1

Cisco ASA 5505 in remote site, connecting as Easy VPN client to ASA 5510 at HQ. VPN light is green, and sh crypto isakmp sa shows active security association.

However connectivity to some of our subnets is not working. Running show crypto ipsec sa shows IPSEC SAs exist for most of our subnets, but not all. Not surprisingly, for subnets where there is no SA, there is no connectivity possible.

When this happens, running clear crypto isakmp sa or power cycling the remote ASA restores the IPSEC tunnels, and access to all the subnets is possible again.

When this occurs it is intermittent. No config changes have happened with the devices affected.

Here are my questions:

  • What would cause an IPSEC SA to fail to one subnet, without bringing down the whole VPN link?
  • What measures might I take to prevent or mitigate against those causes?
  • Is there any configuration of the ASA that will detect when this happens, and restore the link automatically?
|improve this question
  • Does it try to establish a new IPSec SA for the other subnets when you try to send traffic through them? – Shane Madden♦ Jun 20 '12 at 5:05
  • No - pings from the remote site to hosts on the affected subnets fail. The subnet in question has our corporate mail server, intranet, file stores - traffic in the form of requests is most definitely going to that subnet! – dunxd Jun 20 '12 at 9:00
  • It should have some sort of a failure with establishing an phase 2 security association, or a broken security association; since it's working after a phase 1 clear, I'm thinking a broken phase 2 SA. Check if there's an association for that subnet in show crypto ipsec sa on both sides of the tunnel, and if it has packets sent and/or received. I'm guessing the association will be there and claim to be working, and it will have packets being encrypted but not decrypted or vice versa. Also - what code version are the devices on? – Shane Madden♦ Jun 20 '12 at 15:54
  • The problem isn't there right now, so I can't completely answer that. However, I checked show crypto ipsec sa on the remote end, and there was not an association for the subnet at that end listed. ASA is version 8.3(2) at HQ, and 8.4(3) at remote end. – dunxd Jun 21 '12 at 9:00
  • I meant to say I had checked the remote end when the problem was evident. Now the problem is not evident there are SAs at both ends. – dunxd Jun 21 '12 at 10:13
1

I recently had this issue with only 1 of 2 SAs activating. I solved this by double checking

sh run crypto map

My ikev1 and ikev2 commands matched, but one side was misign

crypto map WAN_map 1 set pfs

After adding that command (substituting your actual crypto map name), and generating traffic from the initiator side, both SAs came up succesfully.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.