I have a IOS firewall router connecting over ISDN (DDR) to a PIX. Topology as follows:
CISCO IOS 1712----isdn----800-PIX
The problem is that the peers try to communicate when not needed, causing the DDR to open up the ISDN link.
ISAKMP lifetime is 300 seconds
IPSec lifetime is 300 seconds.
I do not want to compromise these just yet. An access list would do, but exactly what? I have tried just allowing data between the secured hosts, but this did not work. It seems that the DDR only comes up when the peers communicate (both the firewalls), but it is exactly this communication that is causing the unnecessary costly call
When there is no traffic to be sent across and the SA expires, no re-negotiation takes place. Re-negotiation of a new SA happens only if traffic is being sent across and this is true if you have a large enough lifetime (say 15 to 20 minutes). With a lifetime of a 2 to 3 minutes, renegotiation will take place. Try a slightly larger lifetime and it might work. Either way, 300 secs is too short a lifetime, and must be stressing out system resources.
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...