Scenario: Several ASA's with SFR's managed by an FMC for one entity, with one policy deployed with v...

I've been testing this now for a few days and it seems to work, so I think this is the issue -- a ne...

OK, I think I understand this and have it fixed. It's a bit weird (or seems so to me). First what I ...

Yes, the issue is definitely that NAT is getting a bad cached value. During the transition, for reas...

cco@leferguson.com wrote: I'm worried I need a sniffer somewhere to see where the packets are (not) ...

Thanks. I haven't, that may be better, and in fact I could probably then use a whole separate tunnel...

OK, that was pointless, I set it up ages ago. it's a static 1:1 nat so no PAT involved. I'm worried ...

Not sure that changed anything; I am not seeing the messages from them, but then again on-demand is ...

I added this to both routers, is there more that would be needed? crypto isakmp keepalive 30 10 peri...

@Rob Ingram wrote:Hi, My first thought would be that you required DPD in order to clear the old SAs....

Here are the configs. I've removed some irrelevant stuff for brevity, and redacted some stuff, but I...

This is sadly not a simple thing to describe. Short version: I can't get FLEXVPN to shift from one t...