My company has 2 ASA firewall with model 5510 & 5512 in difference country, I was connected it via IPSEC VPN. It can work in normal until 2 weeks ago.

I checked from log in ASA5512 firewall, it has error message :

Tunnel Manager has failed to establish an L2L SA.  All configured IKE versions 
failed to establish the tunnel. Map Tag= outside_map.  Map Sequence Number = 1.

And this message only display in ASA5512 and haven't alert in ASA5510. Also, the problem only affected specified tunnel only, remain other IPSEC VPN tunnel able to work properly.

I ran show isakmp sa on both firewall it shows:

IKE Peer: [Firewall IP Address]
Type    : user            Role    : initiator 
Rekey   : no              State   : MM_WAIT_MSG2

It look IKE phase 1 is unable to connect on each other.

Does anyone can advise on this issue?

  • Something must have changed in one of the configurations. Can you compare the current configuration to a previous one? Or, can you post the configurations of each (remove sensitive info first)? – Ron Trunk Feb 12 '15 at 13:24
  • Thanks Ron, I was tried restore old configure file to it but no help. Afterward I removed those configure in both side ASA then recreate it, it able to connect right now. Will keep monitor to it and thanks for your reply. Best Regards – Man Timothy Feb 16 '15 at 8:49
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 11 '17 at 4:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.