nerdexam
Cisco

300-730 · Question #179

A network administrator is troubleshooting an IPSec Site-to-Site VPN tunnel on a Cisco ASA firewall. The VPN tunnel is established but is unable to pass traffic between 192.168.10.155 and…

The correct answer is C. Configure ACL for interesting traffic to match remote firewall. The ASA log message %ASA-4-402116 indicates received ESP packets cannot be matched to any Security Association, which is caused by a crypto ACL mismatch where the interesting traffic definitions on the two firewalls are not mirror images of each other.

Troubleshooting VPNs

Question

A network administrator is troubleshooting an IPSec Site-to-Site VPN tunnel on a Cisco ASA firewall. The VPN tunnel is established but is unable to pass traffic between 192.168.10.155 and 192.168.100.172. The administrator observes this log message: `%ASA-4-402116: IPSEC: Received an ESP packet (SPI= 0x489041890C, sequence number= 0x9E) from 100.1.1.1 (user= 100.1.1.1) to 12.12.12.12. What must the administrator do to resolve this issue?

Options

  • AImplement IKE Phase 1 proposal to match other firewall.
  • BConfirm that IP address of tunnel interface is correctly configured.
  • CConfigure ACL for interesting traffic to match remote firewall.
  • DSetup identical Pre-shared keys must be on both firewalls.

How the community answered

(48 responses)
  • A
    2% (1)
  • B
    8% (4)
  • C
    85% (41)
  • D
    4% (2)

Why each option

The ASA log message %ASA-4-402116 indicates received ESP packets cannot be matched to any Security Association, which is caused by a crypto ACL mismatch where the interesting traffic definitions on the two firewalls are not mirror images of each other.

AImplement IKE Phase 1 proposal to match other firewall.

An IKE Phase 1 proposal mismatch prevents the tunnel from establishing at all, but the question states the tunnel is already established and only traffic passing fails.

BConfirm that IP address of tunnel interface is correctly configured.

Tunnel interface IP configuration applies to GRE or FlexVPN deployments; ASA site-to-site VPNs use crypto maps and do not have a tunnel interface whose IP would affect traffic decryption.

CConfigure ACL for interesting traffic to match remote firewall.Correct

Log message 402116 fires when the ASA receives ESP packets that do not match any active SA, which occurs when the crypto ACL on one peer specifies a different source or destination network than the remote peer's ACL; making both ACLs mirror each other (local src/dst swapped) ensures the traffic is correctly identified and decrypted.

DSetup identical Pre-shared keys must be on both firewalls.

Mismatched pre-shared keys cause IKE Phase 1 authentication failure before any tunnel comes up, which contradicts the scenario where the tunnel is already established.

Concept tested: IPsec crypto ACL interesting traffic mismatch on Cisco ASA

Source: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/217888-troubleshoot-asa-site-to-site-vpn.html

Topics

#IPsec site-to-site#crypto ACL#interesting traffic#ESP packet

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-730 Practice