Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Cisco anyconnect vpn protocol timeouts

Posted on 2009-07-14
2
Medium Priority
?
1,197 Views
Last Modified: 2012-06-21
We have a Cisco ASA configure with Anyconnect clients connecting over ssl.

This is all working great, clients can connect and stay connected for days.

The problem we are having is that TCP sessions have an overly aggressive timeout configured.
If I log into a unix server over the vpn session using ssh, the session works fine as long as I am not idle.  If I idle the session, the ASA tears the tcp session down in around 7 minutes.  
If I have any other client/server package running that allows the session to idle for between 5 and 7 minutes, the session will die.

I assume that the ASA is tearing down TCP sessions when they time out due to excessive idle time.

I need to be able to turn this idle timer up to a much longer perion.

What configuration lines control this behavior?
0
Comment
Question by:georgew3
2 Comments
 
LVL 32

Expert Comment

by:Kamran Arshad
ID: 24857650
0
 

Accepted Solution

by:
georgew3 earned 0 total points
ID: 24947253
I found the solution.

This is the command line:

timeout conn 10:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
0

Featured Post

[Webinar] Cloud and Mobile-First Strategy

Maybe you’ve fully adopted the cloud since the beginning. Or maybe you started with on-prem resources but are pursuing a “cloud and mobile first” strategy. Getting to that end state has its challenges. Discover how to build out a 100% cloud and mobile IT strategy in this webinar.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When you connect to your workplace's VPN, you may not notice that you are using your workplace's servers to serve up webpages.  This might be undesirable since the workplace can log all the places you've been.  It also might be very slow to load pag…
I've written this article to illustrate how we can implement a Dynamic Multipoint VPN (DMVPN) with both hub and spokes having a dynamically assigned non-broadcast multiple-access (NBMA) network IP (public IP). Here is the basic setup of DMVPN Pha…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Suggested Courses

927 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question