Rekey data left of 0KB in ASA 5505-5510 seems to make IPSec SA fail

Question

Hello
I have a Central Office with a Cisco ASA 5510 connected to several remote locations with ASA5505
The site to site VPNs work well, but sometimes some of them fail. After some research I found that, it that situation, the IKE and IPSec SAs are working, but traffic only crosses the tunnel in one direction. As an example, if I ping a remote host, it receives the ping request and sends the ping reply, but this reply never crosses the tunnel back.
As far as I know, it seems to happen randomly, at least I couldn't find a pattern. I tried logging out the tunnel by means of the ASDM but, when the tunnel re-establishes, the same happens. The only solution is to force a reload of the ASA5505 in the remote location, and then it starts to work normally (I can't do a reload on the 5510, as it would break the connection with the rest of remote locations).
The only clue I have is that it can only affect one of the several IPSec SAs of the IKE session while the rest of SAs of that session keep on working and, when failing, the data rekey lifetime of that IPSec SA is 0 KB:
WORKING SA:
  IPSec:
  Session ID   : 2
  Local Addr   : X.X.X.X/255.255.255.0/0/0
  Remote Addr  : X.X.X.X/255.255.255.0/0/0
  Encryption   : 3DES                   Hashing      : SHA1
  Encapsulation: Tunnel
  Rekey Int (T): 28800 Seconds          Rekey Left(T): 18401 Seconds
  Rekey Int (D): 3825000 K-Bytes        Rekey Left(D): 3824715 K-Bytes
  Idle Time Out: 30 Minutes             Idle TO Left : 30 Minutes
  Bytes Tx     : 22570303               Bytes Rx     : 35752322
  Pkts Tx      : 490855                 Pkts Rx      : 408700
FAILING SA:
  IPSec:
  Session ID   : 3
  Local Addr   : X.X.X.X/255.255.255.0/0/0
  Remote Addr  : X.X.X.X/255.255.255.0/0/0
  Encryption   : 3DES                   Hashing      : SHA1
  Encapsulation: Tunnel
  Rekey Int (T): 28800 Seconds          Rekey Left(T): 14862 Seconds
  Rekey Int (D): 3825000 K-Bytes        Rekey Left(D): 0 K-Bytes
  Idle Time Out: 30 Minutes             Idle TO Left : 30 Minutes
  Bytes Tx     : 67264                  Bytes Rx     : 0
  Pkts Tx      : 1051                   Pkts Rx      : 0
This led me to notice that, even when both 5510 and 5505 have the same traffic volume lifetime settings for the SA, the Rekey Data interval of the SAs is different between 5505 and 5510 (4275000 KB for 5505 and 3825000 KB for 5510 for by default setting of 4608000 KB; I tried changing this value to 5000000 in both devices and their new intervals were also different between them). I don't know if it's something to do with my problem, but seems quite odd.
I've looked for a solution in manuals and also browsed the Internet but with no result, so I would be very grateful if someone could give me some advice.
Thanks and regards

Answer 1

Does the version upgrade need to be applied to the head-end firwall (5510) or the remote firewall (5505)? I may be having this same issue, but it only affects VPN connections from ASA firewalls and not from PIX firewalls, so I was thinking it would have to do with the 5505 code. Except that I see two ISAKMP SAs on the corporate side, one showing rekey. I hadn't checked the ASP table or looked to see if the data was at 0k.
The reason I ask which device needs to be running the fixed version is that our head-end firewall is already running 8.3(2) which is in the fixed version list. We are running 8.2(2)22 on our remote ASA5505 firewalls which are the only ones that are having the issue.
Thanks,
Mark