Site-to-Site VPN - one side behind firewall

[gerdpleyer]

Hi forum!

I have two ASA5505 and want to setup a site-to-site vpn.

I used the ipsec wizard and the vpn works so far.

The problem is the remote side where the asa is behind a firewall of my isp. The incoming ports are completly closed.

Now if the idle time pass by and on the remote side there is no traffic the tunnel disrupts.

I found a workaround by setting the idle-timout to none. But if the tunnel disrupt by other reasons, e.g. ISP disconnects I can't rebuild it from the server side.

Is there any command to send a keepalive signal or something?

[a.alekseev]

tunnel-group x.x.x.x ipsec-attributes

pre-shared-key *

isakmp keepalive threshold 15 retry 2

[gerdpleyer]

Hi! Thanks for the quick reply.

But the keepalive is standard - or isn't it?

Where should I set the keepalive - core or remote? or both?

I think the problem is that the core ASA can't connect to the ASA behind the firewall.

[a.alekseev]

here two links related to DPD

http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/i3.html#wp1799409

http://www.cisco.com/en/US/docs/ios/security/configuration/guide/sec_ipsec_dead_peer_ps6350_TSD_Products_Configuration_Guide_Chapter.html#wp1043332