Cisco ASA 5505 in remote site, connecting as Easy VPN client to ASA 5510 at HQ. VPN light is green, and sh crypto isakmp sa
shows active security association.
However connectivity to some of our subnets is not working. Running show crypto ipsec sa
shows IPSEC SAs exist for most of our subnets, but not all. Not surprisingly, for subnets where there is no SA, there is no connectivity possible.
When this happens, running clear crypto isakmp sa
or power cycling the remote ASA restores the IPSEC tunnels, and access to all the subnets is possible again.
When this occurs it is intermittent. No config changes have happened with the devices affected.
Here are my questions:
- What would cause an IPSEC SA to fail to one subnet, without bringing down the whole VPN link?
- What measures might I take to prevent or mitigate against those causes?
- Is there any configuration of the ASA that will detect when this happens, and restore the link automatically?
show crypto ipsec sa
on both sides of the tunnel, and if it has packets sent and/or received. I'm guessing the association will be there and claim to be working, and it will have packets being encrypted but not decrypted or vice versa. Also - what code version are the devices on?show crypto ipsec sa
on the remote end, and there was not an association for the subnet at that end listed. ASA is version 8.3(2) at HQ, and 8.4(3) at remote end.