Packet drops in the IPsec Tunnel between Cisco ASA firewalls

[shivani.bsc29 (Shivani R)]

Hi ,
I am facing connectivity issue through the IPsec tunnel configured between Cisco ASA firewalls. Pls help & suggest the way forward to troubleshoot it.

Scenario: The IPsec tunnel (Ikev1) was stable since years but suddenly started observing random packet drops between the interesting traffic only. There are no packet drops to the remote peer public IP address at the same time ?

[lagapidis (Lazarus Agapidis)]

Hello Shivani

There may be several reasons for such an occurrence. In order to help you with troubleshooting, take a look at the following post:

Cisco ASA Site-to-Site IKEv1 IPsec VPN

Hello Pavan Recieve errors on an IKEv1 IPSec tunnel usually increase when one of the tests performed during the decapsulation of the ESP fails. These include: Anti-replay out of window errors Digest errors (packet corrupted) Invalid decapsulation length/SA/protocol Any other decapsulation failure In order to determine in detail where the problem is, you can use various debug commands for IPSec including: debug crypto ipsec debug crypto isakmp If it is an issue with ESP decapsulation, you …

You may also find some additional help at this NetworkLessons note:

https://notes.networklessons.com/asa-troubleshooting-ipsec

Let us know how you get along in your troubleshooting!

I hope this has been helpful!

Laz