Solved: What is the difference between vpn-idle-timeout and vpn-session-timeout?

ttrevino1 · ‎12-05-2008

I have some users going through an 5520, and their session gets dropped at some point in the evening, rather than staying active until they disconnect. The config is set for:

vpn-idle-timeout 30

vpn-session-timeout 900

What is the difference in these 2? Does one override the other? Looking at these settings, I would think the session would drop after 30 minutes of inactivity, however, in another firewall, the config is set to:

vpn-idle-timeout 30

vpn-session-timeout none

and they don't ever get dropped.

Any suggestions? I need the vpn in the first config to not timeout overnight. Thanks, Tony

Jon Marshall · ‎12-05-2008

Tony

vpn-idle-timeout 30 = the amount of time the vpn connection is idle ie. no activity seen on the tunnel, before it is disconnected

vpn-session-timeout 900 = the amount of time the VPN tunnel is allowed to stay up regardless of whether there is activity or not.

Both times are in minutes. So setting vpn-session-timeout to none as on the other device means the session time is unlimited.

Jon

View solution in original post

Jon Marshall · ‎12-05-2008

Tony

vpn-idle-timeout 30 = the amount of time the vpn connection is idle ie. no activity seen on the tunnel, before it is disconnected

vpn-session-timeout 900 = the amount of time the VPN tunnel is allowed to stay up regardless of whether there is activity or not.

Both times are in minutes. So setting vpn-session-timeout to none as on the other device means the session time is unlimited.

Jon

ttrevino1 · ‎12-05-2008

Hi John, thanks for the help, that answered my question. Have a great day!

ttrevino1 · ‎12-05-2008

Hey John, one last question, can I make this change without affecting currently connected vpn users?

Jon Marshall · ‎12-05-2008

Tony

Now you are asking :-). From memory i believe these settings are negotiated when a client first connects so if you change them it should only effect new connections and should not reset existing connections.

But i wouldn't want to bet my house on it, so if you could do during quiet time it would be best.

Jon

ttrevino1 · ‎12-05-2008

Okay, thanks. I'll just let them know when I'm going to do it, so they can disconnect and reconnect. Thanks again!