Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I connect to my Cisco ASA 5510 via the built in IPSec VPN on my ipad (over both 3G and Wifi) the connection drops without error (the icon just disappears once I go into settings to check on time connected duration) after about 60 seconds of inactivity.

Now if I connect and USE the connection to access the local resources it remains connected, I'm currently running a continuous ping from the ipad to an internal server and it's been going for 10 minutes straight so far. As soon as the pings stop, 60 seconds later I fall off the VPN. I have no idea why this is happening, I have the idle timeouts set to none and and here is a sample of the config:

write failed connection reset by peer

webvpn port 444 enable LAN enable vlan2 enable vlan3 enable Branches enable Internet dtls port 444 default-idle-timeout 36000 anyconnect-essentials anyconnect image disk0:/anyconnect-wince-ARMv4I-2.4.1012-k9.pkg 1 anyconnect image disk0:/anyconnect-win-2.4.1012-k9.pkg 2 anyconnect image disk0:/anyconnect-linux-2.4.1012-k9.pkg 3 anyconnect image disk0:/anyconnect-macosx-i386-2.4.1012-k9.pkg 4 anyconnect enable group-policy DefaultRAGroup internal group-policy DefaultRAGroup attributes wins-server value dns-server value vpn-tunnel-protocol l2tp-ipsec default-domain value COMPANY.local group-policy DfltGrpPolicy attributes wins-server value vpn-idle-timeout none vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-client ssl-clientless default-domain value COMPANY.local split-dns value COMPANY.local address-pools value vlan2VPNdhcpl group-policy VPNtest internal group-policy VPNtest attributes banner none wins-server value dns-server value vpn-idle-timeout none vpn-session-timeout none vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-client ssl-clientless password-storage enable group-lock none split-tunnel-policy tunnelspecified split-tunnel-network-list value test default-domain value COMPANY.local split-dns value COMPANY.local split-tunnel-all-dns enable vlan none address-pools value vlan2VPNdhcpl webvpn anyconnect dpd-interval client 3600 anyconnect dpd-interval gateway 3600 username testuser password xxxx.xxxx encrypted username testuser attributes vpn-group-policy VPNtest

share|improve this question
That config is completely unreadable, but crypro isakmp keepalive might be what you need. – Grisha Levit May 9 '13 at 20:49
Thanks for the info and yea sorry about the mess, here is another look at it,, also I tried to enter that command and it didnt like it, went conf t, crypto isakmp keepalive, but it said the keepalive part was invalid. Would ISAkmp configs make a difference against IPSec mobile connections? Thanks! – Richard May 10 '13 at 13:03
You need to add some parameters to the keepalive command, take a look at – Grisha Levit May 10 '13 at 16:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.