L2L VPN tunnel is being reset during IPSec rekey

[jason.williams]

I have a L2L VPN tunnel that completely resets, beginning again with Phase 1, when the IPSec SA timer expires.  Even though there are multiple SAs, it still resets the entire tunnel.

I see the following errors in the log when this happens:

06-03-2013    12:54:41    Local7.Notice    ipRemoved    Jun 03 2013 12:54:41 LKM-NVP-L2L-01 : %ASA-5-713050: Group = ipRemoved, IP = ipRemoved, Connection terminated for peer ipRemoved.  Reason: Peer Terminate  Remote Proxy N/A, Local Proxy N/A

06-03-2013    12:54:41    Local7.Notice    ipRemoved    Jun 03 2013 12:54:41 LKM-NVP-L2L-01 : %ASA-5-713259: Group = ipRemoved, IP = ipRemoved, Session is being torn down. Reason: User Requested

06-03-2013    12:54:41    Local7.Warning    ipRemoved    Jun 03 2013 12:54:41 LKM-NVP-L2L-01 : %ASA-4-113019: Group = ipRemoved, Username = ipRemoved, IP = ipRemoved, Session disconnected. Session Type: IKE, Duration: 4h:00m:06s, Bytes xmt: 260129, Bytes rcv: 223018, Reason: User Requested

06-03-2013    12:55:33    Local7.Notice    ipRemoved    Jun 03 2013 12:55:33 LKM-NVP-L2L-01 : %ASA-5-713041: IP = ipRemoved, IKE Initiator: New Phase 1, Intf inside, IKE Peer ipRemoved  local Proxy Address 204.139.127.24, remote Proxy Address 156.30.21.200,  Crypto map (L2LVPN)

06-03-2013    12:55:33    Local7.Notice    ipRemoved    Jun 03 2013 12:55:33 LKM-NVP-L2L-01 : %ASA-5-713119: Group = ipRemoved, IP = ipRemoved, PHASE 1 COMPLETED

06-03-2013    12:55:33    Local7.Notice    ipRemoved    Jun 03 2013 12:55:33 LKM-NVP-L2L-01 : %ASA-5-713049: Group = ipRemoved, IP = ipRemoved, Security negotiation complete for LAN-to-LAN Group (ipRemoved)  Initiator, Inbound SPI = 0x9213bdc9, Outbound SPI = 0x1799a099

06-03-2013    12:55:33    Local7.Notice    ipRemoved    Jun 03 2013 12:55:33 LKM-NVP-L2L-01 : %ASA-5-713120: Group = ipRemoved, IP = ipRemoved, PHASE 2 COMPLETED (msgid=b8a47603)

06-03-2013    13:02:11    Local7.Notice    ipRemoved    Jun 03 2013 13:02:11 LKM-NVP-L2L-01 : %ASA-5-713041: Group = ipRemoved, IP = ipRemoved, IKE Initiator: New Phase 2, Intf inside, IKE Peer ipRemoved  local Proxy Address 204.139.127.71, remote Proxy Address 156.30.21.200,  Crypto map (L2LVPN)

06-03-2013    13:02:11    Local7.Notice    ipRemoved    Jun 03 2013 13:02:11 LKM-NVP-L2L-01 : %ASA-5-713049: Group = ipRemoved, IP = ipRemoved, Security negotiation complete for LAN-to-LAN Group (ipRemoved)  Initiator, Inbound SPI = 0x93f9be6c, Outbound SPI = 0x1799a16d

06-03-2013    13:02:11    Local7.Notice    ipRemoved    Jun 03 2013 13:02:11 LKM-NVP-L2L-01 : %ASA-5-713120: Group = ipRemoved, IP = ipRemoved, PHASE 2 COMPLETED (msgid=1f6c9acd)

Any thoughts on why it would be doing this?

Thanks.

Jason

[Jouni Forss · Accepted solution]

Hi,

Both of the log messages would seem the suggest that the remote end is closing/clearing the connection.

Is this a new connection that is suffering this problem or has this started on an existing connection?

The Cisco documentation related to the Syslog messages doesnt really provide any usefull information regarding these log messages.

I'd imagine that your problem is that the TCP connections through the L2L VPN suffer from these complete renegotiations of the L2L VPN.

I wonder if the following configuration might help even if this situation persisted

sysopt connection preserve-vpn-flows

Here is a link to the ASA command reference (8.4 - 8.6 softwares) with a better explanation of this configuration.

http://www.cisco.com/en/US/docs/security/asa/asa84/command/reference/s8.html#wp1538395

It is not enabled by default on the ASA.

Hope this helps

- Jouni

[jason.williams]

That worked!

Thank you!