cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
629
Views
0
Helpful
1
Replies

cisco ASA 5505 Remote Access IPSec - Tunnel Rejected - The maximum tunnel count allowed has been reached

carlo.taddei1
Level 1
Level 1

I am working on implementing a "standard" Remote Access IKEv1 IPSec VPN to a cisco ASA 5505 (OS 8.4 - base license) and I keep getting the error message:

%ASA-4-713239: IP_Address: Tunnel Rejected: The maximum tunnel count allowed has been reached

even if there are no Site to Site or any additional VPN sessions (remote access VPN, Easy VPN, etc.) currently running / established on the unit.

I have tried to clear the "vpn-sessiondb" summary / statistics, as well as all ISAKMP / IKE SAs - no luck.

Before the statistics reset, the cumulative count of VPN sessions (remote access + S2S, SSL as well as IKEv1 and IKEv2) was set to > 60.

It is currently set to 0; however it looks to me as if the OS is still somehow "retaining" the cumulative count of VPN sessions.

(the unit has now been running over almost 14 months...)

It looks to me as if something as OS level is stuck .... does anyone know a workaround for resetting the responsible SW modules without needing to reboot the platform ?

1 Reply 1

rvarelac
Level 7
Level 7

Hi Carlo, 

Is this ASA in multiple context ? If so, you should check the resource limitation assigned to this context.

http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/116639-technote-asa-00.html

Hope it helps

-Randy-