cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1378
Views
0
Helpful
2
Replies

IPSEC VPN's dropping intermittently. Fragmenting?

ajrussell
Beginner
Beginner

We have 100+ IPSEC VPN tunnels configured out to remote locations.  This is a new project - about six months old - and from the start, these tunnels would inexplicably drop.  Many times they would just restore themselves - sometimes in a few minutes, other times in a few of days.  We have had several cases where the tunnel drops, the interet still shows up after logging on to the provider's modem, but the only way to get them back up is to replace the provider's modem.  Configuration and modem type exactly the same.  Nothing appears to change on their end after the swap, but our tunnels immediately come up with the new "identical" modem.  In all these cases, we have been able to login to the provider modem and confirm the internet connection shows up (and we can ping it from the public network).  I.E. from telco's perspective, there is nothing wrong and it is working.

We get the following errors on the state of the connection while the tunnels are down (internet connection still good)

Branch-side ASA 5505 error on the tunnel:  AM_TM_INIT_XAUTH_V6C           

Core-side ASA 5510 error on the specific tunnel:  AM_TM_INIT_MODECFG_V6H

Some research has turned up some information about possible fragmentation issues caused by telco making changes to their network.  All of these problematic sites are over CenturyLink DSL.  We have cable sites that have experienced no problems, so it does seem to point at CenturyLink.  However, I've been around and around with them and can hopefully get more specific information here as to the cause and even more hopefully a resolution.

Thank you!


					
				
			
			
				
			
			
				
			
			
			
			
			
			
		
2 Replies 2

ajrussell
Beginner
Beginner

I figured this one was obscure...

Does anyone at least have any idea what the ASA's are seeing that would cause these alarms to generate?

I have the same problem and in deed the ISP is CenturyLink.  Just curious, did you resolve it? and how?

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers