• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 623
  • Last Modified:

Cisco PIX to Cisco VPN drops connection periodically

I have a Cisco Pix 506e connecting via a T1 line to a Cisco Device on the other end. I'm not exactly sure of the device on the other end, but it does handle multiple VPNs without the others having problems.

Currently to fix it we turn it off then on and it and it resolves the problem.

I'm looking to determine the cause. What commands are available on the PIX to try to diagnose the problem? Are there any third party tools available to help?

Thanks,
Ron
0
youritstaff
Asked:
youritstaff
4 Solutions
 
billwhartonCommented:
No third party tools i have come across.

You could use these commands which show you the state of your connection and the debug commands show you live output for your vpn tunnels.
show crypto ipsec sa
show crypto isakmp sa

debug crypto ipsec
debug crypto isakmp
0
 
youritstaffAuthor Commented:
Thank you for your post. I've used those command initially to debug the initial connectivity. I didn't think they'll help me in this instance. Is there anyway to write the output to a log file so that I can go through the info after an outage.

Also, is there any way to check for memory leaks?

Thanks again.
0
 
grbladesCommented:
Hi youritstaff,
Check to see what IOS version the remote device is running and see if you can get an upgrade. This might be free if the problem you are experiencing is a known problem.

Also check the key lifetimes are set to identical values at both ends.
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
clkempCommented:
How often does it drop? Weekly? Daily? Hourly?  Can you post the crypto section from the pix with passwords and ip's changed?  If you have the same info from the host end, please post it too.  More information will help diagnose the problem.

You can send system messages to a syslog server.  Pick up a syslog server for windows from Kiwi software (www.kiwisyslog.com).  Setup your pix to send all messages to the syslog server.

logging on
logging host server_ip_address
logging facility 20
logging trap informational
0
 
tevensCommented:
Most likely the reason why you can re-establish the connection on reboot is because one side adjusts to match your config during establishment.  Verify that both ISAKMP and IPSEC proposals match on both sides.  Make sure that both sides select the correct proposal first.  Sometimes the problem lies with having the proposal order the same on both sides.

--Tim
0
 
youritstaffAuthor Commented:
Thank you everyone for your help. It turned out to be the linksys switch between the cisco router and switch. I distributed the points as they all helped in one way or another.
0

Featured Post

SMB Security Just Got a Layer Stronger

WatchGuard acquires Percipient Networks to extend protection to the DNS layer, further increasing the value of Total Security Suite.  Learn more about what this means for you and how you can improve your security with WatchGuard today!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now