IPSec VPN to Cisco ASA peers periodically failing to re-establish IPSec security association.

When IPSec VPN is to Cisco ASA peers, we may see instances where we cannot re-establish IPSec security association (SA) when phase2 lifetime expires. Manually clearing IKE (phase1) SA enables VPN to re-establish.

Cisco ASA has dead-pear detection (DPD) enabled by default. SRX by default does not have DPD enabled, but can respond to peer DPD hellos. Therefore if there is any connectivity issues between the peers, then Cisco ASA will lose DPD hellos and thereby drop IKE SA. In this scenario SRX will not be notified that peer IKE SA is down and will attempt to rekey phase2 only using existing phase1 parameters. This results in a mismatch for IKE and IPSec SA as SRX is not notified of loss of IKE SA on peer side. When manually clearing ike SA on SRX, this causes SRX to restart ike phase1 again. Then VPN will establish successfully.

The resolution would be to enable DPD on SRX side as well. This would allow SRX to be notified if IKE SA is no longer present on remote peer side and thereby allow phase1 to re-establish automatically.

Example:

[edit security ike]
root@SRX# show 
policy policy1 {
    mode main;
    proposal-set standard;
    pre-shared-key ascii-text "$ABC123"; ## SECRET-DATA
}
gateway ike1 {
    ike-policy policy1;
    address 1.1.1.1;
    dead-peer-detection;
    external-interface ge-0/0/0;
}

2020-02-26: minor non-technical edits.