1

We are using Cisco 5500 series ASA for sites HQ and BX and there is a site-to-site vpn in between,

BX (subnet 192.168.6.0) can access to subnet 192.168.200.0 subnet at HQ but can't access 192.168.0.0 subnet at HQ.

Packet trace shows us that the data is being transmitted to both sites but it drops. I can't locate the source of the problem. I sense it is regarding routing but can't point the problem.

I know that it is better for me to post the logs but I don't know how. I need a hand on this, noobe here.

Thanks and happy new year. K.

5
  • When you say 192.168.0.0 subnet, do you mean 192.168.0.0/24 subnet? And what do you mean by "to both sites"? Jan 2, 2013 at 22:46
  • Is the endpoint of the VPN at HQ on the 192.168.200.0 subnet? If so, has the 192.168.0.0 subnet been configured with a route back to the 192.168.6.0 subnet? Is there a conflict with another subnet, possibly at the end of another site-to-site VPN? Consider the networks of any business partners.
    – Jonathan J
    Jan 2, 2013 at 23:00
  • Thanks for the comment. HQ has a couple of subnets: 200.x, 0.x, and 1.x. Where can I identify if it is routed back to BX site (6.x) subnet?
    – user151692
    Jan 3, 2013 at 17:03
  • David, Yes that's what I meant. To both sites means that from Point A to B and Point B to A I am getting all the green checks with package track.
    – user151692
    Jan 3, 2013 at 18:14
  • We called Cisco, and they confirmed that this was a bug of the ASA we use. The data was not being encrypted so ASA was not sending it back. Guess what? Tech told us to restart the firewall, and problem went away. It sounds stupid, but sometimes you have to remember: Router is a fing router and it requires fing restart. Excuse my language but I really got frustrated.
    – user151692
    Jan 10, 2013 at 21:08

1 Answer 1

0

It was a bug in the firewall. Cisco confirmed it. Router restart fixed the problem.

1
  • 1
    We're seeing similar issues -- did they give you a bug ref at all? what code version is your ASA on?
    – user152910
    Jan 10, 2013 at 21:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .