vpn site to site connectivity problem after it works fine

[amralrazzaz]

hi all 

i have Cisco ASA5516-X and already configured site to site vpn ? once i deploy the connection working fine and i can reach the remote hosts but after sometimes it stop working by it self after checking same day at night ..

my question is do i have to check the windows firewall maybe its blocking something ?

what can cause this problem my side or the other side ?

is there is any policy that control the timing of accessing vpn connection ?

im the remote branch site and try to connect main head office 

need ideas of trouble shoot or what can cause this problem ?

[Chewbakka1]

The ipsec tunnel will be established if there is data to be sent.

Is the tunnel configured as bidirectional?

[Rob Ingram]

The IKEv1/IKEv2 and IPSec SA's all have configured lifetime timers. You can determine these using the commands:-

show vpn-sessiondb detailed l2l

show crypto ipsec sa

These do expire if no interesting traffic has been sent over the VPN tunnel, in which case you would just need to intiate traffic for the tunnel to be re-established.

Dead Peer Detection (DPD) might be useful to be configured, reference here.

HTH

[Marius Gunnerud]

As mentioned above, if no "interesting" traffic is sent over the VPN the tunnel will teardown.  You can increase the lifetime of ISAKMP and IPsec, and set vpn-idle-timeout none under the group policy assigned to the site to site VPN. However, if a rekey happens during a period when there is no traffic crossing the VPN, the tunnel will be still torn down.

The better option is to have your monitoring device at the HQ office send periodic ping / connectivity checks to the inside IP of the ASA.  For this to work you need to have management-access <interface name that you are pinging> configured on your ASA.