Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We are using Cisco 5500 series ASA for sites HQ and BX and there is a site-to-site vpn in between,

BX (subnet can access to subnet subnet at HQ but can't access subnet at HQ.

Packet trace shows us that the data is being transmitted to both sites but it drops. I can't locate the source of the problem. I sense it is regarding routing but can't point the problem.

I know that it is better for me to post the logs but I don't know how. I need a hand on this, noobe here.

Thanks and happy new year. K.

share|improve this question
When you say subnet, do you mean subnet? And what do you mean by "to both sites"? – David Schwartz Jan 2 '13 at 22:46
Is the endpoint of the VPN at HQ on the subnet? If so, has the subnet been configured with a route back to the subnet? Is there a conflict with another subnet, possibly at the end of another site-to-site VPN? Consider the networks of any business partners. – Jonathan J Jan 2 '13 at 23:00
Thanks for the comment. HQ has a couple of subnets: 200.x, 0.x, and 1.x. Where can I identify if it is routed back to BX site (6.x) subnet? – user151692 Jan 3 '13 at 17:03
David, Yes that's what I meant. To both sites means that from Point A to B and Point B to A I am getting all the green checks with package track. – user151692 Jan 3 '13 at 18:14
We called Cisco, and they confirmed that this was a bug of the ASA we use. The data was not being encrypted so ASA was not sending it back. Guess what? Tech told us to restart the firewall, and problem went away. It sounds stupid, but sometimes you have to remember: Router is a fing router and it requires fing restart. Excuse my language but I really got frustrated. – user151692 Jan 10 '13 at 21:08

1 Answer 1

It was a bug in the firewall. Cisco confirmed it. Router restart fixed the problem.

share|improve this answer
We're seeing similar issues -- did they give you a bug ref at all? what code version is your ASA on? – user152910 Jan 10 '13 at 21:57

protected by Michael Hampton Feb 22 '13 at 15:26

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.