topic Re: Modify idle timeout value for LAN to LAN IPSEC Tunnel in Network Security https://community.cisco.com/t5/network-security/modify-idle-timeout-value-for-lan-to-lan-ipsec-tunnel/m-p/1019844#M918732 <HTML><HEAD></HEAD><BODY><P>Can you please post the output of the following:</P><P></P><P>show run crypto</P><P>show crypto protocol statistics ipsec</P><P>show crypto map detail</P><P></P><P></P><P>Also what values have you used in the crypto isakmp keepalive command?</P><P></P><P>Is there any firewall in the transit path?</P><P></P><P>Regards</P><P></P><P>Farrukh</P></BODY></HTML> Tue, 10 Jun 2008 06:04:59 GMT Farrukh Haroon 2008-06-10T06:04:59Z Modify idle timeout value for LAN to LAN IPSEC Tunnel https://community.cisco.com/t5/network-security/modify-idle-timeout-value-for-lan-to-lan-ipsec-tunnel/m-p/1019841#M918729 <P>Hi Folks, </P><P>I have an ASA with several LAN to LAN IPSEC tunnels configured and having VPN drop outs if we leave our session idle for sometimes as little as 5 minutes.</P><P></P><P>Can this be increased to something more realistic, say 60 minutes +?</P><P></P><P>Thanks,</P><P>Chandru</P><P></P> Mon, 11 Mar 2019 12:56:50 GMT https://community.cisco.com/t5/network-security/modify-idle-timeout-value-for-lan-to-lan-ipsec-tunnel/m-p/1019841#M918729 ckuriyar74 2019-03-11T12:56:50Z Re: Modify idle timeout value for LAN to LAN IPSEC Tunnel https://community.cisco.com/t5/network-security/modify-idle-timeout-value-for-lan-to-lan-ipsec-tunnel/m-p/1019842#M918730 <HTML><HEAD></HEAD><BODY><P>Do you have crypto isakmp keepalives configured?</P><P></P><P>Also what is the idle time currently configured for phase 1 and phase 2?</P><P></P><P>Regards</P><P></P><P>Farrukh</P></BODY></HTML> Mon, 09 Jun 2008 19:46:52 GMT https://community.cisco.com/t5/network-security/modify-idle-timeout-value-for-lan-to-lan-ipsec-tunnel/m-p/1019842#M918730 Farrukh Haroon 2008-06-09T19:46:52Z Re: Modify idle timeout value for LAN to LAN IPSEC Tunnel https://community.cisco.com/t5/network-security/modify-idle-timeout-value-for-lan-to-lan-ipsec-tunnel/m-p/1019843#M918731 <HTML><HEAD></HEAD><BODY><P>Yes, I have configured crypto isakmp keepalives.</P><P></P><P>crypto isakmp policy 30</P><P> authentication pre-share</P><P> encryption 3des</P><P> hash md5</P><P> group 2</P><P> lifetime 86400</P><P></P><P>Thanks,</P><P>Chandru</P></BODY></HTML> Tue, 10 Jun 2008 05:47:22 GMT https://community.cisco.com/t5/network-security/modify-idle-timeout-value-for-lan-to-lan-ipsec-tunnel/m-p/1019843#M918731 ckuriyar74 2008-06-10T05:47:22Z Re: Modify idle timeout value for LAN to LAN IPSEC Tunnel https://community.cisco.com/t5/network-security/modify-idle-timeout-value-for-lan-to-lan-ipsec-tunnel/m-p/1019844#M918732 <HTML><HEAD></HEAD><BODY><P>Can you please post the output of the following:</P><P></P><P>show run crypto</P><P>show crypto protocol statistics ipsec</P><P>show crypto map detail</P><P></P><P></P><P>Also what values have you used in the crypto isakmp keepalive command?</P><P></P><P>Is there any firewall in the transit path?</P><P></P><P>Regards</P><P></P><P>Farrukh</P></BODY></HTML> Tue, 10 Jun 2008 06:04:59 GMT https://community.cisco.com/t5/network-security/modify-idle-timeout-value-for-lan-to-lan-ipsec-tunnel/m-p/1019844#M918732 Farrukh Haroon 2008-06-10T06:04:59Z Re: Modify idle timeout value for LAN to LAN IPSEC Tunnel https://community.cisco.com/t5/network-security/modify-idle-timeout-value-for-lan-to-lan-ipsec-tunnel/m-p/1019845#M918733 <HTML><HEAD></HEAD><BODY><P>Also I forgot the most important command</P><P></P><P>show run all group-policy</P><P></P><P>I'm just looking for the </P><P></P><P>vpn-idle-timeout and vpn-session-timeout commands in there. They are used to set the idle/absole timeouts for VPN connections. You can increase them and check.</P><P></P><P>Regards</P><P></P><P>Farrukh</P></BODY></HTML> Tue, 10 Jun 2008 06:21:36 GMT https://community.cisco.com/t5/network-security/modify-idle-timeout-value-for-lan-to-lan-ipsec-tunnel/m-p/1019845#M918733 Farrukh Haroon 2008-06-10T06:21:36Z Re: Modify idle timeout value for LAN to LAN IPSEC Tunnel https://community.cisco.com/t5/network-security/modify-idle-timeout-value-for-lan-to-lan-ipsec-tunnel/m-p/1019846#M918734 <HTML><HEAD></HEAD><BODY><P>Thanks Farrukh,</P><P></P><P>I have attached the output in the file.</P><P></P><P></P><P>Chandru</P><P></P><P> </P><P></P></BODY></HTML> Tue, 10 Jun 2008 07:24:18 GMT https://community.cisco.com/t5/network-security/modify-idle-timeout-value-for-lan-to-lan-ipsec-tunnel/m-p/1019846#M918734 ckuriyar74 2008-06-10T07:24:18Z Re: Modify idle timeout value for LAN to LAN IPSEC Tunnel https://community.cisco.com/t5/network-security/modify-idle-timeout-value-for-lan-to-lan-ipsec-tunnel/m-p/1019847#M918735 <HTML><HEAD></HEAD><BODY><P>Please configure the following and test:</P><P></P><P>group-policy DfltGrpPolicy attributes</P><P> vpn-idle-timeout none</P><P></P><P>Or set it to something higher? Default is 30 minutes of idle time.</P><P></P><P>Regards</P><P></P><P>Farrukh</P></BODY></HTML> Tue, 10 Jun 2008 07:28:13 GMT https://community.cisco.com/t5/network-security/modify-idle-timeout-value-for-lan-to-lan-ipsec-tunnel/m-p/1019847#M918735 Farrukh Haroon 2008-06-10T07:28:13Z Re: Modify idle timeout value for LAN to LAN IPSEC Tunnel https://community.cisco.com/t5/network-security/modify-idle-timeout-value-for-lan-to-lan-ipsec-tunnel/m-p/1019848#M918736 <HTML><HEAD></HEAD><BODY><P>Thanks, I will configure &amp; test it.</P><P></P><P></P><P>Chandru</P></BODY></HTML> Tue, 10 Jun 2008 08:32:36 GMT https://community.cisco.com/t5/network-security/modify-idle-timeout-value-for-lan-to-lan-ipsec-tunnel/m-p/1019848#M918736 ckuriyar74 2008-06-10T08:32:36Z