VPN problem persists

Hi, I implemented a project some time back which went something like this: a Headquarters site where a PIX515E is installed with a public static IP on its external interface. Three remote sites, each with connecting to the internet through 837 routers ADSL with a dynamic public IP address. I configured the firewall and routers for EzVPN (router is configured in client mode) and the VPN tunnel rises and it works fine. Of course, when there is no interesting traffic through the tunnel and the idle timer on the PIX expires, the tunnel down. It is also very good. The problem is once the tunnel breaks down, it is again automatically when interesting traffic passes through the router (which is assumed). I use the console and ran the debugging on one of the routers and noticed that once the tunnel descends and the router tries to bring it up again, it gives the message:

"Key pair for this"XXX. " XX. XX. Mask XX/XX"already exists." Then, when I give the command "clear crypto isakmp his ', the tunnel rises immediately. I already posted this question before (link:http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.1dd6e4b2). Maybe she has something to do with the Dead Peer Detection on the PIX and the router system. In any case, I have configured the following command on the router and PIX:

ISAKMP crypto keepalive 2 10

but still it does not solve the problem. The router's IOS version 12.3 (2) XC2 and the PIX OS version 6.3 a (3). Also im attaching the PIX and router config for this post. What else can be done to solve the problem?

I replied to your last message.

As I said, you must at least 12.3.7 so that it works correctly.

"You must at least 12.3 (7) T for Dead Peer Detection work and send KeepAlive interval you want.

ISAKMP crypto keepalive [interval] [dry til counted dead] periodical

for example,.

"isakmp crypto 15 5 keepalive periodicals.

the key word is "periodic" is not available until 12.3.7 or later.

ISAKMP crypto keepalive 2 10

without periodic does nothing, you need periodic KeepAlive.

ISAKMP crypto keepalive 2 10 periodicals

will maintain the tunnel and head of network device know if/when it falls. It should be applied to the router and the PIX in your situation.

I worked through this issue before with IOS EzVPN (12.3 (11) T) to PIX (6.3 (3)) and IOS EzVPN hub VPN3000 (4.1) of the basic VPN

also... http://www.Cisco.com/en/us/products/SW/iosswrel/ps5207/products_feature_guide09186a00801ee19a.html

Tags: Cisco Security

Similar Questions

Maybe you are looking for