I have a ASA 5520 that has several PIX 501 and Cisco 871's which connect to it using a EZVPN connection. For some strange reason only 2 or 3 of the connections will drop on the ASA 5520. The 871 on the other end still shows a VPN tunnel as being up even though the ASA shows it as not connected. Traffic will not cross when it is in this state. It is always the same 871's with the issue. The tunnel will recreate on it's own from time to time but at not set time. It may be in 15 minutes or 5-6 hours.
If the 871 is power cycled they will come right back up and work for 30 minutes up to 16-18 hours before it happens again.
I have monitoring software behind the ASA 5520 that connects to the 871's inside interface once per minute to verify that it is up. Therefore, there is traffic crossing that link at least once every 60 seconds. The packets are small but there is always data traveling.
I have swapped out 871's at these remote locations, but the issue still appears. Also the internet providers are different at each of these locations. All providers that I talked to state that they see no issues with our connection to the internet.
you may want to investigate if the 5520 is experiencing one of two bugs:
CSCsd79775 or CSCsd48512
On the 5520 do a 'show ipsec stat' command and see if the "missing SA failures" count increments or not. Also try a 'show asp drop" counter "Tunnel being brought up or torn down" counts are incrementing. If the counts are incrementing, you have one of the bugs. A workaround is to hard power down the firewall and power it back up.
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...