Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
New Member

ASA Failover VPN Issues

It seems each time our ASA's failover (at least once a month), that our Cisco VPN clients no longer connect with a error 433 unknown. Our Anyconnect clients work just fine. Failing back seems to do the trick. Is there anything specific I can look for once this happens again?

3 REPLIES

Re: ASA Failover VPN Issues

Hey Jason

Is the connectivity to the ASA's external IP fine, during this issue ? Is it a layer 3 issue or something to do at the top layers (authentication, encryption etc ) ?? Did you do a debug when users connect onto the failover ASA ? Hope there are software licenses on the failover unit ! do a debug crypto isakmp, debug aaa authentication etc, to see the exact error and troubleshoot from there ..

Hope this helps.. all the best..

Raj

Re: ASA Failover VPN Issues

HI Dear,

Which ASA software version you are using.

Is it 7.2(4)

This turned out to be a Cisco software bug. We were running 7.2(4) when we experienced the failover problem but upgraded to 7.2(4)9 and this resolved the issue.

The related bugs seem to have been:

CSCsl52895 - ASA 7.2.3 number of IPSec SA not replicated in failover unit.

CSCsl82200 - IPSec not encrypting after failover

There is also another bug to be aware of: search for CSCsi18736 in the bug toolkit.

Hope it will work for you.

Please feel free to revert if the isse still unresolved.

Kind Regards,

Sachin

New Member

Re: ASA Failover VPN Issues

Sachin,

I was using 8.0(3), but recently upgraded to 8.0(4), and everything seems to be working correctly on failover.

Thanks

192
Views
4
Helpful
3
Replies
CreatePlease to create content