Cisco ASA5506 often stops vpn connection in the morning

jude — Fri, 21 Feb 2020 15:18:07 GMT

I need some specialists to help with this:

We have 2 ASA5506 with same configuration in two spoke sites, IPSEC-vpn-connected to ASA5515 in the hub site (same hub-spoke vpn). Internet and cross-site traffic works very well, but after some hours one spoke site stops sending traffic out from the ASA5506 (the other one never had problem).

ASDM connection from internet works fine as I'm managing the problem ASA5506 remotely. What I have found:

- 21 incidents out of 60 occurred in the morning round 8:00 AM, when nobody works in the spoke site, but many users start to work in the hub site. Other events occurred in the working hours mostly.

- IPSEC SA is still active when it stops sending traffic out. SA sent packets still increases, but received packets won't increase.

- There is 50%-70% packet loss pinging the spoke site's isp router IP from ASA5506 (same network segment) during incident time, but no packet loss to ping ASA5506 outside IP from internet.

- The problem can be resoled by reloading either the spoke ASA5506, or the hub ASA5515.

IPSEC lifetime is disabled. 'Show asp drop' displays packet drop increase for 'l2_acl', 'acl_drop' and 'sp_security_failed' when traffic stops, but they are quite similar as that when no problem.

ISP presented bandwidth utilization graph, there were some peak times reaching bandwidth limit, but the peak times don't match the times when connection stopped in general.

I assume it's a vpn issue as I can still remotely manage the ASA during the problem time. It might also be related to user traffic as 1/3 incidents occurred between 8:00-8:05, but don't know how to figure out why the packets are not sent.

I'm posting my configuration file below but the IP addresses are not real for safety consideration:

: Hardware: ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cores)
:
ASA Version 9.5(2)
!
hostname ASA5506
domain-name mycompany.net
enable password ****** encrypted
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
passwd ****** encrypted
names
!
interface GigabitEthernet1/1
nameif outside
security-level 0
ip address 151.218.145.237 255.255.255.252
!
interface GigabitEthernet1/2
nameif inside
security-level 100
ip address 10.201.0.1 255.255.255.0
!
interface GigabitEthernet1/3
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/4
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/5
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/6
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/7
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/8
shutdown
no nameif
no security-level
no ip address
!
interface Management1/1
management-only
nameif management
security-level 0
ip address 192.168.1.1 255.255.255.0
!
ftp mode passive
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
dns server-group DefaultDNS
domain-name mycompany.net
object network CSM
host 171.66.30.203
description 171.66.30.203
object network Net_10.0.0.0-8_RFC1918
subnet 10.0.0.0 255.0.0.0
object network Net_172.16.0.0-12_RFC1918
subnet 172.16.0.0 255.240.0.0
object network Net_192.168.0.0-16_RFC1918
subnet 192.168.0.0 255.255.0.0
object network test_1.1.1.1
host 1.1.1.1
object network OutsideIP
host 151.218.145.237
object network CSM_VPN_NAT_0_OBJ_NET_1
subnet 10.201.0.0 255.255.254.0
object network CSM_VPN_NAT_0_OBJ_NET_2
subnet 0.0.0.0 0.0.0.0
object network CSM_VPN_NAT_0_OBJ_NET_3
subnet 10.201.0.0 255.255.255.0
object-group network RFC1918
description All pricate addresses
network-object 10.0.0.0 255.0.0.0
network-object 172.16.0.0 255.240.0.0
network-object 192.168.0.0 255.255.0.0
object-group network GRP_RFC1918
network-object object Net_172.16.0.0-12_RFC1918
network-object object Net_192.168.0.0-16_RFC1918
network-object object Net_10.0.0.0-8_RFC1918
object-group network Allowed_WAN_Hosts
description Internet hosts allowed all IP traffic
network-object object test_1.1.1.1
object-group service NTP
description NTP Protocols
service-object tcp destination eq 123
service-object udp destination eq ntp
object-group service Synology
service-object tcp destination range 5000 5001
object-group service Apple
service-object tcp destination eq 16384
service-object tcp destination eq 16385
service-object tcp destination eq 16386
object-group service Internet_Access
service-object icmp
service-object tcp destination eq www
service-object tcp destination eq https
service-object tcp destination eq ftp
service-object tcp destination eq ftp-data
service-object tcp destination eq nntp
service-object udp destination eq domain
service-object tcp destination eq domain
service-object tcp destination eq pop3
service-object tcp destination eq imap4
service-object tcp destination eq ssh
service-object tcp destination eq 8080
service-object tcp destination eq 8000
service-object tcp destination eq 5938
service-object tcp destination eq 4443
service-object tcp destination eq 10020
group-object NTP
group-object Synology
group-object Apple
access-list CSM_FW_ACL_inside extended permit ip object Net_10.0.0.0-8_RFC1918 object-group GRP_RFC1918
access-list CSM_FW_ACL_inside extended permit ip object Net_172.16.0.0-12_RFC1918 object-group GRP_RFC1918
access-list CSM_FW_ACL_inside extended permit object-group Internet_Access object Net_10.0.0.0-8_RFC1918 any
access-list CSM_FW_ACL_inside extended permit object-group Internet_Access object Net_172.16.0.0-12_RFC1918 any
access-list CSM_FW_ACL_inside remark Bypass WAN IP with special ports
access-list CSM_FW_ACL_inside extended permit ip object Net_10.0.0.0-8_RFC1918 object-group Allowed_WAN_Hosts
access-list CSM_FW_ACL_inside extended permit ip object Net_172.16.0.0-12_RFC1918 object-group Allowed_WAN_Hosts
access-list CSM_FW_ACL_inside extended deny ip any any
access-list CSM_FW_ACL_outside extended permit ip object-group GRP_RFC1918 object Net_10.0.0.0-8_RFC1918
access-list CSM_FW_ACL_outside extended permit ip object-group GRP_RFC1918 object Net_172.16.0.0-12_RFC1918
access-list CSM_FW_ACL_outside extended permit ip object CSM object OutsideIP
access-list CSM_FW_ACL_outside extended deny ip any any
access-list CSM_IPSEC_ACL_2 extended permit ip 10.201.0.0 255.255.255.0 any4
pager lines 24
logging enable
no logging hide username
logging standby
logging asdm debugging
logging debug-trace
mtu outside 1500
mtu inside 1500
mtu management 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,outside) source static CSM_VPN_NAT_0_OBJ_NET_3 CSM_VPN_NAT_0_OBJ_NET_3 destination static CSM_VPN_NAT_0_OBJ_NET_2 CSM_VPN_NAT_0_OBJ_NET_2 no-proxy-arp route-lookup
nat (management,outside) source static CSM_VPN_NAT_0_OBJ_NET_3 CSM_VPN_NAT_0_OBJ_NET_3 destination static CSM_VPN_NAT_0_OBJ_NET_2 CSM_VPN_NAT_0_OBJ_NET_2 no-proxy-arp route-lookup
nat (inside,outside) source dynamic RFC1918 interface destination static CSM CSM
access-group CSM_FW_ACL_outside in interface outside
access-group CSM_FW_ACL_inside in interface inside
route outside 0.0.0.0 0.0.0.0 151.218.145.238 1
route outside 171.66.30.203 255.255.255.255 151.218.145.238 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
user-identity default-domain LOCAL
http server enable 4443
http 151.43.54.243 255.255.255.255 outside
http 88.45.123.123 255.255.255.255 outside
http 0.0.0.0 0.0.0.0 inside
snmp-server host inside 10.161.20.112 community *****
no snmp-server location
no snmp-server contact
snmp-server community *****
service sw-reset-button
crypto ipsec ikev1 transform-set CSM_TS_1 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set CSM_TS_2 esp-aes-256 esp-sha-hmac
crypto ipsec security-association pmtu-aging infinite
crypto map CSM_outside_map 1 match address CSM_IPSEC_ACL_2
crypto map CSM_outside_map 1 set pfs group5
crypto map CSM_outside_map 1 set peer 213.102.216.16
crypto map CSM_outside_map 1 set ikev1 transform-set CSM_TS_1 CSM_TS_2
crypto map CSM_outside_map 1 set security-association lifetime seconds 3600
crypto map CSM_outside_map 1 set reverse-route
crypto map CSM_outside_map interface outside
crypto ca trustpool policy
crypto isakmp identity address
crypto ikev1 enable outside
crypto ikev1 policy 1
authentication pre-share
encryption aes-256
hash sha
group 5
lifetime 86400
telnet timeout 1
ssh stricthostkeycheck
ssh 151.43.54.243 255.255.255.255 outside
ssh 88.45.123.123 255.255.255.255 outside
ssh 10.0.0.0 255.0.0.0 inside
ssh 172.16.0.0 255.240.0.0 inside
ssh 192.168.0.0 255.255.0.0 inside
ssh timeout 60
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 60
management-access inside

threat-detection basic-threat
threat-detection statistics host
threat-detection statistics port
threat-detection statistics protocol
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 97.165.172.58 source outside
dynamic-access-policy-record DfltAccessPolicy
username myadmin password ****** encrypted privilege 15
username mygroup password ****** encrypted privilege 15
username nysfg password ****** encrypted privilege 15
tunnel-group 213.102.216.16 type ipsec-l2l
tunnel-group 213.102.216.16 ipsec-attributes
ikev1 pre-shared-key *****
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect icmp
class class-default
user-statistics accounting
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily

Re: Cisco ASA5506 often stops vpn connection in the morning

jude — Wed, 07 Feb 2018 07:10:17 GMT

one correction: the hub site ASA model is Cisco ASA5516x.

topic Re: Cisco ASA5506 often stops vpn connection in the morning in Network Security

Cisco ASA5506 often stops vpn connection in the morning

Re: Cisco ASA5506 often stops vpn connection in the morning