Keep VPN connection UP

[lmel]

Hello

I have a site-to-site VPN running between 2 cisco ASA. Everytime the connection drops, i have to restart the FIREWALLs to bring up the tunnel again.
Is there way to maintain the connection even if drops (ex: failed WAN connection).

Plus, i cannot understand the difrence between LIFETE and CRYPTO ISAKAMP KEEPALIVE.

Thanks

[balaji.bandi]

Is there way to maintain the connection even if drops (ex: failed WAN connection).

if the WAN connection drop VPN go down, but when it comes back depends on the timer configured it should reconnect.

ti suggest best we need more information what is this device? what is other end devices? your configuration.

if you want to keep up all the time if there is no active session connection then you need to tune the config.

[lmel]

Hey

We have one ASA in each site establishing the TUNNEL

VPN Config:

SITE A

access-list outside_20_cryptomap extended permit ip 192.168.100.0 255.255.255.0 192.168.200.0 255.255.255.0
access-list outside_20_cryptomap extended permit ip 192.168.100.0 255.255.255.0 192.168.0.0 255.255.255.0
access-list outside_20_cryptomap extended permit ip 192.168.100.0 255.255.255.0 10.0.0.0 255.255.255.0

access-list inside_nat0_outbound extended permit ip 192.168.200.0 255.255.255.0 192.168.100.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 192.168.200.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 192.168.200.0 255.255.255.0 10.0.20.0 255.255.255.0
nat (Inside) 0 access-list inside_nat0_outbound

crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto map outside_map 20 match address outside_20_cryptomap
crypto map outside_map 20 set pfs
crypto map outside_map 20 set peer IP_SitteB
crypto map outside_map 20 set transform-set ESP-AES-256-SHA
crypto map outside_map interface outside

crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 20
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp nat-traversal 20
tunnel-group ip_SiteB type ipsec-l2l
tunnel-group ip-SiteB ipsec-attributes
pre-shared-key **********
exit

SITE B

access-list outside_20_cryptomap extended permit ip 192.168.200.0 255.255.255.0 192.168.100.0 255.255.255.0
access-list outside_20_cryptomap extended permit ip 192.168.200.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list outside_20_cryptomap extended permit ip 192.168.0.0 255.255.255.0 192.168.100.0 255.255.255.0

access-list inside_nat0_outbound extended permit ip 192.168.200.0 255.255.255.0 192.168.100.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 192.168.200.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 192.168.200.0 255.255.255.0 10.0.20.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 192.168.100.0 255.255.255.0 192.168.200.0 255.255.255.0
nat (inside) 0 access-list inside_nat0_outbound

crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto map outside_map 20 match address outside_20_cryptomap
crypto map outside_map 20 set pfs
crypto map outside_map 20 set peer ip_SiteA
crypto map outside_map 20 set transform-set ESP-AES-256-SHA
crypto map outside_map interface outside

crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 20
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp nat-traversal 20
tunnel-group ip_SiteB type ipsec-l2l
tunnel-group ip_SiteB ipsec-attributes
pre-shared-key ***********
exit

[balaji.bandi]

as per the config looks good.

coming back to your statement  :

 i have to restart the FIREWALLs to bring up the tunnel again.

why do you need to reload FW, what is the outcome reset the tunnel?  also, you need to understand what causes the FW to terminate the Tunnel also check what kind of Traffic this FW handling also important here.  ( your Logs can give you more information when the next time Tunnel drops check the logs and offload the logs for understanding).

Not sure what causing the VPN Drop out, is this because of no traffic or due to idle?

Also, keep up the tunnel always read the below: set up an idle timeout.

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/118087-technote-asa-00.html#anc6