I have the 10.64.0.0 subnet and 172.21.0.0 subnet that talk to each other via the tunnel. Everyday in the morning i have to bounce the tunnel to get this working. I have case opened with the TAC engineer but seems like there is no resolution to this.
IMMCUSTFW01# sh asp table classify crypto | be out
out id=0xad1abc10, priority=70, domain=encrypt, deny=false
hits=3270, user_data=0x3b27dc, cs_id=0xacc6dbd8, reverse, flags=0x0, protocol=0
src ip=10.64.0.0, mask=255.255.0.0, port=0
dst ip=172.21.0.0, mask=255.255.0.0, port=0, dscp=0x0
out id=0xacccd398, priority=70, domain=encrypt, deny=false
hits=1676, user_data=0x0, cs_id=0xacc6dbd8, reverse, flags=0x0, protocol=0
src ip=10.64.0.0, mask=255.255.0.0, port=0
dst ip=172.21.0.0, mask=255.255.0.0, port=0, dscp=0x0
Last clearing of hits counters: Never
IMMCUSTFW01# show crypto ipsec sa peer 148.61.xx.xx
Crypto map tag: Outside_map, seq num: 12, local addr: 63.111.xx.xx
access-list outside_14_cryptomap extended permit ip 10.64.0.0 255.255.0.0 172.21.0.0 255.255.0.0
local ident (addr/mask/prot/port): (10.64.0.0/255.255.0.0/0/0)
remote ident (addr/mask/prot/port): (172.21.0.0/255.255.0.0/0/0)
current_peer: 148.61.xx.xx
#pkts encaps: 4784, #pkts encrypt: 4784, #pkts digest: 4784
#pkts decaps: 4782, #pkts decrypt: 4782, #pkts verify: 4782
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 4784, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: 63.111.xx.xx, remote crypto endpt.: 148.61.xx.xx
path mtu 1500, ipsec overhead 58, media mtu 1500
current outbound spi: 71792FB1
current inbound spi : 42E74BAC
The TAC engineer says that the SPI values are different from the existing once to the once that are found in the output shown above for the SAs(sh asp table classify crypto | be out). I am running the 8.2.5 version of ASA code. There is no way to delete the inactive SPIs in this version of code. Has anyone have encountered such a situation and would like to know how to resolve this issue.
When the traffic is not reachable no SAs are formed between the peer for those subnets but i can see for those subnets in the sh asp table classify crypto | be out. Once i bounce the tunnel, SAs are formed but the SPI values are different when compared to those in the sh asp table classify crypto | be out.
