IPsec tunnel active time

[M Talha]

Dear All,

I have implemented IPSec tunnels b/w my Hub and branch router, but after some time it shows session status : DOWN even after i ping from LAN to LAN devices from both ends. I just want that session status will always be UP on both ends at all the time. Help needed.

[Rob Ingram]

Hi,
Is the VPN tunnel idle for long periods, with no traffic being sent over the tunnel?
Are you running a routing protocol over the VPN tunnel?
What is the configured lifetimes of iskamp or ikev2?
Is DPD configured?

[M Talha]

Yes some times it is idle for around 10-12 hours and no traffic passes over the tunnel.

I am running RIPv2 over the tunnel and the lifetime i have configured is 86400. No i haven't configured DPD. Please help me with that too.

Regards,

Talha

[Rob Ingram]

Well if you are running RIPv2 it's timers should act as keepalives and be generating regular traffic sent over the tunnel. Useful DPD link, this explains how to configure, this may not resolve your issue but very useful.

[M Talha]

So should i move to EIGRP or OSPF and that would generate traffic b/w tunnels and will resolve the issue ?

Regards,

Talha

[Rob Ingram]

No. I was merely trying to determine if you were running any routing protocol, it's hello timers would act as keepalive for the VPN tunnel. So no you don't need to move to eigrp or ospf to resolve this issue.

What version of IOS are you running on Hub and Spoke?
Is the tunnel DOWN on both Hub and Spoke?

[M Talha]

HUB : Cisco IOS Software, 2800 Software (C2800NM-ADVSECURITYK9-M), Version 12.4(15)T1, RELEASE SOFTWARE (fc2)

SPOKE : Cisco IOS Software, C2900 Software (C2900-UNIVERSALK9-M), Version 15.0(1)M1, RELEASE SOFTWARE (fc1)

Right now i have reconfigured them and now they are working and traffic is passing the two routers.

[Rob Ingram]

So is this just a sVTI between just 2 routers?

Is the tunnel DOWN on both routers or just one router?

[M Talha]

Dear RJI,

Currently its working from both ends now. But now i am adding another Spoke so should i have to configure another policy or i can use the same policy i configured for first spoke. Secondly i want to use same transform set for second spoke. what else should i need to add for second spoke ?

[Rob Ingram]

You said you can still ping through the tunnel? So it's just the fact the tunnel says it's DOWN, but it's not actually down?

If the session status says it is DOWN on one end this may just be a cosmetic issue affecting that router firmware and a bug. Please confirm which router, this may be resolvable by upgrading the firmware. Both your IOS versions out old, so upgrading might be advisable anyway.

I don't know your current configuration, I assume it's a sVTI, so therefore the tunnel destination is set. You would probably be better off converting to a DVTI on the hub, you'd still use a sVTI on the spokes. Alternatively you could configure DMVPN (your 2800 router won't support FlexVPN).

HTH