ASA 5510 tunnel dropping

Unanswered Question
Jul 13th, 2009
User Badges:

We have two ASA 5510 firewalls with a tunnel between two sites. The tunnel works without issue until one of the sites experiences a brief outage due to the service provider. The VPN tunnel is not automatically establishing after the outage. It takes a restart of one of the ASA's before it will come back online. How do I get the devices to automatically try to restore the tunnel?


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Collin Clark Mon, 07/13/2009 - 07:32
User Badges:
  • Purple, 4500 points or more


If you configure ISAKMP keepalives, it helps prevent sporadically dropped LAN-to-LAN or Remote Access VPN, which includes VPN clients, tunnels and the tunnels that are dropped after a period of inactivity. This feature lets the tunnel endpoint monitor the continued presence of a remote peer and report its own presence to that peer. If the peer becomes unresponsive, the endpoint removes the connection. In order for ISAKMP keepalives to work, both VPN endpoints must support them.

*Cisco PIX/ASA 7.x and later, for the tunnel group named

securityappliance(config)#tunnel-group ipsec-attributes

securityappliance(config-tunnel-ipsec)#isakmp keepalive threshold 15 retry 10

Hope that helps.

ctcahoe Tue, 07/14/2009 - 10:53
User Badges:

Thanks for your reply Collin. As it stands, the "isakmp keepalive" command is enabled by default on ASA appliances with 7.2 code. The keepalive command has not been removed from the configuration. Both devices are ASA 5510's with 7.2 software running on them.


This Discussion