FTD VPN idle timeout per peer

[DraganSkundric87318]

hi,

is it posible to remove idle timeout (set it to no timeout) ond per peer bases? 

br

[balaji.bandi · Accepted solution]

i think yes please check below :

https://www.cisco.com/c/en/us/support/docs/security/firepower-management-center/217436-disable-ftd-site-to-site-vpn-idle-timeou.html

[DraganSkundric87318]

hmmm ... this workarround desribed in bug looks pormising ... will try it tommorow ... I do not want to mess with flexconfig

For Firepower Management Center: Workaround 1 - per S2S VPN: Enable Traffic Flow Confidentiality (TFC). TFC sends dummy encrypted packets at random intervals. Those packets are counted as real sent traffic and they will keep the VPN from idling out. To configure on FMC: https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/firepower_threat_defense_site_to_site_vpns.html#reference_nwy_fhl_wy
Edit VPN Topology -> IPsec tab -> unfold ESPv3 settings -> Enable TFC

[DraganSkundric87318]

just info ... workarround is working ok