topic Temporary Disable IP Sec VPN in Network Security

Temporary Disable IP Sec VPN

craig.corbett — Mon, 11 Mar 2019 23:19:00 GMT

Hi,

We have a site to site IPsec vpn as well as a LES circuit to the same destination. Some traffic will use the VPN and other the LES connection.

I need to temporarily kill the site to site VPN to do some testing and am looking at suggestions for the best way to do so.

I was thinking of changing the IKE peer then clear crypto ipsec sa peer. I'll then put the correct ipsec peer in to pring up the tunnel.

Any suggestions / comments appreciated.

Thanks

Craig.

Temporary Disable IP Sec VPN

nkarthikeyan — Thu, 14 Jun 2012 16:49:39 GMT

also you can do by removing the tunnel-group commands or removing the transform-set commands to achieve it... Pls try and let me know your results....

Temporary Disable IP Sec VPN

nkarthikeyan — Thu, 14 Jun 2012 16:53:45 GMT

also you can disable the interafce pointed for vpn traffic in vpn configurations. i.e.

no crypto map map-name interface interface-name

Temporary Disable IP Sec VPN

craig.corbett — Thu, 14 Jun 2012 17:24:47 GMT

Thanks - I should have mentioned that there are other IPSEC vpn’s that need to stay up.

Temporary Disable IP Sec VPN

nkarthikeyan — Thu, 14 Jun 2012 18:03:12 GMT

Okay... Then you can use the 1st option by removing the tunnel group commands.....

Temporary Disable IP Sec VPN

Marvin Rhoads — Thu, 14 Jun 2012 19:04:53 GMT

I like the

no crypto map map-name interface interface-name

...option best. The map-name should be unique per IPsec L2L VPN

I know this is an old post

RouteOps_gm — Tue, 01 Aug 2017 15:46:00 GMT

I know this is an old post but I would like to point out that this doesn't work - you can only have one crypto map on an interface, removing it will remove any other IPsec VPNs from that interface too.