PIX501 6.3 -> PIX515 7.2 outbound VPN drops

[sip240]

Hi,

We've got an external ISP network at our office used by contractors to access email, and other related issues - it's not part of the company network.

The external ISP provides a router, and we have two Cisco PIX 501's behind it providing DHCP addresses and NATing those users to the outside world. Everything works - but the 501's are no longer under support and need to be replaced.

So...We took the "pretty basic" 6.3 configs from the 501's and manually pasted them into the two new 515e's running 7.2. The 515e automatically converted an entry to the new 7.2 format and the PDM commands were modified to ASDM, but most of the config lines were taken directly into the 515e without complaint.

Everything seemed to be operating normally, people can hit the web, check email and stuff. However, a couple of contractors complained that when they went to VPN into their company VPN to sync outlook or other mundane things that need to be completed on their companies network, that their VPN connection would drop after 5-10 minutes. The Cisco VPN client connects, they can log in and get to their applications, email, whatever, then it just drops the connection with an error "Secure VPN Connection terminated locally by the client. Reason 412: The remote peer is no longer responding".

These are outbound requests... I.E. These new 515e's are not the VPN endpoints - these guys are just launching the Cisco VPN Client and trying to connect outbound.

We made no modifications to the config on the 515's, and when we drop the 501's back into the network, everything is fine...


Any ideas?

 

[maczen]

Setting your MTU to 1300 or lower will prevent packets from being fragmented and therefore increase performance. To do that ,go to the Start>All Programs>Cisco Systems VPN Client>Set MTU

This is an excerpt from a troubleshooting forum when receiving that message..

----------------------------------------------------
Perhaps these guys need to update their VPN client software.. Could be that it works fine with older PIX OS but issues with the newer one... Worth a shot..

7.2(3) supports the Cisco VPN client Version 3.6 or later
----------------------------------------------------
Interesting but not sure that it would cause this issue.. Can cause failover.. "If you are using ASDM, we recommend no more than a 500 KB configuration file because larger configuration files can interfere with the performance of ASDM on your workstation."
----------------------------------------------------

I can not view the Cisco bug toolkit but this looks like a possibility judging by the title..

CSCsg65434 Multiple ipsec peers : PIX/ASA stops processing the IPSEC peers list

You can reach the Bug Toolkit here..

http://www.cisco.com/support/bugtools

You can view the full list for 7.2(3) here..

http://www.cisco.com/en/US/docs/security/pix/pix72/release/notes/pixrn723.html

B Haines
CCNA R&S, ETA FOI

 

[sip240]

Thanks Maczen,

I'll give that a try and let you know if it works. I have access to Cisco's bugtools, I'll check that DDTS out also...

Regards,

sip

 

[sip240]

This was apparently caused by something on the backbone between our location and the far end... The path that our provider took to connect our traffic between both locations (and outside of our control) was having issues.

What we can actually see of the traceroute is different now, and all is well.

The change of the MTU from 1500 to 1300 didn't seem to make any difference as the problem was still occurring.


Regards,

sip