topic Re: FTD VPN : inactive due to Peer Address Changed. in Network Security

FTD VPN : inactive due to Peer Address Changed.

engchheang — Wed, 17 Aug 2022 04:19:23 GMT

Hello all,

I have got an error like this : Site A - VPN Tunnel between FW/OUT/x.x.x.x/0.0.0.0 and Extranet Device/x.x.x.x/LAN-B is inactive due to Peer Address Changed.

but the connection VPN is up as normal!

Have you ever meet this issue please help to share your solution!!

Thanks in advanced

Re: FTD VPN : inactive due to Peer Address Changed.

Jitendra Kumar — Wed, 17 Aug 2022 05:20:39 GMT

Check below Bug..

https://quickview.cloudapps.cisco.com/quickview/bug/CSCuz89989

Re: FTD VPN : inactive due to Peer Address Changed.

engchheang — Wed, 17 Aug 2022 06:37:37 GMT

Jitendra,

Can you detail solution for me ?

Re: FTD VPN : inactive due to Peer Address Changed.

Jitendra Kumar — Wed, 17 Aug 2022 07:46:07 GMT

If you are in the same affected release you have to upgrade.

Product (1 of 1)

Cisco Adaptive Security Appliance (ASA) Software

Known Affected Releases (1 of 1)

9.0

Known Fixed Releases (3 of 3)

9.7.1

9.6.3

9.4.4

Re: FTD VPN : inactive due to Peer Address Changed.

engchheang — Wed, 17 Aug 2022 08:54:40 GMT

I'm using Firepower 2120 not ASA.

Re: FTD VPN : inactive due to Peer Address Changed.

Jitendra Kumar — Wed, 17 Aug 2022 09:10:16 GMT

can you share IPsec config details from both side?

Re: FTD VPN : inactive due to Peer Address Changed.

MHM Cisco World — Wed, 17 Aug 2022 14:04:23 GMT

you must config FTD side with dynamic Crypto map, this make the FTD listen to new IPsec Peer IP.

Re: FTD VPN : inactive due to Peer Address Changed.

engchheang — Thu, 18 Aug 2022 07:10:28 GMT

Sorry i can't, but the configuration is the same as standard IPsec VPN.

Re: FTD VPN : inactive due to Peer Address Changed.

engchheang — Thu, 18 Aug 2022 07:11:18 GMT

Hi MHM,

Is there other solution beside this solution ?

Re: FTD VPN : inactive due to Peer Address Changed.

MHM Cisco World — Thu, 18 Aug 2022 13:16:25 GMT

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/119007-config-asa9x-ike-ipsec-00.html
config the FW with FQDN Peer instead of IP, example above give you some point how you config it.