Depending on the settings, most IPSec VPNs will allow the security associations to expire after a period without any "interesting traffic". For instance, the default for an ASA IPsec VPN is 24 hours (Phase 1 ISAMKP SAs) and 1 hour (Phase 2 IPsec SAs).
I have found in the past that one easy way to avoid ever allowing the VPN to expire is to run a small background program on a utility server. In a previous job where we had ASAs talking to Juniper Netscreens over a problematic VPN, we ran a script that sent a "tcp ping" (using the tcping Linux utility) every couple of seconds to an address across the VPN. That sufficed to keep the Phase 1 SA and at least one Phase 2 SA always active.
