cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
203
Views
5
Helpful
8
Replies
KGrev
Beginner

ASA keeping session active after client powers down.

Hi,

My ASA is holding on to  sessions too long. We have devices that use vpn tunnels in the field. They are occasionally rebooted. They use usernames for static IP assignment from the ASA. Trouble is when the device powers down, the VPN is not ending the session. When the device powers back up the ASA is not creating a new session for it or ending the previous session so it stays stuck offline.

 

I recently posted this similar situation here but felt it had evolved to a different problem to continuing in a new thread as the previous answer was on how to change the idle timeout. The idle timeout is currently at 1 minute but the vpn is not ending while the device is powered down.

 

Any help is greatly appreciated.

8 REPLIES 8
balaji.bandi
VIP Guru

how is your DPD config on the firewall, if the peer dead the connection should disconnect :

 

check common troubleshoot tips :

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-firewalls/212972-anyconnect-vpn-client-troubleshooting-gu.html#anc6

 

check the logs and session DB information.

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

Sorry, these arent anyconnect clients. Also, when I look at the anyconnect policies that I do have with the webvpn syntax in them. If I try to add to that I do not get the options for SVC syntax.

MHM Cisco World
Advisor

can I see show vpn session db?
before and after power down the VPN client 

Sorry, I dont have the ability to power one down currently. Can I still show a "before"?

Yes if you can share before.

20220623_113646.jpg

KGrev
Beginner

I've also been looking at setting up Keep alives for these ikev1 tunnels which should be more like an "are you there?" message or a DPD setting but I dont see any options to turn this feature on.

Figured it out.

Needed to do a "show running-config all" to see hidden parameters.

Then i saw the error in where i was trying to do this.

*tunnel-group NAME ipsec attributes*

 

Then my commands would work: https://community.cisco.com/t5/security-documents/dead-peer-detection/ta-p/3111324

Create
Recognize Your Peers
Content for Community-Ad