Cisco ASA - manually start a VPN tunnel

Question

Using a cisco ASA is it possible manually bring up a lan to lan VPN tunnel & SA from the device, rather than having one of the systems that is part of the VPN initiate traffic to start the VPN?

I'd like to avoid having to trigger a ping on one of the systems in a VPN to start the VPN, to make troubleshooting a bit quicker.

Answer 1

You have to present "interesting traffic" to the ASA. There's no command that would bring up the tunnel without traffic.

Answer 2

I second the advice of ynguldyn.

On the ISR series router you can test the VPN by having the router generate traffic for you, but there is no such option on the ASA platform.

Answer 3

In Cisco ASA7.0 or greater OS, you can establish the tunnel by simulating interesting traffic with the packet-tracer command. Here's an example - substitute IP addresses from your networks:

packet-tracer input inside tcp 10.100.0.50 1250 10.200.0.100 80
      Source Interface^     | Src IP^  Src Port    |          |
                    Protocol^                Dst IP^  Dst Port^

You can use the output of the command to help diagnose any issues as to why traffic didn't successfully pass as well, but the command itself will actually stimulate the VPN and establish both the ISAKMP and IPSec sa's.

Answer 4

ping inside "ip address at the other end of the tunnel"

Inside interface will have to be in the encryption domain.

At least that works for me.