Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an issue with IPSEC VPNs where a single endpoint generates multiple ISAKMP SAs. (in my examples I have replaced the IPs - is the remote endpoint, is an object on the remote network, and is an object on the local network).

>sh crypto isakmp sa
15  IKE Peer:
    Type    : L2L             Role    : responder
    Rekey   : no              State   : MM_REKEY_DONE_H2
17  IKE Peer:
    Type    : L2L             Role    : responder
    Rekey   : yes             State   : MM_ACTIVE_REKEY

When this happens, no traffic can be sent over the tunnel in either direction. This happened originally with no PFS enabled and I have enabled and disabled it as troubleshooting which made no difference. When the duplicate SA appears (seems to be around an hour after the first tunnel is established) the following is repeated over and over in terminal monitor:

%ASA: Group =, IP =, IKE Initiator: New Phase 2, Intf portal, IKE Peer  local Proxy Address, remote Proxy Address,  Crypto map (outside_map)
%ASA: IP =, Received encrypted packet with no matching SA, dropping

Anyone have any hints on where to look next? There seems to be very limited resources online about issues with duplicate SAs being generated.

share|improve this question
What version of ASA code are you running? Anything useful in the system log (turn it up to debug for VPN stuff if it isnt already)? – Shane Madden Mar 2 '12 at 6:39
this is a 5505 with Cisco Adaptive Security Appliance Software Version 8.2(2) – ohtee Mar 2 '12 at 6:43
Does everything go back to normal as soon as you clear the ISAKMP SAs? What does the config look like for the connection, and is dead peer detection enabled? – Shane Madden Mar 2 '12 at 6:49
Everything does go back to normal for an hour, I will attach the config later but I researched the dead peer connection and the conf says 'iskamp keepalive threshold infinite' would this possibly be the issue? I am preparing to change this because it seems likely to me. – ohtee Mar 2 '12 at 7:05
Yes - but, turning that down if the remote end doesn't respond to DPD packets will get your tunnel disconnecting a lot sooner. Do you control the remote device - and do the ISAKMP and IPSec lifetimes and rekeying intervals match between the two? – Shane Madden Mar 2 '12 at 7:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.