ASA 8.0(2) – disappearing ISAKMP nat-traversal

Version 8.0(2) contains a bug that involves an inconsistent interpretation of what the default command is for “crypto isakmp nat-traversal 20”. Whilst running, the device appears to have this command on by default but on boot the command is negated by default. The effect of this is nat-traversal is disabled every time you reboot the ASA.

Workaround?

Use a non-default keep-alive interval. I used “crypto isakmp nat-traversal 30” and the command now persists through a reboot.

Note: This issue appears to be fixed in 8.0(3) bug ID CSCsj5258.