TCL script to clear crypto sessions at a certain time

[ewood2624]

I'm trying to figure a way to run an automated TCL script to clear the crypto sessions at a certain time of day.  We have a site that is sending strange udp port numbers from the isp and the vpn will not connect properly and clear crypto session resets the vpn and it works fine after that.             

[Joe Clarke · Accepted solution]

You don't need Tcl for this.  You can use an EEM applet:

event manager applet clear-crypto

event timer cron cron-entry "0 12 * * *"

action 1.0 cli command "enable"

action 2.0 cli command "clear crypto session"

That would clear the session everyday at 12:00 (noon).

[Joe_george]

Is it possible to get the Syslog entry or SNMP trap whenever EEM clears Crypto Session?

[ewood2624]

I'm waiting for it to kick off so I can get the syslog message.  Can you add wildcards for the syslog pattern?

event manager applet clear-crypto

event syslog pattern ".*CRYPTO.*GigabitEthernet0/1.*"

[Joe Clarke]

Sure.  That regular expression there will work just fine.

[Joe Clarke]

You can add an action to generate a syslog or SNMP trap:

action 3.0 syslog msg "Crypto sessions were cleared"

or

action 3.0 snmp-trap strdata "Crypto sessions were cleared"

[ewood2624]

When the EEM runs, does it start it's script in the exec or privilaged mode?  I saw that the first line is enable, what would be the syntax for typing the enable password?

[Joe Clarke]

You don't need the password.  All that does is enter enable mode for authorization.  Authentication is assumed to have happened because you had to be authenticated to configure the applet.  That applet can work as-is.