CSCup37416 - Stale VPN Context entries cause ASA to stop encrypting traffic

[praveen.bangera@wipro.com]

Hi All,

Does any one have an permanent fix for this issue? One of customer VPN connections suddenly stops the traffic and connection is lost. This is becoming an regular issue and would need an permanent fix immediately. My current firewall ISO is ASA Version 9.1(6) 

Issue :

Stale VPN Context entries cause ASA to stop encrypting traffic

ASAs which had a working L2L VPN tunnel suddenly stops encrypting traffic. 

The ASP table will show duplicate ASP entries and traffic is hitting an ASP entry
that is stale and the traffic for particular SA is blackholed.

[Kanwaljeet Singh]

Hi Praveen,

Developers are working on it and there is no permanent fix yet. But you can try below workarounds:

1)Disable data-based rekeying:
"crypto map <map-name> <seq-num> set security-association lifetime kilobytes unlimited"

2) clear crypto ipsec sa inactive

3) Use IKEv1

You can also open TAC case for further information and you might also be offered to run a debug image to get more details around the issue.

Regards,

Kanwal

Note: Please mark answers if they are helpful.