Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a IPSEC tunnel set up between our ASA and a Barracuda NG on the other side. The tunnel is functional, except it seems to have a very short idle time-out (couple of seconds) and it can only be raised from the Barracuda side.

I feel reasonably confident that ASA side is properly configured (but am open to ideas, in case I'm wrong) but I have no idea about Barracuda. If anyone knows that device - What are we missing? Where does the keep-alive get set? And, why can the tunnel only be opened from their side?

Any help is much appreciated.

share|improve this question

If the tunnel can only be "opened" form the Barracuda side, then yes, you did misconfigure the ASA end of the tunnel :)

To enable bidirectional initiation, set

crypto map <map_name> <prio> set connection-type bidirectional

To alter the keepalive behaviour, set the isakmp keepalive:

  tunnel-group <peer-ip> ipsec-attributes
    isakmp keepalive threshold <infinite> | <10-3600> retry <2-10>
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.