VPN SITE TO SITE

[Gacki]

Hello,

I set up a vpn site to site with a partner, unfortunately after 30 minutes from setting up the vpn stops going through the second phase of IKE, what could be the problem?
We have the same vpn settings for phase 1 and phase 2

Thank you.

[G_W_Albrecht]

What about the peers details ? What is the error shown in logs ? 

[Blason_R]

VPN v1 or v2?

Start debug and see where is that failing. Hope you are aware of vpn debug commands?

vpn debug trunc

vpn debug ikeon

vpn debug on

once done

vpn debug ikeoff

vpn debug off

fw ctl debug 0

[G_W_Albrecht]

> VPN v1 or v2?

You mean IKE ?

[Blason_R]

That is correct - Wondering what was the IKE version and what is the tunnel type? Route based or policy based?

[G_W_Albrecht]

Did not answer...

[Gacki]

Policy base, IKEv2

[G_W_Albrecht]

So give us information - we only know that you have two VPN peers and use IKEv2, but no more details: no error messages, no log entries, so nobody can tell you anything usefull by now... 

[the_rock]

I agree with @G_W_Albrecht . You did not give us much info, except its ikev2 and policy based. Thats great, but as he said, we need errors, logs you see, where it fails, phase 1, phase 2? @Blason_R provided you excellent basic VPN debug that TAC would ask you to do anyway, but you may as well call them and get this fixed, way better over remote.

[G_W_Albrecht]

I would suggest that you contact TAC - a quick RAS could find the issue easily and it will be resolved soon. As you do not want to explain anything here i see no other possible way...

[Blason_R]

Or best way I would recommend is try disabling vpn acceleration. That has helped me lot many times.

vpn accel off -> This would reinitialize the IKE session.

[Lloyd_Braun]

I have had issues with Cisco ASA VPN peers that leave their default vpn-idle-timeout at 30 minutes.