Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Cisco ASA 5505 IPSec tunnel won't establish until remote site attempts to connect

I have a site to site IPSec tunnel setup and operational but periodically the remote site goes down, because of a somewhat reliable internet connection. The only way to get the tunnel to re-establish is to go to the remote site and simply issue a ping from a workstation on the remote network. We were having this same issue with a Cisco PIX 506E but decided to upgrade the hardware and see if that resolve the issue. It ran for well over a year and our assumtions was that the issue was resolved. I was looking in the direction of the security-association lifetime but if we power cycle the unit, I would expect that it would kill the SA but even after power cycling, the VPN does not come up automatically.

Any assistance would be appreciated.

ASA Version 8.2(1)

!

hostname KRPS-FW

domain-name lottonline.org

enable password uniQue

passwd uniQue

names

!

interface Vlan1

nameif inside

security-level 100

ip address 10.20.30.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address xxx.xxx.xxx.xxx 255.255.255.248

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

description Inside Network on VLAN1

!            

interface Ethernet0/2

shutdown

!

interface Ethernet0/3

shutdown

!

interface Ethernet0/4

shutdown

!

interface Ethernet0/5

shutdown

!

interface Ethernet0/6

shutdown

!

interface Ethernet0/7

description Inside Network on VLAN1

!

ftp mode passive

dns server-group DefaultDNS

domain-name lottonline.org

access-list NONAT extended permit ip 10.20.30.0 255.255.255.0 10.20.20.0 255.255.255.0

access-list NONAT extended permit ip 10.20.30.0 255.255.255.0 192.168.0.0 255.255.255.0

access-list NONAT extended permit ip 10.20.30.0 255.255.255.0 192.168.15.0 255.255.255.0

!

access-list KWPS-BITP extended permit ip 10.20.30.0 255.255.255.0 10.20.20.0 255.255.255.0

access-list KWPS-BITP extended permit ip 10.20.30.0 255.255.255.0 192.168.0.0 255.255.255.0

access-list KWPS-BITP extended permit ip 10.20.30.0 255.255.255.0 192.168.15.0 255.255.255.0

!

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list NONAT

nat (inside) 1 0.0.0.0 0.0.0.0

access-group OUTSIDE_ACCESS_IN in interface outside

route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-record DfltAccessPolicy

http server enable

http 10.20.30.0 255.255.255.0 inside

http 10.20.20.0 255.255.255.0 inside

!

snmp-server enable traps snmp authentication linkup linkdown coldstart

!

crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto dynamic-map DYNMAP 65535 set transform-set ESP-AES-256-SHA

crypto map VPNMAP 1 match address KWPS-BITP

crypto map VPNMAP 1 set peer xxx.xxx.xxx.001

crypto map VPNMAP 1 set transform-set ESP-AES-256-SHA

crypto map VPNMAP 65535 ipsec-isakmp dynamic DYNMAP

crypto map VPNMAP interface outside

crypto isakmp enable outside

crypto isakmp policy 5

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

crypto isakmp policy 65535

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

!

ssh timeout 5

console timeout 0

management-access inside

!

tunnel-group xxx.xxx.xxx.001 type ipsec-l2l

tunnel-group xxx.xxx.xxx.001 ipsec-attributes

pre-shared-key somekey

!

1 REPLY

Cisco ASA 5505 IPSec tunnel won't establish until remote site at

Hi there,

I had same issue with PIX 506E and it was not even a circuit issue and I got ride of it and problem got fixed with PIX515E

I don't know, the device is too old to stay alive.

thanks

1332
Views
0
Helpful
1
Replies
CreatePlease login to create content