Site to Site VPN issues

[dano1979]

Hello all,

I'm trying to figure out a problem we're having with 2 sites. These are the only 2 sites connected via vpn site 2 site. The host location has a PIX515(T1) and both remote locations have 501's(1 DSL and 1 Cable). It doesn't appear to be a time out issue as the users are abruptly disconnected at both sites at the same time while keeping the connection active. Unfortunately, we have an old IBM mainframe, users use a telnet client to connect. So they know when the connection drops because there sessions close and then my phone rings. It's backup in less than 10 seconds. Any thoughts? I do have keepalive set at all locations.

Thanks,
Dan

 

[NetworkGhost]

You said both sites drop at exaclty the same time? Well you could do some poking around in the pix. Do you have a syslog server? or at least logging to buffer on the pix? Check the logs and see what is happening at the time the connections dies. If it is necessary to do debugging you will be able to see if a reset packet is being sent. Another thought is the server. Is the server dropping these connections ? Is there anything in the logs on the server? May have to increase the xlate and connection timeouts on the pix.

 

[dano1979]

Yes, both sites same time.

I do have a syslog server and i'm using Firegen to pull out any relevant information, which hasn't been much. I'll note today what shows up if it happens.

I'm quite certain the telnet daemon does not have a timeout period set as all of our users at the host location are also connected to this box and they are not getting disconnected.

Would you like to see what my current xlate and connection timeouts are set to?

Thanks for any help!
Dano

 

[NetworkGhost]

Yes show your timeouts. I have had this problem before and had to increse them.

 

[dano1979]

timeout xlate 0:30:00
timeout conn 0:50:00 half-closed 0:30:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute

Thanks!

 

[NetworkGhost]

I would increase your xlate and connection table to hours rather than minutes. If your employees work for 8 hours, try setting to 6 hours for both.


conf t
timeout xlate 6:00:00
timeout conn 6:00:00 half-closed 0:30:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

 

[dano1979]

Thanks for the last reply.

Today it happened again and I found this in the log at the exact time it happened,

decaps: rec'd IPSEC packet has invalid spi for destaddr=vpn.Redlon-Johnson.com, prot=esp, spi=0x3d7851cc(1031295436), srcaddr=pool-70-16-65-202.port.east.verizon.net

 

[NetworkGhost]

Try increasing the SA lifetime:

isakmp policy (priotitynumber) lifetime 28800

That will keep the lifetime of the SA to 8 hours. That may be part of the problem. What is the lifetime on both sides? What OS Version are you running on all sites? Remember you will want to do the changes on all pixes.

 

[dano1979]

On both sites and host site:

lifetime 86400

OS's

501's
Cisco PIX Firewall Version 6.3(4)103
Cisco PIX Firewall Version 6.3(5)

515
Cisco PIX Firewall Version 6.3(5)

 

[dano1979]

Just thought I'd give an update to this.

Turns out our firewall had a "Field Notice" issued for an Ethernet Controller. Document ID 15905

The link was going up and down as indicated in syslog from our switch.

Thanks,
Dan