0

We have IPsec tunnel which is working but somehow getting drop and reconnect itself and that causing disturbance in application, i am unable to find root cause. I have check isakmp and crypto map setting both side also key lifetime too.

This is what i am seeing when i continue run following command.

asa/pri/act# show crypto ipsec sa peer 49.xx.xx.211
peer address: 49.xx.xx.211
    Crypto map tag: MAP-VPN, seq num: 1010, local addr: 66.xx.xx.33

      access-list ACL-VPN-FOO extended permit ip 70.xx.xx.0 255.255.255.0 172.17.0.0 255.255.0.0
      local ident (addr/mask/prot/port): (70.xx.xx.0/255.255.255.0/0/0)
      remote ident (addr/mask/prot/port): (172.17.0.0/255.255.0.0/0/0)
      current_peer: 49.xx.xx.211


      #pkts encaps: 16, #pkts encrypt: 16, #pkts digest: 16
      #pkts decaps: 17, #pkts decrypt: 17, #pkts verify: 17
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 16, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #TFC rcvd: 0, #TFC sent: 0
      #Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 66.xx.xx.33/4500, remote crypto endpt.: 49.xx.xx.211/4500
      path mtu 1500, ipsec overhead 66(44), media mtu 1500
      PMTU time remaining (sec): 0, DF policy: clear-df
      ICMP error validation: disabled, TFC packets: disabled
      current outbound spi: 30F33694
      current inbound spi : 8AA1F00B

    *** Tunnel rekeyed or deleted ***

crypto map

crypto map MAP-VPN 1010 match address ACL-VPN-FOO
crypto map MAP-VPN 1010 set pfs group1
crypto map MAP-VPN 1010 set peer 49.xx.xx.211
crypto map MAP-VPN 1010 set ikev1 transform-set FOO-ESP-3DES-MD5
crypto map MAP-VPN 1010 set security-association lifetime seconds 3600

isakmp

crypto ikev1 policy 20
 authentication pre-share
 encryption 3des
 hash md5
 group 1
 lifetime 86400

EDIT

I am pinging my peer public address 49.xx.xx.211 and 0 packet loss there so its not Internet issue. I am clearly seeing my tunnel getting drop and after 2 packet drop its back itself, Is there anyway i can find reason for dropping tunnel or logs?

We have many tunnel to remote site and they all working fine except this one.

I am continuing ping to remote LAN IP and intermediately seeing packet drop and same time i notice tunnel down, and after few packet missing in ping it back itself.

If you notice my ipsec output, i am notice this

*** Tunnel rekeyed or deleted ***

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.