VPN IPSEC site-to-site stop working ( There are no IPSEC SAs )

[Alvaro Campos]

Hi,

I have configured an IPSEC VPN site-to-site betwwen two ASA 5506 and were working well for months but yesterday i realize that the tunnel is down, i did not change any configuration, i restart both devices but tunnel is still not working  and when i try   # sh crypto ipsec sa  or   # sh crypto ikev1 sa , the answer is " There are no IPSEC  SAs" or "There are no Ikev1 SAs" .   What could be happing ?.

[balaji.bandi]

Check the both the side configuration phase 1 and phase 2 configuration.

Enable debug and check the logs.

[Alvaro Campos]

Thanks for the response! , how can we do that? , could you please write the commands?

[balaji.bandi]

show run  on both the ASA and check the VPN part of config. make sure Phase1 and Phase2 config matches and also ACL for the interested traffic.

[Alvaro Campos]

I have already checked them twice and they are ok , i have not changed any configuration lately ....

[balaji.bandi]

Then do you have IP reach-ability between these site.

1. check site to site Iip able to ping.

2. Verify the Config.(any key issue).

3. check show crypt (phase 1 and Phase 2)

4. enable debug and see any logs(which can give you indication what is the issue).

refer below document :

https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/5409-ipsec-debug-00.html