topic vpn-idle-timeout 1, VPN will never be disconnected. in Network Security

vpn-idle-timeout 1, VPN will never be disconnected.

JustTakeTheFirstStep — Thu, 27 Feb 2020 08:19:35 GMT

The timeout setting for a VPN group is 1 minute.

vpn-idle-timeout 1

However, even after one minute, the VPN will never be disconnected.

What configuration do need?

Re: vpn-idle-timeout 1, VPN will never be disconnected.

Sheraz.Salim — Thu, 27 Feb 2020 08:26:34 GMT

Is this anyconnect or for site-to-site vpn?

Re: vpn-idle-timeout 1, VPN will never be disconnected.

JustTakeTheFirstStep — Thu, 27 Feb 2020 08:31:03 GMT

remote vpn, anyconnect

Re: vpn-idle-timeout 1, VPN will never be disconnected.

Abheesh Kumar — Thu, 27 Feb 2020 08:44:37 GMT

Hi,
Try adding vpn-session-timeout value under group policy and check.

Hope This Helps

Abheesh

Re: vpn-idle-timeout 1, VPN will never be disconnected.

Sheraz.Salim — Thu, 27 Feb 2020 08:50:18 GMT

here vpn-session-timeout 1 value under group policy and test it

Re: vpn-idle-timeout 1, VPN will never be disconnected.

JustTakeTheFirstStep — Thu, 27 Feb 2020 08:56:22 GMT

I added a config and tried the test several times.
But VPN don't disconnect.

VPN-ASA-IMSI# sh run group-policy
group-policy GroupPolicy_VPN_IMSI internal
group-policy GroupPolicy_VPN_IMSI attributes
wins-server none
vpn-idle-timeout 1
vpn-tunnel-protocol ssl-client
split-tunnel-policy tunnelspecified
split-tunnel-network-list value VPN_IMSI_Tunnel
webvpn
anyconnect profiles value VPN_IMSI type user

Re: vpn-idle-timeout 1, VPN will never be disconnected.

JustTakeTheFirstStep — Thu, 27 Feb 2020 08:57:10 GMT

Re: vpn-idle-timeout 1, VPN will never be disconnected.

Sheraz.Salim — Thu, 27 Feb 2020 09:03:23 GMT

okay try change the default-group idle-timout

group-policy DfltGrpPolicy attributes
vpn-idle-timeout 1

Re: vpn-idle-timeout 1, VPN will never be disconnected.

Abheesh Kumar — Thu, 27 Feb 2020 09:06:03 GMT

Hi, Change like below and test.

group-policy GroupPolicy_VPN_IMSI internal
group-policy GroupPolicy_VPN_IMSI attributes
wins-server none
vpn-idle-timeout 1
vpn-session-timeout 1
vpn-tunnel-protocol ssl-client
split-tunnel-policy tunnelspecified
split-tunnel-network-list value VPN_IMSI_Tunnel

Hope This Helps

Abheesh

Re: vpn-idle-timeout 1, VPN will never be disconnected.

JustTakeTheFirstStep — Thu, 27 Feb 2020 09:13:03 GMT

session-timeout : disconnects even when a tunnel is in use.
I'm right ??
I want to disconnect the VPN when not in use.

Re: vpn-idle-timeout 1, VPN will never be disconnected.

JustTakeTheFirstStep — Thu, 27 Feb 2020 09:19:45 GMT

group-policy DfltGrpPolicy attributes
vpn-idle-timeout 1
group-policy GroupPolicy_VPN_IMSI internal
group-policy GroupPolicy_VPN_IMSI attributes
wins-server none
vpn-idle-timeout 1
vpn-tunnel-protocol ssl-client
split-tunnel-policy tunnelspecified
split-tunnel-network-list value VPN_IMSI_Tunnel
webvpn
anyconnect profiles value VPN_IMSI type user

After setting the monitor for 5 minutes, the VPN cannot be disconnected.

Re: vpn-idle-timeout 1, VPN will never be disconnected.

Abheesh Kumar — Sat, 29 Feb 2020 08:20:14 GMT

Hi,

Yes, session timeout will terminate VPN session as per the minutes you set. As per the config Idle timeout of VPN is set to 1 min and your are facing issue that VPN is not getting disconnected after 1 min right...??

Did you check the inactivity time of a anyconnect user "sh vpn-sessiondb anyconnect filter name XXXX"

If the inactivity reaches 1 min then VPN will get disconnected.

#sh vpn-sessiondb anyconnect filter name abheesh

Session Type: AnyConnect

Username : abheesh Index : 2789
Assigned IP : XX.XX.XX.XX Public IP : XX.XX.XX.XX
Protocol : AnyConnect-Parent SSL-Tunnel DTLS-Tunnel
License : AnyConnect Premium
Encryption : AnyConnect-Parent: (1)none SSL-Tunnel: (1)AES-GCM-256 DTLS-Tunnel: (1)AES256
Hashing : AnyConnect-Parent: (1)none SSL-Tunnel: (1)SHA384 DTLS-Tunnel: (1)SHA1
Bytes Tx : 216584 Bytes Rx : 96473
Group Policy : XX.XX.XX.XX-POLICY
Tunnel Group : XX.XX.XX.XX-PROFILE
Login Time : 11:17:58 QA Sat Feb 29 2020
Duration : 0h:00m:40s
Inactivity : 0h:00m:00s
VLAN Mapping : N/A VLAN : none
Security Grp : none

Hope This Helps

Abheesh

Re: vpn-idle-timeout 1, VPN will never be disconnected.

JustTakeTheFirstStep — Sat, 29 Feb 2020 08:37:54 GMT

You're right. I finished all the Windows processes with VPN connected and monitored without doing anything. No solution?

Re: vpn-idle-timeout 1, VPN will never be disconnected.

Abheesh Kumar — Sat, 29 Feb 2020 08:48:35 GMT

can you share the output of "sh vpn-sessiondb anyconnect filter name XXXX"

Re: vpn-idle-timeout 1, VPN will never be disconnected.

Sheraz.Salim — Sat, 29 Feb 2020 09:44:28 GMT

Hi I have just test this. even though i set my idel-timeout 1. but it took anyconnect to discounted in 3minutes. what i noted is you have to make sure the anyconnect which is install on the machine is not sending/receiving any traffic at all. which mean the machine need to be in silent mode in order to not sending any noise toward anyconnect. if it is sending receving traffic it wound not discount from ASA.

Re: vpn-idle-timeout 1, VPN will never be disconnected.

Cristian Matei — Sat, 29 Feb 2020 14:33:33 GMT

Hi,

First make sure you have a stable version running on your Cisco ASA. Second, try also configuring the "default-idle-timeout" under your "WebVPN" configuration.

Regards,

Cristian Matei.

Re: vpn-idle-timeout 1, VPN will never be disconnected.

JustTakeTheFirstStep — Sat, 29 Feb 2020 15:08:12 GMT

I've already done it.
But the results are the same.

Re: vpn-idle-timeout 1, VPN will never be disconnected.

Cristian Matei — Sat, 29 Feb 2020 16:06:22 GMT

Hi,

Try running a stable version on the ASA, make sure there is no traffic through the tunnel (look in AnyConnect statistics) and see if it's fixed.

Regards,

Cristian Matei.

Re: vpn-idle-timeout 1, VPN will never be disconnected.

JustTakeTheFirstStep — Mon, 02 Mar 2020 13:14:47 GMT

I want to know for sure.
Is the inactive time when it is in sleep mode or when the computer is shut down?

Re: vpn-idle-timeout 1, VPN will never be disconnected.

Cristian Matei — Thu, 12 Mar 2020 19:17:14 GMT

Hi,

When there is no traffic through the tunnel(shutdown for sure, sleep mode it depends if the PC actually generates some traffic like towards a Domain Controller or not).

Regards,

Cristian Matei.