Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Always up lan-to-lan tunnel

Hi all,

I have a Cisco ASA 5540 which has several Lan-to-Lan tunnels on it. Most of these tunnels are fine to drop with traffic inactivity, but a few can not.

These VPN links are monitored by our data center and when they drop our data center freaks out. Right now they have been told to basically ignore the warnings and continue on.

Anyway with the ASAs to configure a tunnel that is ALWAYS connected? If the tunnel ever does drop, the ASA will instantly try to reconnect.

I have set the inactivity time-outs up to 4 hours and played with several other settings but still dropping.

2 REPLIES
New Member

Re: Always up lan-to-lan tunnel

Hi,

a couple of items to think about:

1. Is the monitoring being done by accessing the device on the far-end of the tunnel? i.e. occasional pings from a NMS may be keeping the tunnels up.

2. Is it possible that a routing protocol is keeping the tunnel up on these specific VPN tunnels?

Steve

Green

Re: Always up lan-to-lan tunnel

Check out...

tunnel-group ipsec-attributes

isakmp keepalive threshold # retry #

This should enable dead peer detection and keep your tunnels up.

474
Views
0
Helpful
2
Replies
CreatePlease to create content