I have ASA running 9.8 code. have an Ipsec tunnel with AWS. Issue is that the server on the aws side can't "bring up the tunnel" with pings. I can bring up the tunnel with a ping stays up for the typical 30mins (no traffic) down tunnel goes. I have zero errors on my side in my logs. AWS is not blocking outbound ping on their side, once tunnel up ping and traffic from AWS to me function fine.
Naturally if I keep a constant ping going tunnel stays up due to the 30min idle time-out. But doing pings every 15 mins via an SLA monitor isn't a real solution.
I need the AWS side to have ability to bring up tunnel since they are "pushing" data to me.
What is the AWS vpn side missing? Is it something in their phase 1 crypto-map that defines interesting traffic? Once phase 1 is done, the tunnel is up traffic flows both ways.
Not sure how your VPN config, look for me you side VPN connection is initiator other side looks like Listener - as per your description, this required clarification.
You can place with VPN idle time out for connection up all time.
or set up an EEM Script to ping to keep the tunnel up :
*** Rate All Helpful Responses ***
Had a guy on Reddit networking drop this doc to me. Here is the "how to" on the AWS side.
Couple things jump out