Unable to ping between IPsec VPN sites

|
  • 88
  • 0

Issue Description

Unable to ping between VPN site.
Perform packet capture, able to see NGAF had forwarded the packet to vpn tunnel however do not find any reply packet in the tunnel.

Handling Process

1. Perform ping test under NGAF towards peer vpn resources and do a packet capture in vpn tunnel.
2. Found NGAF had forwarded the packet into VPN tunnel, however do not find any reply packet in the tunnel.
3. Checked on the VPN configuration, verified the tunnel had been established, and peer site had replied the packet.
4. Enable troubleshooting module and found the corresponding ESP packet is being dropped by Local ACL.
5. Checked on the Local ACL configuration, found there is custom Local ACL configuration on the selected WAN interface for VPN connection.
6. Disabled the Local ACL and it is able to access VPN resources.

Root Cause

ESP packet is being dropped by Local ACL

Solution

Disable or fine tune the Local ACL configuration to allow ESP packet transmission.

I want to write a case
Doc ID: 7365
Author: JunMing
Updated: 2022-10-05 11:41
Version: