I have Cisco ASA site-to-site tunnel with remote and which i don't have control.
I have following config:
crypto ikev1 policy 10 authentication pre-share encryption aes hash sha group 2 lifetime 28800
crypto map VPN 10 match address ACL-VPN crypto map VPN 10 set pfs crypto map VPN 10 set peer 201.222.X.X crypto map VPN 10 set ikev1 transform-set VPN-ESP-AES-SHA crypto map VPN 10 set security-association lifetime seconds 3600 crypto map VPN interface outside
tunnel-group 201.222.X.X type ipsec-l2l tunnel-group 201.222.X.X ipsec-attributes ikev1 pre-shared-key ***** isakmp keepalive threshold 10 retry 10
One option i have SLA icmp to generate traffic and keep it up but what other option i have to make it up if i don't want to use
If i change isakmp lifetime to
zero does that required change to remote end?
EDIT - 1
- If i ping from PC-1 to any ip in 10.10.10.x range (no matter its up or down) my vpn tunnel get trigger and up
If i ping from ASA-Local to ip in 10.10.10.x range, vpn tunnel not getting up because its using
outsideinterface default to ping.
If i ping from ASA-Local using this command
ping inside 10.10.10.1my tunnel get trigger and working.