2

I need to know how to establish VPN connection with Cisco VPN using vpnc on Centos 5.6. I can start the connection but after a period of time the vpnc process doesn't exist in the process list when run

# pgrep vpnc

I don't know is that because the connection itself goes down or what?...if so, then how can I make the connection permanent?

The configuration file looks like this

## generated by pcf2vpnc
IPSec ID xxxx
IPSec gateway xx.xx.xx.xx
IPSec secret xxxxx
Xauth username xxxxxx
Xauth password xxxxxx

I tried the solution in this article here but that didn't solve the problem!

Any one can help me regarding this?

Thanks in advance,

2 Answers 2

0

Not specifically related to vpnc but, I'll offer what I can think of...

Typically, client VPN connections go down because there is a period of inactivity across the tunnel. The easiest way to overcome that is to keep a ping -t to a known device at the other end of the tunnel.

Otherwise, if your vpnc process is going down, it may be because the VPN endpoint is overloaded, either endpoint is sending packets that the other endpoint believes to be invalid and so has torn it down, or vpnc is ostensibly broken. See if anythin is mentioned in its associated log files.

It should be noted that, as I understand it vpnc is a client tool, not a service/daemon. It might be more appropriate to use a more service-oriented tool for your endpoint (or even a cheap hardware site-to-site gateway/firewall/router). Not sure what software-based solutions might do this.

The remaining alternative is to script/code your processes so that they check for the existence of the target server address and/or vpnc process and start vpnc if not found, before each unit of work.

But, really, a hardware device should be used for permanent connections. You can pick up a basic Linksys/Netgear/D-Link/etc device that can talk the basic protocols cheaply enough.

1
0

I've made a script that takes care of it.

Linux vpnc - How to define a specific tunX number in vpnc

Maybe you want to try it with the necessary adaptations like:

#!/bin/bash
# Run script as # nohup ./vpn-monitor.sh /dev/null 2>&1 &

vpn_clientA(){

vpnName="clientA"
endpoint="10.10.10.10" # endpoint1 inside tunnel
endpoint2="10.20.30.40" # endpoint2 inside tunnel

count=$( ping -c 3 $endpoint | grep icmp* | wc -l )
count2=$( ping -c 3 $endpoint2 | grep icmp* | wc -l )

if [ $count -eq 0 -a $count2 -eq 0 ] # Echo reply not received. 
    then
    # Ping failed
    echo "Ping FAILED $(date)" >> /var/log/vpnc/$vpnName.log

    # Sending email notification
    echo "Ping for $endpoint FAILED! More info /var/log/vpnc/$vpnName.log " | mail -s "VPN $vpnName failed " [email protected]

    # restart connection
    # pkill vpnc
    /usr/sbin/vpnc /etc/vpnc/vpn_clientA --local-port 0 >> /var/log/vpnc/$vpnName.log &

else
    echo "Ping replied $(date)" >> /var/log/vpnc/$vpnName.log
fi
}


while : # infinite cycle

do
# call function every 30 seconds
vpn_clientA
sleep 30

done

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .