Re: IPSec tunnels have invalid SPI after PIX Failover

pbohanno · ‎01-12-2005

Greetings.

I am working with a hub-and-spoke VPN environment using one PIX 515 and several PIX 501s. Each PIX 501 has an IPSec tunnel terminated at the 515. Additionally, the PIX 515 is in a statefail failover environment which works perfectly, except for maintenance of the IPSec tunnels.

When failover occurs, TCP sessions are continued and access to the Internet at the PIX 515 location is unhindered. However, it seems as if the VPN tunnels with the 501s are unusable. Based on log messages, it seems as if the "invalid spi" problem creeps up, which I suppose makes a bit of sense given that the checksum was calculated on the first 515.

Does anyone have a design suggestion for this problem? I suppose I could setup the tunnels with lifetimes of 10 minutes or so to mitigate the problem, but unnecessarily re-establishing the tunnels umpteen times throughout the day seems a bit much. Idle timeout won't work, because the 501s don't perceive the tunnel as active, they're still encrypting and sending data.

Any help would be appreciated. Thanks!

--pb

ehirsel · ‎01-12-2005

On each end of the vpn connection, that is on the pix 501 and the 515 units code this statement:

crypto isakmp keepalive

This will force the use of keepalive packets, that can detect when a peer goes away. Now your pix standby units in a FO mode will assume the ip address of the active unit, but when they see a keepalive packet in the active state, they will respond with a isa delete message that will let the remote end know to reneogtiate the phase1 and phase2 sa's.

You need to do this on both ends as it will not work otherwise - keepalives only work if it is configured on both ends. I believe that the default value is 30 sec. and it should suffice.

Let me know if this helps.

pbohanno · ‎01-13-2005

That looks to be exactly what I need, based on the documentation. Due to high availability requirements for this customer, I'll have to wait until Monday to implement it. I will surely let you know. Many thanks!

Patrick