Cisco ASA version 8.2(5)
There is a VPN tunnel with a TCP connection inside it. We noticed that from time to time TCP connection break up.
This is what we found in ASA logs:
Group = X.X.X.X, IP = X.X.X.X, Connection terminated for peer X.X.X.X. Reason: IPSec SA Idle Timeout Remote Proxy 193.58.21.4, Local Proxy 172.18.234.209 --- NATTED TO 192.168.146.18
%ASA-6-602304: IPSEC: An outbound LAN-to-LAN SA (SPI= 0xA2D13B6B) between Y.Y.Y.Y and X.X.X.X (user= X.X.X.X) has been deleted
%ASA-6-602303: IPSEC: An outbound LAN-to-LAN SA (SPI= 0x46C77A2B) between Y.Y.Y.Y and X.X.X.X (user= X.X.X.X) has been created.
%ASA-5-713049: Group = X.X.X.X, IP = X.X.X.X, Security negotiation complete for LAN-to-LAN Group (X.X.X.X) Initiator, Inbound SPI = 0x208585eb, Outbound SPI = 0x46c77a2b
%ASA-6-602303: IPSEC: An inbound LAN-to-LAN SA (SPI= 0x208585EB) between Y.Y.Y.Y and X.X.X.X (user= X.X.X.X) has been created.
%ASA-5-713120: Group = X.X.X.X, IP = X.X.X.X, PHASE 2 COMPLETED (msgid=05b30a90)
%ASA-6-302014: Teardown TCP connection 727713 for outside:193.58.21.3/6204 to inside:192.168.146.18/60700 duration 0:50:41 bytes 306776210 Tunnel has been torn down
%ASA-6-106015: Deny TCP (no connection) from 193.58.21.3/6204 to 172.18.234.209/41660 flags ACK on interface outside
%ASA-6-106015: Deny TCP (no connection) from 193.58.21.3/6204 to 172.18.234.209/41660 flags ACK on interface outside
%ASA-6-106015: Deny TCP (no connection) from 193.58.21.3/6204 to 172.18.234.209/41660 flags ACK on interface outside
%ASA-6-106015: Deny TCP (no connection) from 193.58.21.3/6204 to 172.18.234.209/41660 flags PSH ACK on interface outside
%ASA-6-106015: Deny TCP (no connection) from 193.58.21.3/6204 to 172.18.234.209/41660 flags ACK on interface outside
%ASA-6-106015: Deny TCP (no connection) from 193.58.21.3/6204 to 172.18.234.209/41660 flags ACK on interface outside
%ASA-6-106015: Deny TCP (no connection) from 193.58.21.3/6204 to 172.18.234.209/41660 flags ACK on interface outside
%ASA-6-106015: Deny TCP (no connection) from 193.58.21.3/6204 to 172.18.234.209/41660 flags ACK on interface outside
%ASA-6-106015: Deny TCP (no connection) from 193.58.21.3/6204 to 172.18.234.209/41660 flags ACK on interface outside
%ASA-6-106015: Deny TCP (no connection) from 193.58.21.3/6204 to 172.18.234.209/41660 flags ACK on interface outside
%ASA-6-106015: Deny TCP (no connection) from 193.58.21.3/6204 to 172.18.234.209/41660 flags ACK on interface outside
Looks like during tunnel rekey all TCP connections are blocked
Is there any workaround?
Thank you
