Strongswan VPN Established but no Packets Routed

Solution 1:

Sorry to necropost on the topic, there's just not much info out there in one place on this particular configuration in terms of troubleshooting.

My config:

Symptoms:

Could initiate tunnel and ping from Cisco ASA private LAN to AWS private LAN always.
On tunnel timeout/restart I could not initiate or ping from AWS to Cisco ASA unless/until traffic was generated from Cisco ASA side. IPSEC STATUSALL revealed
```
Tasks active: MODE_CONFIG
Tasks queued: QUICK_MODE
```

I found that with modeconfig=push and leftsourceip= both configured, it got stuck at:

Tasks active: MODE_CONFIG
Tasks queued: QUICK_MODE

Removing modeconfig=push left it stuck at:

Tasks active: MODE_CONFIG

Removing leftsourceip= did the trick and everything was up and stable both ways.

I take it those two are needed by PIX an maybe some older version of ASA but not this one.