Yes the dsl modem is doing NAT. It's a centurylink PK5001z which is a zytel rebrand. When the vpn goes offline, we lose all remote access to the ASA5505. I have a non technical user on the far side so I cant walk him through much... once the tunnel goes down, I cant get into the ASA by any means until it is restarted.
With this clearing up though, it definitely looks like a L2/L3 issue carrier side. Thanks to all the suggestions and if this issue crops up again I will dig more into it. Thanks. Blake -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Andy Ellsworth Sent: Saturday, December 29, 2012 10:23 AM To: [email protected] Subject: Re: [c-nsp] ASA VPN Tunnels So the customer's DSL modem is doing routing rather than bridging - any chance it's also providing some kind of stateful firewall behavior? Wondering if it could be timing out/closing the session passing through it. If the DSL modem has stateful packet inspection, perhaps it can be turned off. Regardless, packet captures are your friend. Run a capture on the client ASA and get a mirrored capture on the RA gateway ASA, load them both up side by side in Wireshark, and see what is happening to your session. http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a0080a9edd6.shtml On Fri, Dec 28, 2012 at 4:53 PM, Alan Buxey <[email protected]> wrote: > Given that same setup elsewhere is working then this problem is local. > The world isn't ideal. I would suggest its an L1 or L2 issue with this > customers line or broadband modem. Maybe line issues and renegotiation > of the link or faulty modem. Get the line checked/measured/conditioned > and/or the modem swapped out. > > alan > > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ > _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
