ASA VTI ikev2 problem

[Dieselboy]

Trying to set up a new site VPN using existing config / lessons-learned. I have a another site already using resilient VTI VPN tunnels with ikev2 and bgp. The new site ikev2 vpn would not come up and was giving some error I had not seen before. So I decided to give up and use ikev1 to get going and change it later. The VPN came up immediately but is not functional and the ASA is logging an error which says:

Code Select Expand

Failed to locate egress interface for GRE from VTI-49:139.x.x.x/0 to 115.x.x.x/0

I'm using ipsec. Any ideas why the log says "GRE"? Does the ASA even do GRE? I have a HA pair of 5515X on 9.8.3 code.

[deanwebb]

I think it has to use that to process the "interesting traffic" that matches the policy-class to send stuff over the VPN. But it should be doing that natively, I'd check to see if the policy-class is right and if the settings on both ends match and if they're explicitly defined because Cisco trying to figure it out from a list sometimes doesn't work as desired.

[Dieselboy]

I went through all the ikev2 VPN config again with a fine tooth comb. It's all 100% correct. THEN I spotted that there was one line missing from the VTI interface:

Code Select Expand

tunnel mode ipsec ipv4


Oops. All working now : )

[deanwebb]

I went through all the ikev2 VPN config again with a fine tooth comb. It's all 100% correct. THEN I spotted that there was one line missing from the VTI interface:

Code Select Expand

tunnel mode ipsec ipv4


Oops. All working now : )

[Dieselboy]

🙈

Explains the ASA logging about the GRE, which is good to know