Hi Andri,
I have the same problem here with 2 Cisco ASA, both version 8.41.
Only one SA from 5 protected by this tunnel is having problem.
fw# sh ipsec sa spi 83813154
spi: 0x83813154
Crypto map tag: outside_map, seq num: 100, local addr: 194.a.a.a
access-list outside_cryptomap_100 extended permit ip 172.31.22.0 255.255.255.0 172.30.10.0 255.255.255.0
local ident (addr/mask/prot/port): (172.31.22.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (172.30.10.0/255.255.255.0/0/0)
current_peer: 195.b.b.b
#pkts encaps: 24817511, #pkts encrypt: 24810950, #pkts digest: 24810950
#pkts decaps: 17000097, #pkts decrypt: 17000097, #pkts verify: 17000097
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 24817511, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 12, #pre-frag failures: 0, #fragments created: 24
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 36
#send errors: 6573, #recv errors: 0
local crypto endpt.: 194.a.a.a/0, remote crypto endpt.: 195.b.b.b/0
path mtu 1500, ipsec overhead 58, media mtu 1500
current outbound spi: 83813154
current inbound spi : 25F7698F
inbound esp sas:
spi: 0x25F7698F (636971407)
transform: esp-3des esp-sha-hmac no compression
in use settings ={L2L, Tunnel, PFS Group 2, }
slot: 0, conn_id: 12410880, crypto-map: outside_map
sa timing: remaining key lifetime (kB/sec): (3688912/19958)
IV size: 8 bytes
replay detection support: Y
Anti replay bitmap:
0xFFFFFFFF 0xFFFFFFFF
outbound esp sas:
spi: 0x83813154 (2206282068)
transform: esp-3des esp-sha-hmac no compression
in use settings ={L2L, Tunnel, PFS Group 2, }
slot: 0, conn_id: 12410880, crypto-map: outside_map
sa timing: remaining key lifetime (kB/sec): (0/19958)
IV size: 8 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
