Cisco ASA IPSec Tunnel Problem.

Pravin Phadte · ‎03-06-2009

Hi All,

This is a strange problem I have come across cisco ASA. Let me know if any one has experienced or is this known issue.

A tunnel configuration is set for site to site and is working fine for many days.

Case 1.

I disconnected the cisco asa from the network. Then I connected a linksys and configured it with the remote peer ip address. The tunnel was not up.

So I changed back to asa and still the tunnel was not up.

Note no configs changes done on cisco asa.

After troubleshooting and given up. I called isp and told them I would like to have a new static ip address.

I configured the new static ip address on interface and as peer yes tunnel-group same changes on remote end. It worked fine.

Case 2.

ISP had to change the ISP router connected to the ASA. Once the change was done the tunnel is down. No configuration changes were made again on asa.

Since I had spare static ip address I changed the ip address as above and it worked fine. Tunnel up.

Both the case is from different ISP.

One of the symptoms' I have noted is that the from the remote end asa we are unable to ping the peer public ip address.

IOS Software Version 8.0(4)

Any one could help or advise on this

Thanks

eddie.mitchell · ‎03-06-2009

In both cases, when you re-attached the ASA to the network, were you able to ping out to the Internet from the ASA? It may have been an arp-cache updating issue. Did you also try clearing the IPSec sa's on the ASA to force a re-negotiation of the tunnel?

'clear crypto ipsec sa peer x.x.x.x'

If all else failed, I also would have just done a reload on the ASA and the upstream network device to be sure.

Best Regards,

Pravin Phadte · ‎03-06-2009

- Yes Ping to internet was fine.

- Internet was working without any problems. only tunnel down.

- clear crypto isakmp sa

-clear crypto ip sa peer X.x.x.x

reloaded the asa, ISP router, ISP modem.

Reconfigueed the inetface again.

Shut no shut

Cleared crypto from remote site as well.

Recreted tunnel also from both sites.

Infact from any remote server i was able to ping the problem cisco asa ip address.

Also the default geatway ip address of the problem asa is reachable only the int ip is not.