1

I have Cisco ASA site-to-site tunnel with remote and which i don't have control.

I have following config:

crypto ikev1 policy 10
 authentication pre-share
 encryption aes
 hash sha
 group 2
 lifetime 28800

Crypto map

crypto map VPN 10 match address ACL-VPN
crypto map VPN 10 set pfs
crypto map VPN 10 set peer 201.222.X.X
crypto map VPN 10 set ikev1 transform-set VPN-ESP-AES-SHA
crypto map VPN 10 set security-association lifetime seconds 3600
crypto map VPN interface outside

Tunnel group

tunnel-group 201.222.X.X type ipsec-l2l
tunnel-group 201.222.X.X ipsec-attributes
 ikev1 pre-shared-key *****
 isakmp keepalive threshold 10 retry 10

One option i have SLA icmp to generate traffic and keep it up but what other option i have to make it up if i don't want to use SLA feature?

If i change isakmp lifetime to zero does that required change to remote end?

EDIT - 1

enter image description here

  • If i ping from PC-1 to any ip in 10.10.10.x range (no matter its up or down) my vpn tunnel get trigger and up

  • If i ping from ASA-Local to ip in 10.10.10.x range, vpn tunnel not getting up because its using outside interface default to ping.

  • If i ping from ASA-Local using this command ping inside 10.10.10.1 my tunnel get trigger and working.

Improve this question
5
  • 2
    Your options are: 1. The IP SLA; 2. Always be sending something over the tunnel from host/server to host/server to keep the tunnel up (effectively just another form of an IP SLA); 3. Configure the lifetimes on BOTH sides (changing only one side will cause other issues).
    – Jesse P.
    Mar 18, 2019 at 17:58
  • You should convert that into an answer, @JesseP.
    – Teun Vink ♦
    Mar 18, 2019 at 18:36
  • @TeunVink I didn't really feel like it was answering the problem as much as just confirming what the OP already knew, but I added it anyway.
    – Jesse P.
    Mar 18, 2019 at 18:38
  • 1
    Possible duplicate of How to keep an ASA tunnel up for lifetime?
    – Jesse P.
    Mar 18, 2019 at 21:41
  • Sorry for slightly not answering the question, but what is the use case for this? The idea behind using IKEv1 is to generate key material for the Child (IPsec) SA so trying to keep the tunnel up forever (no rekey) slightly defeats the point. IKE rekeys the child SA prior to lifetime expiry such that there is no traffic loss as the two SA's are temporarily installed together If you want a tunnel not to rekey you can set the ipsec lifetime for both timer and data to disabled (and will stay up until other end rekeys), or you can create an IPsec child SA with no IKE session by creating an IPsec tu
    – Owensteam
    Mar 21, 2019 at 15:06

2 Answers 2

Reset to default
4

Your options are:

  1. The IP SLA
  2. Always be sending something over the tunnel from host/server to host/server to keep the tunnel up (effectively just another form of an IP SLA)
  3. Configure the lifetimes on BOTH sides (changing only one side will cause other issues).

Edit (in response to how to apply the group-policy):

tunnel-group 74.201.x.x general-attributes
 default-group-policy FOO

Edit 2 (in response to SLA source-interface):

sla monitor <number>
 type echo protocol ipIcmpEcho <target> interface <source interface>
Improve this answer
11
  • i was reading about vpn-idle-timeout none not sure about that if it support site-to-site
    – Satish
    Mar 18, 2019 at 21:19
  • @Satish I use that setting on one of my tunnels without any issue. What are you seeing that's causing doubt?
    – Jesse P.
    Mar 18, 2019 at 21:39
  • where i should apply that setting?
    – Satish
    Mar 18, 2019 at 21:40
  • 1
    @Satish You apply it as part of the group-policy that your tunnel is set to use. group-policy <tunnel policy name> attributes and then vpn-idle-timeout none. Then make sure your tunnel-group is set to use whatever policy you add that command to.
    – Jesse P.
    Mar 18, 2019 at 21:43
  • I am confused, This is what i did group-policy FOO attributes and inside policy i set vpn-idle-timeout none now where i should put this FOO policy? should i add in tunnel-group 74.201.x.x general-attributes with default-group-policy? could you please add example config or command in your answer would be helpful
    – Satish
    Mar 19, 2019 at 14:16
0

https://community.cisco.com/t5/vpn/keep-a-vpn-tunnel-on-asa/m-p/3789508

you will find the ASA embedded event manager quite useful

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.