Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We have two sites running ASA 5520's with a VPN between the two firewalls. Recently we have had problems with the VPN failing under load. The logs say that there are problems in calculating the DH checksum. There doesn't appear to be any way to rectify the problem, even tearing down and completely rebuilding the VPN makes no difference. But if both firewalls are rebooted the VPN comes back straight away! Cisco specs say the VPN has a max capacity of 225Mbps and the logs indicate that traffic has peaked at 220Mbps, so pretty maxed out. We're already taking steps to move traffic off the vpn, but would still like to understand why the problem has occurred in the first place. Has anyone else seen this issue?

Logs:
Here's the log entries (with ip's obsfucated). Last few lines then start to repeat

Jul  2 07:58:17 firewallJul 02 2012 07:58:17: %ASA-5-750002: Local:xxx.xxx.xxx.125:500 Remote:xxx.xxx.xxx.126:500 Username:Unknown Received a IKE_INIT_SA request
Jul  2 07:58:17 firewallJul 02 2012 07:58:17: %ASA-4-750003: Local:xxx.xxx.xxx.125:500 Remote:xxx.xxx.xxx.126:500 Username:Unknown Negotiation aborted due to ERROR: Failed to compute the DH value
Jul  2 07:58:17 firewallJul 02 2012 07:58:17: %ASA-5-752003: Tunnel Manager dispatching a KEY_ACQUIRE message to IKEv2.  Map Tag = Man-Ext_map.  Map Sequence Number = 1.
Jul  2 07:58:17 firewallJul 02 2012 07:58:17: %ASA-4-752011: IKEv1 Doesn't have a transform set specified
Jul  2 07:58:17 firewallJul 02 2012 07:58:17: %ASA-5-752003: Tunnel Manager dispatching a KEY_ACQUIRE message to IKEv2.  Map Tag = Man-Ext_map.  Map Sequence Number = 1.
Jul  2 07:58:17 firewallJul 02 2012 07:58:17: %ASA-4-752011: IKEv1 Doesn't have a transform set specified
Jul  2 07:58:17 firewallJul 02 2012 07:58:17: %ASA-5-750001: Local:xxx.xxx.xxx.125:500 Remote:xxx.xxx.xxx.126:500 Username:Unknown Received request to establish an IPsec tunnel; local traffic selector = Address Range: xxx.xxx.xxx.241-xxx.xxx.xxx.241 Protocol: 0 Port Range: 0-65535; remote traffic selector = Address Range: xxx.xxx.xxx.11-xxx.xxx.xxx.11 Protocol: 0 Port Range: 0-65535
Jul  2 07:58:17 firewallJul 02 2012 07:58:17: %ASA-4-752012: IKEv2 was unsuccessful at setting up a tunnel.  Map Tag = Man-Ext_map.  Map Sequence Number = 1.
Jul  2 07:58:17 firewallJul 02 2012 07:58:17: %ASA-3-752015: Tunnel Manager has failed to establish an L2L SA.  All configured IKE versions failed to establish the tunnel. Map Tag= Man-Ext_map.  Map Sequence Number = 1.
share|improve this question
1  
Anything interesting in the logs? –  Tom O'Connor Jul 4 '12 at 10:54
    
You want to know why Cisco have specced the device to only do VPN traffic up to 225Mbps? –  womble Jul 4 '12 at 10:57
    
@womble Because at 225Mbps you have to buy the 5580? –  Tom O'Connor Jul 4 '12 at 11:23
    
@TomO'Connor: That's pretty much the answer. I'm wondering what else the OP is actually after... –  womble Jul 4 '12 at 11:47
    
So no, nothing interesting in the logs. I suspect Womble is right on track here. –  Tom O'Connor Jul 4 '12 at 16:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.