Has anyone here been able to specify a stable configuration for the L2L VPN between an ASA device and pfSense 2.0.1? I am using the most accomodating settings on the ASA side (DefaultL2LGroup
with many transform sets and using PSK so that the pfSense device does all of the specifying of networks) and the simplest settings on the pfSense end (default settings + no DPD + NAT-T enabled. The P1/P2 lifetimes match on both ends. P2 uses 3DES/SHA1 specified in pfSense and simply tunnels LAN net to the other LAN. There are no IP addressing conflicts between the networks, no complex routing going on, etc. It's pretty much a /24 LAN to another /24 LAN, and it works almost all of the time. However, the tunnel drops intermittently (perhaps 2-5 times per day) and although it is very hard to predict, it occurs all of the time! I've been pulling hair out trying to get it to stop dropping but so far I have had no luck. I've even heard from some colleagues that there is something about Cisco's IPSec implementation that precludes pfSense and ASA from playing nicely. Is there anything left to try? Can anyone provide some anecdotal tips or tricks to diagnose and/or fix the dropped tunnel?
Things I have tried
- Viewing racoon debug log
- Eliminating DPD
- Different lifetime values (both ends)
- Having the ASA initiate traffic (not
DefaultL2LGroup
)
Any and all help is tremendously appreciated.