Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

VPN Up Then Down Then Dead

Hi, have a strange one on the Pix'es and VPN site-to-site:

Pix515e (v7.0(5)) is the hub and Pix 506e is the branch. Can set up and initialize a VPN tunnel between them, IKE and IPSEC work, policies are the same including lifetimes and users can send data in the l2l tunnel. However after a length of time (seems random but always greater than 2 hrs) the VPN session dies and will not re-initialize even though "interesting" traffic is triggering the connection. An error message of "unable to remove PeerTbleEntry" appears. I then have to manually change the SA lifetime on both Pixes and the VPN comes back up. I do not know what is going on or why I need to manually change the SA. If I leave the Pixes for about 2hrs the VPN tunnel re-establishes on it's own; however that is 2hrs of downtime. I set up a PING -t to see if the tunnel would remain open and after a length of time (random but more than 2hrs) the VPN tunnel crashes again. Bandwidth utilization/memory/CPU is low so no buffer worries. I remote to the Pix 506e and Pix 515 outside the VPN and those SSH connections do not crash.

Any ideas?

Thanks.

3 REPLIES
New Member

Re: VPN Up Then Down Then Dead

Think I solved the problem. Out of despair I decided to change the transform-sets. Confirmed that both sides were exactly the same first. I changed from MD5 to SHA....and the VPN has remained stable for 12hrs now. But I don't understand why this is so? I plan on changing back to MD5 on the weekend to see if the original problem can be replicated.

In the meantime does any one know why a change from MD5 to SHA would potentially "stabilize" a VPN tunnel??

Thanks

Colin

New Member

Re: VPN Up Then Down Then Dead

Not positive about this, but if you don't want the tunnel to go down I think you should look at

isakmp keepalive

New Member

Re: VPN Up Then Down Then Dead

Sorry, should have indicated that was already configured on the tunnels.

But thanks for your reply.

164
Views
0
Helpful
3
Replies
CreatePlease login to create content