We are experiencing random communication failures between two sites over our VPN tunnel. Both sites have the same hardware specs (5585) and software version (8.4(3)9). Both sides have matching cryptomap ACLs, just mirror images of each other.
The problem is that over a random period of time, both sides will not be able to ping specific networks that are allowed to cross the tunnel. The issue is cleared by resetting the tunnel (clear crypto ipsec sa peer x.x.x.x). It doesn't matter what side the tunnel is cleared, to fix the problem. The problem I have is what is causing this behavior to occur? Has anyone experiencing this behavior before? If so, please share.
What is interesting as well is that say for example one time 10.10.10.1/24 (site A) can't ping 10.20.10.1/24 (site B) (this has worked before. Say on site A firewall I then reset the tunnel and now host 10.10.10.1 can ping 10.20.10.1. Now say another instance, 10.10.100.1 (site A) can't ping 10.20.100.1 (site B). This has also worked before. But what is interesting is that even though 10.10.100.1 can't see 10.20.100.1, 10.10.10.1 can ping 10.20.10.1. Again to clear the issue the site to site tunnel needs to be reset. If this were related to tunnel problems you would think all the networks allowed to pass the tunnel would be affected but they are not.
And yes, all settings have been verified to match on both ends.
