I have an issue with IPSEC VPNs where a single endpoint generates multiple ISAKMP SAs. (in my examples I have replaced the IPs - 126.96.36.199 is the remote endpoint, 10.10.10.10 is an object on the remote network, and 188.8.131.52 is an object on the local network).
>sh crypto isakmp sa 15 IKE Peer: 184.108.40.206 Type : L2L Role : responder Rekey : no State : MM_REKEY_DONE_H2 17 IKE Peer: 220.127.116.11 Type : L2L Role : responder Rekey : yes State : MM_ACTIVE_REKEY
When this happens, no traffic can be sent over the tunnel in either direction. This happened originally with no PFS enabled and I have enabled and disabled it as troubleshooting which made no difference. When the duplicate SA appears (seems to be around an hour after the first tunnel is established) the following is repeated over and over in terminal monitor:
%ASA: Group = 18.104.22.168, IP = 22.214.171.124, IKE Initiator: New Phase 2, Intf portal, IKE Peer 126.96.36.199 local Proxy Address 188.8.131.52, remote Proxy Address 10.10.10.10, Crypto map (outside_map) %ASA: IP = 184.108.40.206, Received encrypted packet with no matching SA, dropping
Anyone have any hints on where to look next? There seems to be very limited resources online about issues with duplicate SAs being generated.