VPN Timeout Issue

[macgyver0099_1]

Hi,

Currently our network allows unlimited VPN timeout duration, meaning, once a user logs on to our network via vpn, that user remains on until s/he logs out of the system manually.  We attempted to limit this by adding a timeout value on the firewall (where our vpn logins have been assigned) for our anyconnect sessions to six hours as can be see from the command output below to no avail.  My question, therefore, is how do we force vpn sessions to disconnect after six hours of idle time?

config t
group-policy Any.Connect.Policy attributes

vpn-idle-timeout 360

[Sheraz.Salim]

This is the command you need 

group-policy DfltGrpPolicy attributes
vpn-idle-timeout 1440

[macgyver0099_1]

Thank you very much.  Many apologies for the potential lack of foresight, but should that timeout value be 360 to equal six hours or is the 1440 a required arbitrary value of some sort necessary to make the idle disconnect process work?

[Sheraz.Salim]

Hi you can set the idle time value according to your needs. I just put a random number.

[macgyver0099_1]

Hi,

We configured that parameter and tested over the weekend still to no avail.  I know I'm missing something, but I'm not sure what.

Here's what we now have:

group-policy cc-VPN-u$r internal
group-policy cc-VPN-u$r attributes
 vpn-idle-timeout 30
 ipsec-udp enable
 ipsec-udp-port 10000
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value ClientVPN
group-policy DfltGrpPolicy attributes
 vpn-idle-timeout 360
 vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-client ssl-clientless
 address-pools value vpn_pool
 webvpn
  anyconnect ssl dtls none
  anyconnect ask none default webvpn
group-policy Any.Connect.Policy internal
group-policy Any.Connect.Policy attributes
 dns-server value x.x.x.x x.x.x.x
 vpn-idle-timeout 360
 vpn-tunnel-protocol ssl-client
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value ClientVPN
 default-domain value <>
 split-dns value <>
 address-pools value vpn_pool
dynamic-access-policy-record DfltAccessPolicy

[Sheraz.Salim]

What is the ASA software version you using? and what anyconnect version you using?

[macgyver0099_1]

ASA5545

asa983-16-smp-k8.bin

anyconnect-win-4.6.00362-webdeploy-k9.pkg

[Sheraz.Salim · Accepted solution]

could you try this

group-policy cc-VPN-u$r attributes
 vpn-idle-timeout 30
 vpn-session-timeout XX   (mean after XX hours user-will discounted)
 ipsec-udp enable
 ipsec-udp-port 10000
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value ClientVPN
group-policy DfltGrpPolicy attributes
 vpn-idle-timeout 360

 vpn-session-timeout XX
 vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-client ssl-clientless
 address-pools value vpn_pool
 webvpn
  anyconnect ssl dtls none
  anyconnect ask none default webvpn
group-policy Any.Connect.Policy internal
group-policy Any.Connect.Policy attributes
 dns-server value x.x.x.x x.x.x.x
 vpn-idle-timeout 360

 vpn-session-timeout XX
 vpn-tunnel-protocol ssl-client
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value ClientVPN
 default-domain value <>
 split-dns value <>
 address-pools value vpn_pool
dynamic-access-policy-record DfltAccessPolicy

[macgyver0099_1]

That was it.  Thank you very much!