Cisco ASA Site-to-Site VPN connection always reestablish

[muhammadaswad]

Can someone help me... I have two Cisco ASA 5506... I've already configured the Site to Site VPN connection.......The VPN connection was established like normal........... the problem is, the VPN connection always dropped, and then it will establish again, this happened frequently ...... Does anyone have an idea of how I could fix this problem?...........or this problem is related to the ISP connection?

FYI, I do the PPPOE at the router site before reach to Cisco ASA

[balaji.bandi · Accepted solution]

You need to look the logs while vpn tear down and post the logs hee, with what ASA  code you running, and let us know what is other end VPN devices ?

[muhammadaswad]

the other end was a Cisco ASA 5516, is this the right log location Monitoring->Logging->Log Buffer ?

I try to retrieve log from the previous day, but I can just only display all the log for today only.

[MHM Cisco World · Accepted solution]

Check lifetime of tunnel, make it longer and disable kbytes lifetime.

[Sheraz.Salim]

agree with @MHM Cisco World also you could run continious pings from your one machine in your network toward the other end of the vpn network. doing so the tunnel will be keep up. it could be going down when there is no traffic passing in the tunnel and due to ideal time vaule the firewall tear down the vpn tunnel.

[muhammadaswad]

Is this the correct location to check tunnel  lifetime  Configuration > Site-to-Site VPN > Connection Profiles >Advanced >Tunnel Group > IKE Keep-alive........ is this the right location ?

[balaji.bandi]

You need to match both sides. here is the site to site VPN config using ASDM.

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/119141-configure-asa-00.html

You need to post the Logs what is the reason of teardown, rather we assume many scenarios why it went down, so you can tweak the config.

if you running IP SLA or IGP between site, you always have active traffic so it won't affect due to idle times.

[muhammadaswad]

I've already follow this link

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/119141-configure-asa-00.html 

and the result is  Site to Site VPN already up for 24 hour  without dropping.......is it save if I've share the log here? 

[MHM Cisco World]

[muhammadaswad]

Noted........Yeah, my configuration already being configured like this.