IPSec tunnel limit

[jwhite]

Would anyone know what is the limit of IPSec tunnels that can be created on a 7206 router. I have about 30 or so IPSec tunnels created on this router. All of the tunnels disconnect randomly and frequently during the course of the day and night. They always reconnect. The consistent error is Quick mode failed with peer.

[ddawson]

I don't think there's a hard limit, but the practical limit is much higher than 30 (i.e. in the hundreds at least, depending on your hardware). Quick Mode is always Phase 2 where the actual SA's for data transfer are brought up. The corresponding parts of the configs are the "ipsec" parameters, so double check those. However, if the configs are correct but the VPN is not reliable, I'd suspect either IOS bugs or the WAN reliability. I'd turn on some debugging ("debug crypto isakmp" and "debug crypto ipsec") and see if there are more details, such as retransmissions that might help point toward the cause.

HTH

[Richard Burts]

I believe that Cisco materials claim about 2000 as the number of tunnels for 7200 router. I am working with a customer where we are terminating 80 tunnels on 7206 and plan to support probably 200 or so tunnels by the time the project is fully implemented. So at 30 tunnels you are not any where near the limit (assuming that you have adequate memory on the router and the VPN module so that encryption is handled in hardware rather than in software).

We observe similar symptoms on some of the tunnels where periodically the crypto tunnel comes down and is immediately renegotiated. Though I do not see an error message about Quick mode failing. Since we also have some sites where this does not happen and these sites are running the same version of IOS and have very similar configurations, we believe that the tunnel dropping is more related to instability within the Internet than it is to IOS bugs or something not configured correctly.

HTH

Rick