Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Using a cisco ASA is it possible manually bring up a lan to lan VPN tunnel & SA from the device, rather than having one of the systems that is part of the VPN initiate traffic to start the VPN?

I'd like to avoid having to trigger a ping on one of the systems in a VPN to start the VPN, to make troubleshooting a bit quicker.

share|improve this question
up vote 2 down vote accepted

You have to present "interesting traffic" to the ASA. There's no command that would bring up the tunnel without traffic.

share|improve this answer

In Cisco ASA7.0 or greater OS, you can establish the tunnel by simulating interesting traffic with the packet-tracer command. Here's an example - substitute IP addresses from your networks:

packet-tracer input inside tcp 1250 80
      Source Interface^     | Src IP^  Src Port    |          |
                    Protocol^                Dst IP^  Dst Port^

You can use the output of the command to help diagnose any issues as to why traffic didn't successfully pass as well, but the command itself will actually stimulate the VPN and establish both the ISAKMP and IPSec sa's.

share|improve this answer

I second the advice of ynguldyn.

On the ISR series router you can test the VPN by having the router generate traffic for you, but there is no such option on the ASA platform.

share|improve this answer

Using 8.4+ we just added a Meinberg Windows NTP server for network time on the receiving end of the tunnel and added this to the remote ASA config:

ntp server source inside prefer

(where is the ip address of the ntp server) - that keeps our tunnels up indefinitely due to NTP generating the interesting traffic right on the remote ASA 5505

share|improve this answer

ping inside "ip address at the other end of the tunnel" Inside interface will have to be in the encryption domain.

This requires that the management-interface command is set to the inside interface - like "management-interface inside".

Let's say you have a bunch of interface mappings in your VPN tunnel to the other end. To test each of them do the following - if you want to test as an example from the dmz interface management-interface dmz ping dmz a.b.c.d where a.b.c.d is on the other end of the tunnel end-point.

Tested on an ASA v.8.3 to ASA 8.2.

By the way, if you have multiple network mappings in the same crypto acl, don't use set reverse-route on the crypto map entry. This may cause issues with the way the ASA uses the crypto ACL to create new tunnel mappings.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.