Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

ASA 5510: flapping s2s VPNs

Hello everyone,

I have a hub-n-spoke VPN network with 5510 boxes at several locations.

Users complaining that s2s links are flapping from time to time for two locations.

Here is log output for the moments when links are torn down:

First spoke:

07-07-2010    20:17:09    Local4.Notice    <HUB-ASA-IP>    %ASA-5-713259: Group = <SPOKE1-ASA-IP>, IP = <SPOKE1-ASA-IP>, Session is being torn down. Reason: User Requested
07-07-2010    20:17:09    Local4.Notice    <HUB-ASA-IP>    %ASA-5-713050: Group = <SPOKE1-ASA-IP>, IP = <SPOKE1-ASA-IP>, Connection terminated for peer <SPOKE1-ASA-IP>.  Reason: Peer Terminate  Remote Proxy 10.3.0.0, Local Proxy 172.16.100.0

Second spoke:


07-07-2010    18:34:45    Local4.Notice    <HUB-ASA-IP>    %ASA-5-713259: Group = <SPOKE1-ASA-IP>, IP = <SPOKE2-ASA-IP>, Session is being torn down. Reason: Idle Timeout

07-07-2010    18:34:45    Local4.Notice    <HUB-ASA-IP>    %ASA-5-713050: Group = <SPOKE1-ASA-IP>, IP = <SPOKE2-ASA-IP>, Connection terminated for peer <SPOKE2-ASA-IP>.  Reason: IPSec SA Idle Timeout  Remote Proxy 10.5.0.0, Local Proxy 172.16.100.0

I believe the text in bold is the reason. But I am not sure why remote site1 is requesting connection termination and why SA for site2 is timeouts.

I have SA lifitime for 24h\4Gb at each ASA and traffic volume or amount of time never exceed in this cases, keepalives are enabled at the hub ASA as well. I see a number or "flappings" through the day with the same termination reasons as I presented above. Does anyone have an idea or suggestion why s2s VPNs are flapping and how to make them more stable even if traffic is not flowing across.

Thanks in advance.

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: ASA 5510: flapping s2s VPNs

Sergey,

Any chance you have vpn idle timeout configured on either of the sides (it can be in group-policy maybe default?)  (show run all group-policy | i vpn)

"IPSec SA Idle Timeout"

HTH,

Marcin

2 REPLIES
Cisco Employee

Re: ASA 5510: flapping s2s VPNs

Sergey,

Any chance you have vpn idle timeout configured on either of the sides (it can be in group-policy maybe default?)  (show run all group-policy | i vpn)

"IPSec SA Idle Timeout"

HTH,

Marcin

New Member

Re: ASA 5510: flapping s2s VPNs

Hi Martin,

Thanks for the hint. I've added:

group-policy DfltGrpPolicy attributes
vpn-idle-timeout none

I'll check the spokes settings and adjust them as well.

Hope it will help.

Thanks again!

5329
Views
0
Helpful
2
Replies
CreatePlease to create content