AnyConnect timeout parameters

[fsebera]

Each remote AnyConnect user connects to the same HQ ASA at different times of the day; with the vpn-idle-timeout 1200 and vpn-session-timeout 1200 (20 hours), do all sessions terminate at the same time each day or does each session terminate 20 hours after each session was initiated?

group-policy phonevpn attributes
 wins-server none
 dns-server value 10.x.y.z 10.a.b.c
 vpn-simultaneous-logins 20
 vpn-idle-timeout 1200
 vpn-session-timeout 1200
 vpn-tunnel-protocol ssl-client ssl-clientless
 address-pools value phone_pool

Thank you

Frank

[jj27]

It is per-session, so 20 hours after the user connects.

[fsebera]

Original config

--snip--

vpn-idle-timeout 1200
vpn-session-timeout 1200

--snip--

NEW config

--snip--

vpn-idle-timeout none
vpn-session-timeout none

--snip--

We have tested this change for multiple days and all seems well.

THANK YOU

Frank

[Rohan Padwal]

this is timer based and calculated after the user connects and its different for different users 

 vpn-idle-timeout 1200 <<<<if their is no traffic over the RA tunnel for 20 hrs his session is disconnected.

 vpn-session-timeout 1200<<<<<ASA will disconnect the user session  forcefully after 20 hrs

default vpn-idle-timeout is 30 mins and vpn-session-timeout is none

[fsebera]

Hi Rohan,

The problem we were having and attempting to solve was after the AnyConnect VPN user was disconnected (after 20 hours), it took multiple hours to reconnect. The AnyConnect VPN users are Cisco VoIP 7945G phones and they are connected across the public Internet.

Thank you

Frank

[Rohan Padwal]

okies if you have below config 

vpn-idle-timeout none
vpn-session-timeout none

then your phone should stay up untill they are disconnected from the client end,

the issue might be after the disconnect the phones didn't reattempt the authentication 

what was the re authentication delay and which mode of auth was used CERT or Username password ?

AnyConnect VPN Phone - IP Phones, ASA, and CUCM Troubleshooting

#Rohan