初心者です。 教えてください。 L3スイッチでestablishedを使用したvlanのconfigがあります。 拡張access-listで別々の定義ですが、送信元と送信先のIPが同じで並びが同じでした。 それぞれの定義はINとOUTで違うvlanインターフェースに適用するようです。 これは、戻ってくるパケットの元々の送信元（パケットが送出されたIP）IPを制御するため 同じ並びになっているのでしょうか？ セッションの制御でそのようにしているのでしょうか？ よろしくお願いします。 ... View more

ASA5500シリーズでリモートアクセスVPNを構築しているのですが、 接続後20分～30分ぐらいで接続が切れてしまいます。 以下のコマンドを流していて、 デフォルトのグループポリシーを引き継ぐ設定をしています。 そのデフォルトグループポリシーでも、何か通信を遮断してしまうようなものの 設定はありません。 vpn-session-timeout none vpn-idle-timeout none crypto ipsec security-association lifetime 86400 何かコンフィグを変更する必要があるか、他のネットワーク機器が動作して遮断をしているか 原因がわかりません。 同じ事象が色々ウェブに掲載されていますが、これという解決策が見当たりません。 教えてください。 宜しくお願いします。 ... View more

There is an issue that cannot be solved. Connection to ASA5505 from VPN client drops intermittenly like after 30 minutes. I checked the following and added some to the existing configuration. I added the 2 of the following to the DfltGrpPolicy vpn-session-timeout none vpn-idle-timeout none and added crypto ipsec security-association lifetime 86400 I checked by using ASDM also. The parameters of the DfltGrpPolicy are as follows. Configuration - GroupPolicy - DfltGrpPolicy - General(Tab) - Connection Settings Access Hours: Unrestricted Maximum Connect Time: Unlimited Idle Timeout: Unlimited Configuration - GroupPolicy - DfltGrpPolicy - Client Configuration(Tab) - Cisco Client Parameters(Tab) IPSecUDPPort - Enabled Configuration - GroupPolicy - DfltGrpPolicy - Hardware Client(Tab) User Authentication Idle Timeout: Unlimited There's another group-policy that inherits the above configuration. I have checked the inherit field for the policy configuration. I refereced to many similar issue reports on websites. However, I'm still far from the conclusion. I'm at comma of what I should do next for this issue. I appreciate if anybody could provide any possible resolution for this. Yoshinori Mori ... View more

We have a issue of disconnection between PC using VPN Client Software and ASA5505. We loose connection sometimes after 5 minutes somtimes 30 minutes without any idle time out. The following is the log data obtained from VPN Client Software. I' ve changed some actual data to tentative. Could it be possible to give us an idea of what would possibly cause this kind of issues? This time there were some changes with the cryptomap but, there must have been no changes other than appropriate changes of IP addresses. SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to 1.1.1.1 Received DPD ACK from 1.1.1.1, seq# received = **********, seq# expected = ********** Disconnecting VPN connection. Secure connections terminated IKE received signal to terminate VPN connection SENDING >>> ISAKMP OAK INFO *(HASH, DEL) to 1.1.1.1 Deleting IPsec SA: (OUTBOUND SPI = ******** INBOUND SPI = ********) Discarding IPsec SA negotiation, MsgID=******** SENDING >>> ISAKMP OAK INFO *(HASH, DEL) to 1.1.1.1 The routing table was returned to original state prior to Virtual Adapter The Virtual Adapter was disabled Discarding IKE SA negotiation (I_Cookie=************** R_Cookie=**********) reason = DEL_REASON_RESET_SADB Phase 1 SA deleted cause by DEL_REASON_RESET_SADB. 0 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system Initializing CVPNDrv Tunnel to headend device 1.1.1.1 disconnected: duration: 0 days 0:0:17 Set tunnel established flag in registry to 0. Key deleting continues..... Reagrds Mori ... View more