IKEv1 and IKEv2 session in ASDM Monitor?

[david]

Hi all, have a question.  I have a L2L tunnel setup between two ASA's (v8.4).  I used the wizard to set these up and selected the defaults of both IKEv1 and IKEv2, thinking that it would select one or the other.  The strange thing is that now I see a separate session between these ASA's, one for IKEv1 and one for IKEv2.  Both are passing traffic.  Is this expected behavior?  Should I disable IKEv1 to force only v2 since both are v8.4?

pic attached to help explain.

[Javier Portuguez]

Hi David,

If both versions are configured then two IKE tunnels will be established.

I suggest to disable IKEv1 and only maintain IKEv2.

HTH.

Portu.

Please rate any helpful posts.

[Marcin Latosiewicz · Accepted solution]

If both versions are configured then two IKE tunnels will be established. 

I'm not so sure this is expected behavior. On ASA tune tunnel manager should try first IKEv2 and if it fails try IKEv1.

There might be some concurrency problems in which one side would initiate IKEv1 while other does IKEv2.

It's something can we can investigate by debugging tunnel manager and both IKEs.

debug crypto ike-common 5
debug crypto ....

I think you might want to open a TAC case so we can check this out thoroughly.

[Javier Portuguez · Accepted solution]

Marcin,

I believe I have seen this in a previous situation. I agree with you about the concurrency problems and a TAC case would probably be the best way to go.

Thanks for the input mate, 5 stars!

[david]

Thanks All, I disabled IKEv1 on the remote ASA and that removed the redundant tunnels.  All seems well now.

[Javier Portuguez]

Sweet

Thanks for sharing the fix.

Have a nice weekend!