Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Using a cisco ASA is it possible manually bring up a lan to lan VPN tunnel & SA from the device, rather than having one of the systems that is part of the VPN initiate traffic to start the VPN?

I'd like to avoid having to trigger a ping on one of the systems in a VPN to start the VPN, to make troubleshooting a bit quicker.

share|improve this question
add comment

5 Answers 5

up vote 2 down vote accepted

You have to present "interesting traffic" to the ASA. There's no command that would bring up the tunnel without traffic.

share|improve this answer
add comment

In Cisco ASA7.0 or greater OS, you can establish the tunnel by simulating interesting traffic with the packet-tracer command. Here's an example - substitute IP addresses from your networks:

packet-tracer input inside tcp 10.100.0.50 1250 10.200.0.100 80
      Source Interface^     | Src IP^  Src Port    |          |
                    Protocol^                Dst IP^  Dst Port^

You can use the output of the command to help diagnose any issues as to why traffic didn't successfully pass as well, but the command itself will actually stimulate the VPN and establish both the ISAKMP and IPSec sa's.

share|improve this answer
add comment

I second the advice of ynguldyn.

On the ISR series router you can test the VPN by having the router generate traffic for you, but there is no such option on the ASA platform.

share|improve this answer
add comment

ping inside "ip address at the other end of the tunnel"

Inside interface will have to be in the encryption domain.

At least that works for me.

share|improve this answer
add comment

Using 8.4+ we just added a Meinberg Windows NTP server for network time on the receiving end of the tunnel and added this to the remote ASA config:

ntp server xxx.xxx.xxx.xxx source inside prefer

(where xxx.xxx.xxx.xxx is the ip address of the ntp server) - that keeps our tunnels up indefinitely due to NTP generating the interesting traffic right on the remote ASA 5505

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.