ASA Site to Site VPN (only comes up with interesting traffic)

[nelson-rick]

Is there anyway to get an ASA to ASA site to site VPN besides interesting traffic?  I need to keep this tunnel regardless of traffic is there anyway to do this?

[nspasov · Accepted solution]

Unfortunately, no such feature has been developed on the ASAs. So you will have to trick the ASA by using a host located in the "interesting" part of the network to constantly generate interesting traffic. Here are a few suggestions:

- Utilize IP SLA on a Cisco device

- Perform TCP ping from a host

- Configure a host from site A to use the ASA from site B as an NTP source

Thank you for rating helpful posts!

[nelson-rick]

Unfortunately the sites aren't always manned and they take their workstations home with them.  I need something to keep the ASA up.  I guess I will need to put something there to contact the other side constantly.  I hope Cisco comes up with something to allow the permanent connection.

[nspasov]

Yep, it would definitely be a nice feature for Cisco to put in place! Let's hope so! If your question is answered please mark the thread as closed :)

[shine pothen]

How long do you thing the tunnel will lay idle without traffic ?

what is the life timer parameter that you are using in the site to site ?

Shine Potha

[nspasov]

I believe it is is 30 min but it can be controlled via the idle-timer. However, once the tunnel "re-keys" and there is not traffic, the tunnel will tear down and not come back up until "interesting" traffic is seen. 

Thank you for rating helpful posts!