topic Re: IPSEC with Cisco ASA in General Topics

IPSEC with Cisco ASA

danielstevenson — Wed, 08 May 2013 20:12:42 GMT

Hello everyone. I'm hoping someone may be able to help me out with this. I am replacing Cisco ASAs with 5020s. I have a lab 3050 setup and I have an IPSEC VPN tunnel between the 3050 and the Cisco ASA. In my configuration, from the PA perspective, I have one local subnet and one remote subnet. I can pass traffic back and forth with no problem. I am now trying to configure from the PA one local subnet to two remote subnets. My original subnet is able to pass traffic, but the new subnet will not communicate. I added both subnets to the interesting traffic acl on the cisco side and I added a second set of proxy-ids on the IPSec Tunnel configuration on the PA side, I just can't seem to find any logs or any reason why I can't communicate with this second subnet. I also made sure to set up the second remote subnet the same as the first, but I'm still not having any luck. Any help would be much appreciated!

Dan

Re: IPSEC with Cisco ASA

gswcowboy — Thu, 09 May 2013 13:25:04 GMT

Checked VR to confirm we have a static route to new subnet utilizing that tunnel interface?

Re: IPSEC with Cisco ASA

ericgearhart — Thu, 09 May 2013 13:36:52 GMT

You made sure you've got your noNAT config set up on both sides of the tunnel correctly right? Usually that's the gotcha when traffic will mysteriously not pass across IPsec tunnels.

Re: IPSEC with Cisco ASA

danielstevenson — Thu, 09 May 2013 13:48:18 GMT

As soon as I read your reply I knew that was the issue. No NAT statement missing on the cisco side. Thanks for the suggestion.

Re: IPSEC with Cisco ASA

ericgearhart — Thu, 09 May 2013 14:15:01 GMT

Glad I could help! Thanks for the 'correct answer' mark too :smileygrin: