SITE-2-SITE VPN
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
03-11-2020 07:36 AM
Hi Gents,
I have been struggling with that one for a while now... I have a site-2-site VPN with our Parent company where they have to initiate the tunnel in order to send traffic. for some subnets everything works fine, we can initiate the traffic; however, there is a specific server, even-thought the tunnel is up, sometimes we have issues to communicate with that server. They also claim they have to initiate the traffic from that server as well.
My concern is when that server is down, even though we report it to them, it will take them weeks before they finally bring it back up...
I was wondering, is there any way in my side that i can force that server to stay up- communication to that server? I have been trying to send a ping request to that server. Obviously it does no work!
thanks,
- Labels:
-
IPSEC
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
03-11-2020 07:43 AM
A couple of options: -
- Run a Route Based VPN (using a VTI) instead of a Policy Based VPN, a VTI is always up, so you do not need to generate traffic.
- From your network management solution (assuming you have one) monitor a device over the VPN tunnel, this will generate interesting traffic to keep the tunnel up.
- Run IP SLA monitor from the local LAN to the remote device, this will continue to generate interesting traffic to keep the tunnel up.
HTH
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
03-11-2020 08:05 AM
Hi RJI,
Thanks for the prompt reply, really appreciated the help.
However, i don't VTI will work for me. The ASA is currently running 9.6.4 code and show interface does not display tunnel:
(config)# int ?
configure mode commands/options:
GigabitEthernet GigabitEthernet IEEE 802.3z
Management Management interface
Port-channel Ethernet Channel of interfaces
Redundant Redundant Interface
vni VNI Interface
<cr>
Also i have full access to one site of the tunnel, and i am not sure the guys in the order site will be willing to change their side of the configuration much... I have promised to put a keepalive in place, but it has been more than 3 months!
Thanks,
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
03-11-2020 08:09 AM
HTH
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
03-11-2020 08:15 AM
RJI,
Sorry if i did not mention that... the tunnel itself is up and running. And other subnets can send traffic under the tunnel. It's only that specific server or the subnets that server resides on...
They know about it, they do have a ticket in the house to change the keepalive, assuming it's just a keepalive thing.
Yeah, i just found that VTI was introduce in 9.7.1. I can upgrade my side of the tunnel any time with a maintenance window of course, but i can't guarantee or force them to do the same.
Thanks,
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
03-11-2020 08:23 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
03-11-2020 07:45 AM
What services does the server run?
Websites, SQL, File, etc...
It might be possible to run a scheduled job to poll that service to ensure that the service is up.
It would be nice to get to the root cause of the issue with that service being down. Do you have any logs that could help?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
03-11-2020 11:11 AM
Hi,
Ib by "down" you mean the server is shutdown, there is nothing you can do about it. Or what exactly do you mean by the server being "down"?
Regards,
Cristian Matei.
