12

I have a site-to-site VPN that seems to be dropping traffic from a particular subnet when a lot of data is being pushed through the tunnel. I have to run clear ipsec sa to get it going again.

I notice the following when running show crypto ipsec sa. The SA timing remaining key lifetime reaches 0 for kB. When this happens the tunnel doesn't pass traffic. I don't understand why it doesn't rekey.

inbound esp sas:
      spi: 0x51BB8CAE (1371245742)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, }
         slot: 0, conn_id: 65753088, crypto-map: OutsideCrypto_map
         sa timing: remaining key lifetime (kB/sec): (3796789/14690)
         IV size: 8 bytes
         replay detection support: Y
         Anti replay bitmap:
          0xFFFFFFFF 0xFFFFFFFF
    outbound esp sas:
      spi: 0x91CA1D71 (2445942129)
         transform: esp-3des esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, }
         slot: 0, conn_id: 65753088, crypto-map: OutsideCrypto_map
         **sa timing: remaining key lifetime (kB/sec): (0/14678)**
         IV size: 8 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00000001

UPDATE 7/1/2013

I am running ASA 8.6.1. Researching Cisco's site I was able to find Bug CSCtq57752. The details are

ASA: IPSec outbound SA data lifetime rekey fails Symptom:

IPSec outbound SA fails to rekey when data lifetime reaches zero kB.

Conditions:

ASA has an IPSec tunnel with a remote peer. The data lifetime on the ASA reaches 0 kB, the lifetime in seconds has not yet expired.

Workaround:

Increase the data lifetime to a very high value (or even the maximum value), or decrease the lifetime in seconds. The lifetime in seconds should ideally expire before the data limit in kB reaches zero. In this manner the rekey will be triggered based on seconds, and the data lifetime issue can be bypassed.

The solution is to update to version 8.6.1(5). I'm going to try and schedule a maintenance window tonight and see if the problem is resolved.

Improve this question
5
  • What are the lifetime settings on both sides?
    – generalnetworkerror
    Commented Jun 30, 2013 at 6:09
  • It's 8 hours and/or 4608000 KBytes. When the KBytes hit 0 it doesn't renegotiate the tunnel.
    – Rowell
    Commented Jul 1, 2013 at 13:32
  • 1
    @Rowell, regarding your 7/1/2013 update.. if a SW upgrade resolves your problem, please post it as an answer instead of an edit to your question...
    – Mike Pennington
    Commented Jul 1, 2013 at 15:43
  • 1
    @MikePennington I definitely intend on posting it as a solution if it is resolved. I will cross my fingers.
    – Rowell
    Commented Jul 1, 2013 at 15:45
  • @rowell if you write a separate answer -- it's perfectly acceptable to answer your own question -- I can aware you the +50 bounty (if you write the answer quickly before the bounty expires tomorrow(wed jul 10). )
    – Craig Constantine
    Commented Jul 9, 2013 at 14:00

1 Answer 1

Reset to default
7
+50

The resolution to my problem is to upgrade my ASA image to 8.6.1(5).

This resolves bug CSCtq57752

The workaround to the bug is to lower the crypto map's timed lifetime and increase the crypto map's traffic volume threshold:

crypto map *YOUR-CRYPTO-MAP ID* set security-association lifetime seconds 3600
crypto map *YOUR-CRYPTO-MAP ID* set security-association lifetime kilobytes 2147483647

The above crypto map lowers the lifetime to 3600 seconds and increases the kilobytes threshold to the highest value. In my case, I just have to ensure the seconds lifetime is depleted before the kilobytes threshold.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.