The log message "%ASA-4-402116: IPSEC: Received an ESP packet" confirms that IPsec Phase
1 and Phase 2 negotiations are successful, andthe VPN tunnel is established. However, traffic is still not passing, which typically indicates an Access Control List (ACL) mismatch for interesting traffic between the two firewalls.
In Cisco ASA, the crypto ACL defines the traffic that should be encrypted and sent through the VPN tunnel. If the ACLs on both firewalls do not match, traffic will be dropped. To resolve this issue, the administrator must ensure that both firewalls have matching ACLs that allow traffic between 192.168.10.155 and 192.168.100.172.
For example, on ASA Firewall A:
access-list VPN_ACL permit ip 192.168.10.0 255.255.255.0 192.168.100.0 255.255.255.0 On ASA Firewall B:
access-list VPN_ACL permit ip 192.168.100.0 255.255.255.0 192.168.10.0 255.255.255.0 Both ACLs must mirror each other to allow bidirectional traffic flow.