Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

SA question/issue

Hi everybody

I am having a lot of trouble with a IPSec site-to-site between an ASA and an ISA server. The is established and can work for hours but, I think, when the IKE/IPSec SA's re-negotiate there can be a dropout. I have tried deleting all IKE and IPSec SAs (clear crypto ipsec/isakmp ...) at both ends and the tunnel then re-negotiates without a problem. However, when I look at active SA's there is 1 active IKE SA but 2 active IPSec SA's... Is this normal? Could this be causing a problem when the SA's timout and try to renegotiate? I am very new to this so any help would be much appreciated.

Thanks a lot

Colin

5 REPLIES
Hall of Fame Super Blue

Re: SA question/issue

Colin

The SA's used in phase 2 ie. what you call the IPSEC SA's are unidirectional. So to eastablish 2 way communication between 2 devices you need 2 SA's. So this is normal behaviour.

Sounds like what may be happening is that one end times out but the other end doesn't. The end that has timed out tries to renegotiate but the other end rejects it because as far as it is concerned the tunnel is still up. Perhaps your timers for tunnel establishement/teardown do not match on both devices.

IPSEC can be very picky between different vendor devices. In addition to Cisco's site you may want to visit Microsoft site and look for ISA to Pix/ASA configurations. If i get time later i'll have a look but both Cisco's and Microsoft's site have a lot of good resources.

Jon

New Member

Re: SA question/issue

Thanks Jon for clearing that up. I will check the differences in the lifetimes at each side - I can see this easily on the ASA but will need to try and find it on the ISA Server...

Cheers

Colin

New Member

Re: SA question/issue

I have attached the oakley.log starting just before the tunnel went down and finishing just after the tunnel came backup - without intervention of any kind... I realise it is a lot to look through but if anybody can see what is happening while it is down it would be a great help - as I said I am very new to all this.

Thanks a lot

Colin

New Member

Re: SA question/issue

oakley log attached

Thanks a lot

Colin

New Member

Re: SA question/issue

Please ignore the oakley log as the ASA was re-booted by somebody on site!

Thanks

Colin

106
Views
0
Helpful
5
Replies
CreatePlease to create content