Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

PIX 501 IPSEC VPN dropouts

I have got an IPSEC VPN setup between 2 PIX 501's. The PIX's have recipricol interesting traffic ACL's.

Site A protects 3 subnets and Site B protects 1. All the tunnels come up ok and data passing

is fine. However, there is one strange problem. Every morning, after an evening of less activity,

- Site B devices would fail to see (eg. ping) devices at Site A, with a few exceptions. For example

one device at site A is always ping'able irrespectively of the ping-status of others. This device

may be a MS domain controller which performs AD replication overnight

- what's even stranger is that if I were to initiate a ping from an un-ping'able device from site

A to a device at site B, all connectivity is restored over a few seconds to a minute.

- During this time, there is no new ISAKMP or IPSEC SA's negotiated. Therefore this is probably not

due to timeout values. I've got ISAKMP timeout set at 86400 sec and IPSEC set at 10000kB/86400sec

- Sometimes, I observe 2 outbound and inbound ESP SA's for the same IP flow (subnet to subnet) with

both having ample time and kb left. Is this normal?

Both PIX's have really simple configuration.

Note also that site B PIX has another VPN tunnel to somewhere else, and it is NOT experiencing any

problems. Both PIX's are running 6.3(4) and have been rebooted.

Thanks in advance for any help.



Re: PIX 501 IPSEC VPN dropouts

Hi Lei,

This sounds to me like an ARP issue, have a look at the ARP tables before and after the problem occurs.

One point I come across before is the PIX runs proxy ARP by default, turning this off can resolve some odd connection problems. Its a sysopt command to disable it, sorry cannot recall the exact syntax, do `show sysopt' to view.