ASA5520 HA failover - IPSEC VPN stops working on standby - ESP Failed Authentication

[garybrophy]

Hi All,

any recommendations welcome!

I have Failover pair of 5520 in active/standby. Everything works fine on the active firewall but when it fails over to the standby Firewall one particular VPN stops working.

the following error constantly appears on the other side

IPSEC:Recieved an ESP packet (SPI=0x56869431, sequence number= 0x2FAF1CD) from x.x.x.x (user = x.x.x.x) to x.x.x.x that failed authentication

While on the Standby I have cleared the IPSEC and ISAKMP connection and I can see Phase 1 and Phase 2 establish but straight after that the above error appears and no traffic passes.

I have rebooted the Firewalls individually and together to clear the cluster but same thing.

I have upgraded the firewalls to version asa9.17-19-k8.bin but same issue.

I am thinking of taking the cables from the Active unit putting them in the Standby unit to see if it works then to rule out a possible hardware issue on the Standby.

Anyone seen this behavior before and have suggestions before I try that?

Thanks

Gary

[Mohammed al Baqari]

On ASA use show failover command check if it cold standby or hot standby. Your config might not be synched.

[garybrophy]

Hi Mohammad,

not sure of the terminology hot and cold but the failover config is synced. Show failover shows standby as standby ready.

I did a moresystem running config on both when active to double check the config and they match exactly.

Regards

Gary

[GioGonza]

Hello @garybrophy, 

Based on your log, this is related to this concern. Normally, this is related to attacks or packets corrupted received by the ASA, when the ASA receives this it drops the packets and you will have problems with the communication. 

A workaround for this is to change the Anti-Replay feature on the ASA, you can disable it or increase the value for that particular feature, this is the link for reference. 

The command should be "crypto ipsec security-association replay window-size 1024", after this test the connection and verify everything is working fine and the log dissapeared. 

HTH

Gio

[garybrophy]

Thanks for the suggestion Gio,

Ill give it a shot later this evening to see if it works for me and let you know.

Do you know if it is possible on the ASA to just change the setting for one VPN rather than doing it globally?

Looks like its possible to do individual ones for the routers but not for the ASA

Thanks

Gary

[GioGonza]

Hello @garybrophy, 

Unfortunately no, the ASA has that feature enabled on the global configuration, there is no way you can change it for specific VPN tunnels.

Gio

[garybrophy]

Thanks Gio,

Ill give it a shot later.

Thanks

Gary

[garybrophy]

cheers for the idea but didn't work

tried setting it to 1024 and disabled it also but same issue occurred.

looks like I'm going to have to go to site for this one to rule out a hardware issue

Regards

Gary