1

I have Cisco ASA site-to-site tunnel with remote and which i don't have control.

I have following config:

crypto ikev1 policy 10
 authentication pre-share
 encryption aes
 hash sha
 group 2
 lifetime 28800

Crypto map

crypto map VPN 10 match address ACL-VPN
crypto map VPN 10 set pfs
crypto map VPN 10 set peer 201.222.X.X
crypto map VPN 10 set ikev1 transform-set VPN-ESP-AES-SHA
crypto map VPN 10 set security-association lifetime seconds 3600
crypto map VPN interface outside

Tunnel group

tunnel-group 201.222.X.X type ipsec-l2l
tunnel-group 201.222.X.X ipsec-attributes
 ikev1 pre-shared-key *****
 isakmp keepalive threshold 10 retry 10

One option i have SLA icmp to generate traffic and keep it up but what other option i have to make it up if i don't want to use SLA feature?

If i change isakmp lifetime to zero does that required change to remote end?

EDIT - 1

enter image description here

  • If i ping from PC-1 to any ip in 10.10.10.x range (no matter its up or down) my vpn tunnel get trigger and up
  • If i ping from ASA-Local to ip in 10.10.10.x range, vpn tunnel not getting up because its using outside interface default to ping.

  • If i ping from ASA-Local using this command ping inside 10.10.10.1 my tunnel get trigger and working.

  • 2
    Your options are: 1. The IP SLA; 2. Always be sending something over the tunnel from host/server to host/server to keep the tunnel up (effectively just another form of an IP SLA); 3. Configure the lifetimes on BOTH sides (changing only one side will cause other issues). – Jesse P. Mar 18 at 17:58
  • You should convert that into an answer, @JesseP. – Teun Vink Mar 18 at 18:36
  • @TeunVink I didn't really feel like it was answering the problem as much as just confirming what the OP already knew, but I added it anyway. – Jesse P. Mar 18 at 18:38
  • 1
    Possible duplicate of How to keep an ASA tunnel up for lifetime? – Jesse P. Mar 18 at 21:41
  • Sorry for slightly not answering the question, but what is the use case for this? The idea behind using IKEv1 is to generate key material for the Child (IPsec) SA so trying to keep the tunnel up forever (no rekey) slightly defeats the point. IKE rekeys the child SA prior to lifetime expiry such that there is no traffic loss as the two SA's are temporarily installed together If you want a tunnel not to rekey you can set the ipsec lifetime for both timer and data to disabled (and will stay up until other end rekeys), or you can create an IPsec child SA with no IKE session by creating an IPsec tu – Owensteam Mar 21 at 15:06
4

Your options are:

  1. The IP SLA
  2. Always be sending something over the tunnel from host/server to host/server to keep the tunnel up (effectively just another form of an IP SLA)
  3. Configure the lifetimes on BOTH sides (changing only one side will cause other issues).

Edit (in response to how to apply the group-policy):

tunnel-group 74.201.x.x general-attributes
 default-group-policy FOO

Edit 2 (in response to SLA source-interface):

sla monitor <number>
 type echo protocol ipIcmpEcho <target> interface <source interface>
  • i was reading about vpn-idle-timeout none not sure about that if it support site-to-site – Satish Mar 18 at 21:19
  • @Satish I use that setting on one of my tunnels without any issue. What are you seeing that's causing doubt? – Jesse P. Mar 18 at 21:39
  • where i should apply that setting? – Satish Mar 18 at 21:40
  • 1
    @Satish You apply it as part of the group-policy that your tunnel is set to use. group-policy <tunnel policy name> attributes and then vpn-idle-timeout none. Then make sure your tunnel-group is set to use whatever policy you add that command to. – Jesse P. Mar 18 at 21:43
  • I am confused, This is what i did group-policy FOO attributes and inside policy i set vpn-idle-timeout none now where i should put this FOO policy? should i add in tunnel-group 74.201.x.x general-attributes with default-group-policy? could you please add example config or command in your answer would be helpful – Satish Mar 19 at 14:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.