Is There a Way to Shorten VPN Failover Time?

[Jesse Shumaker]

Here's my situation. I have two sites that each have asa 5505's and each have dual ISP's. Currently I'm using sla monitor to failover to the secondary line when there is a detected outage. After this sla failover occurs which seems to be instant, secondary ISP re-establishes the VPN. This process takes about 30 seconds. My thought is that the side which is healthy does not detect the outage due to a preset amount of timeouts and thats where this 30 second delay comes in to re-negotiate the VPN tunnel.

So my question is: can I create a smaller window of time to heartbeat between the two so that the VPN outagage is detected in around 5-10 seconds and thus re-negotiates with the sister sites IP faster?

thanks for your advice

[Marcin Latosiewicz]

Jesse,

Truth be told 30 seconds is a very decent time for IKE based failover.

What is probably happening is that "healthy" side still can send traffic over existing tunnel until DPDs tell it otherwise.

But you would have to check debugs to understand where the delay comes from. Try setting DPDs to 10 seconds (it should not cause problems for a small deployment).

M.

[Jesse Shumaker]

thanks for the help. yeah they were set on 20 seconds so perhaps lowering this will do the trick. it looks like the tunnel-group keepalives default is 10 seconds with a 2 second retry because when I inputed this it didn't appear in my running config. Is that correct?

[Marcin Latosiewicz]

That's correct :-)

http://www.cisco.com/en/US/docs/security/asa/asa84/command/reference/i3.html#wp1919163

if in doubt you can do "show run all ..." to see the defaults.

M.