ASA VPN L2L - possible NAT problem?

[Gerd Singer]

As mollom spam filter blocked my Initial post, and no Response after a week of reporting this error, i try to work around, so please don't mind my writing ;)

I have an ASA 5510 as central FW, and 4 ASA 5505 on remote Locations, which all run the identical config - except IP range and pre-shared key. My Problem is, that 2 of the 4 loose data traffic almost every day - not exactly every 24h but sometimes less. The Show crypto isakmp sa command Shows the tunnels itselves being intact - but no more data (ping, etc) is possible. Doing a cl crypto isakmp sa resets all - so traffic is again possible.

As this is only Happening on 2 of the 4- 5505 - my only guess is, that it has sth to do with my central config, which all were converted from PIX 506E and PIXs 501 (remotes) directly to past 8.3 IOS - but appearently not a 100% :/

Config will follow in next post - if it works ;)

I would appreciate any hints for this Problem - Any code i Need to add or remove - thank you!!

[Gerd Singer]

SA 5510:

object network obj_any
 subnet 0.0.0.0 0.0.0.0
object network 192.168.0.0
 subnet 192.168.0.0 255.255.255.0
object network 192.168.1.0
 subnet 192.168.1.0 255.255.255.0
object network 192.168.2.0
 subnet 192.168.2.0 255.255.255.0
object network 192.168.4.0
 subnet 192.168.4.0 255.255.255.0
object network 10.23.53.0
 subnet 10.23.53.0 255.255.255.0

access-list outside extended permit icmp any any echo-reply
access-list outside extended permit icmp any any unreachable
access-list outside extended permit icmp any any time-exceeded
access-list outside extended permit icmp any any information-reply
access-list outside extended permit icmp any any information-request
access-list outside extended permit icmp any any parameter-problem
access-list 101 extended permit ip 10.23.53.0 255.255.255.0 any
access-list 110 permit ip 10.23.53.0 255.255.255.0 192.168.0.0 255.255.255.0
access-list 111 permit ip 10.23.53.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list 112 permit ip 10.23.53.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list 114 permit ip 10.23.53.0 255.255.255.0 192.168.4.0 255.255.255.0

nat (inside,outside) source static 10.23.53.0 10.23.53.0 destination static 192.168.0.0 192.168.0.0                  
nat (inside,outside) source static 10.23.53.0 10.23.53.0 destination static 192.168.1.0 192.168.1.0                  
nat (inside,outside) source static 10.23.53.0 10.23.53.0 destination static 192.168.2.0 192.168.2.0                  
nat (inside,outside) source static 10.23.53.0 10.23.53.0 destination static 192.168.4.0 192.168.4.0                  
!
object network obj_any                     
 nat (inside,outside) dynamic interface                                      
object network ftp_server                        
 nat (inside,outside) static interface service tcp ftp ftp                                                         
object network rdp                 
 nat (inside,outside) static interface service                                            
access-group outside in interface outside                                                                                                                   

crypto ipsec ikev1 transform-set MYSET esp-des esp-md5-hmac                                                            
crypto dynamic-map MYSET 10 set ikev1 transform-set MYSET
crypto map MYSET1 10 ipsec-isakmp dynamic MYSET
crypto map MYSET1 20 match address 110                      
crypto map MYSET1 20 set peer xx.xx.xx.xx                                             
crypto map MYSET1 20 set ikev1 transform-set MYSET
crypto map MYSET1 30 match address 112                                       
crypto map MYSET1 30 set peer xx.xx.xx.xx                                           
crypto map MYSET1 30 set ikev1 transform-set MYSET
crypto map MYSET1 40 match address 111                                       
crypto map MYSET1 40 set peer xx.xx.xx.xx                                            
crypto map MYSET1 40 set ikev1 transform-set MYSET
crypto map MYSET1 60 match address 114                                       
crypto map MYSET1 60 set peer xx.xx.xx.xx                                            
crypto map MYSET1 60 set ikev1 transform-set MYSET
crypto map MYSET1 interface outside                                    
crypto isakmp identity address                             
crypto ikev1 enable outside                          
crypto ikev1 policy 10                     

ASA 5505:

object network obj_any                     
 subnet 0.0.0.0 0.0.0.0                      
object network 192.168.4.0                         
 subnet 192.168.4.0 255.255.255.0                                
object network 10.23.53.0                        
 subnet 10.23.53.0 255.255.255.0                               
access-list outside extended permit icmp any any echo-reply                                                          
access-list outside extended permit icmp any any unreac                                                    
access-list outside extended permit icmp any any time-exceeded                                                             
access-list outside extended permit icmp any any information-reply                                                                 
access-list outside extended permit icmp any any information-request                                                                   
access-list outside extended permit icmp any any parameter-problem                                                                 
access-list 101 extended permit ip 192.168.4.0 255.255.255.0 any                                                               
access-list 110 extended permit ip 192.168.4.0 255.255.255.0 10.23.53.0 255.255.255.0

nat (inside,outside) source static 192.168.4.0 192.168.4.0 destination static 10.23.53.0 10.23.53.0                  
!
object network obj_any                     
 nat (inside,outside) dynamic interface                                      
crypto ipsec ikev1 transform-set MYSET esp-des esp-md5-hmac                                                            
crypto dynamic-map MYSET 10 set ikev1 transform-set MYSET
crypto map MYSET1 10 ipsec-isakmp dynamic MYSET

// crypto map MYSET1 20 match address 110    // had to remove that line, otherwise i get no packet encaps/decaps
crypto map MYSET1 20 set peer xx.xx.xx.xx                                            
crypto map MYSET1 20 set ikev1 transform-set MYSET
crypto map MYSET1 interface outside                                    
crypto isakmp identity address                             
crypto ikev1 enable outside                          
crypto ikev1 policy 10access-group outside in interface outside

[Marvin Rhoads]

It sounds like you might be hitting the rekey time limit and the sessions are not recovering gracefully across that that event. You can check to watch for one getting close with "show cry IPSec sa".

You didn't say but are all the ASAs running the same version of software? It could be a bug in only some versions. 

One other thing you can try is the command "sysopt connection preserve-vpn-flows". Its usage is described here:

http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113014-asa-userapp-vpntunnel.html

[Gerd Singer]

thank you Marvin for your reply!

All are running on 8.4 (5) - as 2 of them run flawlessly i had checked everything else beside the code i was able to: same licenses, same Memory, i even swapped them before (working site vs. faulty site) so i was stuck with my central config.

last time at the latest disconnect i checked "ipsec sa" - it had around 12000 sec left for this tunnel

what i am not  sure of:

1. does the order of the sequence numbers in my crypto map somehow affect this ? (30 -match address 112, 40 - match address 111 - 50 missing due to deleted site - 60 - working flawlessly)

2. would i have to set Extended ACL instead of Standard for the 4 sites?

thank you

[Rahul Govindan]

You may also want to see what how much traffic flows through each of these tunnels. There is a default Kb lifetime that forces the tunnels to rekey after certain amount of data flows through it. It could be that the 2 tunnels in question have more traffic than the other 2 causing a rekey to occur. In an ideal scenario, rekey alone would not cause data to stop.

Another way to troubleshoot would be to apply capture for traffic on the WAN interfaces for encrypted traffic when the traffic starts failing. I have seen some weird behavior with ISP's blocking traffic after certain times, so it would be good to know at what point the traffic fails.

[Gerd Singer]

thx for your Input Rahul!

from my personal Feeling and given the size of the remote sites, i am quite sure, that the 2 in question have moderate data flow... the working 2 are the "largest" and the "smallest" site.

another (fun) fact is, when i plug in the old PIX 506E on the central - all sites work properly, so i left the PIX in place until this mystery is solved :/ (... better old and slow than daily phonecalls from the sites )

as i am no professional, i converted most of the config with the conversion tool... so don't you think this behavior could have been related to my above questions?

thank you!