topic site to site issue in Network Security

site to site issue

prashantrecon — Wed, 13 Mar 2019 01:02:56 GMT

Hi All,

We have site to site tunnel suddenly the tunnel got disconnected and we recieved error such as

IKE Peer: 196.25.48.3
     Type    : L2L             Role    : responder
    Rekey   : yes             State   : MM_ACTIVE_REKEY

IKE Peer: 196.25.48.3
Type : L2L Role : responder
Rekey : no State : MM_REKEY_DONE_H2

And after time tunnel was up automotically.When confirmed to far end network admin no changes where made from there side.From our side no changes were made.

My question is there any other factors for tunnel down reason.

site to site issue

ajay chauhan — Fri, 18 Nov 2011 13:22:48 GMT

Should be related to SA life cycle check both end if there is mismatch or very short duration is configured.

site to site issue

prashantrecon — Fri, 18 Nov 2011 13:36:07 GMT

Hi Ajay

Now the tunnel is displaying as

IKE Peer: 196.25.48.3

Type : L2L Role : responder

Rekey : no State : MM_ACTIVE

But the problem is we are not able to connect some remote machine as checked phase i is up and we have allowed ip range on firewall and there is no log when excuted show connection command.

Can u please suggest some command to check where the problem is there.

site to site issue

ajay chauhan — Fri, 18 Nov 2011 13:42:27 GMT

I would suggest following-

1) check all parameters both end should be same for phase 1 and 2

2) check pfs setting if configured should be on both side also can be tested removing both end.

3) check crypto acl

4) show ipsec sa to check if some traffic going might be one way.

5) finally run the packet tracer command

packet-tracer input inside 1024 80

it will show you what is happening in packet flow.

Thanks

Ajay

site to site issue

prashantrecon — Fri, 18 Nov 2011 14:07:43 GMT

Hi Ajay,

Problem we are able to take remote of one machine But not able to take any another machine which are in same range.

when i excuted the command show crypto ipsec sa encryped packets are increasing but decrypted packet remains same.

Is it problem is from far end?

site to site issue

ajay chauhan — Fri, 18 Nov 2011 14:09:42 GMT

yes might be pfs is on other side would suggest to take a look on remote .

site to site issue

prashantrecon — Fri, 18 Nov 2011 14:24:22 GMT

Hi please suggest on above output

site to site issue

ajay chauhan — Fri, 18 Nov 2011 14:35:05 GMT

looks like dropped by crypto acl please paste the config then only i can suggest something.

site to site issue

prashantrecon — Sat, 19 Nov 2011 06:25:12 GMT

Hi Ajay,

Issue is solved , there is some problem from far end.

Thanks

site to site issue

ajay chauhan — Sat, 19 Nov 2011 07:59:40 GMT

Great