What is the difference between vpn-idle-timeout and vpn-session-timeout?

Answered Question
Dec 5th, 2008
User Badges:

I have some users going through an 5520, and their session gets dropped at some point in the evening, rather than staying active until they disconnect. The config is set for:

vpn-idle-timeout 30

vpn-session-timeout 900


What is the difference in these 2? Does one override the other? Looking at these settings, I would think the session would drop after 30 minutes of inactivity, however, in another firewall, the config is set to:

vpn-idle-timeout 30

vpn-session-timeout none

and they don't ever get dropped.

Any suggestions? I need the vpn in the first config to not timeout overnight. Thanks, Tony

Correct Answer by Jon Marshall about 8 years 4 months ago

Tony


vpn-idle-timeout 30 = the amount of time the vpn connection is idle ie. no activity seen on the tunnel, before it is disconnected


vpn-session-timeout 900 = the amount of time the VPN tunnel is allowed to stay up regardless of whether there is activity or not.


Both times are in minutes. So setting vpn-session-timeout to none as on the other device means the session time is unlimited.


Jon

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
Jon Marshall Fri, 12/05/2008 - 08:10
User Badges:
  • Super Blue, 32500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

Tony


vpn-idle-timeout 30 = the amount of time the vpn connection is idle ie. no activity seen on the tunnel, before it is disconnected


vpn-session-timeout 900 = the amount of time the VPN tunnel is allowed to stay up regardless of whether there is activity or not.


Both times are in minutes. So setting vpn-session-timeout to none as on the other device means the session time is unlimited.


Jon

ttrevino1 Fri, 12/05/2008 - 08:13
User Badges:

Hi John, thanks for the help, that answered my question. Have a great day!

ttrevino1 Fri, 12/05/2008 - 08:24
User Badges:

Hey John, one last question, can I make this change without affecting currently connected vpn users?

Jon Marshall Fri, 12/05/2008 - 08:36
User Badges:
  • Super Blue, 32500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

Tony


Now you are asking :-). From memory i believe these settings are negotiated when a client first connects so if you change them it should only effect new connections and should not reset existing connections.


But i wouldn't want to bet my house on it, so if you could do during quiet time it would be best.


Jon

ttrevino1 Fri, 12/05/2008 - 08:39
User Badges:

Okay, thanks. I'll just let them know when I'm going to do it, so they can disconnect and reconnect. Thanks again!

Actions

This Discussion