VPN Needs Ping to Stay Up

[Patrick McHenry]

Hi,

Does anyone know why some of our site to site VPNs need a ping every half hour to stay up? Others don't.

Thanks, Pat.

[Marvin Rhoads]

If there's no interesting traffic being presented on the tunnel, the default behavior would be to tear it down after the Phase 2 SA times out.

If there is interesting traffic, yet it still drops, it could be an interoperability bug with a different vendor at the distant end. I have seen that on occassion between ASA and Juniper Netscreen.

[Patrick McHenry]

would Phase 2 be the Security Association Lifetime Settings?  On this particular VPN, they are set to 8 hours.

Thanks, Pat

[Marvin Rhoads]

Yes, lifetime settings would be it.

"Show crypto ipsec sa" will show you. among other things, what the firewall believes is the configured and remaining time. See examples in this document. You might want to verify that at both ends to confirm the settings.