Cisco ASA PA ipsec issue

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Cisco ASA PA ipsec issue

L1 Bithead

Hi,

 

We have recently come across an interesting issue between a Cisco ASA ikev2 tunnel with a PA. 

If I was to failover the PA to an HA peer, traffic initiated from the Cisco ASA continues to flow whilst traffic initiating from the PA stops.

 

I noticed when the PA fails over the ASA drops both phases and recreates them with a new SPI value whilst the PA continues to use the same SPA value. PA manages to change its SPA value to match the new SPI value only for traffic that originates from the ASA  although traffic from the PA continues to use the same SPA value which causes the traffic to not be sent.

My fix currently is by resetting the problematic proxy ID's from PA.

I have a case open with PA although has anyone come across this before as I assume this would be a common problem faced.

 

Cisco ASA 9.8.4.xx, PA 10.1.4-h4

 

7 REPLIES 7

Cyber Elite
Cyber Elite

Hi @ITforacompany ,

 

Have you configured Liveness Check under Network > Network Profiles > IKE Gateways > [edit gateway] > Advanced Options?  I have that set to 5 seconds on an IPsec tunnel to an FTD device which is has much of the same code as an ASA.  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClgcCAC

 

The ASA may need the "crypto ikev2 dpd interval retry-interval" command configured.  I can't remember if it is default.

 

Thanks,

 

Tom

Help the community: Like helpful comments and mark solutions.

Hi Tom,

 

Appreciate the reply although the liveness check on the PA's and the DPD on the ASA is already configured.

They are different values where the PA is 5seconds and the ASA is 10seconds retry every 2 although i would not think this would be the issue.

 

Thanks

L1 Bithead

Hi Tom,

 

Are you using route or policy based routing for your site to site tunnels between the PA and FTD?

Cyber Elite
Cyber Elite

Hi @ITforacompany ,

 

Mine is still proxy-based.

 

Thanks,

 

Tom

Help the community: Like helpful comments and mark solutions.
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!