Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to set up an ipsec tunnel between our ASA 5505 and a Juniper ssg5. The tunnel is up and running, but I cannot get any data through it.

The local network I am on is and the remote is But I cannot ping anything on their network. I receive a "Phase 2 OK" when I set up the ipsec.

I think this is the part of the config that is applicable. It seems like the data is not routed through the tunnel, but I am not sure...

object network our-network
object network their-network
access-list outside_cryptomap extended permit ip object our-network object their-network 
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac 
crypto map outside_map 1 match address outside_cryptomap
crypto map outside_map 1 set pfs 
crypto map outside_map 1 set peer THEIR_IP
crypto map outside_map 1 set ikev1 phase1-mode aggressive 
crypto map outside_map 1 set ikev1 transform-set ESP-3DES-MD5
crypto map outside_map 1 set ikev2 pre-shared-key *****
crypto map outside_map 1 set reverse-route
crypto map outside_map interface outside

group-policy GroupPolicy_THEIR_IP internal
group-policy GroupPolicy_THEIR_IP attributes
 vpn-filter value outside_cryptomap
 ipv6-vpn-filter none
 vpn-tunnel-protocol ikev1 
tunnel-group THEIR_IP type ipsec-l2l
tunnel-group THEIR_IP general-attributes
 default-group-policy GroupPolicy_THEIR_IP
tunnel-group THEIR_IP ipsec-attributes
 ikev1 pre-shared-key *****
 ikev2 remote-authentication pre-shared-key *****
 ikev2 local-authentication pre-shared-key *****
crypto ikev1 enable outside
crypto ikev1 policy 10
 authentication crack
 encryption aes-256
 hash sha
 group 2
 lifetime 86400

Tihis is the output of the packet tracer. I user my ip as source, their firewall as destination and IP with protocol 0 on interface OUR

in outsied
Type -IP-OPtions Action -ALLOW
Tyope -NAT Action -DROP Show rule in NAT Rules table.
object network obj_any
nat (any,outside) dynamic interface
RESULT - The packet is dropped
Input Interface: OUR
Output  Interface:outside
Info: (acl-drop) Flow is denied by configured rule
share|improve this question

You config looks sane at first glance, even though I don't see the need for the reverse-route. You forgot to add the isakmp policy which starts with "crypto isakmp policy ", although entering Phase 2 obviously means Phase 1 completed.

1) Do you let it bypass the normal ACL (by config: sysopt connection permit-vpn)?

2) Can you do a packet-tracer and paste the result?

share|improve this answer
Thanks a lot for your reply. I tried the sysopt connection permit-vpn but it didn't seem to accept that command. I pasted the result of packet tracer above – Oskar Kjellin Mar 25 '12 at 8:56
I think I am missing a NAT exempt – Oskar Kjellin Mar 25 '12 at 9:01
Good call, completely neglected NAT. – 3molo Mar 25 '12 at 9:49
I fixed the nat part. However, the problem is still there. I am wondering if the site-to-site tunnel is on the wrong interface. Perhaps it should be our and not outside? If I packet trace from outside, it is sent through the tunnel. But if I packet trace from our (which I should, right?) it isn't sent through the tunnel – Oskar Kjellin Mar 25 '12 at 10:34

Okay, so there was two things I needed to fix:

1) UN-NAT the traffic going through the tunnel nat (any,any) source static their-network their-network no-proxy-arp

2) Update the ACL so it went both ways:

access-list outside_cryptomap extended permit ip object our-network object their-network 
access-list outside_cryptomap extended permit ip object their-network object our-network 

Now it works just fine.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.