Cisco ASA S2S VPN

[ToX1c1986]

Hi!

I have two Cisco ASA 5505 and S2S VPN tunnel, when tunnel is down( no more traffic,rekey) I have no access to local network of another site until somebody from another site pings my local network, but at the same time "show crypto isakmp sa" and "show crypto ipsec sa" show that everything including the tunnel is working well -  State   : MM_ACTIVE.

What should I do that ping from my local network give me access to another location without ping from another location?

crypto isakmp keepalive doesn't help to resolve this problem

Please help!

Thank you!

[Joe B Danford]

Need to see the configs of both ends here. Should check to make sure that SA lifetimes match, ensure there are no NAT issues and etc...  Typical site to site VPN would look like this

SITE A:

crypto isakmp policy 10

encr 3des

hash md5

authen pre-sha

!

crypto isakmp key cisco address 2.2.2.2

!

access-list acl_no_nat permit ip 10.10.10.0 255.255.255.0  11.11.11.0 255.255.255.0

access-list acl_match_vpn1 permit ip 10.10.10.0 255.255.255.0  11.11.11.0 255.255.255.0

!

nat (inside) 0 access-list acl_no_nat

!

crypto ipsec transform-set 3DES-SHA esp-3des esp-sha-hmac

!

crypto map vpn_map_outside 10 match address acl_match_vpn1p
crypto map vpn_map_outside 10 set peer 2.2.2.2
crypto map vpn_map_outside 10 set transform-set 3DES-SHA
crypto map vpn_map_outside interface outside

crypto isakmp nat-traversal

!

tunnel-group 2.2.2.2  type ipsec-l2l
tunnel-group 2.2.2.2  ipsec-attributes
   pre-shared-key cisco

SITE B:

crypto isakmp policy 10

encr 3des

hash md5

authen pre-sha

!

crypto isakmp key cisco address 1.1.1.1

!

access-list acl_no_nat permit ip   11.11.11.0 255.255.255.0 10.10.10.0 255.255.255.0

access-list acl_match_vpn1 permit ip  11.11.11.0 255.255.255.0 10.10.10.0 255.255.255.0

!

nat (inside) 0 access-list acl_no_nat

!

crypto ipsec transform-set 3DES-SHA esp-3des esp-sha-hmac

!

crypto map vpn_map_outside 10 match address acl_match_vpn1p
crypto map vpn_map_outside 10 set peer 1.1.1.1
crypto map vpn_map_outside 10 set transform-set 3DES-SHA
crypto map vpn_map_outside interface outside

crypto isakmp nat-traversal

!

tunnel-group 1.1.1.1 type ipsec-l2l
tunnel-group 1.1.1.1  ipsec-attributes
    pre-shared-key cisco

[ToX1c1986]

Thanks Joe! My configuration almost identical.

One ASA have nat(inside) 0 0 0

second            no nat-control    and no configuration of nat but other configurations are mirror