cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

210
Views
5
Helpful
5
Replies
Beginner

Unable to set VPN idle timeout to NONE on cisco FTD

Does anyone know how to change the default value of  vpn-idle-timeout 30 on Cisco FMC or Cisco FTD CLI. I have just configured a site-to-site VPN and it goes down every 30 mins on Cisco FMC.

 

I have checked almost everywhere on the Internet, don't know why it's so difficult on Cisco FTD but easy on Cisco ASA.

Everyone's tags (1)
5 REPLIES 5
Enthusiast

Re: Unable to set VPN idle timeout to NONE on cisco FTD

Hi,
Are you facing this issue continuously even when the L2L session is active...???

I couldn't find any direct way to change the idle timeout value in FTD. Did you try by changing this with FLEX CONFIG.

Beginner

Re: Unable to set VPN idle timeout to NONE on cisco FTD

Thanks Abheesh, It happens every time, the tunnel only stays UP for 30mins, and when I check "show crypto ikev2 sa or show crypto ipsec sa", it says NO active Ikev2 or NO active ipsec. I tried the FLEX CONFIG, No difference. I don't know why Cisco made it that way.
Hall of Fame Guru

Re: Unable to set VPN idle timeout to NONE on cisco FTD

First, vpn-idle-timeout should only take effect if there is no traffic on the site-site VPN for the specified period.

Flexconfig is the correct place to change this parameter (as of 6.5 at least).

If you've verified that you have it set (double check that you are using the expected group-policy) and you are still seeing timeouts even though you have not met your specified idle timeout value, it may be happening due to a setting on the remote end.

Beginner

Re: Unable to set VPN idle timeout to NONE on cisco FTD

Hi Marvin, Thanks for shedding more light. The vpn-idle-timeout was set to 30 (default from Cisco), and there is NO traffic, I only did a PING trace over the tunnel, among the three Cisco FTDs, all having same settings, and found out the tunnel is down after 30 mins. My Cisco FTD run 6.2.3 version, and I couldn't find anything related to vpn idle time on the Flexconfig. Hopefully works when traffics are migrated to these FTDs. Thanks so much for your time.
Highlighted
Hall of Fame Guru

Re: Unable to set VPN idle timeout to NONE on cisco FTD

With no traffic we would expect the tunnel to tear down after 30 minutes. That's normal behavior and by design.

As long as there is traffic, it would normally rekey before the lifetime expires and stay up effectively forever.