VPN with ASA - Smaller subnets are negotiated on Phase 2 - No working traffic

[CheckPointerXL]

Hi all,

i tried to bring up a ikev1 tunnel with a ASA but no luck.

Essentially, the encryption domain is:

Local: 172.16.0.0/12   Remote: 192.168.151.0/24

but after the tunnel is established there is no traffic and this is likely the main reason:

 

basically it seems the opposite problem about the famous supernetting

any suggestion?

R81.10 take110

thanks

[Bob_Zimmerman]

What does an IKE debug say? That's the final word in which side is doing the wrong thing.

[CheckPointerXL]

it says that CP is going to propose the smaller subnet....

i already saw this behavoir in other deployment with asa

sorry forgot to mention R81.10 take110

[the_rock]

set below values to FALSE in guidbedit, push policy -> test

Andy

ike_enable_supernet

ike_p2_enable_supernet_from_R80.20

ike_use_largest_possible_subnets

[CaseyB]

Possibly this? 

Using "Encryption Domain Per community" feature overrides Encryption Domain for other communities (c...

[the_rock]

I seen that sk before...its good reference, for sure, though I never had that sort of problem with any customer.

Andy

[CheckPointerXL]

sounds good... i will investigate, already seen that sk but not considered until now....ty