PIX to PIX VPN and tunnel rengotiation

[nvekaria]

I've got a 1720 Router sandwiched between two PIX 506s. A workstation is also connected to each PIX. I am able to ping from one workstation to the other using a standard PIX-PIX VPN tunnel. If I down the PIX local to the workstation and reload it, the VPN tunnel is re-established when the local PIX comes back up. If I down the Remote PIX and bring it back up, I have to manually clear the SAs on the local PIX in order to re-establish the tunnel, or else restablish the tunnel by pinging back from the remote workstation. How do I get the PIXes to attempt to re-negotiate the tunnel automatically once it has been broken by the remote peer being reset.

[Amin-Al]

I had the same problem before, however, you did not give much detail in your post.

- check pfs make sure they policies are matching at both Pixs

- make sure the SA life time are matching on both Pixs !

hope this helps.

[jfrahim]

If your remote pix is down, then you can try to enable isakmp keepalives in your environment. This would keep track of the remote pix, and once the remote pix is down, it will delete all the related IPSec SAs