ASA VPN with VTI towards AWS goes down every 24 Hrs

[vahabudeen]

Hi,

I do have an L2L VPN between my AWS account and ASA using the VTI interface. And I am running my BGP with AWS through this VTI interface in ASA. Everything works fine but every 24 Hrs my VPN gets reset, Hence BGP is also flapping.

Your inputs will be highly appreciated.

Thanks

Vahab

[Cristian Matei]

Hi,

    24 hours, maybe just a coincidence, matches the default ISKAMP lifetime; could you change that to 12 hours and see if the problem appears again in 12 hours now.

Regards,

Cristian Matei.

[vahabudeen]

Thanks, Cristian for your quick response

I don't think it's a coincidence as this is repeating every 24 Hrs.

Here is my current ISAKMP policy. lifetime is time set to 8 Hrs.

crypto ikev1 policy 201
encryption aes
authentication pre-share
group 2
lifetime 28800
hash sha

I hope you are clear about my scenario.

Tunnel to AWS has been created as GRE over IPSec using VTI .

BGP peering with AWS VGW is through this VTI interface (GRE Tunnel ).

Thanks

Vahab

[Cristian Matei]

Hi,

    Maybe things go wrong when Phase2 has key renegotiation, due to Phase2 lifetime. Are you using 24 hours there, most probably yes? Do you have a lifetime match between the VPN headends, not a requirement, but sometimes it can cause issues. When the problem shows up, issue a "show crypto ipsec sa peer x.x.x.x" and "show vpn-sessiondb detail l2l filter ipaddress x.x.x.x" and post it here.

Regards,

Cristian Matei.