Site to Site VPN Issues

[vtgman]

I have a Cisco ASA 5510 I just installed and there are 3 site to site VPN's connected to it. 2 of my VPNs keep disconnecting every 10 minutes but reconnect. The 3rd stays up without any issues. Does anyone have any thought as to what I should be checking. Cisco says it is an Internet line issue but the carrier says everything is running clean. I am stuck in the middle and need some help.

Thansk for any help.

 

[brianinms]

Well if 1 of them stays up the entire time then you know that it and the host aren't having issues. What type of connection do you have at the other locations? What gear are you using at the remotes?

 

[vtgman]

I have DSL connections at all three. Cisco equipment all around. Fix 501s at all 3 remote locations.

 

[Supergrrover]

You might try adjusting the MTU of the DSL connections.


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[NetworkGhost]

2 of my VPNs keep disconnecting every 10 minutes but reconnect."


Do you mean you can access stuff then all of the sudden cant?

or your SAs are reestablishing after 10 minutes?

MTU may be a problem. You can test this by sending sized ICMP packets to determine what the best MTU is for the connection.

http://www.wr-mem.com

 

[vtgman]

I have to add a twist to the whole thing. I had a pix 515R and had it working. When I added the ASA5510 is when everything starting going down. Everything is programed the same except the ASA has teh 7.0 code and everything else is 6.5.3

 

[NetworkGhost]

Posta scrubbed copy of your 7.0 config.

http://www.wr-mem.com

 

[NetworkGhost]

Also may not be related but you might want to run the latest code on the ASa just to be sure there are no other issues.

http://www.wr-mem.com

 

[vtgman]

Config has been attached.

ASA Version 7.2(3)
!
hostname FMBASA
domain-name cisco.com
enable password 2nCFwnPanWFQ3CL2 encrypted
names
dns-guard
!
interface Ethernet0/0
nameif Outside
security-level 0
ip address XX.XX.XX.XX 255.255.255.248
!
interface Ethernet0/1
nameif Inside
security-level 100
ip address 10.1.1.220 255.255.255.0
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
shutdown
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
management-only
!
passwd 2nCFwnPanWFQ3CL2 encrypted
boot system disk0:/asa723-k8.bin
ftp mode passive
dns server-group DefaultDNS
domain-name cisco.net
same-security-traffic permit intra-interface
access-list fmb extended permit ip 10.1.1.0 255.255.255.0 10.1.3.0 255.255.255.0
access-list nonat extended permit ip 10.1.0.0 255.255.0.0 172.16.2.0 255.255.255.0
access-list nonat extended permit ip 10.1.1.0 255.255.255.0 10.1.3.0 255.255.255.0
access-list nonat extended permit ip 10.1.1.0 255.255.255.0 10.1.2.0 255.255.255.0
access-list nonat extended permit ip 10.1.1.0 255.255.255.0 10.1.11.0 255.255.255.0
access-list nonat extended permit ip 10.1.6.0 255.255.255.0 172.16.2.0 255.255.255.0
access-list nonat extended permit ip 10.1.2.0 255.255.255.0 172.16.2.0 255.255.255.0
access-list nonat extended permit ip 10.1.3.0 255.255.255.0 172.16.2.0 255.255.255.0
access-list nonat extended permit ip 10.1.4.0 255.255.255.0 172.16.2.0 255.255.255.0
access-list nonat extended permit ip 10.1.5.0 255.255.255.0 172.16.2.0 255.255.255.0
access-list nonat extended permit ip 10.1.11.0 255.255.255.0 172.16.2.0 255.255.255.0
access-list nonat extended permit ip 10.1.9.0 255.255.255.0 172.16.2.0 255.255.255.0
access-list nonat extended permit ip 10.1.12.0 255.255.255.0 172.16.2.0 255.255.255.0
access-list wstock extended permit ip 10.1.1.0 255.255.255.0 10.1.2.0 255.255.255.0
access-list outside_int extended deny tcp any host 168.95.5.12
access-list outside_int extended deny tcp any host 168.95.5.13
access-list outside_int extended deny tcp any host 168.95.5.14
access-list outside_int extended deny tcp any host 168.95.5.15
access-list outside_int extended deny tcp any host 168.95.5.16
access-list outside_int extended deny tcp any host 168.95.5.17
access-list outside_int extended deny tcp any host 168.95.5.0
access-list outside_int extended permit tcp any host xx.xx.xx.xx eq smtp
access-list outside_int extended permit tcp any host xx.xx.xx.xx eq pop3
access-list outside_int extended permit tcp any host xx.xx.xx.xx eq https
access-list outside_int extended permit tcp any host xx.xx.xx.xx eq www
access-list luray extended permit ip 10.1.1.0 255.255.255.0 10.1.11.0 255.255.255.0
pager lines 24
logging enable
logging buffered warnings
logging trap warnings
logging asdm informational
logging host Inside 10.1.1.10
no logging message 106011
mtu Outside 1500
mtu Inside 1500
mtu management 1500
ip local pool hburg 172.16.2.1-172.16.2.254
ip verify reverse-path interface Outside
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-507.bin
asdm history enable
arp timeout 14400
nat-control
global (Outside) 1 interface
nat (Inside) 0 access-list nonat
nat (Inside) 1 0.0.0.0 0.0.0.0
static (Inside,Outside) xx.xx.xx.xx 10.1.1.43 netmask 255.255.255.255
access-group outside_int in interface Outside
route Outside 172.16.2.0 255.255.255.0 10.1.1.220 1
route Outside 0.0.0.0 0.0.0.0 65.121.217.185 1
route Inside 10.1.4.0 255.255.255.0 10.1.1.220 1
route Inside 10.1.5.0 255.255.255.0 10.1.1.220 1
route Inside 10.1.6.0 255.255.255.0 10.1.1.220 1
route Inside 10.1.7.0 255.255.255.0 10.1.1.220 1
route Inside 10.1.8.0 255.255.255.0 10.1.1.220 1
route Inside 10.1.9.0 255.255.255.0 10.1.1.220 1
route Inside 10.1.12.0 255.255.255.0 10.1.1.220 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
http server enable
http 10.1.1.34 255.255.255.255 Inside
http 10.1.1.15 255.255.255.255 Inside
http 10.1.1.10 255.255.255.255 Inside
http 192.168.1.0 255.255.255.0 management
http 10.1.8.20 255.255.255.255 Outside
snmp-server host Inside 10.1.1.10 community public
no snmp-server location
no snmp-server contact
snmp-server community public
snmp-server enable traps snmp authentication linkup linkdown coldstart
sysopt connection tcpmss 1200
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set myset esp-3des esp-md5-hmac
crypto ipsec security-association lifetime seconds 3600
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 20 set security-association lifetime seconds 28800
crypto dynamic-map outside_dyn_map 30 set transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 30 set security-association lifetime seconds 28800
crypto map outside_map 10 match address fmb
crypto map outside_map 10 set peer xx.xx.xx.xx
crypto map outside_map 10 set transform-set myset
crypto map outside_map 10 set security-association lifetime seconds 28800
crypto map outside_map 20 match address wstock
crypto map outside_map 20 set peer xx.xx.xx.xx
crypto map outside_map 20 set transform-set myset
crypto map outside_map 20 set security-association lifetime seconds 28800
crypto map outside_map 30 match address luray
crypto map outside_map 30 set peer xx.xx.xx.xx
crypto map outside_map 30 set transform-set myset
crypto map outside_map 30 set security-association lifetime seconds 28800
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface Outside
crypto isakmp identity address
crypto isakmp enable Outside
crypto isakmp enable Inside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 1
lifetime 86400
crypto isakmp policy 20
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
crypto isakmp policy 30
authentication pre-share
encryption 3des
hash md5
group 1
lifetime 86400
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp nat-traversal 20
telnet 10.1.1.10 255.255.255.255 Inside
telnet 10.1.1.11 255.255.255.255 Inside
telnet 10.1.1.43 255.255.255.255 Inside
telnet 10.1.1.45 255.255.255.255 Inside
telnet 10.1.1.4 255.255.255.255 Inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 Outside
ssh timeout 30
ssh version 1
console timeout 0
management-access Inside
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd enable management
!
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns migrated_dns_map_1
parameters
message-length maximum 1024
policy-map global_policy
class inspection_default
inspect dns migrated_dns_map_1
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
group-policy hburg internal
group-policy hburg attributes
wins-server value 10.1.1.11
dns-server value 10.1.1.11
vpn-idle-timeout 360
split-tunnel-policy excludespecified
default-domain value farmersbankva.net
username fmbank password kjIrJ6nbgnp3sHGO encrypted
tunnel-group DefaultL2LGroup ipsec-attributes
isakmp keepalive threshold 20 retry 2
tunnel-group DefaultRAGroup ipsec-attributes
isakmp keepalive threshold 20 retry 2
tunnel-group hburg type ipsec-ra
tunnel-group hburg general-attributes
address-pool hburg
default-group-policy hburg
tunnel-group hburg ipsec-attributes
pre-shared-key *
tunnel-group xx.xx.xx.xx type ipsec-l2l
tunnel-group xx.xx.xx.xx ipsec-attributes
pre-shared-key *
tunnel-group xx.xx.xx.xx type ipsec-l2l
tunnel-group xx.xx.xx.xx ipsec-attributes
pre-shared-key *
tunnel-group xx.xx.xx.xx type ipsec-l2l
tunnel-group xx.xx.xx.xx ipsec-attributes
pre-shared-key *
prompt hostname context
Cryptochecksum:a0dd5662cab714d608e1934f7df016c7
: end
FMBASA(config)#