Cisco ASA 5505 in remote site, connecting as Easy VPN client to ASA 5510 at HQ. VPN light is green, and
sh crypto isakmp sa shows active security association.
However connectivity to some of our subnets is not working. Running
show crypto ipsec sa shows IPSEC SAs exist for most of our subnets, but not all. Not surprisingly, for subnets where there is no SA, there is no connectivity possible.
When this happens, running
clear crypto isakmp sa or power cycling the remote ASA restores the IPSEC tunnels, and access to all the subnets is possible again.
When this occurs it is intermittent. No config changes have happened with the devices affected.
Here are my questions:
- What would cause an IPSEC SA to fail to one subnet, without bringing down the whole VPN link?
- What measures might I take to prevent or mitigate against those causes?
- Is there any configuration of the ASA that will detect when this happens, and restore the link automatically?