Hi, thanks as always for the great response. This is more or less what I was running in to. I rebooted the Pix with no luck but when I restarted the ASA pair all began to function.
I have some ASA hardware on the way to replac the pixes, I just need to make this hold together for a few more weeks. Thanks for the pointers! On Mar 10, 2011, at 6:32 AM, Ryan West wrote: > Scott, > >> >> I have two devices a Pix running the 7.x code base in the field and a pair >> of ASA 5520 devices running 8.2.2. >> The 5520 pair is set up in an active passive arrangement. > > Which version of 7.x are you running. 7.2.4 below interim 33 was very buggy > with VPNs. They stop for no reason and removing the crypto map completely > and re-applying it does not fix it. Try the following if you don't plan to > upgrade soon: > > Enable logging class vpn monitor debugging, clear isakmp sa on both sides. > The receiver of the tunnel is going to have the most useful debugs and if you > don't have access to the devices on either side, use packet-tracer to > simulate interesting traffic. Try initiating from both sides, if you still > aren't getting anywhere, remove and add back the crypto map from the outside > interface. Debug cry isa 255 and debug cry ipsec 255 should also help. > Beyond that, a reboot will clear up the 7.2.4 bug. > > -ryan > _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
