Excellent.
After the tunnel is created Dead Peer Detection (DPD) messages are sent to the client side to verify if the peer is alive.
Taking a look at the logs on the ASA side, during this time May 21 07:00:43 [IKEv1], the tunnel got established.
After that, we sent DPD messages to the client but the client never receives it.
May 21 07:05:48 [IKEv1]: IP = 5.9.246.162, IKE_DECODE SENDING Message (msgid=be5432bd) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
May 21 07:05:50 [IKEv1 DEBUG]: Group = remotevpn, Username = user1, IP = 5.9.246.162, Sending keep-alive of type DPD R-U-THERE (seq number 0x1e2d6442)
ASA keeps sending 3 DPD messages to see if the client is there but the client doesn't respond.
So, the ASA tears down the tunnel.
Looking at the logs on the client side, I see the same thing. The client sends DPD messages but the ASA doesnt receive them, so - the tunnel gets terminated. After about 6 minutes or so.
Solutions:
a. You can either disable DPD keepalive messages on the ASA
b. You can put a sniffer trace in front of the ASA or in front of the client to see if we are sending DPD messages on the wire. Once we know that its out of the wire, then you can check the next hop to see where it is getting dropped or blocked.
I believe you are using IPSec over UDP, so it would UDP 500 packets that should be seen on the wire, unless you are doing NAT-T in which case it would UDP 4500.
Hope this helps in narrowing down the problem.
Rate it, if it helps.
Cheers
Gilbert
