ASA Checkpoint VPN S2S disorders <>

Similar Questions

• Cannot resolve the problem between ASA - CheckPoint (VPN)

  Hi team,

  I have a strange problem with a L2L VPN between an ASA on my side and a checkpoint as her counterpart.

  The IPsec tunnel works very well, but from time to time, the traffic stop through the tunnel.

  Scenario:

  172.31.250.0/28--ASA---Internet---checkpoint---200.122.x.y/32

  I've done many tunnels between ASAs and control points, but this time we found this:

  access extensive list ip 172.31.250.0 outside_1_cryptomap allow 255.255.255.240 host 200.122.164.165

  local ident (addr, mask, prot, port): (172.31.250.0/255.255.255.240/0/0)

  Remote ident (addr, mask, prot, port): (200.122.164.165/255.255.255.255/0/0)

  #pkts program: encrypt 0, #pkts: 0, #pkts digest: 0

  #pkts decaps: 1148, #pkts decrypt: 1148, #pkts check: 1148

  local ident (addr, mask, prot, port): (172.31.250.8/255.255.255.248/0/0)

  Remote ident (addr, mask, prot, port): (200.122.164.0/255.255.255.0/0/0)

  #pkts program: 27682, #pkts encrypt: 27683, #pkts digest: 27683

  #pkts decaps: 27683, #pkts decrypt: 27683, #pkts check: 27683

  local ident (addr, mask, prot, port): (172.31.250.8/255.255.255.248/0/0)

  Remote ident (addr, mask, prot, port): (200.122.164.165/255.255.255.255/0/0)

  #pkts program: 3579, #pkts encrypt: 3579, #pkts digest: 3579

  #pkts decaps: 10443, #pkts decrypt: 10443, #pkts check: 10443

  Traffic is defined between 172.31.250.0/28 and a single host, but I see three SAs:

  1 172.31.250.0/28 - 200.122.164.165/32

  2 172.31.250.8/32 - 200.122.164.0/24

  3 172.31.250.8/32 - 200.122.164.165/32

  What is the reason for this?

  The reason why I have paste this above is because the control point defines the traffic "interesting" as two rules (one in each direction).

  Control point:

  Rule 1: The traffic of 200.122.164.165/32 172.31.250.0/28

  Rule 2: The traffic of 172.31.250.0/28 200.122.164.165/32

  So, I think that the problem occurs because we hear by the SAs of the phase 2 bidirectional rules (crypto ACL), and control point sets the SAs of the phase 2 as one-way rules. Even if traffic matches, I see the output above.

  I think this means that the ASA receives a portion of the traffic in a SA and send it via another, and I don't know if that is causing the problem and if so, how to fix?

  The problem is totally random. We have reduced the time to generate a new key for 2 minutes at the minute of the phase 2 and 5 on the phase 1 and there is no problem during the generate a new key.

  We had not been able to capture the log at the exact moment of the problem. Then the tunnel suddenly rises again and start working.

  ASA 5510 version 8.2 (5)

  Any help is appreciated!

  Federico.

  Federico,

  New installation SAs is not so to generate a new key, it consicides with a homologous assuming it matches traffic again and must so initial has ITS new.

  Now when we have a static, selector of this SA traffic encryption card new must match what we defined in the ACL.

  Generally, you will get an error if there is absolutely no match and tunnel would fail to phase 2.

  I want to just make sure we're on the same page. When it ends on a dynamic encryption card, we know (or rarely know) what will look like the SA distance so we accept everything.

  I do not say that this checkpoint of the half was here half it matched. I say it's more likely (for some reason I couldn't be aware, or a bug) implemented match the ACL under static crypto map.

  Marcin

• How to pass the traffic of a site VPN S2S by ASA to another S2S VPN site?

  I have a need for hosts on separate VPN networks connected to my ASA corp to communicate among themselves.  Example: Host A site 1 a need to communicate with host B on the site 2.  Both sites 1 & 2 are connected via the VPN S2S.  I would get every site traffic to flow through the ASA at the other site.  Where should I start my configuration?  NAT? ACL?

  I can ping each host in the network Corp. but cannot ping from one site to the other.  I set up same-security-traffic permit intra-interface and addition of NAT and rules the ACL to allow/permit 1 Site to contact Site 2.  When I do a trace of package through Deputy Ministers DEPUTIES, packets are allowed to pass. I read different that tell no NAT y at - it something at the other end of the VPN to do?  should NAT and ACLs rules be mirrored? Just in case, a site is an instance of MS Azure VM and the other is a 3rd party VM instance.

  On the HubASA, can I set up a new card encryption that selects the Site1 Site2 traffic and protect the traffic and value her counterpart Site2 public IP or just add this selection of traffic to the existing encryption card for the existing tunnel between HubASA and Site2?

  Just add this traffic to the existing encryption card.

  Remember that this should be added on three routers (two hubs and there has been talk).

  Site1

  CRYPTO ip access list allow Site2 subnet >

  CRYPTO ip access list allow subnet training3 >

  CRYPTO ip access list allow subnet HUB >

  Site2

  CRYPTO ip access list allow Site1 subnet >

  CRYPTO ip access list allow subnet training3 >

  CRYPTO ip access list allow subnet HUB >

  Training3

  CRYPTO ip access list allow Site1 subnet >

  CRYPTO ip access list allow Site2 subnet >

  CRYPTO ip access list allow subnet HUB >

  HUB

  CRYPTO_1 ip access list allow Site1 subnet >

  CRYPTO_1 ip access list allow Site1 subnet >

  CRYPTO_1 ip access list allow Site1 subnet >

  CRYPTO_2 ip access list allow Site2 subnet >

  CRYPTO_2 ip access list allow Site2 subnet >

  CRYPTO_2 ip access list allow Site2 subnet >

  CRYPTO_3 ip access list allow subnet training3 >

  CRYPTO_3 ip access list allow subnet training3 >

  CRYPTO_3 ip access list allow subnet training3 >

  Each of these ACLs is attributed to their respective crypto cards.  CRYPTO_1 is assigned the site1 crypto map, CRYPTO_2 is assigned to the site2 crypto card... etc.

  I hope that's clear

  In addition to this, you need to configure identity NAT / NAT provides both the HUB and the spokes of sites.

  --

  Please do not forget to select a correct answer and rate useful posts

• Application of VPN S2S (with NAT)

  Hello experts,

  ASA (8.2) and standard Site 2 Site Internet access related configs.

  Outside: 1.1.1.1/24-> peer IP VPN S2S.

  Inside: Pvt subnets

  Standard "Nat 0' orders and crypto ACL for our remote offices, local networks with IP whp program.

  Requirement:

  Need to connect the PC to external clients (3.3.3.3 & 4.4.4.4) on tcp/443 via vpn S2S on our LAN. Client only accepts only the host with public IPs.

  I need NAT to my internal IP to the public IP say 1.1.1.2 and establish the VPN tunnel between 1.1.1.1-> PRi Client-side & secondary IPs (Cisco router).

  (without losing connectivity to remote offices). No policy NAT work here?

  ex:

  My Intern: 10.0.0.0/8 and 192.168.0.0/16
  Assigned IP available for NAT (some time to connect to the client only): 1.1.1.5

  External client LAN IPs: 3.3.3.3 & 4.4.4.4

  PAT: permit TOCLIENT object-group MYLAN object-group CUSTOMER LAN ip extended access-list

  NAT (inside) 5-list of access TOCLIENT

  5 1.1.1.5 (outside) global
      
   Crypto: tcp host 1.1.1.5 allowed extended CRYPTO access list object-group CUSTOMER LAN eq 443

  Outsidemap 1 crypto card matches the address CRYPTO
   
  Customer will undertake to peer with IP 1.1.1.1 only.

  Do I need a ' Nat 0' configs here?

  Also, for the specifications of the phase 2, it is not transform-set options gives. Info given was

  Phase2: AH: people with mobility reduced, life: 3 600 s, PFS: disabled, LZS Compression: disabled.
  This works with options of the phase 2?

  Thanks in advance

  MS

  Hello

  «Existing NAT (inside) 1 & global (outside) does not interfere with NAT 5 when users try to reach the ClientLAN.»

  Your inside nat index is '1', while the dynamic policy-nat is index '5 '.

  "" For the phase 2 in general, we define Crypto ipsec transform-set TEST ".

  Sure, the remote tunnel peers even accept transform set, everything you put up with the example below and distant homologous put the same tunnel.

  Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

  "In this scenario, no need to define any what and just add empty transform don't set statement under card crypto?

  No you need a defined transformation.

  "3. If we want to limit the destination port 443, I need to use separate VPN filters?

  That's right, use a vpn-filter.

  "4. we have several phase 1 configs, but wanted to use AES256 & DH5 (new policy)"... for s2s, these options work fine. ""

  Of course, you have set the phase 1, as required.

  Thank you

  Rizwan James

• Access to the DMZ to remote sites via VPN S2S

  We have an ASA 5520 and two remote site ASA 5505 that connect to each other through tunnels VPN S2S. They are doing tunneling split, while local traffic passes over the tunnel. We are local LAN (10.0.0.0/16) and our network to the DMZ (10.3.0.0/24) on the main site. The DMZ hosts our external sharepoint, but we access it internally

  The problem is site A (10.1.0.0/24) and B (10.2.0.0/24) have no idea of it, and when you try to go to the site, it fails. You can access it via the external site address, but that's the only way. Normally the external address is blocked when you're an intern.

  That I'm stuck on is even when we had all sent traffic from Site A to our Senior Center, would find it yet. I do a separate vpn purely tunnel that traffic to DMZ?

  Yes. So if you do this in ASDM under Edit Site profile connection Site, it will look like this.

  Local network: 10.0.0/16, 10.3.0.0/24

  Distance: 10.1.0.0/24

• Ontario Regulation distributes dynamic routes via VPN S2S

  Hi halijenn / experts

  (1) please let me know if IPP works on a Site in tunnel

  (2) I have a behind remote ASA 10.10.1.0 and 10.10.2.0 network that must be distributed to another branch ASA with S2S ASA remote via OSPF

  3) there is an L3 Switch behind the ASA of the branch and Switch L3 there is a router that has a default route pointing router WAN

  Router WAN
  |
  |
  Users-> router-> L3 Switch-> ASA-> Internet-> remote ASA branch (10.10.1.0, 2.0)

  Note: 10.10.1.0 2.0 AND are already configured in the ACL Crypto at the ends.

  Users are able to reach the 10.10.2.X network to the remote end.

  Now for the 10.10.2.0 static routes are already there in the router and the switch finally pointing the ASA branch however as the network grows, it is impossible in the router behind the switch to add static whenever routes (such as the default route to router WAN points). This is why in order to learn routes dynamically, I will add an ospf process to the ASA to branch with the following configuration. Please let me know if iam correct when I add IPP and other OSPF commands to the ASA of the branch. (hope I have nothing to do on ASA remote associated with IPP or OSPF?)

  I take just an example of a remote host 1 10.10.1.4. Inside ASA interface leading to users is 172.16.1.0/24

  access-list redistribute allowed standard host 10.10.1.4 255.255.255.255

  router ospf 1
  network 172.16.1.0 255.255.255.0 area 0
  Journal-adj-changes
  redistribute static subnets redistribute route map

  In addition, I will also be allowing the order for IPP in the encryption of the VPN S2S said card.

  Please help me understand if I'm wrong

  Pls set the OSPF firstly on the SAA process before removing the static routes. Once you have confirmed that the OSPF is configured correctly and the roads are in the OSPF database, then you can delete the static routes. Static routes will always take precedence over OSPF because it has higher metric. Please keep the default route configured on the SAA.

  Hope that confirms it.

• Cisco and Checkpoint VPN clients on a single PC

  Hello

  I'm in the following fix:

  I had used customer Checkpoint SecuRemote 4.1 SP - 5 VPN in the past.

  Now, I have installed the Cisco VPN client version 4.0.4 on my PC to access IPSec VPN for the PIX in our headquarters.

  According to Cisco VPN release notes http://www.cisco.com/univercd/cc/td/doc/product/vpn/client/rel404/404clnt.htm#wp1346340 , it should be possible to have clients both Cisco and Checkpoint VPN installed on the same machine.

  But I am not able to connect to my PIX, I receive the following error message:

  "Secure the complete VPN connection locally by the Client.

  Reason 403: failed to contact the security gateway. »

  When I'm looking for signs of PC control-> system-> hardware-> device Administration-> network cards, I can see Cisco Systems VPN Adapter disabled.

  After you activate manually, I always get the same error when you try to connect to the Cisco VPN client.

  After PC restart the Cisco VPN adapter is disabled later.

  I tried to uncheck Check Point SecuRemote form my Dial-up connection (bypassing CSCea31192 of bug, but the bug does not affect NAT - T connection which I use).

  I noticed the same situation on three different computers, one running Windows XP, both running Windows 2000.

  After uninstalling the client Checkpoint completely (including Windows registry manual removal), the Cisco VPN client works very well.

  It seems to me, therefore, that there is a profound mismatch between Cisco and Checkpoint VPN clients.

  Does anyone know of a workaround?

  Thank you

  Milan

  We had the same problem with some of our users who need to use the two clients to connect to customer sites.

  If I remember the cisco client does not start automatically, but the client of checkpoint 4.1 don't.

  We by-passed by deleting the registry entry point control that starts the client at startup. fwenc.exe is the entrance and it is in

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

  After that make a shortcut to the executable file that is stored in the directory \bin to relevant checkpoint on the client (it is different from NT & 9 client x) and then only start when it is necessary.

  Hope that's a help

• ASA 5505 VPN sessions maximum 25?

  Hello friend´s

  The company I work when acquired several ASA 5505, so now we will be able to connect several branches at Headquarters. But, now, I know that the ASA 5505 just scalates to 25 VPN sessions, I think that it won´t be enough to support the operations of an office. I have a lot of questions about this:

  Is - what the number 25 menas supporting up to 25 L2L tunnels? Or it means 25 sessions, regardless of the amount of L2L tunnels?

  Is this the way number 25 supporting up to 25 users in the Branch Office? Or it means that a user can use several sessions?

  I'm the stage of testing in a laboratory where one PC connects to many applications, at - it now someone if there is a command in the SAA to check how many VPN sessions is used?

  Please, do not hesitate to ask as much as necessary information. Any comments or document will be appreciated.

  Kind regards!

  Hi Alex,

  The assistance session 25 ASA 5505 VPN as max for IKEv1 or IPSEC tunnels customers it could be up to 25 L2L tunnels or 25 users using ikev1 (Legacy IPSEC client) and another 25 sessions for Anyconnect or Webvpn in this case are used in function.

  To check how many sessions VPN is currently running, run the command 'Show vpn-sessiondb' and 'display the summary vpn-sessiondb '.

  Find the official documentation for the ASA5505 on the following link:

  http://www.Cisco.com/c/en/us/products/collateral/security/ASA-5500-series-next-generation-firewalls/datasheet-C78-733510.html

  Rate if helps.

  -Randy-

• ASA for vpn only

  Hello

  I would like to configure the ASA for vpn only. By default, ASA allows traffic from the interface of high security to low security interface. I want to stop it. Is it possible to do without resorting to access lists.

  Thank you

  John

  Define interfaces for the same level of security and make sure that you do not have same-security-traffic permits inter-interface enabled.
  

  http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a00807fc191.shtml

  Hope that helps.

• DHCP relay for users (ASA) SSL VPN

  I have ASA 5520 vpn endpoint. Before asa, there are firewalls which translates the public ip address to the private sector and to pass SSL traffic to ASA. I have configured DHCP relay to get the IP address for the DHCP in Windows Server users:

  dhcprelay Server 10.100.2.101 on the inside

  dhcprelay activate vpn

  dhcprelay setroute vpn

  and it does not work. with the local pool, it works fine. Should I do something else? When I turn on debugging it has not any activity.

  You try to assign the IP address to the SSL vpn client using the DHCP server?

  If so, you don't need these commands contained in your message.

  Basically, you need to set dhcp server in tunnel-group and dhcp-network-scope in group policy.

  Here is an example of Ipsec client. Setup must be the same.

  http://www.Cisco.com/en/us/partner/products/ps6120/products_configuration_example09186a0080a66bc6.shtml

• VPN with ASA 5500 VPN with PIX 515E vs

  I wonder what are the differences between the use of an exisitng PIX 515E for VPN remote users as appossed to acquire an ASA 5500 VPN remote users? Information or advice are appreciated to help me lean toward one or the other.

  Craig

  According to the version of the code that you run on the PIX on the PIX or ASA VPN features must be the same. So if the choice is not based on differences in features, what else would help guide the choice? You can consider if the existing PIX has sufficient resources to add the extra processing VPN load or if you should put that on another box. You might consider that the PIX is an older product range, and his end is near, while the ASA is the product that is the strategic replacement for the PIX. Given a choice I probably prefer to use a technology newer than the old technology. I also believe that the ASA will give you more choice of technology to go forward (a way of better growth) while the PIX provides current capacity but no path of growth.

  On the other hand, there is the aspect of consider that using the existing PIX does not need not to buy something new and ASA would be an expense you have to cover in the budget. And for some people the budget constraint is an important consideration.

  HTH

  Rick

• Cisco ASA 5510 VPN Site to Site with Sonicwall

  I am trying to configure a tunnel between a Cisco ASA 5510 VPN (Version 8.2 (2)) and TZ200 Sonicwall. I rose tunnel and go and I am able to ping the internal IP address of Cisco ASA of the Sonicwall LAN but nothing work. When I try to ping a host behind the Cisco ASA of the Sonicwall LAN I get the following message "rules asymmetrical NAT matched for flows forward and backward; Connection for tcp src outside:10.20.10.x/xxxx dst inside:10.20.2.x/xxxx refused due to failure of reverse path of NAT"on the SAA

  Googling the error above shows the problems with version 8.3 or later that resembled the nat commands have been changed SAA, train is still on 8.2 but I another common question does not add an exemption of NAT I have double-triple checked that I did add an exception rule of NAT of the hosts on the network from cisco for the guests of the Sonicwall network. Looks like I hit a road block so any help would be appreciated. Thank you

  Here are a few excertps of the config file (10.20.2.0 behind the cisco) and 10.20.10.0 behind the sonicwall

  NAT (inside) 0 access-list sheep

  ..

  IP 10.20.2.0 allow Access-list extended sheep 255.255.255.0 10.20.10.0 255.255.255.0

  access extensive list ip 10.20.2.0 outside_1_cryptomap allow 255.255.255.0 10.20.10.0 255.255.255.0

  ..

  card crypto outside_map 1 match address outside_1_cryptomap

  card crypto outside_map 1 set counterpart x.x.x.x

  card crypto outside_map 1 set of transformation-ESP-3DES-SHA

  outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

  outside_map interface card crypto outside

  ..

  crypto ISAKMP allow outside

  crypto ISAKMP policy 5

  preshared authentication

  3des encryption

  sha hash

  Group 2

  lifetime 28800

  ..

  internal SiteToSitePolicy group strategy

  attributes of Group Policy SiteToSitePolicy

  VPN-idle-timeout no

  Protocol-tunnel-VPN IPSec

  Split-tunnel-network-list no

  ..

  tunnel-group x.x.x.x type ipsec-l2l

  tunnel-group x.x.x.x General attributes

  Group Policy - by default-SiteToSitePolicy

  tunnel-group ipsec-attributes x.x.x.x

  pre-shared key *.

  ..

  Added some excerpts from the configuration file

  Hello Manjitriat,

  Okay, detected IPSEC parody is normal, that means you are trying to send unencrypted on a line of encrypted packets.

  Now, if you see on the plotter of package that traffic will hollow the VPN channel all its fine in your site.

  Now the packet tracer must be something like this:

  entrance to Packet-trace inside private_ip_lan destination_private_ip_lan 1025 tcp 80

  Please provide us with the result of the following instructions after you run the packet tracer.

  See the crypto Isakamp SA

  See the crypto Ipsec SA

  Kind regards

  Julio

• ASA 5520 VPN licenses

  Community support,

  I want to run this question by you guys to avoid the sales of our partner CISCO and similar pitch more to the best solution that would give us what we want.

  We currently have a VPN from CISCO 3020 hub to terminate the Lan-to-Lan tunnels and have our mobile workers to connect through the client VPN CISCO (300 users-employees and contractors).

  Given that this device is coming to an end of LIFE this year, we bought a CISCO 5520 (here is the current licenses in this topic)

  Licensing seems quite complicated, so here's my question:

  -What VPN do you recommend for our users and entrepreneurs? I understand that the CISCO VPN client does not work with ASA 5500 Series devices

  Is there a license needed to deploy a VPN solution for our remote users(employees/contractors)?

  Thank you

  John

  The devices allowed for this platform:
  The maximum physical Interfaces: unlimited perpetual
  VLAN maximum: 150 perpetual
  Guests of the Interior: perpetual unlimited
  Failover: Active/active perpetual
  VPN - A: enabled perpetual
  VPN-3DES-AES: activated perpetual
  Security contexts: 2 perpetual
  GTP/GPRS: Disabled perpetual
  AnyConnect Premium peers: 2 perpetual
  AnyConnect Essentials: Disabled perpetual
  Counterparts in other VPNS: 750 perpetual
  Total VPN counterparts: 750 perpetual
  Shared license: disabled perpetual
  AnyConnect for Mobile: disabled perpetual
  AnyConnect Cisco VPN phone: disabled perpetual
  Assessment of Advanced endpoint: disabled perpetual
  Proxy UC phone sessions: 2 perpetual
  Proxy total UC sessions: 2 perpetual
  Botnet traffic filter: disabled perpetual
  Intercompany Media Engine: Disabled perpetual

  This platform includes an ASA 5520 VPN Plus license.

  Your understanding that the Cisco VPN client does not work with ASA is wrong. Maybe it's the version of Cisco VPN client that you use currently does not work with ASA. But these (and so not very new indeed) versions of VPN client work with the ASA. I installed for several clients who use the traditional IPSec VPN client with ASA ASAs and they work well.

  You are right that the granting of licenses for the SAA is complicated. Your tunnels IPSec VPN site-to-site will work on the SAA and pose much challenge in terms of licenses. But there are problems and alternative solutions to consider for remote access VPN clients. At this point, there are two major variants: you can use the classic IPSec VPN client or you can use the new AnyConnect client. From a licensing perspective there is a Hugh difference between them. It is not special license that applies to the traditional IPSec client and they are just against your license for peers Total VPN (for which you have 750 in your license). For the AnyConect there is a condition of licence. There is a premium for AnyConnect license and there are licensed AnyConnect Essentials. The Essentials license price is much lower than the premium license, but Essentials does not all the features that made the premium.

  In the immediate future, that it would sound like an easy question to answer, use the traditional IPSec VPN client for which theere is not a special permit and it is what you are used to. However Cisco has announced the dates of end of sale and end of Support for the traditional VPN client. If at some point you will need to use the AnyConnect client. I would say that if you make the change of the ASA that it might be a good choice to also adopt the AnyConnect client.

  HTH

  Rick

• ASA 5520 - VPN users have no internet.

  Hello

  We just migrated a Pix 515 and an ASA 5520 VPN concentrator.  The firewall part works fine, but we have some problem with our remote VPN.

  Everything inside network is accessible when you use VPN remote but there is no access to our perimeter network or the internet.  I don't know there's only something simple you need that I'm missing, and hoping someone can shed some light on what is needed to allow the VPN tunnel back outdoors and in our DMZ.

  The ASA is running 8.2 (2) 9 and ASDM 6.2 (1).

  See you soon,.

  Rob

  From the 172.16.68.0/24 you can PING 10.10.10.1 correct?

  The 10.10.10.0/24 you can PING 172.16.68.1 correct?

  I'm having a hard time find now how this tunnel is up since you have PFS
  activated on the SAA, but not on the PIX.

  Federico.

• ASA 5510: beat s2s VPN

  Hi all

  I have a VPN of n-star with 5510 boxes in several places.

  Users complaining that s2s links are beat from time to time for both places.

  Here's the log output for the moments where the links are torn down:

  First spoke:

  07/07/2010-20:17:09 Local4.Notice % 713259-5-ASA: group = , IP = , Session is to be demolished. Reason: The user has requested
  07/07/2010-20:17:09 Local4.Notice % 5-ASA-713050: group = , IP = , missed connection for peer .  Reason: terminate Peer  Remote proxy 10.3.0.0 Proxy Local 172.16.100.0

  Second spoke:

  07/07/2010-18:34:45 Local4.Notice % 713259-5-ASA: group = , IP = , Session is to be demolished. Reason: Idle Timeout

  07/07/2010-18:34:45 Local4.Notice % 5-ASA-713050: group = , IP = , missed connection for peer .  Reason: IPSec SA time-out  Remote proxy 10.5.0.0, Proxy Local 172.16.100.0

  I think the bold text is the reason. But I don't know why a connection stop remote site1 and why to site2 is timeouts.

  I have HIS lifitime for 24h\4Gb to each ASA and the volume of traffic or time never pass in this case, KeepAlive is enabled to the ASA hub as well. I see a number or a "spacing" all day with the same reasons for termination that I presented above. Anyone has a suggestion or idea why s2s VPN are hinged and how make them more stable even if the traffic is not flowing throughout.

  Thanks in advance.

  Sergey,

  No matter how lucky you have vpn time-out configured on one of the sides (it may be in default group policy perhaps?)  (see the race from all political group | I vpn)

  "IPSec SA time-out"

  HTH,

  Marcin