I have a VPN3000 (ver 3.5) at the hub site with PIX 501's deployed remotely. Remote sites can bring up a tunnel without any problem. Once the tunnel is up traffic can be initiated by either side and there's full connectivity.
When the tunnel drops only traffic from the remote site can bring it back up. With PIX's or routers it doesn't matter where the traffic starts from but the VPN3k seems to care. This seems like basic functionality to me so I can't believe it doesn't do it. What's the secret?
Make sure your ACL's (or local and remote networks in the 3000) are the exact opposite of each other. Then make sure your Phase 1 lifetime is the same on all devices (check what IKE Proposal the L2L tunnel is using, then check the lifetime for that proposal under the IKE Proposals section).
Other than that, clear the log on the 3000, try and bring up the tunnel and see what it says. If you enable the IKE, IKEDBG, IPSEC and IPSECDBG event classes at Severity to Log of 1-13, then you'll get a bunch more info, feel free to paste it back in here and we can check it out.
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...