Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 

Site to Site VPN Problem

Dear All;

I have problem with the Lan-to-Lan VPN tunnel.

the VPN working fines since 9 months ago without any problems.

Suddenly got the problem!

In last two days we faced problem the VPN down.

in first time the problem in phase-2.. but after that in phase-1... in latest no data packet received to their side.

We are not made any change on configuration for beginning..

My Cisco ASA 5505 and their side Cisco ASA 5540

Below in First the configuration from our side:

=========================================

access-list 202 extended permit ip host 20.1.1.2 host 10.1.1.5

access-list 202 extended permit ip host 20.1.1.2 host 10.1.1.6

access-list 202 extended permit ip host 20.1.1.2 host 10.1.1.7

access-list 202 extended permit ip host 20.1.1.3 host 10.1.1.5

access-list 202 extended permit ip host 20.1.1.3 host 10.1.1.6

access-list 202 extended permit ip host 20.1.1.3 host 10.1.1.7

crypto map rackmap 202 match address 202

crypto map rackmap 202 set peer 12.12.12.1

crypto map rackmap 202 set transform-set ESP-3DES-MD5

crypto map rackmap 202 set security-association lifetime seconds 28800

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash md5

group 2

lifetime 86400

crypto isakmp policy 20

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

crypto isakmp policy 30

authentication pre-share

encryption 3des

hash md5

group 2

lifetime 28800

tunnel-group 12.12.12.1 type ipsec-l2l

tunnel-group 12.12.12.1 ipsec-attributes

pre-shared-key *********

=========================================

And now the configuration for their side:

=========================================

crypto map outside_map 81 match address outside_81_cryptomap

crypto map outside_map 81 set peer 11.11.11.1

crypto map outside_map 81 set transform-set ESP-3DES-MD5

crypto map outside_map 81 set security-association lifetime seconds 28800

crypto map outside_map 81 set security-association lifetime kilobytes 4608000

access-list outside_81_cryptomap extended permit ip object-group DM_INLINE_NETWORK_74 object-group DM_INLINE_NETWORK_75

access-list DMZ5_nat0_outbound extended permit ip object-group DM_INLINE_NETWORK_74 object-group DM_INLINE_NETWORK_75

object-group network DM_INLINE_NETWORK_74

network-object host 10.1.1.5

network-object host 10.1.1.6

network-object host 10.1.1.7

object-group network DM_INLINE_NETWORK_75

network-object host 20.1.1.2

network-object host 20.1.1.3

tunnel-group 11.11.11.1 type ipsec-l2l

tunnel-group 11.11.11.1 ipsec-attributes

pre-shared-key *****

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash md5

group 2

lifetime 86400

crypto isakmp policy 20

authentication pre-share

encryption des

hash sha

group 1

lifetime 86400

crypto isakmp policy 30

authentication pre-share

encryption 3des

hash sha

group 1

lifetime 86400

crypto isakmp policy 40

authentication pre-share

encryption des

hash md5

group 1

lifetime 86400

crypto isakmp policy 50

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

crypto isakmp policy 70

authentication pre-share

encryption aes-256

hash sha

group 5

lifetime 86400

crypto isakmp policy 90

authentication pre-share

encryption des

hash md5

group 2

lifetime 86400

crypto isakmp policy 110

authentication pre-share

encryption 3des

hash md5

group 1

lifetime 86400

=========================================

When trying to initiate the tunnel we got the below error:

Feb 12 2012 07:24:54: %ASA-7-715065: IP = 12.12.12.1, IKE MM Initiator FSM error history (struct &0xc5516d88)  <state>, <event>:  MM_DONE, EV_ERROR-->MM_WAIT_MSG2, EV_RETRY-->MM_WAIT_MSG2, EV_TIMEOUT-->MM_WAIT_MSG2, NullEvent-->MM_SND_MSG1, EV_SND_MSG-->MM_SND_MSG1, EV_START_TMR-->MM_SND_MSG1, EV_RESEND_MSG-->MM_WAIT_MSG2, EV_RETRY

Feb 12 2012 07:24:54: %ASA-7-713906: IP = 12.12.12.1, IKE SA MM:0ce19fb3 terminating:  flags 0x01000022, refcnt 0, tuncnt 0

Feb 12 2012 07:24:54: [IKEv1 DEBUG]: IP = 12.12.12.1, sending delete/delete with reason message

we triad to do ... re create the tunnel from beginning... and restart the firewall.. but all times we got the up error

Please advice and help me ASAP

Best Regards

Version history
Revision #:
1 of 1
Last update:
‎02-12-2012 11:57 AM
Updated by:
 
Labels (1)
Comments

Hello,

Create this posting as discussion. Also, post the entire config from 5505 as well.

Thx

MS