Incompatibility on Site to site VPN tunnels between Watchguards and Cisco ASA’s
Profile: Jason Tramer
I have been working with a client with multiple sites and up until recently they have been using Watchguards at all sites. Recently we have been switching out some of the Watchguard for Cisco ASA’s but there have been a ton of site to site VPN issues. For example, a tunnel goes down, so you re-key it, it doesn’t come back up, but if you recreate then tunnel on the watchguard side with the exact same settings everything works fine. What is the point of having a Standard if companies aren’t following it. Yeesh.
Comment
RSS Feed
Email a friend
2 Comments on this Post
there's a note in the VPN configuration summary that acknowledges difficulty with VPNs to ASA and says that you want to set the ASA timeout value in the Cisco ASA VPN configuration to a lower value than the default timeout on the Watchguard. In our case the timeouts were the same, I had the guy with the Watchguard change his timeout to larger than my Cisco ASA, as I have over 100 VPN tunnels with other peer devices and only the watchguard is this much of a headache. I did configure the tunnel on the ASA side to never idle time out. Both those settings have reduced issues, however, the tunnel still goes down when the remote end has ISP problems and does not come back up unless the Watchguard guy deletes and rebuilds the tunnel on his end.