topic VPN Needs Ping to Stay Up in Network Security https://community.cisco.com/t5/network-security/vpn-needs-ping-to-stay-up/m-p/1822384#M480256 <P>Hi,</P><P></P><P>Does anyone know why some of our site to site VPNs need a ping every half hour to stay up? Others don't.</P><P></P><P>Thanks, Pat.</P> Mon, 11 Mar 2019 22:16:49 GMT Patrick McHenry 2019-03-11T22:16:49Z VPN Needs Ping to Stay Up https://community.cisco.com/t5/network-security/vpn-needs-ping-to-stay-up/m-p/1822384#M480256 <P>Hi,</P><P></P><P>Does anyone know why some of our site to site VPNs need a ping every half hour to stay up? Others don't.</P><P></P><P>Thanks, Pat.</P> Mon, 11 Mar 2019 22:16:49 GMT https://community.cisco.com/t5/network-security/vpn-needs-ping-to-stay-up/m-p/1822384#M480256 Patrick McHenry 2019-03-11T22:16:49Z VPN Needs Ping to Stay Up https://community.cisco.com/t5/network-security/vpn-needs-ping-to-stay-up/m-p/1822385#M480257 <HTML><HEAD></HEAD><BODY><P>If there's no interesting traffic being presented on the tunnel, the default behavior would be to tear it down after the Phase 2 SA times out.</P><P></P><P>If there is interesting traffic, yet it still drops, it could be an interoperability bug with a different vendor at the distant end. I have seen that on occassion between ASA and Juniper Netscreen.</P></BODY></HTML> Thu, 19 Jan 2012 15:24:12 GMT https://community.cisco.com/t5/network-security/vpn-needs-ping-to-stay-up/m-p/1822385#M480257 Marvin Rhoads 2012-01-19T15:24:12Z VPN Needs Ping to Stay Up https://community.cisco.com/t5/network-security/vpn-needs-ping-to-stay-up/m-p/1822386#M480258 <HTML><HEAD></HEAD><BODY><P>would Phase 2 be the Security Association Lifetime Settings?&nbsp; On this particular VPN, they are set to 8 hours.</P><P></P><P>Thanks, Pat</P></BODY></HTML> Thu, 19 Jan 2012 15:32:39 GMT https://community.cisco.com/t5/network-security/vpn-needs-ping-to-stay-up/m-p/1822386#M480258 Patrick McHenry 2012-01-19T15:32:39Z VPN Needs Ping to Stay Up https://community.cisco.com/t5/network-security/vpn-needs-ping-to-stay-up/m-p/1822387#M480259 <HTML><HEAD></HEAD><BODY><P>Yes, lifetime settings would be it.</P><P></P><P>"Show crypto ipsec sa" will show you. among other things, what the firewall believes is the configured and remaining time. See examples in <A href="http://www.cisco.com/en/US/tech/tk583/tk372/technologies_tech_note09186a00800949c5.shtml#crypto_isakmp">this document</A>. You might want to verify that at both ends to confirm the settings.</P></BODY></HTML> Thu, 19 Jan 2012 15:50:32 GMT https://community.cisco.com/t5/network-security/vpn-needs-ping-to-stay-up/m-p/1822387#M480259 Marvin Rhoads 2012-01-19T15:50:32Z