IPsec Tunnel issue between Cisco ASA- FTD1120 frequently

[adity]

Hi Team,

We are facing the issue between Ipsec tunnel between 2 sites, tunnels went down frequently everyday after 1-2 hours.

 Site A has : ASA5516

 Site B has : FTD 1120.

issue: both the phases shows down, once I regenerated the traffic from site B then tunnels came up.

[MHM Cisco World]

If it ikev2 this normal'

Site A is respone only and site B is initiate.

[adity]

But earlier it's working fine from past 1 week i have noticed this issue.

Both the phases went to downstate, so need to regenerate the traffic from Site B end.

[gajownik]

If there's no traffic then by default tunnel will go down. You would need to change vpn-idle-timeout to none on ASA and FTD. On FTD this can be achieved only via FlexConfig at the moment:

CSCvr82274 ENH: FMC and FDM - make the vpn-idle-timeout configurable for site to site VPNs
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvr82274

If it's not related to lack of traffic you should run debugs and wait for the tunnel to go down:

ASA/FTD IKEv1
system support diagnostic-cli
undebug all
show clock
show crypto ikev1 sa
show crypto ipsec sa peer X.X.X.X
debug crypto condition peer X.X.X.X
debug crypto ike-common 127
debug crypto ikev1 255
debug crypto ipsec 255
//wait for the tunnel to go down
undebug all

Explanation of each Main Mode can be found here:
https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/113594-trouble-ios-ike-00.html
Debug examples are from IOS, but they look similar on ASA/FTD.

ASA/FTD IKEv2
system support diagnostic-cli
undebug all
show clock
debug menu ikev2 3 1 //it will enable timestamps in the debugs
debug crypto condition peer X.X.X.X
debug crypto ike-common 127
debug crypto ikev2 platform 255
debug crypto ikev2 protocol 255
debug crypto ipsec 255
//wait for the tunnel to go down
undebug all

https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/115936-understanding-ikev2-packet-exch-debug.html