Cisco ASA 5508 site to site vpn is disconnecting frequently.

[gprudhvi523@gmail.com]

Hi Team,

I have a site to site VPN configured between two ASA firewalls. And I have two ISP's (ISP1 and ISP 2)at my end for failover to support redundancy.

Issue :

The Site to Site VPN's is disconnecting frequently.

As a first step, I thought it was due to lifetime kilobytes so I have set the lifetime kilobytes to unlimited but still, I am facing the same issue.

Later one day ISP2(redundant)  was down due to some reason at the ISP side for one day I didn't find any disconnections during the day.

Then I have noticed the issue exists only when two ISP is active on my ASA, I am not sure what causing the issue.

It works well when only one ISP is connected, it may be ISP1 or ISP2. VPN disconnects if both are connected to the ASA.

I am having issues with only the VPN everything else works fine.

Please help me in resolving the issue.

[GRANT3779]

How is the redundancy setup on the ASA for fail over between the ISPs at your side?

[gprudhvi523@gmail.com]

sla monitor 123
type echo protocol ipIcmpEcho 4.2.2.2 interface outside
num-packets 3
frequency 10
sla monitor schedule 123 life forever start-time now
service sw-reset-button

[GRANT3779]

What is the address you are pinging within the SLA? The ISP GW or something else?
I'd be looking to setup traps to a syslog server for the SLA and then look into the possibility of it flapping and any potential link between this and the VPN hanging.

[gprudhvi523@gmail.com]

It is pinging to 4.2.2.2 and I think its a default address for SLA.

I could see a few drops for 4.2.2.2, Is it something causing the issue??

Then why not it is affecting my internet communication?

Observations:

1. No drops in the internet

2. Noticed drops in the SLA IP address

3. VPN is reconnecting during the same time.

4. No drops in the remote tunnel IP address.

[GRANT3779 · Accepted solution]

Hi,
I would use your ISP GW address as your target for SLA. If you are using an address further down in the "Internet" it might not be your ISP that is down overall.
If the SLA is failing over, then your VPN will be building over the second ISP and then rebuilding over the normal ISP when it comes back up which may be causing problems. VPNS are sensitive souls...
Highly likely this drop won't be noticed by "normal" traffic / end user when surfing the net etc..

[gprudhvi523@gmail.com · Accepted solution]

This is resolved after changing the SLA IP address to the ISP gateway.

Thanks for the support.