I created a site-to-site vpn connection between local ASA(5512, OS 9.1) and Azure. it seems phase 1 and 2 is up but I can't ping from any side and Azure portal shows 0 for data in and some bytes for data-out.
I checked this article below for the same issue and checked what it suggests but seems find on my end. I can't figure out where is wrong.
http://social.msdn.microsoft.com/Forums/windowsazure/en-US/a17ffd32-b712-46d5-90e5-6c4f470f36f6/virtual-network-no-data-in?forum=WAVirtualMachinesVirtualNetwork
Can anyone help on this?
<<<<related configuration on ASA>>>>>>
object-group network azure-networks
network-object 10.1.2.0 255.255.255.0
object-group network onprem-networks
network-object 172.18.100.0 255.255.255.0
access-list azure-vpn-acl extended permit ip object-group onprem-networks object-group azure-networks
nat (INSIDE,OUTSIDE-MAIN) source static onprem-networks onprem-networks destination static azure-networks azure-networks
access-group azure-vpn-acl in interface OUTSIDE-MAIN
crypto ipsec ikev1 transform-set azure-ipsec-proposal-set esp-aes-256 esp-sha-hmac
crypto ipsec security-association lifetime seconds 3600
crypto ipsec security-association lifetime kilobytes 102400000
crypto map azure-crypto-map 10 match address azure-vpn-acl
crypto map azure-crypto-map 10 set peer xxx.xxx.xx.xxx
crypto map azure-crypto-map 10 set ikev1 transform-set azure-ipsec-proposal-set
crypto map azure-crypto-map interface OUTSIDE-MAIN
crypto isakmp identity address
no crypto isakmp nat-traversal ;tried with crypto isakmp nat-traversal as well but the same result.
crypto ikev1 enable OUTSIDE-MAIN
crypto ikev1 policy 10
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 28800
tunnel-group xxx.xxx.xx.xxx type ipsec-l2l
tunnel-group xxx.xxx.xx.xxx ipsec-attributes
ikev1 pre-shared-key *****
sysopt connection tcpmss 1350
<<<<<<<Azure network configuration>>>>>>>
<NetworkConfiguration xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.microsoft.com/ServiceHosting/2011/07/NetworkConfiguration">
<VirtualNetworkConfiguration>
<Dns>
<DnsServers>
<DnsServer name="Azure Local DNs" IPAddress="10.1.2.4" />
</DnsServers>
</Dns>
<LocalNetworkSites>
<LocalNetworkSite name="Tishman_Local">
<AddressSpace>
<AddressPrefix>172.18.100.0/24</AddressPrefix>
</AddressSpace>
<VPNGatewayAddress>xx.xxx.xx.xxx</VPNGatewayAddress>
</LocalNetworkSite>
</LocalNetworkSites>
<VirtualNetworkSites>
<VirtualNetworkSite name="TishmanVN" AffinityGroup="TishmanAG">
<AddressSpace>
<AddressPrefix>10.1.2.0/24</AddressPrefix>
</AddressSpace>
<Subnets>
<Subnet name="Subnet-1">
<AddressPrefix>10.1.2.0/25</AddressPrefix>
</Subnet>
<Subnet name="GatewaySubnet">
<AddressPrefix>10.1.2.128/29</AddressPrefix>
</Subnet>
</Subnets>
<DnsServersRef>
<DnsServerRef name="Azure Local DNs" />
</DnsServersRef>
<Gateway>
<ConnectionsToLocalNetwork>
<LocalNetworkSiteRef name="Tishman_Local">
<Connection type="IPsec" />
</LocalNetworkSiteRef>
</ConnectionsToLocalNetwork>
</Gateway>
</VirtualNetworkSite>
</VirtualNetworkSites>
</VirtualNetworkConfiguration>
</NetworkConfiguration>