISP_2_WANInterface_map 3 set ikev1 transform-set
 ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5
 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA
 ESP-DES-MD5
 
 
 
 
 
 ---------------------------------------------------- 
Define Access List for VPN Traffic:
 ---------------------------------------------------- 
access-list ISP_2_WANInterface_cryptomap extended permit ip object DataSeg13
 object SiteBRemote10.1.10.0Network 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 ---------------------------------------------------- 
Static Route and Static Route to Direct VPN Traffic to ISP2:
 ---------------------------------------------------- 
route ISP_2_WANInterface 0.0.0.0 0.0.0.0 [SITE A WAN IP OF THE GATEWAY] 5
 route ISP_2_WANInterface 10.1.10.0 255.255.255.248 [SITE A WAN IP OF
 THE GATEWAY] 1

Site B

----------------------------------------------------
Objects
----------------------------------------------------
object network 10.113.0.0-network subnet 10.113.0.0 255.255.0.0







----------------------------------------------------
Define IKEv2 Policy
----------------------------------------------------
crypto ikev2 policy 1
 encryption aes-256
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
 crypto ikev2 enable outside


----------------------------------------------------
Define IPsec Transform Set
----------------------------------------------------
crypto ipsec ikev2 ipsec-proposal AES256
 protocol esp encryption aes-256
 protocol esp integrity sha-1 md5


----------------------------------------------------
Create Tunnel Group
----------------------------------------------------
tunnel-group [SITE A PUBLIC WAN IP] type ipsec-l2l
tunnel-group [SITE A PUBLIC WAN IP] general-attributes
 default-group-policy GroupPolicy_[SITE A PUBLIC WAN IP]
tunnel-group [SITE A PUBLIC WAN IP] ipsec-attributes
 ikev1 pre-shared-key *****
 ikev2 remote-authentication pre-shared-key *****
 ikev2 local-authentication pre-shared-key *****







----------------------------------------------------

Configure Crypto Map
----------------------------------------------------

crypto map outside_map 3 match address outside_cryptomap_2
crypto map outside_map 3 set peer [SITE A PUBLIC WAN IP]
crypto map outside_map 3 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 3 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
crypto map outside_map interface outside




----------------------------------------------------
Define Access List for VPN Traffic
----------------------------------------------------
access-list outside_cryptomap extended permit ip 10.1.10.0 255.255.255.248 object 10.113.0.0-network 
access-list outside_cryptomap_1 extended permit ip 10.1.10.0 255.255.255.0 object 10.113.0.0-network 
access-list outside_cryptomap_2 extended permit ip 10.1.10.0 255.255.255.0 object 10.113.0.0-network 
access-list SITE_A_OFFICE_ACCESS extended deny ip 10.113.0.0 255.255.255.0 host 10.1.10.1 log 
access-list SITE_A_OFFICE_ACCESS extended permit ip 10.113.0.0 255.255.0.0 10.1.10.0 255.255.255.248 log 



----------------------------------------------------
Static Route and Static Route to Direct VPN Traffic to ISP1:
----------------------------------------------------
route outside 0.0.0.0 0.0.0.0 [SITE B WAN IP OF THE GATEWAY] 1

SHOW LOGS

ASA-1/pri/act# show crypto ipsec sa
Doesn’t show the active vpn connection

ASA-1/pri/act# packet-tracer input inside tcp 10.113.1.11 500 10.1.10.$

Phase: 1
Type: ACCESS-LIST
Subtype: 
Result: ALLOW
Config:
Implicit Rule
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0x7f842969c270, priority=1, domain=permit, deny=false
        hits=4040842493, user_data=0x0, cs_id=0x0, l3_type=0x8
        src mac=0000.0000.0000, mask=0000.0000.0000
        dst mac=0000.0000.0000, mask=0100.0000.0000
        input_ifc=inside, output_ifc=any

Phase: 2
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop [SITE A WAN IP OF THE GATEWAY] using egress ifc  ISP_2_WANInterface

Phase: 3
Type: UN-NAT
Subtype: static
Result: ALLOW 
Config:       
nat (inside,ISP_2_WANInterface) source static DataSeg13 DataSeg13 destination static SiteBRemote10.1.10.0NetworkNetwork SiteBRemote10.1.10.0NetworkNetwork no-proxy-arp route-lookup
Additional Information:
NAT divert to egress interface ISP_2_WANInterface
Untranslate 10.1.10.1/500 to 10.1.10.1/500
              
Phase: 4      
Type: ACCESS-LIST
Subtype: log  
Result: ALLOW 
Config:       
access-group inside_access_in in interface inside
access-list inside_access_in extended permit ip any any 
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0x7f8429682c10, priority=13, domain=permit, deny=false
        hits=51084378, user_data=0x7f841ed55ec0, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
        input_ifc=inside, output_ifc=any
              
Phase: 5      
Type: CONN-SETTINGS
Subtype:      
Result: ALLOW 
Config:       
class-map class-default
 match any    
policy-map global_policy
 class class-default
  set connection decrement-ttl
service-policy global_policy global
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0x7f842aa194d0, priority=7, domain=conn-set, deny=false
        hits=56857924, user_data=0x7f842aa15340, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
        input_ifc=inside, output_ifc=any
              
Phase: 6      
Type: NAT     
Subtype:      
Result: ALLOW 
Config:       
nat (inside,ISP_2_WANInterface) source static DataSeg13 DataSeg13 destination static SiteBRemote10.1.10.0NetworkNetwork SiteBRemote10.1.10.0NetworkNetwork no-proxy-arp route-lookup
Additional Information:
Static translate 10.113.1.11/500 to 10.113.1.11/500
 Forward Flow based lookup yields rule:
 in  id=0x7f842758d3a0, priority=6, domain=nat, deny=false
        hits=14, user_data=0x7f8429e166d0, cs_id=0x0, flags=0x0, protocol=0
        src ip/id=DataSeg13, mask=255.255.0.0, port=0, tag=any
        dst ip/id=10.1.10.0, mask=255.255.255.248, port=0, tag=any, dscp=0x0
        input_ifc=inside, output_ifc=ISP_2_WANInterface
              
Phase: 7      
Type: NAT     
Subtype: per-session
Result: ALLOW 
Config:       
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0x7f84288c6380, priority=0, domain=nat-per-session, deny=false
        hits=110098636, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=6
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
        input_ifc=any, output_ifc=any
              
Phase: 8      
Type: IP-OPTIONS
Subtype:      
Result: ALLOW 
Config:       
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0x7f84296a38b0, priority=0, domain=inspect-ip-options, deny=true
        hits=68976842, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
        input_ifc=inside, output_ifc=any
              
Phase: 9      
Type: SFR     
Subtype:      
Result: ALLOW 
Config:       
class-map sfr 
 match access-list sfr_redirect
policy-map global_policy
 class sfr    
  sfr fail-open monitor-only
service-policy global_policy global
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0x7f842b2e5d40, priority=71, domain=sfr, deny=false
        hits=70517966, user_data=0x7f842abc8bd0, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
        input_ifc=inside, output_ifc=any
              
Phase: 10     
Type: FOVER   
Subtype: standby-update
Result: ALLOW 
Config:       
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0x7f8429a56720, priority=20, domain=lu, deny=false
        hits=46497807, user_data=0x0, cs_id=0x0, flags=0x0, protocol=6
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
        input_ifc=inside, output_ifc=any
              
Phase: 11     
Type: VPN     
Subtype: encrypt
Result: DROP  
Config:       
Additional Information:
 Forward Flow based lookup yields rule:
 out id=0x7f842a925010, priority=70, domain=encrypt, deny=false
        hits=11, user_data=0x0, cs_id=0x7f842a8beb40, reverse, flags=0x0, protocol=0
        src ip/id=DataSeg13, mask=255.255.0.0, port=0, tag=any
        dst ip/id=10.1.10.0, mask=255.255.255.248, port=0, tag=any, dscp=0x0
        input_ifc=any, output_ifc=ISP_2_WANInterface
              
Result:       
input-interface: inside
input-status: up
input-line-status: up
output-interface: ISP_2_WANInterface
output-status: up
output-line-status: up
Action: drop  
Drop-reason: (acl-drop) Flow is denied by configured rule
              

—------------------------------------------
TRIED AGAIN SAME THING
—------------------------------------------

ASA-1/pri/act# 
ASA-1/pri/act# packet-tracer input inside tcp 10.113.1.11 500 10.1.10.$

Phase: 1
Type: ACCESS-LIST
Subtype: 
Result: ALLOW
Config:
Implicit Rule
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0x7f842969c270, priority=1, domain=permit, deny=false
        hits=4041271514, user_data=0x0, cs_id=0x0, l3_type=0x8
        src mac=0000.0000.0000, mask=0000.0000.0000
        dst mac=0000.0000.0000, mask=0100.0000.0000
        input_ifc=inside, output_ifc=any

Phase: 2
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop [SITE A WAN IP OF THE GATEWAY] using egress ifc  ISP_2_WANInterface

Phase: 3
Type: UN-NAT
Subtype: static
Result: ALLOW 
Config:       
nat (inside,ISP_2_WANInterface) source static DataSeg13 DataSeg13 destination static SiteBRemote10.1.10.0NetworkNetwork SiteBRemote10.1.10.0NetworkNetwork no-proxy-arp route-lookup
Additional Information:
NAT divert to egress interface ISP_2_WANInterface
Untranslate 10.1.10.1/500 to 10.1.10.1/500

Phase: 4
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group inside_access_in in interface inside
access-list inside_access_in extended permit ip any any 
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0x7f8429682c10, priority=13, domain=permit, deny=false
        hits=51088859, user_data=0x7f841ed55ec0, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
        input_ifc=inside, output_ifc=any

Phase: 5
Type: CONN-SETTINGS
Subtype: 
Result: ALLOW
Config:
class-map class-default
 match any
policy-map global_policy
 class class-default
  set connection decrement-ttl
service-policy global_policy global
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0x7f842aa194d0, priority=7, domain=conn-set, deny=false
        hits=56862405, user_data=0x7f842aa15340, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
        input_ifc=inside, output_ifc=any

Phase: 6
Type: NAT
Subtype: 
Result: ALLOW
Config:
nat (inside,ISP_2_WANInterface) source static DataSeg13 DataSeg13 destination static SiteBRemote10.1.10.0NetworkNetwork SiteBRemote10.1.10.0NetworkNetwork no-proxy-arp route-lookup
Additional Information:
Static translate 10.113.1.11/500 to 10.113.1.11/500
 Forward Flow based lookup yields rule:
 in  id=0x7f842758d3a0, priority=6, domain=nat, deny=false
        hits=15, user_data=0x7f8429e166d0, cs_id=0x0, flags=0x0, protocol=0
        src ip/id=DataSeg13, mask=255.255.0.0, port=0, tag=any
        dst ip/id=10.1.10.0, mask=255.255.255.248, port=0, tag=any, dscp=0x0
        input_ifc=inside, output_ifc=ISP_2_WANInterface

Phase: 7
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0x7f84288c6380, priority=0, domain=nat-per-session, deny=false
        hits=110106939, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=6
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
        input_ifc=any, output_ifc=any

Phase: 8
Type: IP-OPTIONS
Subtype: 
Result: ALLOW
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0x7f84296a38b0, priority=0, domain=inspect-ip-options, deny=true
        hits=68982554, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
        input_ifc=inside, output_ifc=any
              
Phase: 9      
Type: SFR     
Subtype:      
Result: ALLOW 
Config:       
class-map sfr 
 match access-list sfr_redirect
policy-map global_policy
 class sfr    
  sfr fail-open monitor-only
service-policy global_policy global
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0x7f842b2e5d40, priority=71, domain=sfr, deny=false
        hits=70522700, user_data=0x7f842abc8bd0, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
        input_ifc=inside, output_ifc=any
              
Phase: 10     
Type: FOVER   
Subtype: standby-update
Result: ALLOW 
Config:       
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0x7f8429a56720, priority=20, domain=lu, deny=false
        hits=46500984, user_data=0x0, cs_id=0x0, flags=0x0, protocol=6
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
        input_ifc=inside, output_ifc=any

Phase: 11
Type: VPN
Subtype: encrypt
Result: ALLOW
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 out id=0x7f842ca06180, priority=70, domain=encrypt, deny=false
        hits=1, user_data=0x578216c, cs_id=0x7f842a8beb40, reverse, flags=0x0, protocol=0
        src ip/id=DataSeg13, mask=255.255.0.0, port=0, tag=any
        dst ip/id=10.1.10.0, mask=255.255.255.248, port=0, tag=any, dscp=0x0
        input_ifc=any, output_ifc=ISP_2_WANInterface

Phase: 12
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
nat (inside,ISP_2_WANInterface) source static DataSeg13 DataSeg13 destination static SiteBRemote10.1.10.0NetworkNetwork SiteBRemote10.1.10.0NetworkNetwork no-proxy-arp route-lookup
Additional Information:
 Forward Flow based lookup yields rule:
 out id=0x7f842e137ac0, priority=6, domain=nat-reverse, deny=false
        hits=15, user_data=0x7f8429e1a5a0, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
        src ip/id=DataSeg13, mask=255.255.0.0, port=0, tag=any
        dst ip/id=10.1.10.0, mask=255.255.255.248, port=0, tag=any, dscp=0x0
        input_ifc=inside, output_ifc=ISP_2_WANInterface

Phase: 13
Type: VPN
Subtype: ipsec-tunnel-flow
Result: ALLOW
Config:
Additional Information:
 Reverse Flow based lookup yields rule:
 in  id=0x7f842c94a2a0, priority=70, domain=ipsec-tunnel-flow, deny=false
        hits=1, user_data=0x5784a2c, cs_id=0x7f842a8beb40, reverse, flags=0x0, protocol=0
        src ip/id=10.1.10.0, mask=255.255.255.248, port=0, tag=any
        dst ip/id=DataSeg13, mask=255.255.0.0, port=0, tag=any, dscp=0x0
        input_ifc=ISP_2_WANInterface, output_ifc=any

Phase: 14
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
 Reverse Flow based lookup yields rule:
 in  id=0x7f84288c6380, priority=0, domain=nat-per-session, deny=false
        hits=110106941, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=6
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
        input_ifc=any, output_ifc=any

Phase: 15
Type: IP-OPTIONS
Subtype: 
Result: ALLOW
Config:
Additional Information:
 Reverse Flow based lookup yields rule:
 in  id=0x7f842963f140, priority=0, domain=inspect-ip-options, deny=true
        hits=9583840, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
        input_ifc=ISP_2_WANInterface, output_ifc=any

Phase: 16     
Type: FLOW-CREATION
Subtype: 
Result: ALLOW
Config:
Additional Information:
New flow created with id 77534832, packet dispatched to next module
Module information for forward flow ...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_tcp_normalizer
snp_sfr
snp_fp_translate
snp_fp_tcp_normalizer
snp_fp_adjacency
snp_fp_encrypt
snp_fp_fragment
snp_ifc_stat

Module information for reverse flow ...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_ipsec_tunnel_flow
snp_fp_tcp_normalizer
snp_fp_translate
snp_sfr
snp_fp_tcp_normalizer
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: ISP_2_WANInterface
output-status: up
output-line-status: up
Action: allow

Show ipsec sa results after doing the packet tracer, the VPN session shows in show ipsec sa. But not data, and cannot ping any devices over there.

interface: ISP_2_WANInterface
    Crypto map tag: ISP_2_WANInterface_map, seq num: 3, local addr: [IP of WAN INTERFACE OF ASA_ISP2]

      access-list ISP_2_WANInterface_cryptomap extended permit ip 10.113.0.0 255.255.0.0 10.1.10.0 255.255.255.248 
      local ident (addr/mask/prot/port): (DataSeg13/255.255.0.0/0/0)
      remote ident (addr/mask/prot/port): (10.1.10.0/255.255.255.248/0/0)
      current_peer: [SITE B PUBLIC WAN IP]


      #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
      #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #TFC rcvd: 0, #TFC sent: 0
      #Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: [IP of WAN INTERFACE OF ASA_ISP2]/500, remote crypto endpt.: [SITE B PUBLIC WAN IP]/500
      path mtu 1500, ipsec overhead 74(44), media mtu 1500
      PMTU time remaining (sec): 0, DF policy: copy-df
      ICMP error validation: disabled, TFC packets: disabled
      current outbound spi: C00A8628
      current inbound spi : 30B4CF8E

    inbound esp sas:
      spi: 0x30B4CF8E (817155982)
         SA State: active
         transform: esp-aes-256 esp-sha-hmac no compression 
         in use settings ={L2L, Tunnel, IKEv2, }
         slot: 0, conn_id: 247746560, crypto-map: ISP_2_WANInterface_map
         sa timing: remaining key lifetime (kB/sec): (4147200/28771)
         IV size: 16 bytes
         replay detection support: Y
         Anti replay bitmap: 
          0x00000000 0x00000001
    outbound esp sas:
      spi: 0xC00A8628 (3221915176)
         SA State: active
         transform: esp-aes-256 esp-sha-hmac no compression 
         in use settings ={L2L, Tunnel, IKEv2, }
         slot: 0, conn_id: 247746560, crypto-map: ISP_2_WANInterface_map
         sa timing: remaining key lifetime (kB/sec): (4008960/28771)
         IV size: 16 bytes
         replay detection support: Y
         Anti replay bitmap: 
          0x00000000 0x00000001

FrameHowitzer · Accepted Answer · 2023-12-12 00:36:47Z

I'm having a really hard time reading your original posted format of copied information, it seems to be lacking a lot of newline characters so the configuration and debug output is all jumbled.

Here are a number of good resources for the basic idea of Cisco ASA firewalls with Dual WAN (ISP) and VPN Site-to-Site tunnel configurations. There are several methods to accomplish that task and it depends on the version of ASA software you have and your specific network design.

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/118962-configure-asa-00.html

https://integratingit.wordpress.com/2023/02/11/asa-dual-isp-backup-vpn/

https://integratingit.wordpress.com/2023/02/12/asa-vpn-preempt/

https://community.cisco.com/t5/vpn/cisco-asa-dual-isp-vpn-redundancy/td-p/1723979

https://community.cisco.com/t5/vpn/dual-isp-failover-for-s2s-vpn/td-p/4094917

https://community.cisco.com/t5/vpn/vpn-setup-for-dual-isp-asa/td-p/3352808

https://community.cisco.com/t5/vpn/cisco-asa-dual-isp-vpn-redundancy/td-p/1723979

https://community.cisco.com/t5/vpn/asa-ipsec-vpn-with-two-active-isp/td-p/2507521/page/2

The primary concepts are that you need to:

Make sure your second internet service is working
Configure the routes so the VPN peer is reachable via the second internet service
Configure NAT (and 'NAT bypass' if desired for the VPN) for the second internet service interface
Configure and apply the crypto map(s) to the second internet service interface (and primary if you want to fail to it)
Make sure the peer is configured to connect to the second internet IP address, not the primary

This example uses FTD rather than native ASA software but the concepts are the same and configuration is largely the same.

https://www.cisco.com/c/en/us/support/docs/security-vpn/security-vpn/216709-configure-failover-for-ipsec-site-to-sit.html

This guide is for a design using virtual tunnel interfaces instead of policy based tunnels (and BGP for route sharing)

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-firewalls/212478-configure-asa-virtual-tunnel-interfaces.html

Take a look through those guides and try to make your VPN configuration use only the secondary internet service first. Then work on making it fail to the primary when needed once you know it works on the secondary service.

As a final observation, your use of packet tracer is consistent with how things should work if the VPN is functioning. The first attempt will fail since the tunnel is not up. The second will proceed through the tunnel and that appears to be what happened. It was sent through the tunnel successfully.

Are you sure it is not working already?

Can you look again, I fixed to make it easier to look. I have reviewed, I don't see anything wrong? — user1378803, Commented Dec 13, 2023 at 20:34
Your packet tracer output indicates that the VPN tunnel is up and working. Try checking the output of 'show crypto ipsec sa' to see if there is a VPN tunnel session and then verify whether traffic is going into it via the counters shown in the output of that command. Test pinging from a device inside one firewall to a device inside the other firewall and see if the counters on the output of 'show crypto ipsec sa' are incremented. — FrameHowitzer, Commented Dec 13, 2023 at 21:25
I did, there is a vpn tunnel session, but no traffic shown. Also cannot ping anything on the devices on the inside of the other firewall. — user1378803, Commented Dec 13, 2023 at 22:31
@user1378803, did you configure any routing across the tunnel? — Ron Maupin, Commented Dec 13, 2023 at 22:42
Ron, no routing. I assumed it's over a tunnel and should work? Just sent all routes to the WAN of the ASA. — user1378803, Commented Dec 13, 2023 at 22:58

Stack Exchange Network

Troubleshooting ipsec ikev2 site to site vpn

SHOW LOGS

1 Answer 1

Your Answer

Not the answer you're looking for? Browse other questions tagged
cisco-asa
vpn
or ask your own question.

Hot Network Questions

Troubleshooting ipsec ikev2 site to site vpn

SHOW LOGS

1 Answer 1

Your Answer

Sign up or log in

Post as a guest

Not the answer you're looking for? Browse other questions tagged cisco-asavpn or ask your own question.

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
cisco-asa
vpn
or ask your own question.