We have a Head-Office/Branch-Office WAN like this,
Server LAN <-> Cisco PIX 515e <-VPN tunnel-> Cisco ASA 5505 <-> Client LAN 1 <-VPN tunnel-> Cisco ASA 5505 <-> Client LAN 2 <-VPN tunnel-> Cisco ASA 5505 <-> Client LAN 3 ... <-VPN tunnel-> Cisco ASA 5505 <-> Client LAN 66
5% of these VPN tunnels degrade over time.
- Clients respond to PING, but not to RPC or RDP.
- On the ASA, VPN tunnels goes from 1 x IKE, 2 x IPSec down to 1 x IKE, 1 x IPSec.
- A restart of the ASA resolves the problem temporarily.
This PIX has been unreliable, and will probably be replaced with a more modern bit of gear. Although usually under 10%, the CPU on the PIX periodically hits 80-90% with traffic spikes, but I can't say I've been able to correlate dropped tunnels with these loads.
I have a few specific questions, but am grateful for any and all insights.
Can I monitor (via SNMP) the total IPSec tunnels on the PIX? This should always be (at least?) twice the number of branch offices, and (at least?) twice the total IKE - if it drops then I probably have a problem.
Is there an event I can alarm on in the PIX's own logging, when one of these tunnels is dropped? Maybe,
snmp-server enable traps ipsec start stop
Is there anything I can do to keep this tunnel alive, until the PIX can be replaced? I was thinking of scriptable keep-alive traffic, PING doesn't seem to cut it. I am also looking at idle time-out values, maybe re-keying intervals, any other ideas?
PIX515E# show run isakmp crypto isakmp identity address crypto isakmp enable outside crypto isakmp policy 10 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 crypto isakmp nat-traversal 20 PIX515E# show run ipsec crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac PIX515E# show version Cisco PIX Security Appliance Software Version 7.2(4) Device Manager Version 5.2(4)