Hi, in our network we have a fleet of ASA's (Cisco virtual ASAv30 appliances) deployed on Amazon Web Services for a IKev2 Remote Access VPN, devices connect to these via a load-balancer that evenly distributes traffic and has a connection persistence of several hours so that you remain on the same ASA.
We have 2 environments, Prod and Pre-Prod which share identical topology and configuration settings.
Remote devices are MDM managed and have an Always-On VPN profile deployed that connects automatically when the device is turned on.
The issue were experiencing is related to Dead Peer Detection, on the mobile devices after 10 minutes of a connection being established it does a DPD check with 5 retires, this is inline with the VPN profile that is deployed to the handset.
On the ASA via a packet capture we see the 5 INFORMATION Initiator request packets land but we dont see any Response packets being sent from the ASA back to the handset, as seen here.
The tunnel is then pulled down by the the device and then recreated again, potentially back to the same ASA due to the persistence on the load-balancer. This has a detrimental impact on voice and video calls as when this happens the call is dropped.
This behavior doesn't affect the Pre-Prod environment it only affects the Production environment and the configurations are identical baring some IP differences between the 2 VPC's.
Looking for some guidance on what might be causing the ASA to not respond back to the Request packet from the client with a Response packet.
Thanks
