CSCup37416 - Stale VPN Context entries cause ASA to stop encrypting traffic

[praveen.bangera@wipro.com]

Hi All,

Does any one have an permanent fix for this issue? One of customer VPN connections suddenly stops the traffic and connection is lost. This is becoming an regular issue and would need an permanent fix immediately. My current firewall ISO is ASA Version 9.1(6) 

Issue :

Stale VPN Context entries cause ASA to stop encrypting traffic

ASAs which had a working L2L VPN tunnel suddenly stops encrypting traffic. 

The ASP table will show duplicate ASP entries and traffic is hitting an ASP entry
that is stale and the traffic for particular SA is blackholed.

[ciscosureshn]

Praveen,

  Tried the cisco work arounds..?

Workaround:Potential workarounds:

1)Disable data-based rekeying:
"crypto map set security-association lifetime kilobytes unlimited"

2) clear crypto ipsec sa inactive

3) Use IKEv1

Let know once applied.