IPSEC ESP packets arrive but no ICPM can be seen

[Stefano_Cappell]

Hi

I just configured an IPSEC vpn with another firewall: The tunnel is up but no packet can be seen getting out from the tunnel.

We just checked the two configurations and they match.

On the remote site they can see the packets (they are just doing a ping) getting encripted and exiting from the vpn virtual interface. On our side we can see the isakmp packets and the esp packet arriving with the ping "pace" but if I dump the icmp traffic filtering for their IP, no packet can be seen.

The vpn tu tlist -p [remote host]  Command shows all the correct parameters and correct local and remote networks.

What can this be about?  

[PhoneBoy · Accepted solution]

What does fw ctl zdebug drop say?

[Stefano_Cappell]

EDIT: I've checked again the configuration of the vpn community another time and I've found out that there was no encryption domain configured in the interoperable device for the remote firewall...

I was so sure I had configured and double-checked the remote encryption domain...

Anyway. Thanks!

.....................................  

It says

 dropped by vpn_drop_and_log Reason: According to the policy the packet should not have been decrypted

I've tried to check this with some info on the internet, I checked the encryption domains: their destination is inside our encryption domain and there shouldn't be any overlapping between their source network and our encryption domain.

I just can't understand what's wrong with this vpn

[Timothy_Hall]

Other side is improperly NATing traffic into the tunnel, and it isn't matching what your firewall is expecting to see from the peer object in regards to their VPN domain.

Otherwise there is an overlap in VPN domains somewhere, run vpn overlap_encdom communities -s to find it.