topic Keep Site-to-Site VPN Tunnel Active for monitoring in VPN

Keep Site-to-Site VPN Tunnel Active for monitoring

shanilkumar2003 — Mon, 21 Jan 2013 11:50:56 GMT

Hi all,

i have a site-to-site VPN tunnel configured only come up when traffic generated from remote peer. is there any way to keep the tunnel always active once after the tunnel is established.

my requirement is to monitor the VPN for availability, so need to ping one of the Natd ip on remote end, but this will come up only when traffic generated from peer end. currently the default timers for SA is configured

please help..

Thanks

Shanil

Keep Site-to-Site VPN Tunnel Active for monitoring

Rudy Sanjoko — Mon, 21 Jan 2013 11:57:42 GMT

You can disable the isakmp keepalive on the tunnel interface, or you can also configure the vpn-idle-timeout and vpn-session-timeout to none on group-policy. This will make you tunnel always up even when there's no traffic passing through the tunnel.

Keep Site-to-Site VPN Tunnel Active for monitoring

shanilkumar2003 — Mon, 21 Jan 2013 17:39:45 GMT

Thanks Rudy..but if i disable the keepalive in interface it will be applied to all teh tunnels right? i need to disable this only for this particular tunnel.

Keep Site-to-Site VPN Tunnel Active for monitoring

shanilkumar2003 — Mon, 21 Jan 2013 17:54:49 GMT

yes. i think disable keepalive has to be done in that particular tunnel group like,

tunnel-group x.x.x.x ipsec-attributes

isakmp keepalive disable

i will try this, please correct me if iam wrong

thanks

Shanil

Keep Site-to-Site VPN Tunnel Active for monitoring

Andrew Phirsov — Mon, 21 Jan 2013 18:32:44 GMT

I think that disabling isakmp keepalives is not a good idea. It may come to a situations like when (due to the flapping interface on any site, bad internet connections or smth else) one site thinks that tunnel is okay, and other thinks the opposite, deletes sa, reinitiates connection and it fails, cause ohter site already has one.

To me it looks good and enough to just set the idle timeout for corresponding group to infinite value.

Keep Site-to-Site VPN Tunnel Active for monitoring

shanilkumar2003 — Mon, 21 Jan 2013 18:45:12 GMT

thanks Andrew..can you please mention how i will configure this?

Thanks

Shanil

Keep Site-to-Site VPN Tunnel Active for monitoring

Andrew Phirsov — Tue, 22 Jan 2013 05:08:17 GMT

group-policy TARGET_GP attributes

vpn-idle-timeout none

Keep Site-to-Site VPN Tunnel Active for monitoring

Rudy Sanjoko — Tue, 22 Jan 2013 08:36:09 GMT

Another idea for this is that you can also use NTP to send traffic between site to site, this will keep the tunnel constantly active as there is always traffic running trought the tunnel.

Re: Keep Site-to-Site VPN Tunnel Active for monitoring

shanilkumar2003 — Wed, 27 Feb 2013 18:23:43 GMT

Hi

Its not working. I have idele-timeout none one side of the tunnel where traffic is iniating. But after a day tunnel got down
Please help
Thanks
Shanil

Sent from Cisco Technical Support iPhone App

Re: Keep Site-to-Site VPN Tunnel Active for monitoring

Rudy Sanjoko — Thu, 28 Feb 2013 09:39:44 GMT

Have you tried to configure the session timeout as well? I believe both needs to be set up to none.

http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a00807e0aca.shtml#solution13

Re: Keep Site-to-Site VPN Tunnel Active for monitoring

shanilkumar2003 — Thu, 28 Feb 2013 10:31:57 GMT

Thanks rudy i will try this and update

Sent from Cisco Technical Support iPhone App

Re: Keep Site-to-Site VPN Tunnel Active for monitoring

shanilkumar2003 — Sat, 02 Mar 2013 12:45:17 GMT

Hi
I have configured both to none ,but still
Tunnel is going down. Please help

Thanks
Shanil

Sent from Cisco Technical Support iPhone App

Re: Keep Site-to-Site VPN Tunnel Active for monitoring

Rudy Sanjoko — Mon, 04 Mar 2013 08:22:09 GMT

Are you configuring it on a router or firewall? I don't see this info on this thread. If it's on a router then the max. idle time that you can configure using IOS is only 86400 seconds which is a day(explained on the link above), this explains why your tunnel goes down after a day. If this is the case then I would suggest you to run NTP between those site to site so that there is always a traffic running on the tunnel, this way the tunnel will stay up as long the the NTP is running.

Re: Keep Site-to-Site VPN Tunnel Active for monitoring

shanilkumar2003 — Mon, 04 Mar 2013 09:12:59 GMT

I have ASA on both ends. Now i have configured idle and session timeout to none under group-policy on both ends. Is this ok? I will observe n update

Thanks
Shanil

Sent from Cisco Technical Support iPhone App

Re: Keep Site-to-Site VPN Tunnel Active for monitoring

Rudy Sanjoko — Mon, 04 Mar 2013 10:30:19 GMT

Yes, that is ok, I missed the information that you configured it only on one side. let us know the result, configuring the idle timeout to none should be enough to keep the tunnel alive forever, if it's not it means something is forcing the tunnel to go down.

Re: Keep Site-to-Site VPN Tunnel Active for monitoring

XIE YAO — Tue, 05 Mar 2013 05:57:42 GMT

Just a question, as explained by the article

Cisco IOS Router

Use the crypto ipsec security-association idle-time command in global configuration mode or crypto map configuration mode in order to configure the IPsec SA idle timer. By default IPsec SA idle timers are disabled.

crypto ipsec security-association idle-time 
seconds

Time is in seconds, which the idle timer allows an inactive peer to maintain an SA. Valid values for the seconds argument range from 60 to 86400.

So, on IOS router, by default, I think the tunnel won't be down even if there is no traffic, right?

Re: Keep Site-to-Site VPN Tunnel Active for monitoring

shanilkumar2003 — Tue, 05 Mar 2013 06:59:15 GMT

Hi Rudy, after i configured on both ends again tunnel is going down. please find the below relevant config on both ends

===

group-policy HTTSA_MOROCCO internal
group-policy HTTSA_MOROCCO attributes
vpn-idle-timeout none
vpn-session-timeout none

tunnel-group x.x.x.x type ipsec-l2l
tunnel-group x.x.x.x general-attributes
default-group-policy HTTSA_MOROCCO
tunnel-group x.x.x.x ipsec-attributes
pre-shared-key *****

SITE

=====

group-policy HTTSA internal
group-policy HTTSA attributes
vpn-idle-timeout none
vpn-session-timeout none

tunnel-group x.x.x.x type ipsec-l2l
tunnel-group x.x.x.x general-attributes
default-group-policy HTTSA
tunnel-group x.x.x.x ipsec-attributes
pre-shared-key *****

Thanks

Shanil

Re: Keep Site-to-Site VPN Tunnel Active for monitoring

shanilkumar2003 — Tue, 05 Mar 2013 07:04:15 GMT

Hi Rudy, after i configured on both ends again tunnel is going down. please find the below relevant config on both ends

===

group-policy HTTSA_MOROCCO internal
group-policy HTTSA_MOROCCO attributes
vpn-idle-timeout none
vpn-session-timeout none

tunnel-group x.x.x.x type ipsec-l2l
tunnel-group x.x.x.x general-attributes
default-group-policy HTTSA_MOROCCO
tunnel-group x.x.x.x ipsec-attributes
pre-shared-key *****

SITE

=====

group-policy HTTSA internal
group-policy HTTSA attributes
vpn-idle-timeout none
vpn-session-timeout none

tunnel-group x.x.x.x type ipsec-l2l
tunnel-group x.x.x.x general-attributes
default-group-policy HTTSA
tunnel-group x.x.x.x ipsec-attributes
pre-shared-key *****

Thanks

Shanil

Re: Keep Site-to-Site VPN Tunnel Active for monitoring

Rudy Sanjoko — Tue, 05 Mar 2013 10:07:12 GMT

does it go down again after a day? do you have logging enabled? what does it say when the tunnel goes down? Are those two group policies are the correct policies that are being used for site to site VPN? Try to debug the isakmp and ipsec sa as well.

Re: Keep Site-to-Site VPN Tunnel Active for monitoring

Rudy Sanjoko — Tue, 05 Mar 2013 10:13:29 GMT

When the sa idle timer is disabled on IOS, it uses the global lifetime value, sas are maintained until the global timers expire, regardless of peer activity.