Solved

PIX 515e 7.1(1) Tunnels Dropping at about 31 mins %PIX-4-113019

Posted on 2006-06-20
8
415 Views
Last Modified: 2010-07-27
I have some tunnels on the firewall that are coming down if there is no interesting traffic.  They are all coming down right around 31m:3xs.  I can't seem to find the timeout issue here and would like to keep the tunnels up if possible.

%PIX-4-113019: Group = <group-ip-address>, Username = <Group-ip-address>, IP = <Group-ip-address>, Session disconnected. Session Type: IPSecLAN2LAN, Duration: 0h:31m:43s, Bytes xmt: 60, Bytes rct

Thanks in advance
0
Comment
Question by:ort11
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
8 Comments
 
LVL 79

Expert Comment

by:lrmoore
ID: 16946720
>are coming down if there is no interesting traffic.
This is by design. IPSEC tunnels are dynamic and depend on interesting traffic. Setup a periodic (like every 15 minutes) ping on a cron job or something from one workstation to something on the other side.

You can adjust the security association lifetime:
 >crypto map mymap 10 set security-association lifetime seconds 2700  <== 45 minutes



0
 
LVL 1

Author Comment

by:ort11
ID: 16950656
Ok, is 2700 the max on the lifetime?

0
 
LVL 79

Accepted Solution

by:
lrmoore earned 500 total points
ID: 16950936
I don't think so. It's just an example
The default is 28,800 seconds (eight hours).
By shortening the lifetime you force re-negotiation earlier.
0
 
LVL 1

Author Comment

by:ort11
ID: 17145579
Please do not stop this thread.  We are still having an issue and would like to keep this open.  Thanks
0
 
LVL 51

Expert Comment

by:Keith Alabaster
ID: 17239299
If no response is received to LRMoores last post to you or an update on the current position is not posted I will be putting this back in the queue on my next round of cleanups which will be next week.

Thanks
Keith
0

Featured Post

Threat Trends for MSPs to Watch

See the findings.
Despite its humble beginnings, phishing has come a long way since those first crudely constructed emails. Today, phishing sites can appear and disappear in the length of a coffee break, and it takes more than a little know-how to keep your clients secure.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Wikipedia defines 'Script Kiddies' in this informal way: "In hacker culture, a script kiddie, occasionally script bunny, skiddie, script kitty, script-running juvenile (SRJ), or similar, is a derogatory term used to describe those who use scripts or…
If you are like regular user of computer nowadays, a good bet that your home computer is on right now, all exposed to world of Internet to be exploited by somebody you do not know and you never will. Internet security issues has been getting worse d…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
There's a multitude of different network monitoring solutions out there, and you're probably wondering what makes NetCrunch so special. It's completely agentless, but does let you create an agent, if you desire. It offers powerful scalability …

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question