#Set vpn monitor rekey junos upgrade#

#Set vpn monitor rekey junos upgrade#

I just checked and there are a number of bugs in regards to rekey, in ASA version 7.2.4, please kindly upgrade both ASA to at least version 7.2.5.ĬSCtc47782 Malformed IKE traffic causes rekey to fail:ĬSCso87442 ASA displays smaller traffic-volume lifetime than negotiated: ĬSCsq67954 ASA rekeys at less traffic volume than expected value: This is the configuration that I use for the tunnel:Ĭrypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmacĬrypto map outside_map 15 match address K015-L2L-listĬrypto map outside_map 15 set peer K015-PeerĬrypto map outside_map 15 set transform-set ESP-3DES-SHAĬrypto map outside_map 15 set security-association lifetime seconds 28800Ĭrypto map outside_map 15 set security-association lifetime kilobytes 4608000Ĭrypto map VPNMAP 10 match address Hosting_ListĬrypto map VPNMAP 10 set peer 83.136.xx.xxxĬrypto map VPNMAP 10 set transform-set ESP-3DES-SHA If I do a clear cry ips sa peer 'IP of the 5505', then the tunnel goes functional again. The 5510 currently holds over 50 IPSEC tunnels and this is the only one behaving like this. Rebooting the failover 5510 is not an option. The ASA5505 has been rebooted several times. It has done this 4-5 times now, so i dont think it is a temporary problem. Idle Time Out: 30 Minutes Idle TO Left : 30 Minutes Rekey Int (T): 28800 Seconds Rekey Left(T): 25701 Seconds Idle Time Out: 30 Minutes Idle TO Left : 29 Minutes Rekey Int (T): 28800 Seconds Rekey Left(T): 25256 Seconds Rekey Int (T): 86400 Seconds Rekey Left(T): 58381 Seconds This is the result of the same command at the ASA5505 end of the tunnel: Rekey Int (D): 413696 K-Bytes Rekey Left(D): 1 K-Bytes

Rekey Int (T): 28800 Seconds Rekey Left(T): 25715 Seconds Rekey Int (T): 28800 Seconds Rekey Left(T): 25270 Seconds Rekey Int (T): 86400 Seconds Rekey Left(T): 58390 Seconds IKE Neg Mode : Main Auth Mode : preSharedKeys Protocol : IPSecLAN2LAN Encryption : 3DES When looking at the tunnel I always see this on the set of 5510's (marked in bold IPSEC ID 3):Īdvdns# sh vpn-sessiondb detail l2l filter ipaddress 93.160.2xx.1xx The tunnel itself stays up, but cannot pass any traffic. Over time they will loose connectivity through the tunnel. I have a L2L IPSEC tunnel between a set of failover pair of two ASA5510's and a single ASA5505.