PIX 7.0 error 710005.

Trying enabling isakmp keepalives.

Since the PIX UDP default teardown time is 2 minutes, try setting keepalive to 60 seconds

isakmp keepalive 60

Thanks Merv.

so imagine the PIX525 initiates the VPN but after that there's not traffic. The teardown starts to count after the last packet received. If in 2 minutes no other traffic is received by PIX515E it closes the tunnel. It was expected to warn the other side (the 525) about the close of the connection.

How does effectively it work? Is there any link?

Thanks,

Alex.

Do not understand your question.

Do you want the tunnel to remain up when there is no VPN traffic between the two PIX's ?

That isn't how timeouts work in IPSec.

When you negotiate an IPSec tunnel, the isakmp phase 1 policy "lifetime" gives you the initial period that a tunnel will stay up. At the end of that period, the security gateway will look to see if there was *any* traffic over the tunnel during the previous interval. If there was *any* traffic, then the tunnel will be renewed (a new session key negotiated) for the same amount of time. At the end of that time (now twice the lifetime value), it looks to see if there was traffic, renews for the same interval if so, and lets the tunnel expire if there was no traffic.

The algorithm doesn't care how long ago the detected traffic was, just that there was *some* traffic during that session validity.

Because it always takes traffic in order to initiate a tunnel, the minimum time a tunnel will be up will be twice the isakmp lifetime.

Thus, your scenario of closing the tunnel after 2 minutes would only happen if your isakmp lifetime was set for 1 minute.

The isakmp keep-alive is there to solve a different problem.

isakmp uses UDP 500; UDP 4500 as well if you are using NAT-T. The security gateway itself will keep that UDP 500 and UDP 4500 open for the appropriate isakmp lifetime period: the normal 2 minute UDP lifetime is there for traffic *through* the PIX, not traffic the PIX is generating, since the PIX knows what the state of the IPSec connection is. So the keep-alive is not needed for plain tunnels.

But if you are going through another layer of security gateway between the two security endpoints, then -that- layer doesn't know that the UDP 500 and UDP 4500 need to be kept open, so the intermediate security gateway might time out it's idea of whether UDP 500 and UDP 4500 should be allowed through. You could get around that by adjusting the intermediate security gateway(s) to statically allow UDP 500/4500 traffic, but you might well not control those intermediate security gateways. In that case, what you need is an isakmp keep-alive pushing a trickle of traffic through the link so that those intermediate security gateways don't shut down your VPN's transit rights.

To repeat: isakmp keep-alive does not have to do with -you- (your PIX) keeping it's idea of the tunnel active: isakmp keep-alive has to do with making sure that filters in the middle that you don't control leave the session path open.

So, as the scenario is

and the 515E is discarding UDP 4500 packets I need to check out what are default NAT expirations for both the cisco router and the Linux box.

And however I need to lower the keepalive on the 525 not on the 515 so the UDP entries ("static NAT" with iptables) that the Linux box has don't expire.

Ok now,

which are the NAT timeouts for a cisco router (or how to see that?) and what about the same issue on the Linux boxes (iptables)?

Thaks a lot to everybody,

Alex.