Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I improve my site to site VPN uptime coming from an ASA 5505 to both Checkpoint safe@office and ASA 5510. The uptime nbetween the 5505-Checkpoint is really bad, like <10 min on average. I haven't had a lot of luck scouring Google and this site for answers. Any ideas would be appreciated. The site to site WORKS, it just disconnects and reconnects a lot. Even general tips are appreciated. Thanks so much.

EDIT 0: This is the error I see in the debugging log:

3   Jul 25 2011 10:02:59    713902                  Group = 209.156.x.x, IP = 209.156.x.x, QM FSM error (P2 struct &0xc9f0c5a8, mess id 0x52494315)!


I was able to resolve the issue by disabling perfect forward secrecy. I don't exactly know what this is - I remember studying Diffie Hellman or whatever a while back - but I think it didn't really jive between the two firewall devices. Then I disabled keep-alives because they were not jiving as well. VPN uptime is @ 2 hrs or so and counting, we'll see...

share|improve this question
Enable debugging and start by figuring out why it's disconnecting. – Chris S Jul 25 '11 at 18:28
Will do. Logging @ debug level now and waiting for it to break – tacos_tacos_tacos Jul 25 '11 at 18:31
Have you taken a look at the underlying connections supporting this tunnel to see if they're dropping? – SpacemanSpiff Jul 25 '11 at 19:25

I am using cisco ASA5510 8.4(2) and CP Safe@Office 500 8.0.42x and I am experiencing the same problem. It will connect P1, P2 and work for a few minutes then disconnect. Then reconnect in a minute or 2. I am disabling PFS per this recommendation. If anyone is still seeing this thread, please add any input. Thanks.

share|improve this answer
What are your crypto_map entries? I found out that my problem was related to the fact that CheckPoint brings over ALL networks, including "OfficeMode" if your users connect via EndPoint Connect/SecureClient/SecuRemote. So, you may want to use Dynamic crypto map entry and then just ping it from the CheckPoint network. – tacos_tacos_tacos Dec 16 '11 at 18:48
VPN connection has been up for 4.5 hours after removing PFS. – Chris Dec 16 '11 at 23:23
I specified the subnets.. for Cisco and for Checkpoint. I did not select the route all traffic option. We want the end users to browse web locally, not over the VPN. Turning off Perfect Forward Secrecy seems to have done it. – Chris Dec 16 '11 at 23:27
If your checkpoint uses OfficeMode it will bring over its network regardless of whether you split tunnel or not – tacos_tacos_tacos Dec 17 '11 at 18:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.