Keep a VPN tunnel on ASA

[yamikani2g2]

Good day experts,

Could someone please explain in detail how i will keep a VPN tunnel up between My ASA and Amazon cloud services.

I have been trying to explain to my team members that we need a constant flow of interesting traffic but issue is Amazon cloud can not source the traffic neither can the third party client source it.

We find the tunnel down and we have to ask the third party client to ping amazon cloud that done the tunnel comes up is there a way we can keep the tunnel up? ?IP SLA?

Thanks in advance

[Sheraz.Salim · Accepted solution]

some good suggestion as this already discuessed.

https://community.cisco.com/t5/firewalls/asa-vpn-to-aws-and-ipsla-to-keep-tunnel-alive/td-p/2787495

https://community.cisco.com/t5/firewalls/ip-sla-monitor-vpn/td-p/1545629

https://community.cisco.com/t5/security-documents/using-ip-sla-to-keep-ipsec-tunnel-active/ta-p/3160713

[Mohammed al Baqari]

IP SLA is an efficient way of doing it to keep the tunnel IP. You can also
configure alerting on SLA failures based on syslog messages to send an alarm

[Michael Braun]

Hi all,

i know this is an old post, but get this:

###### = comment

## in config mode ##

event manager applet PingHost ###> PingHost is the applet name
event timer watchdog time 300 ###> i set it to repeat every 5 min
action 1 cli command "ping inside 10.4.121.112 repeat 2" ###> ping my host on the other side of the VPN
action 2 cli command "ping inside 10.4.121.121 repeat 2" ###> ping my second host on the other side of the VPN

output none ###> you could add like a syslog entry, in my case nothing

## add more if you want  - of course change the IP to the host you try to reach @##

## you need the " at the end ##

## This will send a periodic ping with source from the inside interface to a destination of your choice - thus bringing up the tunnel ##

[Rob Slean]

Michael, this is an amazing solution.

One thing to add, in order for this to work make sure you have the "management-access inside" command entered as well.