Friday, August 2, 2019

Cisco ASA S2S VPN, no encaps only decaps

I'm trying to ping across a S2S VPN but it's failing, phase 1 is MM_Active, phase 2 has 0 encaps and some decaps.

access-list OUTSIDE_cryptomap_3 extended permit ip 10.10.12.0 255.255.255.0 10.134.151.0 255.255.255.0

local ident (addr/mask/prot/port): (10.10.12.0/255.255.255.0/0/0)

remote ident (addr/mask/prot/port): (10.134.151.0/255.255.255.0/0/0)

current_peer:

#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0

#pkts decaps: 9382, #pkts decrypt: 9382, #pkts verify: 9382

I'm sourcing a ping from Site A(3rd party FW) to Site B(this Cisco ASA and stats). When I run a capture on site B's server I don't see the ping come in. When I capture on the ASA's inside interface I don't see it come in. It seems to be getting dropped between the tunnel and inside interface.

Any help is appreciated.



No comments:

Post a Comment