Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using Cisco ASA 5505 to establish a site to site VPN tunnel.

The problem is that, my ASA 5505 does not seem to initiate the negotiation but once the device on the other starts the negotiation the tunnel establishes successfully!

Is there any such configuration that enables the initiation of phase 1 negotiation?

Any clues what am I missing?

Thanks,

share|improve this question
1  
Can you post some relevant sections of your config? –  Tom O'Connor Aug 19 '10 at 8:20
    
Is keepalive enabled? –  Nic Nov 18 '11 at 6:48
add comment

2 Answers

I would run through these steps:

  1. Before the L2L P2 is up, go ahead and ping an interesting traffic host. If everything is set up correctly, this will initiate the tunnel. Apologies if you already knew that but some do not.
  2. On the ASA, ensure that you have set up a crypto map entry for the interesting traffic. What could be happening, and this is just a guess, but perhaps you do not have the correct crypto map in place and instead when the peer initiates you are establishing using the dynamic crypto map.
  3. Using ASDM you can check out your connection profile and check your setting under Crypto Map and make sure that it is on "Bidirectional" rather than "answer only"
  4. Finally, make sure that is not your peer that is the issue.
share|improve this answer
add comment

You can debug using ASDM and Packet tracer from Tools menu.
Do you have a NAT exempt rule for the other end IP(s)?

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.