VPN Failure (randomly)

[timkaye]

Hi all.

Recently changed customers hardware from a 2611 (12.2) to 2801 (12.4).

Along with this the internet connection and addressing changed.

Configuration was ported between the 2600 and 2800.

Ever since the change, it appears the VPN fails randomly (maybe on lifetime failure?)

Clearing the session at the remote end (2800) doesn't work. A reboot sorts the problem.

my question is 12.4 full of bugs?

it appears to be. Any suggestions would be appreciated.

FYI lifetimes are all set between end consistently.

Thanks

Tim

[johnd2310]

Hi,

What errors are you getting when the vpn fails and what versions of 12.4 are you running. I have had certian versions of 12.4 crash and had to go to a 12.3

Regards

John

[timkaye]

John,

I'm running c2801-advsecurityk9-mz.124-3g.bin

I'll have to capture some debugging.

Its interesting as it simply fails to establish. And Interestingly I've seen a session on the other end (ASA) which shows the connection as a user connection and using encryption /hash thats not configured.

Try to clear the crypto sessions on the router doesn't help.

I'll capture some debugging for you.

Tim

[johnd2310]

Hi Tim,

Interesting you brought up the ASA. I have an ASA running 8.0(2)that will just not make a vpn connection. What version is the ASA? and is your config easy vpn in network extension mode or pure lan to lan vpn.

John

[timkaye]

ASA is running 7.2(1).

Its pure L2L.

A few people seem think maybe the ASA is a little flaky. My experience has been with PIX 6.3.

[timkaye]

A quick update.

The ASA by default for the tunnel groups has keepalives (DPD) on.

I've configured keepalives on the router and can now see the router responding with to the keepalives from the ASA.

Appears my VPN has been up for 15 hours. Appears to be stable (fingers crossed).

Tim