I have an issue with IPSEC VPNs where a single endpoint generates multiple ISAKMP SAs. (in my examples I have replaced the IPs - 220.127.116.11 is the remote endpoint, 10.10.10.10 is an object on the remote network, and 18.104.22.168 is an object on the local network).
>sh crypto isakmp sa 15 IKE Peer: 22.214.171.124 Type : L2L Role : responder Rekey : no State : MM_REKEY_DONE_H2 17 IKE Peer: 126.96.36.199 Type : L2L Role : responder Rekey : yes State : MM_ACTIVE_REKEY
When this happens, no traffic can be sent over the tunnel in either direction. This happened originally with no PFS enabled and I have enabled and disabled it as troubleshooting which made no difference. When the duplicate SA appears (seems to be around an hour after the first tunnel is established) the following is repeated over and over in terminal monitor:
%ASA: Group = 188.8.131.52, IP = 184.108.40.206, IKE Initiator: New Phase 2, Intf portal, IKE Peer 220.127.116.11 local Proxy Address 18.104.22.168, remote Proxy Address 10.10.10.10, Crypto map (outside_map) %ASA: IP = 22.214.171.124, Received encrypted packet with no matching SA, dropping
Anyone have any hints on where to look next? There seems to be very limited resources online about issues with duplicate SAs being generated.