2

We have a Cisco ASA and at the remote end I have no idea what the device is. This is what happening:

When I send a packet or generate interesting traffic, it brings up the tunnel and everything starts working. The problem is that the remote end doesn't have an interesting traffic trigger and they won't be able to ping my machine until I send a packet and bring the tunnel up.

I did set SLA to generate interesting traffic but we have multiple subnets and every subnet creates its own tunnel.

This is what we have in the ACL at my side to generate interesting traffic:

Object group name - NET-REMOTE - 172.16.x.x/16

Here is the ACL:

access-list ACL-VPN extended permit ip 71.x.x.x 255.255.255.0 object-group NET-REMOTE
access-list ACL-VPN extended permit ip 61.x.x.x.x 255.255.254.0 object-group NET-REMOTE
access-list ACL-VPN extended permit ip 10.x.x.x 255.255.0.0 object-group NET-REMOTE

Here is the SLA statement:

sla monitor 10
 type echo protocol ipIcmpEcho 172.16.1.1 interface outside
 frequency 30

I can see that my isakmp policy lifetime is 86400 (24 Hours); but, still my tunnel is getting turned down in a few minutes:

crypto ikev1 policy 20
 authentication pre-share
 encryption 3des
 hash md5
 group 1
 lifetime 86400

At present, I have setup a continuous ping from one of my hosts to keep the tunnel up; but, this is not a good solution.

There must be a way to do this better.

Improve this question
1
  • 1
    Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Apr 1, 2018 at 20:28

2 Answers 2

Reset to default
5

You should be able to disable this in the group policy attributes.

group-policy "policy_name" attributes

vpn-idle-timeout none

Improve this answer
2
  • can i do this per IPSec tunnel?
    – Satish
    Feb 7, 2018 at 15:16
  • 1
    Yes, you can create multiple group policies with different configurations. Then you can assign the group-policies on a per tunnel basis depending on the attributes you want.
    – A-A-Ron
    Feb 7, 2018 at 16:01
0
= comment

in config mode

event manager applet PingHost ###> PingHost is the applet name

event timer watchdog time 300 ###> i set it to repeat every 5 min

action 1 cli command "ping inside 10.4.121.112 repeat 2" ###> ping my host on the other side of the VPN

action 2 cli command "ping inside 10.4.121.121 repeat 2" ###> ping my second host on the other side of the VPN

output none ###> you could add like a syslog entry, in my case nothing

add more if you want - of course change the IP to the host you try to reach @##

you need the " at the end

This will send a periodic ping with source from the inside interface to a destination of your choice - thus bringing up the tunnel

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.