VPN Always UP KB ID 0001839
Problem
This was information that was passed to me by a colleague (Thanks Ajay) this week. If you have a site to site VPN tunnel after a period of inactivity the tunnel will be torn down. In most cases when required it will simply be re-established, but what if you wanted it to be permanently up?
I have had situations where only the ASA side of a tunnel can bring it up (usually because of misconfiguration at the ‘other end‘) and that situation cannot be rectified.
Search for how to do this and the usual answer is to simply set the vpn-idle-timeout on the group policy that applied to the tunnel to none, remember if you haven’t specified a group policy for a tunnel it should take its settings from the DfltGrpPolicy so you would simply do this.
Petes-HomeASA# conf t Petes-HomeASA(config)# group-policy DfltGrpPolicy attributes Petes-HomeASA(config-group-policy)# vpn-idle-timeout none Petes-HomeASA(config-group-policy)# exit Petes-HomeASA(config)# wr mem
However, I’ve tested that AND IT DOES NOT WORK!
Solution : VPN Always UP
The solution that works, is to use the event manager applet, and schedule an event to happen periodically, (like send some traffic down the tunnel to keep it up). This is simple to do.
Petes-HomeASA# conf t Petes-HomeASA(config)# event manager applet VPN-Always-UP Petes-HomeASA(config-applet)# event timer watchdog time 1500 Petes-HomeASA(config-applet)# action 1 cli command "ping tcp inside 192.168.100.3 80 source 10.254.254.212 55555 repeat 2" Petes-HomeASA(config-applet)# output none Petes-HomeASA(config-applet)# exit Petes-HomeASA(config)# exit Petes-HomeASA# write mem Building configuration... Cryptochecksum: b81da41e 32a6843e 07680a8f aaacd646 10988 bytes copied in 0.370 secs [OK] Petes-HomeASA#
To test,simply wait a moment then issue a ‘show cry isa’ command on the firewall. You will see that there is a tunnel established, or if your too lazy, just ping something at the other end of the tunnel in ‘most‘ cases if the first packet times out, then it starts to respond, then that’s a warning the tunnel was NOT up. If it instantly responds that’s a good indicator that the tunnel was already up.
Related Articles, References, Credits, or External Links
Thanks to Ajay Mandava for the article.
Bring up a VPN Tunnel From the ASA
