PPTP inactivity time-out

[jdepies]

Hello,

I am running 6.3.3 with PPTP used heavily. I want to make sure any sessions that remain inactive for more than say 30 minutes are terminated. By inactive I mena no traffic either direction, even if the keep alives are good.

I currently have the pptp echo command set at 60 seconds, but I believe that only terminates the tunnel if the keep alives are not received back from the client.

I have several users who forget to disconnect their PPTP client, and remain VPNed in for days at a time. I want their connections to close after 30 minutes of inactivity.

Is this possible?

Thanks a lot

Jeff

[ehirsel]

The only pix command may help you achieve what you want that I am aware of is this one:

timeout uauth hh:mm:ss absolute

It will force the user to re-authenticate every interval - you can set it for 4 or 8 hours which should be reasonable for most user connections. I am not sure of the max. value, but it is not an idle timer, howerver it should be good enough.

Let me know if this helps.

[jdepies]

Thanks for the reply, however our PIX is already configured (and it appears to be the default) with timeout uath 00:05:00 absolute, but our users are not kicked off after 5 minutes like this command is supposed to do.

Jeff

[ehirsel]

Please run the show timeout command and post the results here. The uauth timer has to be shorter than the xlate timers, and when absolute is in effect it won't take effect until the user starts a new session - unlikely to happen with PPTP users. This is taken from the pix 6.3 command ref. for timeout.

What may be better is to turn off pptp-echo and to configure the uauth inactivity timer to 4 or 8 hours, or whatever idle time is appropriate for your environment.

I don't know when pptp echo is configured, how often it runs, but it will reset the idle timer when the client responds. You don't want the echos to keep the session alive - wait until the user sends some interesting traffic. Note that some telnet sessions can be configured to send keepalives so telnet over pptp can defeat the uauth inactivity timer.

[jdepies]

timeout xlate 1:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

I tried to remove the pptp echo command from our VPDN group, but you cannot.

Thanks

Jeff

[jdepies]

Any other ideas? Maybe someone from Cisco can chime in?

Thanks so much

Jeff

[jdepies]

Anything? Please?

[jdepies]

anyone?

[jdepies]

Thanks!