CloudLabBox
Try the free demo

Firewalls and VPNs lab 14 of 16

Troubleshooting phase 2 - selectors NAT and routing

Two tunnels to an IOS head office are broken by five realistic phase 2 faults on an ASA, a FortiGate and the IOS router: mismatched selectors, a NAT exemption in the wrong section, a route-based peer given narrow selectors, a safety route that wins, and a route that sends VPN traffic to the internet. Find each one from the evidence, fix it and prove both tunnels carry traffic both ways.

Run this lab

It needs Lite: its 6 nodes are set to 6 vCPU and 6,144 MB in total. That fits the free demo too.

In your workspace: Shared, then Firewalls and VPNs multi-vendor guided labs, then 14 - Troubleshooting phase 2 - selectors NAT and routing

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 90 minutes
Nodes need
6 vCPU, 6,144 MB
Smallest plan
Lite

The scenario

Hollins Timber's head office router (HQ) has two site-to-site tunnels: a crypto map to the ASA at the sawmill (site A) and a VTI to the FortiGate at the depot (site B). After a weekend of "tidying up" by three different people, nothing crosses either tunnel. The ticket says phase 1 is fine. There are five faults in phase 2, NAT and routing, spread across all three devices. Find them from the evidence, not by reading every line of configuration, and record which command showed you each one.

DeviceInterfaceAddressNotes
ISPGi0/0 / Gi0/1 / Gi0/2203.0.113.1/30 / 198.51.100.1/30 / 192.0.2.1/30
HQGi0/0 / Lo0 / Tunnel2203.0.113.2/30 / 10.0.0.1/24 / 169.254.14.1/30Crypto map to A, VTI to B
A-FWinside / outside10.1.0.1/24 / 198.51.100.2/30PAT for the LAN
A-PCGi0/010.1.0.10/24
B-FWport1 / port2 / to-HQ192.0.2.2/30 / 10.2.0.1/24 / 169.254.14.2
B-PCGi0/010.2.0.10/24
TunnelDesignCryptoProtected traffic
HQ to A-FWCrypto map on bothIKEv2 AES-256-GCM, DH 2010.0.0.0/24 to and from 10.1.0.0/24
HQ to B-FWRoute-based on bothIKEv2 DES/SHA-256, DH 14 (FortiGate evaluation limit)Whatever is routed into the tunnel

What you’ll practise

  • Separate phase 1 problems from phase 2 problems with each vendor's SA commands
  • Recognise TS_UNACCEPTABLE and mirrored-selector faults on a crypto map
  • Find one-way traffic from encrypt and decrypt counters, and trace it to NAT order on the ASA
  • Match a FortiGate phase 2 to a route-based peer
  • Read routing as part of the VPN: a blackhole route that wins and a route that bypasses the tunnel
  • Verify the repair on IOS, ASA and FortiGate

The tasks

  1. Confirm the ticket: is phase 1 really fine?
  2. Site A, phase 2
  3. Site A, one-way traffic
  4. Site B, phase 2 and routing
  5. Prove it

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Troubleshooting phase 2 - selectors NAT and routing6 nodes, 5 links. Every link is listed as text below the diagram.ISPHQA-FWA-PCB-FWB-PCGi0/0Gi0/0Gi0/0Gi0/0port2Gi0/0Gi0/1Gi0/1Gi0/2port1
6 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • ISP Gi0/0 to HQ Gi0/0
  • ISP Gi0/1 to A-FW Gi0/1
  • ISP Gi0/2 to B-FW port1
  • A-FW Gi0/0 to A-PC Gi0/0
  • B-FW port2 to B-PC Gi0/0
Nodes in Troubleshooting phase 2 - selectors NAT and routing, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
ISPCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
HQCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
A-FWCisco ASAvasav-9.22.1.1-PLR-Licensed1 vCPU, 2,048 MB
A-PCCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
B-FWFortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
B-PCCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Firewalls and VPNs multi-vendor guided labs.

  3. Open 14 - Troubleshooting phase 2 - selectors NAT and routing and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Firewalls and VPNs labs

All Firewalls and VPNs labs

Related labs in other courses

CloudLabBox is independent of Check Point, Cisco, CompTIA, Fortinet, Juniper Networks, MikroTik, Netgate and Palo Alto Networks. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.