topic Re: VPN with ASA - Smaller subnets are negotiated on Phase 2 - No working traffic in General Topics

VPN with ASA - Smaller subnets are negotiated on Phase 2 - No working traffic

CheckPointerXL — Fri, 08 Sep 2023 15:00:22 GMT

Hi all,

i tried to bring up a ikev1 tunnel with a ASA but no luck.

Essentially, the encryption domain is:

Local: 172.16.0.0/12 Remote: 192.168.151.0/24

but after the tunnel is established there is no traffic and this is likely the main reason:

basically it seems the opposite problem about the famous supernetting

any suggestion?

R81.10 take110

thanks

Bob_Zimmerman — Fri, 08 Sep 2023 14:56:42 GMT

What does an IKE debug say? That's the final word in which side is doing the wrong thing.

CheckPointerXL — Fri, 08 Sep 2023 15:01:26 GMT

it says that CP is going to propose the smaller subnet....

i already saw this behavoir in other deployment with asa

sorry forgot to mention R81.10 take110

the_rock — Fri, 08 Sep 2023 15:04:10 GMT

set below values to FALSE in guidbedit, push policy -> test

Andy

ike_enable_supernet

ike_p2_enable_supernet_from_R80.20

ike_use_largest_possible_subnets

CaseyB — Fri, 08 Sep 2023 21:02:31 GMT

Possibly this?

the_rock — Fri, 08 Sep 2023 22:45:41 GMT

I seen that sk before...its good reference, for sure, though I never had that sort of problem with any customer.

Andy

CheckPointerXL — Sat, 09 Sep 2023 09:01:38 GMT

sounds good... i will investigate, already seen that sk but not considered until now....ty