Hi all
We have a VPN Hub running on ASr1001-x that terminates several remote IPsec tunnels.
A few of these tunnels hang while the session is still in UP_active state and teh only way around to get bidirectional flow is to remove and re-add the Crypto Map attached to the main interface.
Before the "restart" on hanging tunnel
Interface: TenGigabitEthernet0/0/1
Profile: LTB-IKEV2-PROFILE
Session status: UP-ACTIVE
Peer: 87.129.28.67 port 500 fvrf: (none) ivrf: semi-trust-corp
Phase1_id: 87.129.28.67
Desc: (none)
Session ID: 8794832
IKEv2 SA: local 185.233.71.132/500 remote 87.129.28.67/500 Active
Capabilities:D connid:3 lifetime:21:52:23
IPSEC FLOW: permit ip 10.228.0.0/255.255.0.0 10.238.68.0/255.255.252.0
Active SAs: 2, origin: crypto map
Inbound: #pkts dec'ed 5451 drop 0 life (KB/Sec) KB Vol Rekey Disabled/5 hours, 52 mins
Outbound: #pkts enc'ed 0 drop 0 life (KB/Sec) KB Vol Rekey Disabled/5 hours, 52 mins
IPSEC FLOW: permit ip 10.112.129.0/255.255.255.0 10.238.68.0/255.255.252.0
Active SAs: 2, origin: crypto map
Inbound: #pkts dec'ed 104 drop 0 life (KB/Sec) KB Vol Rekey Disabled/5 hours, 52 mins
Outbound: #pkts enc'ed 0 drop 0 life (KB/Sec) KB Vol Rekey Disabled/5 hours, 52 mins
After Restart:
Interface: TenGigabitEthernet0/0/1
Profile: LTB-IKEV2-PROFILE
Uptime: 00:23:45
Session status: UP-ACTIVE
Peer: 87.129.28.67 port 500 fvrf: (none) ivrf: semi-trust-corp
Phase1_id: 87.129.28.67
Desc: (none)
Session ID: 8804011
IKEv2 SA: local 185.233.71.132/500 remote 87.129.28.67/500 Active
Capabilities:D connid:6 lifetime:23:36:15
IPSEC FLOW: permit ip 10.228.0.0/255.255.0.0 10.238.68.0/255.255.252.0
Active SAs: 2, origin: crypto map
Inbound: #pkts dec'ed 584 drop 0 life (KB/Sec) KB Vol Rekey Disabled/7 hours, 37 mins
Outbound: #pkts enc'ed 563 drop 0 life (KB/Sec) KB Vol Rekey Disabled/7 hours, 37 mins
IPSEC FLOW: permit ip 10.112.129.0/255.255.255.0 10.238.68.0/255.255.252.0
Active SAs: 2, origin: crypto map
Inbound: #pkts dec'ed 18 drop 0 life (KB/Sec) KB Vol Rekey Disabled/7 hours, 37 mins
Outbound: #pkts enc'ed 18 drop 0 life (KB/Sec) KB Vol Rekey Disabled/7 hours, 37 mins
IPSEC FLOW: permit ip 10.195.0.0/255.255.0.0 10.238.68.0/255.255.252.0
Active SAs: 2, origin: crypto map
Inbound: #pkts dec'ed 3485 drop 0 life (KB/Sec) KB Vol Rekey Disabled/7 hours, 36 mins
Outbound: #pkts enc'ed 3604 drop 0 life (KB/Sec) KB Vol Rekey Disabled/7 hours, 36 mins
#sh install active
[ R0 ] Active Package(s) Information:
State (St): I - Inactive, U - Activated & Uncommitted,
C - Activated & Committed, D - Deactivated & Uncommitted
--------------------------------------------------------------------------------
Type St Filename/Version
--------------------------------------------------------------------------------
IMG C 17.06.05.0.5797
Uptime: 02:07:37
sh plat
Chassis type: ASR1001-X
Slot Type State Insert time (ago)
--------- ------------------- --------------------- -----------------
0 ASR1001-X ok 12w0d
0/0 BUILT-IN-2T+6X1GE ok 12w0d
R0 ASR1001-X ok, active 12w0d
F0 ASR1001-X ok, active 12w0d
P0 ASR1001-X-PWR-AC ok 12w0d
P1 ASR1001-X-PWR-AC ok 12w0d
P2 ASR1001-X-FANTRAY ok 12w0d
Slot CPLD Version Firmware Version
--------- ------------------- ---------------------------------------
0 14041015 16.3(2r)
R0 14041015 16.3(2r)
F0 14041015 16.3(2r)
crypto ikev2 profile LTB-IKEV2-PROFILE
match identity remote address 87.129.28.67 255.255.255.255
authentication remote pre-share key
authentication local pre-share key
dpd 10 2 on-demand
ivrf semi-trust-corp
Any ideas what this could be causing the tunnels to hang this
Best Regards,
