Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

L2L between PIX and VPNC3000.

When VPNC or PIX disconnect a L2L if there isn't interesting traffic?

Thanks.

Andrea.

10 REPLIES

Re: L2L between PIX and VPNC3000.

Hi Andrea,

Termination of L2L tunnel does not necessarily due to no interesting traffic to trigger, or to maintain the tunnel to stay connected (after no activity within certain period of time).

Nevertheless, this could also due to configuration issue, e.g someone made changes during L2L tunnel session, network connectivity issue (on LAN/WAN) between the VPN devices, or could be one of the VPN device internal operational issues (firmware/image, memory, etc).

Rgds,

AK

New Member

Re: L2L between PIX and VPNC3000.

Many thanks for your help but I don't understand well!

My L2L never goes down! Why?

Regards.

Andrea.

Re: L2L between PIX and VPNC3000.

It's hard to tell why. You need to capture & take a look at the log and probably run debug to get additional info.

Apart from that, you also need to check/verify the VPN config on both VPN devices are correctly done (just in case if someone made changes).

Rgds,

AK

New Member

Re: L2L between PIX and VPNC3000.

I think that DPD takes up my L2L when no interesting traffic between VPNC and PIX.

Regards.

Andrea.

Cisco Employee

Re: L2L between PIX and VPNC3000.

Hello,

DPD are never sent when the tunnel is idle. They are only sent when there is a traffic. They follow the traffic, otherwise if there is a dead peer the other side will never know that the traffic is going into oblivion. If DPD will be sent on an idle tunnel then the tunnel will never drop, again a security hazard and against RFC.

Check the DPD RFC for more info.

Vikas

Re: L2L between PIX and VPNC3000.

It could be. How long your L2L has been running before the problem started?

DPD function is similar to Cisco IOS keepalives. If this is the case, try to adjust the timer to maximum/longer time.

But I think, run the debug (debug crypto isakmp) command to verify what's happening to your VPN setup.

The following doc gives you a good DPD explanation:

http://www.cisco.com/en/US/partner/products/ps6635/products_white_paper09186a00801ee19a.shtml#wp1027129

Rgds,

AK

Cisco Employee

Re: L2L between PIX and VPNC3000.

Hello,

The tunnel between a PIX and a Conc. will drop when the isakmp tunnel drops. If you really want your tunnel to be dropped when there is no traffic plan for a shorted isa and ipsec timers.

With router this scenario is little different.

Vikas

New Member

Re: L2L between PIX and VPNC3000.

I have just tried with a different timers without success. My L2L comes up with interesting traffic and never goes down.

Regards.

Andrea.

Cisco Employee

Re: L2L between PIX and VPNC3000.

Hello,

Please give us the timer values in PIX as well as in Conc.

Vikas

Cisco Employee

Re: L2L between PIX and VPNC3000.

Hello,

Please drop the tunnel and collect the debugs after initiating it from PIX.

The lesser timer value should be accepted as per the RFC.

Vikas

175
Views
0
Helpful
10
Replies
CreatePlease login to create content