Forum Discussion

mr_evil_116524's avatar
mr_evil_116524
Icon for Nimbostratus rankNimbostratus
Jan 06, 2014

Question about IPSEC

Hi Guys,

 

I am having an issue with IPSEC between F5 and CISCO ASA. IPSEC is working however when IPSEC is down i.e. no traffic between the two system when I try to bring up the tunnel from CISCO ASA end vie ping or telnet it doesnt not bring up the tunnel. However when I try to ping from F5 to CISCO ASA end it works fine and bring up the tunnel. And ofcourse now I am able to ping from CISCO end to F5.

 

I do remember this happening but it was fixed as CISCO ASA end but i cannot remember. Does anyone here know or experienced this issue before?

 

Thanks,

 

3 Replies

Sort By
  • Pedro_Haoa's avatar
    Pedro_Haoa
    Ret. Employee
    Jan 07, 2014

    Hi,

     

    Try to put some traffic from behind de Cisco ASA to de F5. Also, check carefully the configuration in the ASA. There are many posibilities, most of them can be resolve checking the configuration file, do some comparisons and check with the SDM tool the IPSec configuration.

     

    In the BIG-IP the config is very straightforward.

     

  • Vitaliy_Savrans's avatar
    Vitaliy_Savrans
    Icon for Nacreous rankNacreous
    Jan 08, 2014

    Hi, check your access-list, which is using in crypto map. I think the "ping" from ASA interface didn't describe in it.

     

  • mr_evil_116524's avatar
    mr_evil_116524
    Icon for Nimbostratus rankNimbostratus
    Jan 08, 2014

    Thanks guy, it appears that under traffic selector you have an option where you can define A HOST or Network. However what I Did since I need to go out from ONE HOST to A network I did host for source and destination for network.

     

    So when I change it to Network for source and network for destination it started to work. However this is the weird part I had two traffic selector using the same IPSEC policy and they were host for source and destination for network, one was working and other wasnt it.

     

    I dont know whether f5 only allows you to do host to host and network to network ..... does anyone know?

     

    No changes were made to forwarding VIP....