Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

IPSec transport mode on firewall

Hi all!

For a special reason (I won't detail it now) I have to use the transport mode of IPSec on a PIX515E. The transport mode on PIX can be used only with dynamyc crypto maps but not with static ones. It means that the PIX side of the IPSec connection cannot initialize the IPSec session. It is not a problem, I initialize it from the other side but I cannot guarantee that the session will be kept alive by the other side because of the traffic caracteristics.

How can I manage to keep alive the manually already initialized session for EVER? The session limits have maximum values, the IKE keepalive also does not guarantee 100% the continuous connection :

http://www.cisco.com/warp/public/cc/so/neso/vpn/vpne/vpne_an.htm

"When the IKE SA expires, it does not renegotiate MM until a new IPSec SA is required. This means that during this non-IKE-SA period, IKE keepalive is not available to provide a resilience mechanism. In other words, if a new IPSec SA is negotiated [QM] just before the IKE SA expires and the headend router goes down just after it expires, then the far end will send traffic into a black hole for the length of the IPSec SA lifetime (one hour by default) since IKE will not be needed until a new QM is required. This has been identified as a bug and should be addressed in a future release of IOS."

What can I do?

Regards,

Gabor

2 REPLIES
VIP Purple

Re: IPSec transport mode on firewall

Schedule a ping on a server on one end of the link to the other?

New Member

Re: IPSec transport mode on firewall

I can use only the CISCO devices. Is there any command whith wich I could manage to schedule a ping on a router or on a PIX?

Gabor

163
Views
0
Helpful
2
Replies
CreatePlease to create content