Tunnel is up but cannot ping directly connected network
- by drmanalo
We configured a site-to-site VPN and here is the topology. I control the network on the left but not the one on the right. All devices in our network has public IPs.
Server---ASA5505---Cisco887======Internet=====ASA5510---devices
I can see the tunnel is up and can do extended ping using a loopback interface. From the 10.175 and 10.165 networks, they can also ping my loopback address. I can also dial in using a Cisco VPN client, and can connect to the devices on the right.
#show crypto session
Crypto session current status
Interface: Vlan3
Profile: xxx-profile
Session status: UP-ACTIVE
Peer: 213.121.x.x port 500
IKEv1 SA: local 77.245.x.x/500 remote 213.121.x.x/500 Active
IPSEC FLOW: permit ip 10.0.20.0/255.255.255.240 10.175.0.0/255.255.128.0
Active SAs: 0, origin: crypto map
IPSEC FLOW: permit ip 10.0.20.0/255.255.255.240 10.165.0.0/255.255.192.0
Active SAs: 2, origin: crypto map
#ping 10.165.29.39 source loopback 2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.165.29.39, timeout is 2 seconds:
Packet sent with a source address of 10.0.20.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 16/17/20 ms
My problem is the devices on the right cannot reach my server. They could only ping the loopback address and nothing else.
I'm pasting some diagnostics related to routing thinking perhaps routing is my issue. I can paste all the running-config on my side of network if needed.
#show ip int brief
Interface IP-Address OK? Method Status Protocol
ATM0 unassigned YES NVRAM administratively down down
Ethernet0 unassigned YES NVRAM administratively down down
FastEthernet0 unassigned YES unset up up connected to ASA
FastEthernet1 unassigned YES unset administratively down down
FastEthernet2 unassigned YES unset administratively down down
FastEthernet3 unassigned YES unset up up
Loopback1 10.0.20.65 YES NVRAM up up
Loopback2 10.0.20.1 YES NVRAM up up
Virtual-Template1 77.245.x.x YES unset up down
Virtual-Template2 77.245.x.x YES unset up down
Vlan1 unassigned YES unset down down
Vlan3 77.245.x.x YES NVRAM up up connected to the Internet
#show run | section ip route
ip route 0.0.0.0 0.0.0.0 77.245.x.x
ip route 213.121.240.36 255.255.255.255 Vlan3
#show access-list
Extended IP access list 102
10 permit ip 10.0.20.0 0.0.0.15 10.175.0.0 0.0.127.255 (3332 matches)
20 permit ip 10.0.20.0 0.0.0.15 10.165.0.0 0.0.63.255 (3498 matches)
#show vlan-switch
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active
3 VLAN0003 active Fa0, Fa1, Fa2, Fa3
1002 fddi-default act/unsup
1003 token-ring-default act/unsup
1004 fddinet-default act/unsup
1005 trnet-default act/unsup
#show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
+ - replicated route, % - next hop override
Gateway of last resort is 77.245.x.x to network 0.0.0.0
S* 0.0.0.0/0 [1/0] via 77.245.x.x
10.0.0.0/8 is variably subnetted, 5 subnets, 3 masks
C 10.0.20.0/28 is directly connected, Loopback2
L 10.0.20.1/32 is directly connected, Loopback2
C 10.0.20.64/28 is directly connected, Loopback1
L 10.0.20.65/32 is directly connected, Loopback1
S 10.165.0.0/18 [1/0] via 213.121.x.x
77.0.0.0/8 is variably subnetted, 3 subnets, 3 masks
S 77.0.0.0/8 [1/0] via 77.245.x.x
C 77.245.x.x/29 is directly connected, Vlan3
L 77.245.x.x/32 is directly connected, Vlan3
213.121.x.0/32 is subnetted, 1 subnets
S 213.121.x.x is directly connected, Vlan3
I read some of the posts here which lead to NATing issue but I'not sure of my next step. Should I translate my public address to private and route it to the loopback address? (only guessing)
CISCO VPN site to site
Site-to-Site VPN between two ASA 5505s only working in one direction
Hope someone could help. Thanks in advance!
