FTD Route based VPN - IKEv2 Questions

[dcanady55]

Hello,

FMC & FTD 7.3

Running a route-based site-to-site IKEv2 between us and a third party. I've been having some issues with the tunnel bouncing, and the third party gave me the following in bold: I have set my timeouts according to them. I can see from running "sh crypto isakmp sa" that I'm the initiator, but I have not figured out how to change this to responder. Please advise. Then under ISAKMP settings, there's nothing in there to suggest there is an action of "restart" for keepalives. Does this setting exist?

Make sure that 'Initiator Mode' is turned off, and that the timeouts are set according to our documentation

Also, your DPD action needs to be 'restart'

Thanks,

[Rob Ingram]

@dcanady55 the terminology changes between hardware vendors, Cisco refers to responder as "answer only". So by setting the tunnel to answer only, the tunnel will not initiate the tunnel.

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/730/management-center-device-config-73/vpn-s2s.html

[MHM Cisco World]

Make sure that 'Initiator Mode' is turned off, and that the timeouts are set according to our documentation

Connection type select answer-only 

Also, your DPD action needs to be 'restart'

Dpd is by defualt run in s2s vpn

[dcanady55]

MHM,

are you saying there is no DPD action of restart in that I can either enabled it or disabled it?

Thanks

[MHM Cisco World]

As I know Yes' 

In asa and fpr the dpd is enable by defualt why you want to disable it?

I think your issue is only with child ikev2 and this solve with answer-only 

[MHM Cisco World]

Dpd is same as keepalive' FMC give you option to disable it 

Advnace > ike > isakamp setting 

Disable ike keepalive 

Note:- be sure that you want to disable it.

[Rob Ingram]

@dcanady55 DPD aka keepalives are enabled as default (interval 10 seconds) on FTD. The keepalives are used to detect the liveliness IKE peer and clear down stale SAs if unreachable. If you don't clear down stale SAs (by disabled DPD keepalive) then you'd have to wait for a rekey, this would result in loss of connectivity. You'd want DPD keepalives enabled on both sides.