topic ASA 5520 8.3, VPN tunnel Drops Traffic in Network Security

ASA 5520 8.3, VPN tunnel Drops Traffic

aquasilk0001 — Mon, 11 Mar 2019 21:15:41 GMT

Hello everybody, we are having a crisis with a very mysterious issue.

We have a 100 Mbps WAN circuit, we have configured an IPsec tunnel between ASA 5520 and Cisco 3845 Router for our DR site replication via Veeam Backup and Replication, it was working fine before, when we established the 3DES tunnel the traffic for certain subnets is dropped after an hour and it stops the replication, although tunnel remains up and we can access the other subnets, as soon as we clear the crypto SA and ISAKMP sessions on the firewall the traffic starts flowing again and then after an hour the traffic is dropped again.

So far the testing and differnet configurations we tried are as under.

Tried with a different MTU size both on firewall and ESXi servers but nothing happened.

Their is no QOS configuration.

Checked the utilization on both ends its Noram although their are subsequent 100% spikes on Cisco 3845 but on average it remians at 30-40%.

ASA 5520 8.3, VPN tunnel Drops Traffic

aquasilk0001 — Tue, 23 Aug 2011 11:57:38 GMT

Guys Any ideas where should i look for, or any specific aparmeters we can change..!!

ASA 5520 8.3, VPN tunnel Drops Traffic

Maykol Rojas — Tue, 23 Aug 2011 17:35:01 GMT

Aqua,

So it is just one type of specific traffic that is being dropped? What port does this application uses? Do you have logs on the firewall when the connection drops? How long does it stays up?

Mike

ASA 5520 8.3, VPN tunnel Drops Traffic

aquasilk0001 — Wed, 24 Aug 2011 05:48:20 GMT

Hi Rojas,

We have only one type of traffic on the link and it drops on certain specific subnets, additionally i can see huge packet drops on the interface, when we torn down the IPsec tunnel on the same interface everything works nicely.

It stays up for almost one and half hour and then traffic for some subnets drop but tunnel remains up.

And again when we torn down the tunnel everything seems to work.

The application uses random TCP ports between (2500 and 5000)

ASA 5520 8.3, VPN tunnel Drops Traffic

Maykol Rojas — Wed, 24 Aug 2011 16:30:36 GMT

Hi,

We may need to get the logs from the connection when its torn down and checkout the reason with the logs. Setup a syslog server, have the connection running and check when it is being torn down on the ASA.

Mike Rojas

ASA 5520 8.3, VPN tunnel Drops Traffic

aquasilk0001 — Wed, 24 Aug 2011 17:19:31 GMT

I have attached the syslog file to the original message posted.

ASA 5520 8.3, VPN tunnel Drops Traffic

praprama — Thu, 08 Sep 2011 18:01:43 GMT

Hi Aqua,

Do you have a timestamp when the traffic stopped passing? it will help when looking through the syslogs.

When you mention traffic just stops for a few subnets, does that mean this same application is running between different subnets?

When the connetion stops working and tunnel is still up, please post the output of show conn | in .

this should give us an idea of what is the state of that TCP connection.

Regards,

Prapanch